Privacy Policy

Last updated: February 22, 2026

1. Data Controller

The data controller for personal data is: Arley Romero Molina Sole proprietor (micro-enterprise) 19 Rue Guilbaud, 91700 Sainte-Geneviève-des-Bois, France Email: support@lovibee.com As a micro-enterprise, LoviBee is not required to appoint a Data Protection Officer (DPO). For any questions regarding your data, contact us at support@lovibee.com.

2. Data Collected

We collect the following categories of data: • Identification data: username, pseudonym, date of birth, gender, email, phone number • Profile data: photos, videos, biography, interests, languages spoken, country, city • Communication data: chat messages, call history, gifts sent/received • Location data: country and city (declared by user) • Technical data: device type, operating system, unique identifier, push notification token • Verification data: identity document (for creators subject to KYC) • Financial data: bee transaction history, balance

3. Legal Basis for Processing

We process your data on the following legal bases: • Contract performance: service provision (profile, matchmaking, video calls, chat, bee system) • Consent: push notifications, automatic message translation, identity verification (KYC) • Legitimate interest: platform security, content moderation, fraud prevention, service improvement • Legal obligation: transaction data retention, response to judicial requests

4. Processing Purposes

Your data is processed for the following purposes: • Creating and managing your user account • Connecting users (discover, browse, live) • Communication between users (chat, video calls) • Automatic message translation via artificial intelligence • Managing the bee system and transactions • Sending notifications (incoming calls, messages, updates) • Creator identity verification (KYC) • Content moderation and report processing • Security and fraud prevention

5. Data Retention

We retain your data for the following periods: • Account data: duration of service use + 1 year after account deletion • Chat messages: 60 days after the last message in the conversation • Identity documents (KYC): 5 years after verification (legal obligation) • Transaction data: 5 years (accounting obligations) • Technical logs: 1 year • Report data: 2 years after processing After these periods, data is deleted or anonymized.

6. Sub-processors and Recipients

Your data may be shared with the following sub-processors: • OVHcloud (France): server and database hosting • Google/Firebase (United States): authentication, push notifications, email verification • Agora (United States): real-time video call infrastructure • DeepL (Germany): automatic translation of chat messages and subtitles • OpenAI (United States): fallback translation for languages DeepL does not support • Deepgram (United States): real-time speech transcription for subtitles during video calls • PostHog (European Union): app usage analytics and session recording, to detect errors and improve the product • Meta (United States): measuring the effectiveness of our advertising campaigns Each sub-processor is contractually bound to data protection obligations compliant with the GDPR.

7. Data Transfers Outside the EU

Some of our sub-processors are located in the United States: • Google/Firebase: covered by the EU-US Data Privacy Framework (DPF) • Agora: transfer governed by the European Commission's Standard Contractual Clauses (SCC) • OpenAI: transfer governed by Standard Contractual Clauses (SCC) • Deepgram: transfer governed by Standard Contractual Clauses (SCC) • Meta: covered by the EU-US Data Privacy Framework (DPF) OVHcloud (France), DeepL (Germany) and PostHog (European Union) host your data within the European Union, so no international transfer takes place. These mechanisms guarantee an adequate level of protection for your personal data in compliance with the GDPR.

8. Your Rights

Under the GDPR, you have the following rights: • Right of access: obtain a copy of your personal data • Right to rectification: correct inaccurate data • Right to erasure: request deletion of your data • Right to portability: receive your data in a structured format • Right to object: object to the processing of your data • Right to restriction: restrict the processing of your data • Right to withdraw consent: at any time, without affecting the lawfulness of prior processing To exercise your rights, contact us at: support@lovibee.com We will respond to your request within 30 days.

9. Right to Complain

If you believe the processing of your data does not comply with the GDPR, you have the right to file a complaint with: Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy, TSA 80715 75334 Paris Cedex 07 Website: www.cnil.fr

10. Cookies and Trackers

As a mobile application, LoviBee does not use cookies in the web sense. We use local storage technologies (AsyncStorage) to: • Keep you signed in • Save your language preferences • Store your authentication token This data is stored locally on your device. In addition, we use the following measurement tools: • PostHog (European Union): records how the app is used — screens visited, actions taken — and may record the session as video to help us detect errors and improve the product. Text you type and images are automatically masked in these recordings, and recording is limited to the first few seconds on the video call and random chat screens. • Meta: receives anonymous events (for example, registration completed or purchase made) that let us measure the effectiveness of our advertising campaigns. You may object to this processing and request deletion of this data by writing to support@lovibee.com.

11. Policy Changes

We reserve the right to modify this Privacy Policy at any time. In case of substantial changes, you will be notified via an in-app notification. The current version is always accessible from the application Settings.