Privacy Policy
Translation provided for information only. Only the French version is authoritative.
Google user data
UNVRS lets you connect two Google services. Both are optional, and you choose to connect them from your dashboard through Google’s official consent screen.
- Google Calendar (
calendar.events,userinfo.email): we read the email address of the Google account you authorise, only to show you which account is connected. We create, update, re-read and delete only the events UNVRS adds to your calendar when you schedule a meeting in UNVRS messaging, so that a time change or cancellation stays in sync. We do not read, list or store your other calendar events. - YouTube (
youtube.readonly,yt-analytics.readonly): we read your channel’s name, picture, subscriber count, view count and audience statistics, read-only, to show them in your own dashboard. We never upload, edit or delete anything on YouTube.
Storage and protection. Google access and refresh tokens are encrypted at rest (AES-256-GCM). The data above is stored only as long as the connection is active.
Sharing. We do not sell Google user data, do not use it for advertising, and do not transfer it to third parties, except to our hosting providers acting on our instructions to run the service, or when required by law. No human at UNVRS reads it, except with your explicit consent for support, for security purposes, or when required by law.
Deletion. You can disconnect Google Calendar or YouTube at any time from your dashboard: this immediately deletes the stored tokens and data for that connection. You can also revoke access from your Google account at myaccount.google.com/permissions, or ask us to delete everything (see Data deletion).
Limited Use. UNVRS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
1. Who are we?
UNVRS is published by UNVRS Agency, Paris, France (“we”). We are the controller of the personal data described here. For any question: contact@unvrsagency.com.
UNVRS connects creative talents (motion designers, directors, photographers, content creators…) with brands, through a creative profile, a portfolio and a social audience dashboard.
2. What data do we collect?
2.1 What you give us
- Waiting list: your email address, if you leave it on the home page before the launch. On that occasion, we also record your IP address, your browser and the page you came from, in order to prevent automated sign-ups.
- Business card: what you put on it (name, title, location, links, photos, video, work). A published card is visible to anyone who has its address; that is what it exists for. You may withdraw it at any time from the studio: its address will then respond as if it had never existed.
- Account: email address, name, password (hashed), profile photo.
- Creative profile: answers given during the sign-up journey (profession, expertise, location, working methods, ambitions, visual tastes), and the derived results (archetype, “creative DNA”).
- Portfolio: texts, projects, images and videos that you upload or link, and the theme chosen.
- Communications: support messages and requests that you send us.
2.2 Connected social accounts (optional)
From your dashboard, you may connect accounts via their official interfaces (OAuth). You choose what you connect, and you may withdraw each connection at any time. Depending on the platform and the permissions you grant, we receive:
| Platform | Data received | Permissions requested |
|---|---|---|
| Facebook (Pages) and Instagram (professional accounts) · Meta | Identifier and name of your Pages and linked Instagram professional accounts, photo, link, number of followers and posts, audience statistics (reach, impressions, accounts reached), access tokens. | public_profile, pages_show_list, pages_read_engagement, read_insights, instagram_basic, instagram_manage_insights |
| YouTube · Google | Channel, number of subscribers, views, audience statistics (read-only). | youtube.readonly, yt-analytics.readonly |
| Google Calendar · Google | Email address of the authorized Google account (to display which one is connected). Creation, modification, reading and deletion of only those events that UNVRS adds to your calendar (meetings scheduled from the messaging service), in order to reflect a change of time or a cancellation. We do not read your other events. | calendar.events, userinfo.email |
| Member identity (name, photo, email). | openid profile email | |
| TikTok | Public profile and list of videos. | user.info.basic, video.list |
| Snapchat | Public professional profile. | snapchat-profile-api |
We never access your private messages, your social network passwords or your friends list; we publish nothing on your behalf.
2.3 Technical data
- Server logs (IP address, timestamp, pages requested, errors), retained for 12 months for security and diagnostic purposes.
- A session cookie that is strictly necessary for signing in (see § 8).
