Privacy Policy

Introduction

This Privacy Policy (the “Policy”) describes how Veil Co-Splay LLC, a Nevada limited liability company (“Co-Splay,” “Company,” “we,” “us,” or “our”), collects, uses, shares, stores, and protects personal information when you access or use www.co-splay.com, www.cos-play.com, our mobile applications, and any related services, features, content, or applications (collectively, the “Platform” or “Services”).

This Policy applies to all users of the Platform, including visitors, registered users, subscribers, fans, creators, agencies, and any other participants. It is incorporated by reference into our Master Terms of Service, Creator Agreement, and Purchaser and Subscriber Terms.

By accessing or using the Platform, creating an account, uploading content, making purchases, or otherwise interacting with our Services, you acknowledge that you have read, understood, and consent to the collection, use, disclosure, and processing of your information as described in this Policy. If you do not agree to this Policy, you must not access or use the Platform.

Section 1: Data Controller Information

1.1 Who Is Responsible for Your Data?

Veil Co-Splay LLC is the data controller responsible for your personal information collected through the Platform.

1.2 EU/UK Representative

If required by applicable law based on our data processing activities, we will designate a representative for privacy matters in the European Union and/or United Kingdom. For all privacy inquiries, including information about any designated representative, please contact us at privacy@co-splay.com.

1.3 Data Protection Officer

We have designated a Privacy Officer who is accountable for our compliance with applicable privacy legislation, including PIPEDA and Quebec Law 25. For privacy-related inquiries, contact our Privacy Officer at privacy@co-splay.com.

Section 2: Information We Collect

We collect a comprehensive range of information to provide, improve, personalize, and secure our Platform. By using the Platform, you consent to the collection of all categories of information described below.

2.1 Information You Provide Directly

(a) Account Registration Information:

• Full legal name
• Display name and username
• Email address
• Password (stored in encrypted form)
• Date of birth
• Profile picture or avatar
• Bio and profile description
• Social media handles and links
• Cosplay aliases and character names
• Location (city, state/province, country)
• Language and communication preferences

(b) Identity Verification Information (Creators and Age-Verified Users):

• Government-issued identification documents (driver's license, passport, state ID, national ID card, military ID)
• Selfie photographs and video for identity verification
• Photographs holding identification documents
• Social Security Number or Tax Identification Number (for U.S. creators)
• Employer Identification Number (for business entities)
• Business registration documents
• Proof of address documents (utility bills, bank statements)
• Date of birth verification
• Citizenship and residency information

(c) Payment and Financial Information:

• Credit card and debit card information (processed by third-party processors)
• Billing name and address
• Bank account information (for creator payouts)
• Routing and account numbers
• PayPal or other e-wallet information
• Transaction history and purchase records
• Subscription and payment history
• Tax forms (W-9, W-8BEN, W-8BEN-E)
• Earnings and payout history

(d) Content and Communications:

• Photos, videos, images, and other media you upload
• Posts, captions, descriptions, and text content
• Messages, chat logs, and direct communications
• Comments, reactions, and engagement data
• Support tickets and customer service communications
• Survey responses and feedback
• Contest and promotion entries

(e) Professional and Business Information (Creators and Agencies):

• Business name and entity type
• Professional biography and credentials
• Portfolio and work samples
• Agency affiliations
• Brand partnerships and sponsorships
• Merchandise and product information

2.2 Information Collected Automatically

When you access or use the Platform, we automatically collect:

(a) Device and Technical Information:

• IP address (current and historical)
• Device type, model, and manufacturer
• Operating system and version
• Browser type and version
• Screen resolution and display information
• Device identifiers (IDFA, GAID, device ID, advertising ID)
• Hardware identifiers
• Mobile network information
• Timezone and locale settings
• Language settings

(b) Usage and Behavioral Data:

• Pages visited and content viewed
• Time spent on pages and content
• Click patterns and navigation paths
• Search queries and browsing history within the Platform
• Features used and interactions
• Frequency and timing of visits
• Session duration and activity patterns
• Scroll depth and engagement metrics
• Content consumption patterns
• Creator subscriptions and follows
• Purchase behavior and patterns
• Abandonment data (incomplete purchases, started but not completed actions)
• Referral source (how you found us)
• Exit pages and bounce rates

