Winchats - Social Media
Privacy Policy
PRIVACY POLICY
1. Who we are
Meta Kicken ("Winchats", "we", "us", "our") respect your privacy and we are committed to protecting the personal data we process about you. Winchats is a social network which enables: (i) "Creators" to share and monetise their own content (as well as subscribe to, and view, the content of other Creators); and (ii) "Fans" to subscribe to, and view, the content of Creators.
2. About this Policy
This privacy policy ("Policy") explains our practices with respect to the personal data we process about our Creators and Fans. Some parts of the Policy are specifically aimed at Creators, and some parts are specifically aimed at Fans. It also applies to how we process the personal data of individuals that feature in content uploaded by a Creator ("Content Collaborators"), and where we process personal data about you in the context of our business relationships.
We process your personal data when you use our website located at www.winchats.com ("Website") and for the provision of the services that we offer from time to time via our Website. We also process your personal data when you interact with us through our social media pages on third-party websites (e.g. Facebook, Google connect and Instagram), or otherwise. We refer to these activities collectively as the "Services" in this Policy.
We are a "data controller" of the personal data that we process in connection with the Services. This means that we decide the reasons why we process personal data about you and how we do so.
Please review this Policy to understand how we process your personal data in connection with the Services. By using our Services, you acknowledge that you have read and understand the information in this Policy.
If you have any questions about this Policy or our processing of your personal data, please see Section 19 (assistance and contact information) for information about how to contact us.
3. What is personal data?
"Personal data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household.
In addition, we may collect data that is not capable of identifying you or is otherwise not associated or linked with you, such as deidentified, aggregated or anonymised information. This type of data is not personal data and our use of such data is not subject to this Policy.
4. Informing us of changes
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes at any point during your relationship with us. Updates or corrections can be made through your account settings on our Website.
5. Applicability of this Policy (18+)
This Policy is provided in addition to, but does not form part of, our Terms of Service (which includes our Acceptable Use Policy) that govern your use of our Website and the Services.
Our Services are strictly intended for individuals 18 years of age or older. Anyone under 18 years of age is not permitted to use the Services. By using the Services, you represent that you are 18 years of age or older.
6. Third-party links
Our Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share personal data about you.
We are not responsible for, and this Policy does not apply to, the content, security or privacy practices of those other websites, plug-ins or applications. We encourage you to view the privacy and cookie policies / notices of those third parties to find out how your personal data may be used.
7. If you do not wish to provide personal data
We need to collect certain personal data from you in order to provide you with access to the Services or specific features and functionalities of the Services in accordance with our contract with you (i.e. our Terms of Service). We are also required to process certain personal data in accordance with applicable laws. Please note that if you do not wish to provide personal data where requested, we may not be able to provide you with access to the Services or specific features and functionalities of the Services.
8. Updates to this Policy
We may update this Policy from time to time, and any updates will be effective upon our posting of the revised Policy on our Website. We will use reasonable efforts to notify you in the event that material updates are made to this Policy, such as sending you a feed notification or a chat message via your account on our Website.
9. Categories of personal data
We process, or our third-party providers process on our behalf, different kinds of personal data about Creators and Fans, which we have grouped together as follows:
User Data
Creators and Content Collaborators
full name*
alias, if applicable
residential address
country of residence*
email address
telephone number
a copy of the government identity document that you provide to us*
a "selfie" of you holding your government identity document*
third-party social media handle / personal website address (used to further verify your age and identity and to help us better understand the content which you are likely to share on our Website)
signature on release forms if you feature in another Creator's content*
Please note: Items marked with * will be requested for Content Collaborators that are not existing Creators on the Website, via a release form.
Fans
email address
telephone number
Third-Party Onboarding Data
The following types of personal data are collected directly by our third-party providers during onboarding:
Creators
a copy of the government identity document that you provide to our third-party providers
a short .gif, taken from a “selfie” that you provide to our third-party providers
the results of the third-party age and identity verification process (pass / fail and reason for failing)
metadata associated with the third-party age and identity verification process (e.g. start and finish time)
Fans
for locations where we conduct third-party age and identity verification of Fans, a copy of the government identity document that you provide to our third-party providers
for locations where we carry out third-party age estimation, or third-party age and identity verification of Fans, a short .gif, taken from a "selfie" that you provide to our third-party providers
the results of the third-party age estimation process or third-party age and identity verification process (pass / fail and reason for failing)
metadata associated with the third-party age estimation process or third-party age and identity verification process (e.g. user start and finish time)
Please see Section 10 (our onboarding processes), below, for further information. Third-Party Onboarding Data and Technical Data does not include Face Recognition Data, as set out below.
