Data Controller

This Privacy Policy explains how Peliku collects, uses, stores and protects personal data when you use the Peliku website and the Peliku application.

Peliku is a content preparation, organisation, collaboration, storage and publishing tool intended in particular for content creators, teams and professionals.

For any questions concerning your personal data or the exercise of your rights, you may contact us at this address.

Data We Process

Depending on the features you use, Peliku may process the following categories of data.

2.1. Account and Profile Data

When you create and use a Peliku account, we may process:

• your email address;
• your user ID;
• your authentication information;
• your name or display name;
• your avatar;
• your language and certain usage preferences.

Authentication is provided in particular through our Supabase infrastructure.

Peliku does not have access to your password in plain text.

2.2. Billing and Subscription Data

When you subscribe to a paid plan or use a billable feature, we may process:

• your name or company name;
• your billing address;
• your country;
• your company name;
• your VAT number, where provided;
• your subscription plan;
• the status and dates of your subscription;
• technical identifiers used to link your Peliku account to Stripe;
• certain information relating to the status of your payment method.

Payments are processed by Stripe.

Peliku does not store full payment card numbers, security codes or other sensitive banking information required to process payments. This information is collected and processed directly by Stripe.

Invoices are also managed by Stripe and may be accessed from Peliku.

Applicable VAT may be determined automatically using Stripe Tax based on the available billing information.

2.3. Content Created in Peliku

When you use Peliku, we may store information that you create or import into the application, including:

• content ideas;
• titles;
• descriptions;
• scripts;
• notes;
• storyboards;
• sequences;
• tasks;
• preparation information;
• calendars and publication dates;
• publication settings;
• thumbnails and previews;
• other information required to organise your content.

This information is processed in order to provide Peliku's features and remains accessible to authorised members of the workspaces to which it belongs.

2.4. Contacts and Information Concerning Third Parties

Peliku allows you to manage contacts.

You may therefore store certain information concerning individuals who do not necessarily have a Peliku account, such as:

• surname;
• first name;
• email address;
• telephone number;
• notes;
• follow-up or reminder information.

When you add information concerning third parties, you are responsible for ensuring that you have an appropriate legal basis for using it in Peliku and, where necessary, for informing those individuals about the processing of their personal data.

Files and Peliku Storage

3.1. Files Stored Directly by Peliku

Peliku allows files to be stored directly within the Service.

Depending on your plan, you may store video, image and audio files subject to the available formats, file-size limits and storage quotas.

Files stored directly in Peliku are hosted using Cloudflare R2.

Our storage configuration is designed to use a storage jurisdiction located within the European Union.

Files stored by Peliku are not made publicly accessible directly from the storage infrastructure.

When a file needs to be viewed, downloaded or transmitted to an authorised service, Peliku uses, in particular, temporary signed access mechanisms that are time-limited and revocable.

3.2. Storage Quotas

The storage capacity included depends on the user's plan or account status.

The applicable capacities and prices are those displayed in Peliku and on our pricing pages at the time the Service is used.

Eligible users may also voluntarily activate additional storage billed according to actual usage.

Additional storage is measured according to the volume stored and the length of time for which it is retained.

The applicable price, any included allowance and the billing conditions are presented to the user before activation.

3.3. Voluntary File Deletion

When you select “Permanently delete from Peliku”, the relevant file is permanently deleted from Peliku storage.

This action is irreversible.

The file is not moved to a recycle bin, and the corresponding storage capacity is released once deletion has been finalised.

When a file is used in one or more pieces of content, Peliku may warn you before deletion and remove the corresponding references.

3.4. End of Subscription

When a subscription providing access to storage effectively ends, the relevant files may enter a temporary retention period to allow them to be recovered.

The current retention period is 30 days from the effective end of the relevant access.

During this period, access may be restricted and the user may, in particular, be invited to retrieve their files or reactivate a subscription.

At the end of this period, the relevant files are intended to be permanently deleted from Peliku storage, unless a new valid entitlement, grace period or other situation provided for by the Service prevents such deletion.

Google Drive and Dropbox

Peliku may be connected to external storage services such as Google Drive or Dropbox.