(c) Location Information:

• IP-based geolocation (country, region, city)
• GPS location (if you grant permission on mobile devices)
• Timezone
• Location inferred from Wi-Fi networks
• Location history over time

(d) Cookie and Tracking Data:

• First-party cookies
• Third-party cookies
• Pixel tags and web beacons
• Local storage and session storage
• Browser fingerprinting data
• Cross-device tracking identifiers
• Advertising identifiers

2.3 Information from Third Parties

We receive information from third parties, including:

(a) Social Media and Third-Party Login Providers:

• If you log in via social media (Google, Facebook, Twitter, Discord, etc.), we receive information from those platforms, including your public profile, email address, name, profile picture, and friend/follower lists
• Social media activity and engagement data
• Public posts and content from connected social accounts

(b) Payment Processors and Financial Partners:

• Transaction verification and authorization data
• Fraud detection and prevention data
• Chargeback and dispute information
• Payment method verification
• Bank verification data

(c) Identity Verification Services:

• Identity verification results
• Document authentication results
• Biometric verification data
• Fraud and risk scores
• Sanctions and watchlist screening results

(d) Analytics and Advertising Partners:

• Demographic information
• Interest and preference data
• Cross-device and cross-site tracking data
• Advertising interaction data
• Conversion and attribution data

(e) Data Enrichment Services:

• Publicly available information
• Data appended from third-party data providers
• Consumer preference and behavior data
• Demographic and psychographic data

(f) Other Users:

• Information about you contained in other users' content (tags, mentions)
• Reports and complaints filed against you
• Messages sent to you by other users

2.4 Sensitive Personal Information

In some cases, we may collect or receive sensitive personal information, including:

• Government identification numbers (SSN, tax ID)
• Financial account information
• Precise geolocation data
• Biometric data (for identity verification)
• Contents of communications (messages)

We process sensitive personal information only as necessary to provide our Services, comply with legal obligations, and for the other purposes described in this Policy.

Section 3: How We Use Your Information

We use the information we collect for the following purposes. By using the Platform, you consent to all uses described below.

3.1 Platform Operations and Service Delivery

• Create, maintain, and secure your account
• Verify your identity and age
• Process payments, subscriptions, and transactions
• Deliver content and services you purchase or subscribe to
• Process creator payouts and earnings
• Provide customer support and respond to inquiries
• Send transactional communications (receipts, confirmations, notifications)
• Maintain Platform functionality and features

3.2 Personalization and Recommendations

• Personalize your experience on the Platform
• Recommend creators, content, and features based on your interests
• Customize the content you see in feeds and discovery features
• Tailor notifications and communications to your preferences
• Remember your settings and preferences across devices
• Create and maintain your user profile

3.3 Marketing, Advertising, and Promotion

• Send promotional emails, newsletters, and marketing communications
• Display targeted advertisements on and off the Platform
• Measure advertising effectiveness and attribution
• Conduct market research and analysis
• Feature creator content in marketing and promotional materials
• Promote the Platform on social media and other channels
• Conduct surveys, contests, and promotions
• Re-target and retarget users who have visited the Platform

3.4 Analytics, Research, and Improvement

• Analyze usage patterns and trends
• Conduct research and data analysis to improve our Services
• Develop new features, products, and services
• Test and evaluate new technologies and approaches
• Create aggregated, anonymized, or de-identified data sets
• Generate analytics reports and business intelligence
• Train and improve artificial intelligence and machine learning models
• Conduct A/B testing and experimentation

3.5 Artificial Intelligence and Machine Learning

We use your information to train, develop, and improve artificial intelligence (AI) and machine learning (ML) systems, including:

• Content moderation and safety systems
• Recommendation and personalization algorithms
• Fraud detection and prevention systems
• Search and discovery systems
• Image and video analysis systems
• Natural language processing systems
• Other AI/ML models that improve our Services

By using the Platform, you consent to the use of your content and data for AI/ML training and development. This includes the use of your uploaded content, engagement data, and interactions to improve automated systems.