Account Data
Creators
profile name
password
avatars and headers of your Creator account
your subscriptions, subscribers and referrals
posts that you have made to your Creator account
comments on posts made from your Creator account
chat messages between you and other users
customer support queries that you submit to us
Fans
profile name
password
avatars and headers of your Fan account
your subscriptions
comments on posts made from your Fan account
chat messages between you and other users
customer support queries that you submit to us
Financial Data
Creators
payment card details*
billing address
funds added to your wallet
bank account information
pay-out country
corporate or business entity if registered for tax purposes
Fans
payment card details*
billing address
funds added to your wallet
* Please note: Any payments made to view the content of Creators are processed by our third-party payment providers. We do not receive your full payment card number, payment card expiration date, or the security code. Instead, the payment provider provides us with a "token" that represents your account, your payment card's expiration date, payment card type and the first six and last four digits of your payment card number.
Transaction Data
Creators
earnings
pay-out requests
payments made to your Creator account
payments made from your Creator account to other Creators
any failed payments
Fans
payments made from your Fan account to Creators
any failed payments
Technical Data
Creators and Fans
Internet or other electronic network activity information, including:
internet protocol (IP) address (and associated location data)
Internet Service Provider (ISP)
device and type
name and version of browser
Usage Data
Creators and Fans
We use cookies where necessary (to allow you to browse the Services and access certain pages of the Website) and, with your consent we will use cookies:
for performance on the Website (e.g. to analyse how users interact with the Website to improve the Services and, where you are a Creator, so that we can recognise that you have referred another Creator through your unique referral code)
for Website functionality (e.g. saving your logged-in status)
More information on our use of cookies, including how to delete or block cookies, can be found in our Cookie Notice . In some cases, data collected from cookies will be in a deidentified, aggregated or anonymised format.
We currently do not use any cross-site tracking technologies and we do not sell personal data collected about you, or share personal data collected about you for cross-context behavioural advertising.
10. Our onboarding processes
CREATORS
We have processes in place that are intended to ensure that all Creators on the Website: (i) are at least 18 years of age; and (ii) verify their identity. Before you can start a Creator account, we will:
Ask you to provide Creator User Data, as set out at Section 9 (categories of personal data).
Check your country of residence. This check is intended to ensure lawful access to the Website and the Services.
Ask you to provide Financial Data, as set out at Section 9 (categories of personal data). This is necessary so that payments can be made to Creators for content, and so that Creators can access their earnings via the Website. Financial Data is also collected as a verification and anti-fraud measure.
Ask you to go through a third-party age and identity verification process:
This process involves our third-party provider collecting a short .gif, taken from a "selfie" and photo from a government identity document (in both cases, that you provide to the third-party provider). The third-party provider then uses Face Recognition Data to match the two images so they can digitally verify your age and identity.
As described at Section 9 (categories of personal data), we do not collect, receive, possess, or have access to any Face Recognition Data collected or processed by our third-party providers through this process.
Where permitted by applicable law, we receive from our third-party providers Third-Party Onboarding Data, and certain Technical Data, as set out at Section 9 (categories of personal data), to maintain a record of the age and identity verification process.
Check that you have not previously been banned from using the Website and our Services (e.g. as a result of violating our Terms of Service ).
FANS
We have processes in place that are intended to ensure that: (i) all Fans on the Website are at least 18 years of age; and (ii) Fans in certain locations verify their identity. Before you can start a Fan account, we will:
Ask you to provide Fan User Data, as set out at Section 9 (categories of personal data).
Check your country of residence. This check is intended to ensure lawful access to the Website and the Services.
Ask you to provide Financial Data , as set out at Section 9 (categories of personal data). This is necessary so that Fans can make payments to Creators. Financial Data is also collected as a verification and anti-fraud measure.
Ask you to go through a third-party process to gain assurances of your age. The specific process will depend upon your location and the third-party provider. This may include:
Third-party age and identity verification
For certain locations, we are required to verify the age and identity of our Fans, so we need to take additional steps. This process involves our third-party provider collecting a short .gif, taken from a "selfie" and photo from a government identity document (in both cases, that you provide to the third-party provider). The third-party provider then uses Face Recognition Data to match the two images so they can digitally verify your age and identity.
As set out at Section 9 (categories of personal data), we do not ourselves collect, receive, possess, or have access to this data.
Where permitted by applicable law, we may receive from our third-party providers Third-Party Onboarding Data, and certain Technical Data, as set out at Section 9 (categories of personal data), to maintain a record of the age and identity verification process.
Third-party age estimation
For certain locations, we use third-party providers to conduct age estimation. This process involves our third-party provider collecting a short .gif "selfie" (that you provide to the third-party provider) and using digital technology to estimate your age, which may involve the use of Face Recognition Data.
If you go through the third-party age estimation process, we will only receive the results of the process (pass / fail and reason for failing), to maintain a record of the age estimation process.
If you fail the third-party age estimation process (e.g. if you are over 18 years of age, but their technology has predicted that you look under 18 years of age), you may have the option to go through the third-party age and identity verification process set out above.