In this case, Peliku may retain certain metadata necessary to use the file, such as:

• its external identifier;
• its name;
• its type;
• its link;
• its thumbnail or preview, where available.

By default, a file selected from Google Drive or Dropbox remains hosted by the relevant provider.

Peliku creates a copy in its own storage only when the user explicitly requests that the file be imported into Peliku.

Files remaining with Google Drive or Dropbox remain subject to the terms and retention policies of those services.

An external service can be disconnected through the settings available in Peliku.

Connecting Social Media Accounts

Peliku allows certain social media accounts to be connected in order to facilitate content preparation, publication, scheduling and performance monitoring.

The features available depend on the connected platform and the permissions you grant.

5.1. Instagram / Meta

When you connect a professional or creator Instagram account, Peliku may, depending on the permissions granted:

• identify the connected account;
• retrieve its name, username and avatar;
• publish Reels;
• schedule their publication from Peliku;
• retrieve publication statuses;
• access certain statistics and information relating to content and the account.

Peliku uses permissions granted through Meta/Instagram's official mechanisms.

5.2. TikTok

• identify your TikTok account;
• retrieve certain public information or account statistics;
• access videos required for authorised features;
• publish videos;
• schedule their publication from Peliku;
• apply publication options provided by TikTok;
• retrieve certain content statistics.

5.3. YouTube / Google

• identify the channel;
• retrieve its name and avatar;
• upload videos and Shorts;
• transmit titles, descriptions, tags and other publication settings;
• manage the requested visibility;
• transmit a custom thumbnail;
• schedule publication;
• retrieve certain YouTube data and statistics.

5.4. Twitch

Peliku may also provide a Twitch connection for certain features relating in particular to the channel, live streams, their scheduling and certain audience information.

Available features may evolve as Peliku's Streaming tools continue to be developed.

OAuth Tokens and Security of External Connections

When you connect an external service, Peliku uses the provider's official OAuth mechanisms.

Access tokens and, where necessary, refresh tokens are stored server-side and are not exposed to other users of the workspace.

They are used solely to perform features authorised by the user, such as publication, scheduling, accessing files or retrieving statistics.

Peliku may automatically renew certain tokens where permitted by the provider in order to maintain the connection.

You can disconnect a service from Peliku.

Where supported by the provider, Peliku may also revoke the token with the relevant service.

Workspaces and Collaboration

Peliku allows you to work within:

• a personal workspace;
• team workspaces.

Team workspaces may include different roles, including:

• Owner;
• Admin;
• Editor;
• Viewer.

Information, content and files belonging to a workspace may be accessible to other authorised members of that workspace according to their role.

Invitations may be sent by email.

When you invite someone to a workspace, their email address may be processed in order to manage the invitation even if they do not yet have a Peliku account.

Shared Social Connections

An Instagram, TikTok or YouTube connection established for a workspace belongs to that workspace rather than solely to the individual who initially connected it.

Depending on their permissions, certain authorised members may therefore prepare, schedule or publish content using the connected social account.

However, they never receive the social account password or direct access to OAuth tokens.

Tokens remain accessible only to Peliku's server-side services.

Sensitive operations, such as connecting or disconnecting a social account, are restricted according to workspace roles and permissions.

Publications and Scheduling

When you use Peliku to publish or schedule content, Peliku may process and retain:

• the content to be published;
• its description;
• its title;
• its settings;
• the scheduled date and time;
• the relevant platform;
• the identifier returned by the platform;
• the publication status;
• the link to the publication, where available;
• any technical errors necessary for diagnosis.

When a publication is scheduled, Peliku retains the information required to perform the action automatically at the requested time.

Publications are performed using the official interfaces provided by the relevant platforms.

Social Media Statistics

When you grant the corresponding permissions, Peliku may retrieve certain statistics from connected platforms, including:

• number of views;
• likes;
• comments;
• shares;
• number of followers;
• other metrics provided by the platform.

Certain statistics may be retained over time in order to display their history and evolution in Peliku.

Support and User Feedback

When you contact support or use a feedback feature, Peliku may process, in particular:

• your email address;
• your message;
• information relating to your browser or device;
• screenshots where you choose to provide them;
• technical information required for diagnosis.