3.6 Safety, Security, and Fraud Prevention

• Detect, prevent, and address fraud, abuse, and security incidents
• Enforce our Terms of Service, policies, and community guidelines
• Verify user identity and prevent fake accounts
• Monitor for suspicious activity and unauthorized access
• Protect the safety of our users, employees, and the public
• Investigate violations and take appropriate action
• Block prohibited content and conduct

3.7 Legal and Compliance

• Comply with applicable laws, regulations, and legal processes
• Respond to lawful requests from law enforcement and government agencies
• Fulfill tax reporting and withholding obligations
• Maintain records as required by law
• Establish, exercise, or defend legal claims
• Enforce our agreements and policies

3.8 Business Operations

• Operate and manage our business
• Plan and execute business strategies
• Conduct financial reporting and analysis
• Support mergers, acquisitions, or business transfers
• Communicate with investors and stakeholders
• Manage vendor and partner relationships

3.9 Communications

• Send you service-related notices and announcements
• Respond to your requests and inquiries
• Communicate about your account, transactions, and subscriptions
• Send marketing and promotional communications (with your consent where required)
• Notify you of changes to our policies and terms

Section 4: How We Share Your Information

We share your information with third parties as described below. By using the Platform, you consent to such sharing.

4.1 Sharing with Other Users

• Your public profile information (username, display name, profile picture, bio) is visible to all Platform users
• Creators can see subscriber information as needed to provide services
• Users can see your comments, reactions, and public interactions
• Messages you send are visible to the recipients

4.2 Sharing with Service Providers

We share information with service providers who perform services on our behalf, including:

4.3 Sharing with Advertising Partners

We share information with advertising partners to deliver targeted advertisements:

• Device identifiers and advertising IDs
• Cookie and tracking data
• Demographic and interest data
• Hashed email addresses and phone numbers for custom audiences
• Conversion and engagement data
• Browsing and purchase behavior

You may opt out of personalized advertising through the settings described in Section 8.

4.4 Sharing with Analytics Partners

We share data with analytics partners to understand Platform usage:

• Aggregated and anonymized usage statistics
• User behavior and engagement metrics
• Demographic and interest information
• Technical and device data

4.5 Sharing for Legal and Safety Purposes

We may share information:

• To comply with applicable laws, regulations, and legal processes
• In response to lawful requests by public authorities, including law enforcement and national security agencies
• To protect the rights, property, and safety of Co-Splay, our users, and the public
• To investigate suspected fraud, Terms violations, or illegal activity
• To enforce our agreements and policies
• To respond to valid legal process (subpoenas, court orders, search warrants)

4.6 Sharing with Affiliates

We may share information with our affiliates, subsidiaries, and related companies for the purposes described in this Policy.

4.7 Sharing in Business Transfers

In connection with any merger, acquisition, sale of assets, financing, bankruptcy, reorganization, or other business transaction involving all or a portion of our business or assets, your information may be transferred to the acquiring entity or successor. You consent to such transfer and agree that the acquirer or successor may use your information as described in this Policy.

4.8 Sharing with Creators (for Subscribers)

When you subscribe to or purchase from a creator, we share:

• Your username and public profile information
• Your subscription status and tier
• Your purchase history with that creator
• Messages you send to the creator

We do NOT share your email address, real name, or payment information with creators unless you provide it directly.

4.9 Sharing of Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you with anyone for any purpose. This includes statistical data about Platform usage, demographic trends, and other insights.

4.10 Third-Party Data Recipients

Third parties who receive your data are contractually obligated to:

• Use the data only for the purposes for which it was shared
• Maintain appropriate security measures
• Comply with applicable data protection laws

However, once shared with third parties, your data is also subject to those parties' privacy policies and practices.

Section 5: Cookies and Tracking Technologies

5.1 What Cookies and Tracking Technologies We Use

We use the following technologies to collect information:

5.2 First-Party vs. Third-Party Cookies

• First-party cookies: Set by Co-Splay directly
• Third-party cookies: Set by our advertising, analytics, and service provider partners

5.3 Cookie Purposes

• Essential Platform operation (login, security, load balancing)
• Analytics and performance measurement
• Advertising and marketing
• Personalization and preferences
• Fraud detection and security

5.4 Managing Cookies

You can manage cookie preferences through:

• Our cookie consent banner (where applicable)
• Your browser settings
• Mobile device settings
• Industry opt-out tools (NAI, DAA, EDAA)

Note that disabling certain cookies may affect Platform functionality.

