DRAFT FOR A LAWYER TO REVIEW. Not final legal advice — Swiss FADP and GDPR applicability have not been confirmed by counsel. Do not publish until reviewed (PLAN.md §11, item L9).

Privacy Policy

Controller: LAGOON Media, [registered address — TBD], Switzerland. We're subject to the Swiss Federal Act on Data Protection (FADP, revised 2023) as a Swiss company, and to the EU General Data Protection Regulation (GDPR) because we offer the service to, and monitor the behavior of, people in the EU (chat, prompts, reactions) — both regimes apply, and where they differ, this policy follows whichever gives you the stronger protection. Which specific FADP/GDPR provisions govern which data category has not been confirmed by counsel — treat every legal-basis statement below as a working draft, not a final position.

What we collect

• Account data: email, password hash, handle, tier.
• Age-verification data: processed by our verification provider (Veriff, at launch) for the mature lane — we receive a pass/fail result and a retention record, not the underlying ID document itself, unless our provider's integration requires otherwise (UNVERIFIED — confirm Veriff's exact data-return shape before launch). See Age Verification Policy.
• Prompts and chat messages: what you type, when, and the broadcast window it produced or attempted to produce, including denied prompts and the category they were denied under.
• Moderation records: an append-only log of every moderation decision our system makes, regardless of account — verdict, category, which model made the call, and a timestamp. This log exists because a moderation system a regulator or a payment processor can't audit isn't one they'll trust; see our Trust & Safety page.
• Refused prompts, and the account behind them: when a prompt is refused we write one permanent record of it. That record holds: the text you typed; the text our prompt enhancer rewrote it into, if one ran; which check refused it (the text check, before anything is generated, or the picture check, after the clip is made) and under which category; which classifier decided and how long it took; the account's user id, email address and handle as they were at that moment; the network address the prompt was sent from, and the address the account was opened from; and your browser's user-agent string. It is append-only: our software cannot edit or delete a row once written.
• Technical data: IP address (used for the moderation and abuse-prevention systems, and for jurisdiction-based age-gate routing — see our Age Verification Policy), device/browser info, connection logs.
• Payment data: none, at launch — LAGOON takes no money at launch (see Terms of Service §8). This section will be updated with specifics once a payment processor is live.

Why we process it (legal basis, GDPR framing)

• Account and prompt data: performance of the contract you enter into by using the service (Art. 6(1)(b) GDPR).
• Moderation and safety records: our legitimate interest in operating a legal platform and our legal obligations under the statutes named in our Acceptable Use Policy (Art. 6(1)(c) and (f) GDPR). Balancing-test documentation for the legitimate-interest basis has not been drafted — a lawyer should confirm this is sufficient, particularly for EU users.
• Age-verification data: legal obligation, where a jurisdiction requires it (Art. 6(1)(c) GDPR; UK OSA s.81, Texas HB 1181, EU DSA Art. 28 — see Age Verification Policy).

Who we share it with

Processing happens on infrastructure hosted in the EU where practical (generation and moderation GPUs, VPS) and via named vendors for specific functions: Veriff (age verification), OpenAI (a free, secondary moderation opinion for non-CSAM content categories only — never for CSAM or non-consensual-imagery content, which is checked exclusively on our own hardware; see Trust & Safety), and Cloudflare (content delivery). A full vendor/sub-processor list with each vendor's own data-processing terms has not yet been compiled — this is a launch-blocking gap for a GDPR-compliant policy, not a stylistic one. We do not sell personal data.

Law enforcement and legal requests

We will disclose the records described above — including refused prompts, the account behind them, and the network addresses attached to them — to a law-enforcement authority, court, or regulator when we are legally required to, and when we believe in good faith it is necessary to prevent or report a serious crime. In practice the categories most likely to lead to that are the ones our Acceptable Use Policy names: child sexual abuse material, non-consensual intimate imagery, and material support for terrorism.

We do not require a warrant for a lawful, properly-scoped request from a competent authority in a jurisdiction that binds us, and we do not promise to notify you first. Where the law permits us to tell you and doing so would not defeat the purpose of the request, we will.

We do not proactively hand these records to anyone. We do not sell them, we do not share them with advertisers or data brokers, and we do not use them to build a profile of you for any purpose other than operating the moderation and abuse-prevention systems described here.