MORE INFORMATION ON OUR ONBOARDING PROCESSES
Why does Winchats use third-party face recognition technology?
The use of face recognition technology by our third-party providers is an important technological measure used in our wider onboarding processes for Creators and Fans. It is intended to ensure safety on the Website and our compliance with applicable laws.
We use third-party service providers to carry out age and identity verification, who carry out these services on our behalf, as data processors.
How does Face Recognition Data help to prevent fraud?
Face recognition technology reduces the possibility of fraudulent face image spoofing and the uploading of fraudulent government identity documents when individuals go through the onboarding process.
Where our third-party providers have identified possible fraud attempts (such as the use of fake or otherwise manipulated documents) our third-party providers may maintain a record of such attempts, including Face Recognition Data, for the purposes of detecting unlawful activity and preventing access to the Website.
Periodic authentication of your identity
During the time that you hold an account with us, we may require you to periodically authenticate your identity. If you have gone through the third-party age identity verification process, where permitted by applicable law our third-party providers may retain Face Recognition Data to enable you to authenticate your identity. Where this is retained, you do not need to Requested Privacy Policy adjustments provide the third-party provider with your government identity document again when authenticating your identity.
Withdrawing your consent: You may withdraw your consent to the retention of your Face Recognition Data for the purposes of subsequent authentication (and delete this) by contacting privacy@winchats.com. While withdrawing your consent to the retention of your Face Recognition Data will not affect your ability to complete a subsequent authentication process, it may require you to provide the third-party provider with your government identity document again during the authentication process.
11. How / why your personal data is used and lawful bases for processing
We process personal data for, or based on, one or more of the following legal bases:
Consent: Your consent is requested only in specific circumstances which includes, for example, the processing of: (i) Face Recognition Data by our third-party providers as part of the age and identity verification process for all Creators (and for Fans in certain locations); and (ii) age estimation captures (which may involve the use of Face Recognition Data) by our third-party providers for Fans in certain locations. Please see Section 10 (our onboarding processes), above, for further information.
Performance of a contract: By using the Services, you have contracted with us through our Terms of Service, and we will process personal data to perform that contract (e.g. to fulfil transactions between Fans and Creators and process Creator earnings) and to enforce the terms of that contract.
Legitimate interests: We may process personal data if it is in our, or a third-party's, legitimate interests (as detailed in the table below). This includes, for example, investigating and responding to a report made through our DMCA takedown procedure to protect a Creator's intellectual property rights.
Compliance with legal obligations: As a global business, we may process personal data to comply with applicable law, rules and regulations in the locations where we operate.
Task carried out in the public interest: We may process personal data as necessary for a task carried out in the public interest. This may include, for example, reporting illegal activity to relevant law enforcement authorities, other governmental agencies and non- governmental organisations.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
12. Obtaining your personal data
We collect your personal data from the following categories of sources:
Directly from you: When you provide it to us directly to open an account and use the Services, when you update your personal data in your account, or by corresponding with us (e.g. User Data, Account Data).
Automatically or indirectly from you: For example, through and as a result of your use of the Services (e.g. Transaction Data, Technical Data, Usage Data).
From our service providers: For example, where permitted by applicable law, we receive Third-Party Onboarding Data and certain Technical Data from our third-party age and identity verification providers.
13. Sharing your personal data
We share personal data with the following categories of third parties:
Our third-party service providers: Such as our IT, payment processing, customer support, content and text moderation, and age and identity verification / age estimation service providers. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our legitimate interests (namely the receipt of services to support business functionality).
Our professional advisers: Such as our legal advisors, bankers, auditors, accountants, consultants, and insurers. Our professional advisors will process personal data as necessary to provide their services to us. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our legitimate interests (namely the receipt of professional services).
Corporate: Relevant third parties in the event of a possible sale, merger, acquisition, business reorganisation or group restructuring exercise. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our and the relevant third parties' legitimate interests (namely assessing and putting into effect potential transactions).
Our group companies: For the centralised coordination and management of our business, in accordance with the purposes set out at Section 9 (categories of personal data). These recipients will process personal data in the same way as set out in this Policy. The lawful basis we rely on for sharing personal data with these recipients is that it is necessary for our legitimate interests (namely coordinating the global operations of our business).
Relevant authorities, regulators and organisations: In response to requests from governmental authorities (including law enforcement and tax authorities), regulators, and certain non-governmental organisations (such as the National Center for Missing & Exploited Children (NCMEC)). These recipients will use your personal data in the performance of their regulatory, law enforcement or otherwise charitable or not-for-profit role. The lawful basis we rely on for sharing personal data with these recipients is that the processing is either necessary to comply with a legal obligation to which we are subject, or necessary for our, or a third-party's, legitimate interests, or where it is in the interests of the wider public to do so (namely reporting illegal content to, and assisting with requests from, such authorities, regulators and organisations, to protect the safety of our users and third parties).