5.5 Do Not Track

Some browsers offer a “Do Not Track” (DNT) feature. We do not currently respond to DNT signals, as there is no industry-standard interpretation of DNT.

Section 6: Data Retention

6.1 Retention Periods

We retain your information for as long as necessary to fulfill the purposes for which it was collected, including:

6.2 Retention of Anonymized Data

We may retain anonymized or aggregated data indefinitely for research, analytics, and business purposes. Anonymized data cannot be used to identify you.

6.3 Basis for Retention

Our retention periods are based on:

• Legal and regulatory requirements
• Contractual obligations
• Statute of limitations periods
• Business operational needs
• User expectations

Section 7: Data Security

7.1 Security Measures

We implement industry-standard security measures to protect your information, including:

7.2 Payment Security

• We are PCI-DSS compliant for payment card processing
• Payment card data is processed by PCI-compliant third-party processors
• We do not store complete credit card numbers on our servers

7.3 No Guarantee of Security

While we implement robust security measures, no system is completely secure. We cannot guarantee the absolute security of your information, and you provide information at your own risk.

7.4 Security Incidents

In the event of a security incident affecting your personal information, we will:

• Investigate and contain the incident
• Notify affected individuals as required by law
• Take appropriate remedial action
• Cooperate with relevant authorities

For Canadian users, we will report breaches to the Office of the Privacy Commissioner of Canada and notify affected individuals where the breach creates a real risk of significant harm, as required by PIPEDA. We maintain records of all breaches involving personal information for a minimum of twenty-four (24) months.

Section 8: Your Rights and Choices

8.1 Account Settings

You can access and update your account information through your account settings on the Platform, including:

• Profile information
• Contact preferences
• Privacy settings
• Notification preferences
• Connected accounts

8.2 Marketing Communications

You can opt out of marketing communications by:

• Clicking “unsubscribe” in marketing emails
• Adjusting notification settings in your account
• Contacting us at privacy@co-splay.com

Note: You cannot opt out of transactional communications related to your account and purchases.

8.3 Cookie Preferences

You can manage cookie preferences through:

• Our cookie consent banner
• Browser settings
• Mobile device settings

8.4 Mobile Permissions

You can control mobile app permissions (location, camera, photos, notifications) through your device settings.

8.5 Connected Accounts

You can disconnect third-party accounts (social media, etc.) through your account settings.

8.6 Data Subject Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information. See Section 9 for California residents and Section 10 for international users.

8.7 Account Deletion

You can delete your account through:

• Account settings (Settings > Delete Account)
• Contacting support@co-splay.com

Upon account deletion, your data will be processed as described in Section 6.

Section 9: California Privacy Rights (CCPA/CPRA)

This section applies to California residents under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

9.1 Categories of Personal Information Collected

9.2 Purposes for Collection

We collect personal information for the business and commercial purposes described in Section 3, including:

• Providing and improving our Services
• Processing transactions
• Marketing and advertising
• Analytics and research
• Safety and security
• Legal compliance

9.3 Retention Periods

See Section 6 for information about how long we retain your data.

9.4 Sale and Sharing of Personal Information

Under the CCPA/CPRA definitions:

• We do NOT “sell” personal information for monetary consideration
• We MAY “share” personal information for cross-context behavioral advertising with our advertising partners

You may opt out of the “sharing” of your personal information for targeted advertising by:

• Clicking “Do Not Sell or Share My Personal Information” on our website
• Contacting privacy@co-splay.com
• Using the Global Privacy Control (GPC) signal in your browser

9.5 Sensitive Personal Information

We collect and use sensitive personal information (SSN, precise geolocation, ID documents) only as necessary to provide our Services and comply with legal obligations. We do not use sensitive personal information for purposes beyond those permitted under CCPA/CPRA.

9.6 Your California Privacy Rights

As a California resident, you have the following rights:

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: You can opt out of the sale or sharing of your personal information for targeted advertising.
• Right to Limit Use of Sensitive Personal Information: You can limit our use of sensitive personal information to purposes necessary to provide the Services.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

9.7 Exercising Your Rights

To exercise your California privacy rights:

• Submit a request at datarights@co-splay.com
• Use the “Privacy Rights” section in your account settings

We will verify your identity before processing your request. You may designate an authorized agent to make requests on your behalf.