This data is used to respond to your request, resolve issues and improve the Service.

Technical Data and Logs

Peliku may process certain technical information necessary for the security, operation and diagnosis of the Service, such as:

• IP address where available in technical logs;
• browser or device type;
• connection information;
• technical events;
• server-function logs;
• errors and information required for security and diagnosis.

This information is not used by Peliku for behavioural advertising within the application.

Cookies and Local Storage in the Application

The app.peliku.com application currently does not use advertising pixels or marketing analytics tools such as Google Analytics, Google Tag Manager, Meta Pixel or TikTok Pixel.

It uses only technical mechanisms necessary for its operation, including:

• authentication and session management;
• security;
• interface preferences;
• language;
• theme;
• active workspace;
• date and time preferences;
• functional application settings.

The fonts used by the application are hosted directly by Peliku and do not require a connection to Google Fonts.

The public peliku.com website may use different technologies. Their use is described in our Cookie Policy.

Purposes of Processing

We process personal data primarily in order to:

• create and manage your Peliku account;
• provide the application's features;
• enable content organisation and preparation;
• enable collaboration between workspace members;
• host and manage your files;
• connect third-party services at your request;
• publish and schedule your content;
• display and retain certain statistics;
• manage subscriptions, payments, quotas and billing;
• provide user support;
• send necessary transactional notifications and emails;
• ensure the security of the Service;
• prevent abuse and fraud;
• diagnose errors;
• comply with our legal, tax and accounting obligations.

Legal Bases for Processing

Performance of a Contract

Where processing is necessary to provide Peliku and the features requested, including:

• account management;
• workspaces;
• content;
• storage;
• subscriptions;
• publication;
• scheduling;
• connections to requested services.

Legal Obligations

• accounting;
• taxation;
• billing;
• legally binding requests.

Legitimate Interests

• ensure the security of Peliku;
• prevent fraud and abuse;
• diagnose errors;
• improve the reliability of the Service;
• establish, exercise or defend our legal rights.

Consent

Where applicable law requires your consent for a particular processing activity, consent is requested separately and may be withdrawn in accordance with applicable requirements.

Service Providers and Third-Party Services

To provide Peliku, certain data may be processed by technical service providers or by platforms that you choose to connect to your account.

We limit the data transmitted to what is necessary for the relevant service to operate.

Supabase

Peliku uses Supabase in particular for user authentication, database hosting, certain server-side functions and technical management of data necessary for the operation of the application.

Cloudflare

Peliku uses Cloudflare R2 in particular to host files imported directly into Peliku.

Stripe

Stripe is used for subscriptions, payments, billing, VAT management, payment methods and any billing for additional storage.

Meta / Instagram

When you connect a compatible Instagram account to Peliku, certain data is exchanged with Meta in order to enable account identification, content publication, scheduling, status retrieval and statistics.

TikTok

When you connect TikTok, Peliku may access information necessary to identify the connected account, publish and schedule videos, apply available publication options and retrieve certain statistics.

Google / YouTube

When you connect a YouTube channel, Peliku uses the permissions granted to enable channel identification, video uploads, scheduling, publication configuration and available statistics.

Google Drive

When you choose to connect Google Drive, Peliku uses limited access to work with files that you select or use with Peliku.

Dropbox

When you connect Dropbox, Peliku may retain the references required for files you use in the application.

Twitch

When you connect Twitch, Peliku may process information necessary for the Streaming features currently provided, including information relating to the channel, live streams, their scheduling and available audience data.

Email Delivery Services

Peliku uses an email delivery service for communications necessary for the operation of the Service, including invitations, notifications and messages relating to your account and subscription.

Lovable

Lovable is involved in the technical infrastructure used for the development, deployment and operation of the Peliku application.

This list may evolve when Peliku adds, replaces or removes a service provider. This Policy will be updated where such changes affect the processing of personal data.

International Data Transfers

Certain service providers or platforms connected to Peliku may process data outside the European Union or European Economic Area.

This may include certain US or international services such as Stripe, Google, Meta, TikTok, Dropbox or other platforms selected by the user.

