Privacy Policy
Version of 20 July 2026.
1. Who is responsible for your data
Onde Interactive is a trading name of Yves Léon EI, a sole trader registered in France.
- Controller: Yves Léon
- Address: 173 rue de Courcelles, 75017 Paris, France
- Telephone: 06 36 73 78 96
- Email: contact@ondeinteractive.com
- SIRET: 10318989000017
No data protection officer has been appointed, as that appointment is not mandatory for an activity of this nature and this size.
2. Do you appear in a video?
If you are recognisable in a clip and you do not want to be, you can request its removal without an account, without giving reasons and without any waiting period: through the contact page (reason “Removal request”), or by email to contact@ondeinteractive.com, giving the URL or the title of the clip.
These requests are handled within 72 hours. The content is taken down while the request is being examined — we take it down first and examine it afterwards.
This is the main safeguard for image rights on the platform: Onde Interactive exercises no prior control over videos and keeps no publication authorisations on file. Responsibility for having obtained the consents lies with the user who uploads, pursuant to article 5.1 of the Terms of Use.
3. What data, why, on what basis and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account — email address, first and last name, profile picture (optional) | Create and manage your account, display your profile | Performance of the contract — art. 6(1)(b) GDPR | Until the account is deleted |
| Acceptance of the contractual documents — date and version of the Terms of Use, the Terms of Sale and this policy, age declaration | Establish proof of your agreement | Legal obligation and legitimate interest — art. 6(1)(c) and 6(1)(f) GDPR | 5 years after the end of the contractual relationship |
| Clips and metadata — video file, spot, town, session date, name of the photographer or videographer | Taking part in contests, display and transcoding of clips | Performance of the contract — art. 6(1)(b) GDPR | Until the clip or the account is deleted |
| Votes and scores | Calculate contest rankings | Performance of the contract — art. 6(1)(b) GDPR | Duration of the contest, or until the account is deleted |
| Security and login — IP address, user agent, session tokens, passkey credentials | Keep the platform secure and maintain your session | Legitimate interest in the security of the service — art. 6(1)(f) GDPR | 30 days; passkey credentials until they are deleted |
| Order and invoicing — identity, billing address, amount, purchase history | Perform the sale, issue the invoice, keep the accounts | Performance of the contract and legal accounting obligation — art. 6(1)(b) and 6(1)(c) GDPR | 10 years (art. L. 123-22 of the French Commercial Code (Code de commerce)) |
| Audience analytics — internal pseudonymous identifier, product journey events, locale and browser | Understand how the platform is used | Consent — art. 6(1)(a) GDPR | See the cookie policy |
On audience analytics. It is entrusted to PostHog Cloud (European Union), which never receives your email address, your name or the value of your votes. No data is sent to it before you consent, and that consent can be withdrawn at any time via the "Cookies" link in the footer.
What is mandatory. Account data is necessary to create an account: without it, the service cannot be provided. Billing data is required by law for any purchase. The profile picture and audience analytics are optional, and refusing them has no consequence for your access to the service.
No automated decision-making. Onde Interactive takes no decision based solely on automated processing producing legal effects concerning you, and carries out no profiling. Moderation and disqualification decisions are taken by a natural person (article 7 of the Terms of Use).
4. Minimum age and minors
Sign-up is restricted to people aged at least 15, the threshold set by article 45 of law no. 78-17 of 6 January 1978 as amended, adopted pursuant to article 8 of the GDPR. Below that age, processing would require the joint consent of the minor and of the holders of parental authority, which Onde Interactive does not collect. If we learn that an account has been created by a younger person, that account and its data are deleted.
A minor may, on the other hand, appear in a clip uploaded by a third party. The user who uploads then warrants that they hold the written authorisation of both holders of parental authority (article 372-1 of the French Civil Code (Code civil)); an authorisation template is made available. Onde Interactive neither collects nor verifies these authorisations: any holder of parental authority can obtain removal of the clip within 72 hours under the procedure in article 2, without giving reasons.
5. Cookies
Onde Interactive places cookies that are strictly necessary for the operation of the service — exempt from consent — and, only after you have consented, audience analytics cookies.
Their full list, their duration and how to withdraw your consent are set out in the cookie policy.
6. Recipients, processors and transfers
| Provider | Role | Data transmitted | Location and safeguards |
|---|---|---|---|
| Neon Inc. | Database | All stored data | European Union — Frankfurt. No transfer for storage |
| Coconut | Video transcoding | Video files, technical metadata | European Union |
| PostHog, Inc. | Audience analytics, on consent | Pseudonymous identifier, product events | European Union — PostHog Cloud EU |
| Vercel Inc. | Application hosting | HTTP logs, IP address, user agent | United States — Standard Contractual Clauses, art. 46(2)(c) GDPR |
| Cloudflare, Inc. (R2) | Storage of videos and images | Clips, thumbnails, profile pictures | Global network, administered from the United States — Standard Contractual Clauses |
| Resend | Transactional emails | Email address, name, message content | United States — Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payments, invoicing, fraud prevention | Identity, email, billing address, amount. Card data is collected directly by Stripe | Ireland and United States — EU–US Data Privacy Framework and Standard Contractual Clauses as a fallback |
These providers act as processors within the meaning of article 28 of the GDPR: they process your data solely on our instructions. No personal data is sold, rented or transferred to third parties for advertising purposes.
One exception: Stripe. For fraud prevention and its anti-money-laundering obligations, Stripe acts on its own account, as an independent controller. Onde Interactive then gives it no instructions and has no control over that processing: contact Stripe directly, whose policy is published at stripe.com/privacy.
A copy of the safeguards covering transfers outside the European Union can be requested at contact@ondeinteractive.com.
7. Your rights
You have the following rights over your data:
- Access (art. 15 GDPR) — obtain a copy of the data we hold about you;
- Rectification (art. 16) — have inaccurate or incomplete data corrected;
- Erasure (art. 17) — obtain its deletion. This entails the permanent closure of the account and the deletion of the associated clips, votes and sessions;
- Restriction (art. 18) — obtain the freezing of a processing operation, in particular while we verify the accuracy of a piece of data or the merits of an objection;
- Portability (art. 20) — receive your data in a structured, machine-readable format. The export is free of charge and provided within 30 days, in JSON or CSV, with videos and images returned in their original format; details are set out in article 11 of the Terms of Sale;
- Objection (art. 21) — object to processing based on our legitimate interest, in particular security and browsing data;
- Withdrawal of consent (art. 7(3)) — withdraw at any time the consent given to audience analytics, via the "Cookies" link in the footer. That withdrawal does not affect the lawfulness of processing carried out beforehand.
To exercise any of these rights, write to contact@ondeinteractive.com — for erasure, with the subject "Account deletion — Onde Interactive". We acknowledge receipt and reply within one month, extendable by two months for complex requests.
8. Lodging a complaint with the CNIL
If you consider that your rights are not being respected, you may refer the matter to the Commission nationale de l'informatique et des libertés — www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
9. Changes
This policy may be updated to reflect changes to the service or to the applicable rules. In the event of a substantial change, you will be informed by any appropriate means. The version date at the top of the document is brought up to date with each change.