9.8 Response Timing

We will respond to verifiable requests within forty-five (45) days, with possible extensions as permitted by law.

9.9 Financial Incentives

We do not offer financial incentives for the collection of personal information.

Section 10: International Users

10.1 Data Transfers

Your personal information may be transferred to and processed in the United States and other countries where our service providers are located. These countries may have different data protection laws than your country of residence.

For Canadian users, Co-Splay remains accountable for personal information transferred to service providers in other jurisdictions and ensures comparable levels of protection through contractual arrangements, in accordance with PIPEDA.

10.2 Transfer Mechanisms

For transfers of personal information from the European Economic Area (EEA), United Kingdom (UK), or Switzerland to the United States, we implement appropriate transfer mechanisms as required by applicable law, which may include:

• EU Standard Contractual Clauses (SCCs)
• UK International Data Transfer Agreement (IDTA)
• Swiss-US Data Privacy Framework (where applicable)
• Adequacy decisions where applicable

10.3 EU/UK User Rights (GDPR/UK GDPR)

If you are located in the EEA or UK, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of Access: You can request access to your personal data.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure: You can request deletion of your data (“right to be forgotten”), subject to certain exceptions.
• Right to Restrict Processing: You can request restriction of processing in certain circumstances.
• Right to Data Portability: You can request your data in a structured, machine-readable format.
• Right to Object: You can object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making: You have rights regarding automated decision-making and profiling.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw consent at any time.

10.4 Legal Basis for Processing (EU/UK Users)

We process your personal data under the following legal bases:

10.5 Legitimate Interests

Where we rely on legitimate interests, our interests include:

• Operating and improving our Platform
• Marketing and growing our business
• Preventing fraud and ensuring security
• Enforcing our Terms and policies
• Conducting analytics and research

10.6 EU/UK Data Protection Authority

You have the right to lodge a complaint with your local data protection authority if you believe we have violated your data protection rights.

10.7 Brazilian Users (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including access, correction, deletion, portability, and information about sharing. Contact us at privacy@co-splay.com to exercise these rights.

10.8 Canadian Users (PIPEDA)

This section applies to users located in Canada and supplements the general provisions of this Privacy Policy. Where this section conflicts with other provisions, this section controls for Canadian users.

10.8.1 Accountability

Veil Co-Splay LLC is responsible for personal information under its control, including personal information transferred to third parties for processing. We have designated a Privacy Officer who is accountable for our compliance with PIPEDA and applicable provincial privacy legislation.

Co-Splay remains accountable for personal information that has been transferred to third-party service providers in the United States or other jurisdictions. We ensure comparable levels of protection through contractual arrangements with all third parties who process personal information on our behalf.

10.8.2 Consent

We obtain meaningful consent for the collection, use, and disclosure of your personal information. The form of consent (express or implied) depends on the sensitivity of the information and your reasonable expectations.

Express consent is obtained for:

• Collection and use of sensitive personal information, including government-issued identification numbers, financial account information, biometric data (facial geometry for identity verification), and precise geolocation data.
• Sharing personal information with third-party advertising partners for targeted advertising purposes.
• Use of personal information for purposes beyond those identified at the time of collection.

Implied consent applies to:

• Information reasonably necessary to provide the services you have requested (account creation, payment processing, content delivery).
• Information collected automatically through cookies and similar technologies for Platform functionality and analytics, subject to your ability to manage cookie preferences.

Withdrawal of Consent:

You may withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions, by contacting privacy@co-splay.com. We will inform you of the implications of withdrawing consent, which may include the inability to provide certain services. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

10.8.3 Limiting Collection, Use, Disclosure, and Retention

We limit the collection of personal information to that which is necessary for the purposes identified in Section 3 of this Privacy Policy. We do not collect personal information indiscriminately and limit the amount and type of information collected to what is needed.

Personal information is used and disclosed only for the purposes for which it was collected, except with the consent of the individual or as required or permitted by law. Personal information is retained only as long as necessary for the fulfillment of those purposes, as described in Section 6 of this Privacy Policy.