Where required by applicable law, such transfers must be subject to a recognised transfer mechanism, such as an adequacy decision or Standard Contractual Clauses.

Files hosted directly by Peliku using Cloudflare R2 are configured for a storage jurisdiction located within the European Union.

Data Security

Peliku implements technical and organisational measures designed to protect data against unauthorised access, loss, alteration or disclosure.

These measures include, in particular:

• segregation of data by workspace;
• permissions appropriate to members' roles;
• server-side storage of tokens used to connect external platforms;
• no exposure of those tokens to other members of a workspace;
• temporary and secure access to files stored in Peliku;
• verification of sensitive communications with certain service providers;
• separation of test and production environments where necessary.

No system can guarantee absolute security.

In the event of an incident likely to present a risk to affected individuals, Peliku will comply with the notification obligations provided for by applicable law.

Cookies and Local Storage in the Application

The app.peliku.com application uses only technical mechanisms necessary or useful for its operation, including to:

• maintain your session;
• remember certain preferences;
• retain your language;
• remember the active workspace;
• manage the theme and certain display settings;
• support certain technical flows such as OAuth or account recovery.

Peliku currently does not use Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel or any other advertising tracking tool within the application.

The fonts used by the application are hosted directly by Peliku and do not require a connection to Google Fonts.

The public peliku.com website may use different technologies. Their use is described in the Cookie Policy available on the website.

Your Rights

In accordance with the GDPR and applicable law, depending on your circumstances, you may have the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability;
• right to withdraw your consent where processing is based on consent.

The exercise of certain rights may be restricted where retaining the data is necessary to comply with a legal obligation, establish or defend a legal claim, prevent fraud or protect other legitimate interests recognised by applicable law.

You may exercise your rights by contacting us at the address provided in this Policy.

We may request information necessary to verify your identity where this is required to protect your personal data.

Account Deletion

Peliku allows users to request the permanent deletion of their account from within the application, subject to certain situations that must first be resolved.

For example, account deletion may be temporarily unavailable if you are the last person responsible for a team workspace that still contains other members, or if certain necessary operations relating to storage or billing must first be completed.

Depending on your situation, deleting your account may result in:

• deletion of your profile;
• deletion of the relevant personal content;
• deletion of ideas, notes, tasks and other associated data;
• deletion of relevant memberships and invitations;
• deletion or revocation of connections to third-party services;
• deletion of relevant files in accordance with the rules applicable to the workspaces for which you are responsible;
• cancellation of the relevant subscription.

Data that must be retained in order to comply with legal, tax or accounting obligations, or to establish or defend legal rights, may be retained for the necessary period.

Billing records retained by Stripe may, in particular, remain after account deletion where such retention is legally required.

Data Concerning Individuals Who Are Not Registered Users

Certain features allow a user to enter information concerning other individuals, for example:

• the name and contact details of a contact;
• the email address of a person invited to a workspace;
• notes or professional information associated with a contact.

In such cases, the user who adds this information must have a legitimate reason for using it and must ensure that the rights of the individuals concerned are respected.

Peliku processes this data solely in order to provide the features requested by the user.

Children's Data

Peliku is a service intended for professional use and is not designed to be used directly by children.

We do not knowingly seek to collect personal data concerning minors who have not reached the age required to lawfully use the Service.

If you believe that personal data concerning a minor has been collected inappropriately, you may contact us so that the situation can be reviewed.

Complaints to the CNIL

If you believe that the processing of your personal data does not comply with applicable data protection law, you may contact us so that we can review your request.

You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority.

CNIL: https://www.cnil.fr/

Contact

For any questions concerning this Privacy Policy, the processing of your personal data or the exercise of your rights, you may contact Peliku at:

The publisher's full legal information is available in the Legal Notice on the Peliku website.

Changes to this Privacy Policy

Peliku may amend this Privacy Policy to reflect:

• changes to the Service;
• new features;
• changes concerning our service providers;
• technical developments;
• legal or regulatory developments.

Where changes are material, we may notify users by an appropriate means.

The “Last updated” date shown at the top of this Policy indicates the version currently in force.