Privacy Policy
Last updated: June 2026
This Privacy Policy describes how InSugarWeTrust SARL (SIREN 942 171 851, 122 rue Amelot, 75011 Paris, France — "we", "us"), as operator of the Treets.me platform (the "Platform"), processes personal data in accordance with Regulation (EU) 2016/679 (the "GDPR") and the French Loi Informatique et Libertés.
1. Data Controller
InSugarWeTrust SARL is the data controller for the processing described in this policy.
Contact for all privacy matters: support@treets.me.
2. Data We Process and Why
2.1 Creators
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data (name, email, username) | Account creation and operation | Contract (Art. 6(1)(b)) | Life of account + applicable limitation periods |
| Identity-verification data (government ID, selfie/liveness data, date of birth) — processed via Didit | Mandatory KYC and age verification; legal and payment-industry compliance | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) | Minimum 7 years |
| Payout details (bank account/IBAN) | Payment of creator earnings | Contract (Art. 6(1)(b)) | 10 years (accounting law) |
| Uploaded content and moderation results | Content hosting, mandatory pre-publication moderation, legal compliance | Contract and legal obligation | Life of content + records obligations |
| Earnings and transaction records | Accounting, tax, anti-money-laundering compliance | Legal obligation (Art. 6(1)(c)) | 10 years |
2.2 Buyers
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | Purchase delivery, receipts, support | Contract (Art. 6(1)(b)) | 10 years (with transaction records) |
| Transaction data (amount, content reference, timestamp) | Order processing, accounting, fraud prevention | Contract and legal obligation | 10 years |
| Age declaration (timestamped) | Age-verification compliance | Legal obligation (Art. 6(1)(c)) | 10 years |
| Technical data (IP address, device identifiers) | Security, fraud prevention, abuse detection | Legitimate interest (Art. 6(1)(f)) | 13 months maximum |
Payment-card data is collected and processed directly by our payment service providers acting under their own privacy policies. We never store full card numbers.
3. Processors and Recipients
We share personal data only with the following categories of recipients, under data-processing agreements where required by Article 28 GDPR:
| Provider | Role | Data concerned |
|---|---|---|
| Didit | Identity and age verification (KYC) | Creator ID documents, biometric verification data |
| Hive Moderation (thehive.ai) | Automated visual content moderation | Uploaded content (analysed for classification) |
| Cloudflare | Infrastructure and CSAM scanning (hash-matching with automated NCMEC reporting) | Uploaded content (processed as hashes) |
| Payment service providers (acquiring bank and payment gateway) | Payment processing for adult content | Payment and transaction data |
| Hosting and storage providers | Infrastructure, content storage | Platform data |
| Email delivery providers | Transactional email | Email addresses |
| Authorities, NCMEC/INHOPE | Mandatory reporting of illegal content; lawful requests | Data strictly necessary to the report or request |
We do not sell personal data. Creators may see the email address of buyers of their content for transaction-related purposes only.
4. International Transfers
Some providers (including Hive Moderation and certain payment providers) are located outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on appropriate safeguards within the meaning of Chapter V GDPR, including European Commission adequacy decisions and Standard Contractual Clauses, together with supplementary measures where necessary.
5. Security
We implement technical and organisational measures appropriate to the risk, including encryption in transit, access controls, watermarking of delivered content, logging of moderation decisions, and the strict separation of payment data (held by our PCI-DSS-compliant payment providers).
6. Your Rights
You have the right of access, rectification, erasure (subject to legal retention obligations), restriction, portability, and objection, and the right to withdraw consent where processing is based on consent. You may also lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.
To exercise your rights: support@treets.me. We respond within one (1) month, extendable by two (2) months for complex requests.
Certain data cannot be deleted on request where retention is required by law — notably transaction and accounting records (10 years), KYC records (minimum 7 years), and records related to illegal-content reports.
7. Creators as Independent Controllers
Where a creator uses buyer data outside the Platform, the creator acts as an independent data controller and is solely responsible for that processing, including having a lawful basis and honouring data-subject rights. For data processed on the Platform, InSugarWeTrust acts as controller for platform operation, payments, moderation, security, and compliance, and as processor for content uploaded and managed by creators.
8. Cookies
The Platform uses strictly necessary cookies for session management and security. Any non-essential cookies (analytics) are subject to your consent via the cookie banner, in accordance with CNIL guidelines.
9. Minors
The Platform is strictly prohibited to persons under eighteen (18). We do not knowingly process the data of minors; any account identified as belonging to a minor is deleted and associated content removed.
10. Changes
We may update this policy at any time. Material changes will be notified by email or prominent notice on the Platform.
11. Contact
InSugarWeTrust SARL — 122 rue Amelot, 75011 Paris, France — support@treets.me