10.8.4 Accuracy

We make reasonable efforts to ensure that personal information is accurate, complete, and up-to-date as necessary for the purposes for which it is to be used. You are encouraged to update your personal information through your account settings or by contacting support@co-splay.com. Where you demonstrate the inaccuracy or incompleteness of personal information, we will amend the information as required.

10.8.5 Safeguards

We protect personal information with security safeguards appropriate to the sensitivity of the information, as described in Section 7 of this Privacy Policy. These include technical measures (encryption in transit and at rest, access controls, firewalls), organizational measures (employee training, least-privilege access, confidentiality agreements), and contractual protections with third-party service providers.

10.8.6 Openness

This Privacy Policy constitutes our public statement of policies and practices regarding the management of personal information. Information about our privacy practices is available at co-splay.com/privacy-policy. We will make our privacy policies and practices available in plain language, and we will respond to inquiries about our privacy practices at privacy@co-splay.com.

10.8.7 Individual Access and Correction

Upon written request and verification of identity, you have the right to:

• Access: Be informed of the existence, use, and disclosure of your personal information, and be given access to that information. We will provide the information in a generally understandable form.
• Correction: Challenge the accuracy and completeness of your personal information and have it amended as appropriate. Where a correction is made, we will send the corrected information to any third parties to which it was previously disclosed, where feasible.
• Account of Disclosure: Request an account of the third parties to which your personal information has been disclosed.

To exercise these rights, contact datarights@co-splay.com. We will respond to your request within thirty (30) days. If we are unable to meet this timeline, we will notify you of the reason for the extension and your right to file a complaint with the Office of the Privacy Commissioner of Canada.

We will provide access at minimal or no cost to the individual. In limited circumstances, we may refuse access where permitted or required by law (e.g., information subject to solicitor-client privilege, information that would reveal confidential commercial information, information collected for a formal dispute resolution process). Where access is refused, we will provide the reasons for refusal and inform you of available recourse.

10.8.8 Challenging Compliance

You may challenge Co-Splay's compliance with PIPEDA by contacting our Privacy Officer at privacy@co-splay.com. We will investigate all complaints and respond within thirty (30) days. If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada:

10.8.9 Cross-Border Transfers

Your personal information may be transferred to and processed in the United States, where our servers and principal offices are located, and in other jurisdictions where our service providers operate. PIPEDA permits cross-border transfers of personal information provided that the transferring organization remains accountable for the information.

Co-Splay ensures comparable levels of protection for personal information transferred outside of Canada through:

• Contractual agreements with third-party service providers requiring them to protect personal information to a standard comparable to PIPEDA.
• Ongoing monitoring of third-party compliance with contractual obligations.
• Limiting the personal information transferred to what is necessary for the service provider to perform its functions.

By using the Platform, you acknowledge that your personal information may be processed in the United States, which may not provide the same level of data protection as Canada. You may obtain information about our policies and practices regarding service providers outside Canada, and the name or title of the person who can answer questions about the collection, use, disclosure, or storage of personal information by contacting privacy@co-splay.com.

10.8.10 Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm to Canadian users, we will:

• Report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible.
• Notify affected individuals as soon as feasible, including a description of the breach, the personal information involved, steps we have taken to reduce the risk of harm, steps individuals can take to reduce the risk of harm, and contact information for further inquiries.
• Maintain records of all breaches of security safeguards involving personal information for a minimum of twenty-four (24) months, regardless of whether the breach meets the threshold for notification.

10.9 Quebec Users (Law 25)

This section applies to users located in the Province of Quebec, Canada, and supplements both Section 10.8 (Canadian Users) and the general provisions of this Privacy Policy. Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, imposes additional requirements that are addressed below.

10.9.1 Privacy Impact Assessments

We conduct Privacy Impact Assessments (PIAs) before implementing any new project, system, or practice that involves the collection, use, or disclosure of personal information of Quebec residents, including before transferring personal information outside of Quebec.

10.9.2 Consent for Profiling and Automated Decision-Making

We use automated systems for content moderation, fraud detection, recommendation, and account risk scoring, as described in Section 14 of this Privacy Policy.

For Quebec residents, we obtain express consent before using personal information for profiling or automated decision-making that produces legal effects or similarly significant effects. You have the right to:

• Be informed that a decision about you is based solely on automated processing.
• Request that the decision be reviewed by a person.
• Correct the personal information used to make the decision.
• Submit observations to the person reviewing the decision.