3. Why, and on what basis?
| Purpose | Legal basis (GDPR) |
|---|---|
| Notifying you of the launch of UNVRS, if you have left your address on the waiting list. | Your consent, given by entering your address; it may be withdrawn at any time by writing to us, which deletes the sign-up. |
| Creating your business card, displaying it to anyone who has its address, and showing you what it has achieved (opens, shares, saved contacts). | Performance of the contract. A card’s statistics are visible only to its holder. |
| Limiting automated sign-ups (IP address, browser, referrer). | Legitimate interest: protecting the service and the persons whose address might be used without their knowledge. |
| Creating and managing your account, displaying your profile and your portfolio. | Performance of the contract (our terms of use). |
| Displaying, in your dashboard, the audience of your connected accounts and how it changes over time. | Your consent, given when connecting the account; it may be withdrawn at any time by disconnecting the account. |
| Suggesting relevant talent ↔ brand introductions. | Performance of the contract and legitimate interest (operating the platform). |
| Security, prevention of abuse, technical logs. | Legitimate interest. |
| Responding to your requests. | Legitimate interest / legal obligation. |
3.1 Felicity: personalization and AI improvement
Felicity is the UNVRS assistant. Two distinct uses of your data concern her, and a third, marketing, remains separate and subject to your consent.
- Personalization is part of the service. UNVRS uses your activity (profiles viewed or saved, searches, projects, collaborations) and the information in your profile to tailor your recommendations, Discover and matching. What Felicity infers from your activity is suggested to you: nothing is displayed to others without your confirmation, and you may correct or dismiss each suggestion. Legal basis: performance of the contract and legitimate interest.
- AI improvement is enabled by default. Your content and your interactions on UNVRS (profile, portfolio, projects, answers and corrections made to Felicity) may be used to improve our AI models, including Felicity. It never covers your private messages, nor the data received from the platforms you connect (Meta, Google, LinkedIn, TikTok, Snapchat). Legal basis: legitimate interest, with your right to object to it at any time.
- You may disable it at any time, in Settings › Privacy & security › Consents. Your choice is retained and applies to subsequent processing; you may re-enable it whenever you wish. Disabling it does not prevent the normal personalization of the service: your recommendations, Discover and matching continue to function.
No window asks you to make this choice: it is located in your settings, together with the date of each change.
What we do not do. We do not sell your data. We do not use it for targeted advertising. We do not pass it on to data brokers. Data received from the platforms (Meta, Google, LinkedIn, TikTok, Snapchat) is used only to display your own statistics to you and to enrich your profile, never to train or improve AI models, in accordance with their platform terms (in particular the Meta Platform Terms and the Google API Services User Data Policy, including the Limited Use requirements).
4. With whom do we share this data?
- Technical processors, solely to host and operate the service: hosting and database (Netlify, Supabase/PostgreSQL), media storage (Cloudinary), sending of transactional emails. They act on our instructions.
- The platforms you connect: we query their interfaces with your authorization; we transmit nothing to them other than the necessary requests.
- The people to whom you hand your card: a published card can be read by anyone who has its address, without an account and without signing in. We never publish its address ourselves: it is you who share it.
- Other users: your public profile and your published portfolio are visible to the brands and talents on the platform, and to anyone who has the portfolio’s address. Your audience statistics are not public by default.
- Authorities: where required by law.
Certain processors may process data outside the European Union; in that case, we rely on the standard contractual clauses of the European Commission or an equivalent mechanism.
5. For how long?
- Waiting list: until the launch of UNVRS and at the latest 12 months after your sign-up, followed by deletion. You may ask to be removed from it earlier, at any time.
- Business card: for as long as you keep it. A card created from the waiting list and never linked to an account is deleted at the same time as the sign-up from which it originated.
- Account and profile: for as long as your account exists, followed by deletion within 30 days after its closure.
- Social account data (tokens, metrics): for as long as the connection is active. Disconnecting an account immediately deletes its tokens and its metrics history. Access tokens are encrypted at rest.
- Technical logs: 12 months.
- Backups: purged at the latest 30 days after the deletion of the production data.
6. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time. To exercise them: contact@unvrsagency.com. We respond within 30 days. You may also lodge a complaint with the CNIL (French data protection authority) (cnil.fr).
To delete the data of your connected accounts or your entire account, follow the Data deletion page. Facebook and Instagram users may also trigger the deletion from their Meta settings: we process it automatically.
7. Security
Encrypted connections (HTTPS), hashed passwords, platform tokens encrypted at rest, restricted access to production data, access logging. No system is infallible: in the event of an incident affecting your data, we will inform you in accordance with the law.
8. Cookies
We use only one session cookie strictly necessary for signing you in, and your browser’s local storage for your display preferences and a portfolio draft. No advertising cookies, no third-party trackers.
9. Minors
The service is intended for persons aged 16 and over. We do not knowingly collect data from minors under the age of 16.
10. Amendments
We may update this policy; the date at the top of the page is authoritative. In the event of a significant change, we will notify you in the application or by email.
11. Contact
UNVRS Agency, Paris, France, contact@unvrsagency.com.