Accuracy of network addresses. The address recorded against a prompt is the one our content-delivery network reports for that request. It is what our systems were told, not something we independently verify, and it can be affected by proxies, VPNs and shared connections. We store the unprocessed technical headers alongside it so that the origin of any single record can be assessed rather than assumed.

International transfers

Switzerland has an EU adequacy decision, so data moving between our Swiss entity and EU infrastructure doesn't require Standard Contractual Clauses on that leg. Where a vendor processes data outside Switzerland/EU (e.g., a US-based service), the applicable transfer mechanism (SCCs, or another safeguard) needs to be confirmed per vendor. Not yet audited — launch-blocking gap, same as the sub-processor list above.

Retention

Account data: for the life of the account plus a reasonable period after closure for legal and safety purposes. Refused-prompt records: kept for [RETENTION PERIOD — a lawyer must set this] from the date of the refusal, and kept even if the account is closed in the meantime, under GDPR Art. 17(3)(b) and (e) — the same carve-out that already keeps our moderation logs and tax records through an erasure request. Moderation logs: see Record-Keeping Policy for the specific reasoning, including the open question of whether 18 U.S.C. §2257's federal record- keeping regime applies to purely synthetic (no real performer) content. Age-verification pass/fail records: retained per the standard each jurisdiction's law requires (UK OSA's written-record duty is the clearest example — see Age Verification Policy); underlying ID documents, if our provider ever returns them to us, are not retained beyond what verification requires.

Your rights

Access, correction, deletion, and data portability, under FADP and/or GDPR depending on where you're located.

Two of these you can exercise yourself, right now, without asking us or waiting for anyone. On your profile page:

• Download my data gives you a file containing everything this service holds that is keyed to your account — your handle and address, every prompt you submitted (both as you typed it and as it was sent to the model), your reactions, your credit ledger and your tax records. The file also names, in plain words, the things it does not contain and why.
• Delete my account ends the account immediately. It signs out every device, destroys any outstanding password-reset link, and takes your name off everything you put on air — your handle is overwritten, so your prompts and your place on the leaderboard stop being attributable to you. Any credits still on the account end with it, and the page tells you how many before you confirm.

Three things deliberately survive a deletion, and we would rather say so than let you find out later: the clips and prompts themselves stay in the channel's history without your name on them; moderation decisions about content you submitted stay in our append-only compliance log (see Record-Keeping); and tax records for anything you bought stay, because retaining them is a legal obligation we do not have the option to waive (GDPR Art. 17(3)(b)). Age-verification pass/fail records stay for the same reason.

For correction, or for anything the two buttons above don't cover, email [email protected]. We'll respond within the timeframe the applicable law requires. Exact statutory response-time figures for FADP vs. GDPR requests have not been independently confirmed for this document.

Deletion does not reach a refused-prompt record. When you ask us to erase your account we overwrite the identifying fields on the account itself, but the refusal records described above are retained under GDPR Art. 17(3)(b) and (e) — compliance with a legal obligation, and the establishment or defence of legal claims. You can still ask us for a copy of what we hold about you, and that copy will include them.

Cookies

Session and functional cookies for login and the chat connection. No third-party advertising trackers at launch. This section will expand if that changes.

Children

LAGOON is not for anyone under 18. We don't knowingly collect data from minors; see our Age Verification Policy for how age is checked.

Contact

LAGOON Media, [registered address — TBD], Switzerland. [email protected].

What's still open, honestly

This document has three gaps flagged inline above that block publication as a real, GDPR/FADP-defensible policy: the full sub-processor list, the international-transfer mechanism per non-EU vendor, and confirmation of exact statutory response-time figures. None of these are stylistic — a lawyer needs to close them before this page goes live, not after.

• How long we keep refused prompts is not decided. The records exist and are permanent as of today; the retention period a lawyer should set for them is blank in "Retention" above, and until it is filled in, "we keep them" is the honest answer.
• Accounts created before 7 September 2026 have no stored acceptance of these Terms, and no recorded signup address. We did not backfill either — a timestamp claiming somebody agreed to text they were never shown would be a fabricated record. Those accounts are asked once, in place, the next time they visit.