10.9.3 Right to De-Indexing

Quebec residents have the right to request that personal information be de-indexed from any search or dissemination mechanism where the dissemination of the information contravenes the law or a court order. To request de-indexing, contact datarights@co-splay.com with the specific information you wish to have de-indexed and the basis for your request.

10.9.4 Designated Privacy Officer

In accordance with Law 25, we have designated a person responsible for the protection of personal information. The title and contact information for this person are published at co-splay.com/privacy-policy and may also be obtained by contacting privacy@co-splay.com.

10.9.5 Language Requirements

In accordance with Quebec's Charter of the French Language (Bill 96), consumer-facing agreements, terms, and privacy policies must be made available in French for Quebec residents. We will make this Privacy Policy and related agreements available in French at co-splay.com/fr/privacy.

Section 11: Children's Privacy

11.1 Age Restriction

The Platform is strictly intended for users who are eighteen (18) years of age or older. We do not knowingly collect personal information from anyone under eighteen (18).

11.2 No Collection from Minors

We do not:

• Allow users under 18 to create accounts
• Knowingly collect information from users under 18
• Market to individuals under 18
• Allow content featuring minors in any inappropriate context

11.3 COPPA Compliance

Although our Platform is for adults only, we comply with the Children's Online Privacy Protection Act (COPPA) by not collecting personal information from children under 13.

11.4 Discovery of Minor's Information

If we discover that we have collected information from anyone under 18, we will:

• Immediately terminate the account
• Delete all associated content and data
• Report to appropriate authorities if warranted

11.5 Parental Contact

If you are a parent or guardian and believe your child has provided information to us, please contact us immediately at privacy@co-splay.com.

Section 12: Third-Party Links and Services

12.1 Third-Party Websites and Services

The Platform may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to those third-party services.

12.2 Third-Party Responsibility

We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you access.

12.3 Social Media Features

The Platform may include social media features (like, share, connect buttons) that may collect information about your interaction with those features. Your interaction with these features is governed by the privacy policy of the company providing the feature.

12.4 Third-Party Analytics

We use third-party analytics services (Google Analytics, etc.) that have their own privacy policies and may collect information independently.

Section 13: Creator Data Responsibilities

13.1 Creator Access to Subscriber Data

Creators receive certain information about their subscribers, including:

• Usernames and public profile information
• Subscription status and tier
• Purchase history with the creator
• Messages from subscribers

13.2 Creator Data Processing Obligations

Creators who access subscriber data agree to:

• Use subscriber data only for purposes related to their creator activities on the Platform
• Keep subscriber data secure and confidential
• Not sell or share subscriber data with third parties
• Comply with applicable data protection laws
• Delete subscriber data upon request or account termination

13.3 Creator Responsibility

Creators are independent data controllers for certain subscriber data they access. Co-Splay is not responsible for a creator's misuse of subscriber data.

Section 14: Automated Decision-Making

14.1 Use of Automated Systems

We use automated systems for:

• Content moderation (detecting prohibited content)
• Fraud detection and prevention
• Recommendation and personalization
• Account risk scoring
• Age verification

14.2 Human Review

For consequential decisions (account termination, earnings forfeiture), we provide human review upon request.

14.3 Rights Regarding Automated Decisions

Where required by law, you have the right to:

• Obtain information about automated decision-making
• Request human review of automated decisions
• Contest decisions that significantly affect you

Section 15: Changes to This Policy

15.1 Right to Modify

We may modify this Privacy Policy at any time in our sole discretion.

15.2 Notice of Changes

We will notify you of material changes by:

• Posting the updated Policy on the Platform with a new “Last Updated” date
• Sending an email notification to your registered email address
• Displaying an in-app notification

15.3 Acceptance of Changes

Your continued use of the Platform after the posting of revised Policy means that you accept and agree to the changes. If you do not agree to the modified Policy, you must stop using the Platform.

15.4 Review of Policy

You are expected to check this Policy periodically. The most current version is always available at co-splay.com/privacy-policy.

Section 16: Contact Information

For questions, concerns, or complaints about this Privacy Policy or our privacy practices, contact us at: