L1VE Inc.
Version: 28 May 2026
Last Updated: 28 May 2026
L1VE Inc. (“L1VE”, “we”, “us”, or “our”) is a corporation incorporated under the laws of the United States of America, with its registered office at 26 Broadway FL 3, New York, NY 10004, USA. L1VE is the data controller for personal data processed in connection with the L1VE Service, which consists of:
(together, the “Service”).
This Privacy Policy explains in detail how the Service collects, uses, shares, retains, and safeguards your personal data. It also describes your rights regarding your personal data and how you can exercise them. We are committed to handling your personal information with transparency and care.
This Policy applies to all users of the Service worldwide. Where jurisdiction-specific provisions apply — in particular for users in the European Union / European Economic Area (EU/EEA), the United Kingdom (UK), California (USA), and other regions with specific legal requirements — these are clearly identified in the relevant sections below.
By accessing or using the Service, you confirm that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use the Service.
The data controller responsible for your personal data is:
L1VE Inc. 26 Broadway FL 3, New York, NY 10004, United States of America. Email: info@l1ve.com. Website: https://www.l1ve.com
As L1VE Inc. is established outside the European Union but processes personal data of EU/EEA residents, it has designated L1VE Germany GmbH as its EU representative pursuant to Article 27 of the GDPR. EU/EEA residents and supervisory authorities may contact the EU representative directly on matters relating to the processing of personal data:
L1VE Germany GmbH — EU Representative for GDPR Article 27 │ DSA Single Point of Contact. Sophienstr. 32, 10178 Berlin, Germany. Commercial Register: Amtsgericht Charlottenburg, HRB 265312 B. VAT ID: DE368641657. Email: info@l1ve.com
L1VE Germany GmbH acts solely as the designated EU contact and representative pursuant to §5 TMG, §18(2) MStV, and GDPR Article 27. It is not the operator of the L1VE Service. Operational and contractual responsibility for the Service and for personal data processing rests with L1VE Inc.
L1VE has appointed a Data Protection Officer (DPO) in accordance with GDPR Article 37. The DPO is responsible for overseeing L1VE’s data protection strategy and implementation, monitoring compliance with the GDPR and other applicable data protection laws, and serving as a point of contact for data subjects and supervisory authorities.
To contact the DPO, please write to: info@l1ve.com (marked: For the attention of the Data Protection Officer). A dedicated DPO contact address will be published at https://www.l1ve.com/privacy-policy.
We collect various types of information from and about users to provide, maintain, and continuously improve our Service. The categories of personal data we collect are set out below.
This includes fundamental data you provide when you register for an account or create your profile, such as your username, email address, password (stored in hashed form), date of birth, and a confirmation that you are at least 18 years of age (captured via checkbox at registration). This information is essential for managing your account, authenticating your access to the Service, and verifying that you meet the minimum age requirement (18 years of age). The 18+ confirmation and date of birth are retained as proof of compliance with our age restriction.
We collect information detailing how you interact with our Service. This includes your viewing history, applications used, frequency and duration of use, in-app actions, virtual events attended, purchases made, app usage within the VR environment, and interaction activity and statistics (e.g., loading times, in-app actions). This data helps us understand user engagement patterns and continuously enhance your experience.
We automatically log information about your device and network connection. This includes device identifiers, your IP address, headset model, operating system version, language and region settings, device attributes, system logs, settings, indicators of function success or failure, and crash reports. This data is used for troubleshooting, monitoring system performance, and maintaining security.
When you make purchases within the Service, we collect information related to your payment method (e.g., card brand and expiration date). We store only very limited financial information directly; most financial transactions are securely handled by accredited third-party payment processors who apply their own data protection measures. We do not store full credit card numbers.
If you communicate with us — such as by contacting customer support — we collect the information you provide in those correspondences. This typically includes your name, email address, phone number, and the contents of your messages or attachments. This data facilitates effective responses to your inquiries and support requests.
When you use the Service via platform accounts (e.g., Meta Quest), we may receive basic user profile information (such as display name, username, profile picture, avatar, age group, and a list of followers and people you follow who also own the app) and usage insights as permitted by the platform. We may also receive metadata about user achievements and unlocked features if such data is generated within our own or integrated apps. The scope of data received from third-party platforms is governed by the privacy settings and terms of those platforms.
Given the immersive nature of our Service, we also collect data unique to your VR experience. Some of this data may constitute biometric data or special category data under applicable law (including GDPR Article 9). Where that is the case, we will only process such data with your explicit consent, as described in Section 5 and Section 6.
Spatial Tracking Data: Information about your headset’s position and orientation in your physical space, and the position of your controllers. This data is essential for enabling movement within the virtual environment and accurate interaction with virtual objects. We do not map or store persistent layouts of your physical environment.
Head and Hand Movement Data: Data on your head movements (e.g., head orientation) and hand movements (e.g., controller position and gestures). This data is used to animate your avatar, facilitate interactions within the virtual environment, and improve the responsiveness of the Service.
Eye-Tracking on Apple Vision Pro: Apple Vision Pro processes eye-tracking on-device and does not share raw eye-tracking data with applications. L1VE does not receive or store raw eye-tracking data from Apple Vision Pro. We only receive coarse interaction events (e.g., a confirmed selection) that the Apple Vision Pro system surfaces to applications after user input. To the extent that any gaze data we do receive elsewhere constitutes biometric data under GDPR Article 4(14), it will only be processed with your explicit consent.
Voice Data: If you utilize voice chat features, we process your voice input for real-time communication. We do not store recordings of your voice conversations unless you have explicitly consented to specific features requiring storage (e.g., voice commands). Voice data processed in real time without storage is treated as Technical Data under Section 3.3.
VR Interaction Data: We track your interactions with virtual objects, participation in virtual events, and engagement with other users’ avatars within the VR environment. This helps us understand engagement and optimize content.
Video and Audio Stream Data: When you stream content, we collect data related to the video and audio streams, including stream quality, buffering, and playback performance, including via streaming technologies used to deliver and optimize your viewing experience.
We use the information we collect for the following purposes:
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
We do not sell your personal information for monetary consideration. We do, however, share certain personal information (such as device identifiers, IP addresses, and event data) with advertising partners — Meta, Google, and TikTok — for cross-context behavioural advertising purposes, as defined by the CCPA/CPRA. California residents have the right to opt out of such sharing at any time (see Section 9.2). For users in the EU/EEA/UK, this sharing is conditional on your prior consent through our Usercentrics consent banner.
For users in the European Union, the European Economic Area, and the United Kingdom, we process your personal data only where we have a valid lawful basis under GDPR Article 6 (and, for special category data, Article 9). The lawful bases we rely on are set out in the table below.
SCROLL TO SEE ALL COLUMNS →
| Data Category | Lawful Basis (GDPR) | Additional Notes |
|---|---|---|
| Account Information | Article 6(1)(b) — Performance of a contract | Necessary to create and manage your account |
| Usage Data (operational, strictly necessary) | Article 6(1)(b) — Performance of a contract | Necessary to deliver the Service |
| Usage Data (analytics — Amplitude, GTM) | Article 6(1)(a) — Consent (via Usercentrics) + § 25(1) TDDDG | Withdrawable at any time |
| Technical Data | Article 6(1)(f) — Legitimate interests | System security, troubleshooting, performance monitoring |
| Financial Data | Article 6(1)(b) — Contract; Article 6(1)(c) — Legal obligation | Payment processing; statutory retention requirements |
| Communication Data | Article 6(1)(b) — Contract; Article 6(1)(a) — Consent (marketing) | Support based on contract; marketing requires opt-in consent |
| Third-Party Platform Data | Article 6(1)(a) — Consent; Article 6(1)(b) — Contract | Depends on platform integration context |
| VR Spatial / Movement Data | Article 6(1)(b) — Contract | Required to deliver the core VR experience |
| Biometric / Eye-Tracking Data | Article 9(2)(a) — Explicit consent | Separate opt-in consent required; withdrawal available at any time |
| Voice Data (stored) | Article 9(2)(a) — Explicit consent | Only stored where user has consented to specific features |
| Location Data (precise) | Article 6(1)(a) — Consent | Only collected with explicit opt-in |
| Location Data (coarse / IP-derived) | Article 6(1)(f) — Legitimate interests | Used for geo-blocking compliance and region-specific content |
| Cookies and similar technologies (non-essential) | Article 6(1)(a) — Consent + § 25(1) TDDDG | Withdrawable at any time |
| Cookies and similar technologies (strictly necessary) | Article 6(1)(f) — Legitimate interests + § 25(2) TDDDG | No consent required |
| Marketing Communications | Article 6(1)(a) — Consent | Opt-in required; withdrawal available at any time |
| Cross-Context Behavioural Advertising (Meta Pixel, Google Ads, TikTok Pixel) | Article 6(1)(a) — Consent + § 25(1) TDDDG | Joint controllership with Meta and TikTok (see Section 8.6); withdrawable at any time |
Where we rely on legitimate interests (Article 6(1)(f)), we have carried out a balancing test to confirm that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests at any time (see Section 9).
Where we rely on consent as the lawful basis, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent does not affect processing carried out on other lawful bases.
Certain VR-specific data we collect — in particular eye-tracking and gaze data, and stored voice recordings — may constitute biometric data or special category data within the meaning of GDPR Article 4(14) and Article 9. We take the following approach to such data:
Spatial tracking data (headset and controller position) and general head/hand movement data not constituting biometric data are processed under Article 6(1)(b) as necessary for delivery of the VR experience.
We may use cookies or similar tracking technologies on our website and within the Service to support functionality, analyze usage, and personalize your experience. For EU/EEA/UK users, non-essential cookies (including analytics and marketing cookies) will only be placed on your device with your prior, freely given consent, in accordance with the ePrivacy Directive and applicable national implementing legislation.
You can manage your cookie preferences at any time through the cookie preference centre available on our website or through your browser settings. For full details on the types of cookies we use, their purpose, and how to manage them, please refer to our separate Cookie Policy available at https://www.l1ve.com/cookies.
We engage in cross-context behavioural advertising (via the Meta Pixel, Google Ads, and TikTok Pixel) only after you have given your explicit opt-in consent through Usercentrics. For California residents, we will honour Global Privacy Control (GPC) signals as an opt-out of the sharing of personal information for cross-context behavioural advertising.
We do not sell your personal information for monetary consideration. We share certain personal information with advertising partners for cross-context behavioural advertising as described in Section 8.1.1 and Section 8.6, and otherwise share information only in the circumstances set out below:
We engage third-party companies and individuals to facilitate our Service (e.g., payment processors, cloud hosting services such as AWS, analytics providers, content delivery networks). These service providers act as data processors and have access to your personal information only to perform tasks on our behalf. They are contractually obligated not to disclose or use it for any other purpose and must process data in accordance with our instructions and applicable law, including under GDPR-compliant Data Processing Agreements (DPAs) where required.
A list of our current sub-processors and service providers is available upon written request to info@l1ve.com. We will notify you of material changes to our sub-processor list in accordance with our sub-processor notification procedure described in the Privacy Policy.
The table below identifies our principal processors and tracking technologies, their purpose, country of processing, the legal basis under GDPR, and whether consent is required under the ePrivacy Directive and § 25 TDDDG (Germany). A full list of sub-processors is available on request.
SCROLL TO SEE ALL COLUMNS →
| Provider | Purpose | Country | Legal basis (GDPR) | Consent required (§ 25 TDDDG) |
|---|---|---|---|---|
| Amazon Web Services (AWS) — Amazon Web Services EMEA SARL / Amazon Web Services, Inc. | Cloud hosting and storage for the Service | EU (primary), USA (failover) | Art. 6(1)(b) (contract) and Art. 6(1)(f) (legitimate interest in providing the Service) | No (strictly necessary) |
| Google Tag Manager (server-side, at tracking.l1ve.com) — Google Ireland Ltd. / Google LLC | First-party server-side tag management for the Webshop. The container itself loads strictly under Consent Mode v2; consented tags are then routed to the providers listed below. | EU / USA | Art. 6(1)(a) (consent) for non-essential tags; Art. 6(1)(f) for the strictly-necessary container infrastructure | Yes, for non-essential tags |
| Usercentrics — Usercentrics GmbH | Consent Management Platform: capture, storage, and proof of consent | EU (Germany) | Art. 6(1)(c) (legal obligation to obtain and document consent) | No (strictly necessary) |
| Stripe Payments Europe Ltd. (EU users) / Stripe, Inc. | Payment processing (Stripe Elements integrated in the Webshop checkout) and fraud prevention | Ireland (EU) / USA (DPF-certified) | Art. 6(1)(b) (contract) and Art. 6(1)(c) (legal obligation, tax/accounting) | No (strictly necessary for the payment transaction) |
| Amplitude, Inc. — Web SDK and VR Application SDK | Product analytics: feature usage, retention, conversion, funnel analysis (across Webshop and VR application) | USA (DPF-certified) | Art. 6(1)(a) (consent) + § 25(1) TDDDG | Yes (in both Webshop and VR application) |
| Google Analytics 4 — Google Ireland Ltd. / Google LLC | Web analytics on the Webshop. IP anonymization enabled; data retention set to 14 months; Google Consent Mode v2 active. | EU / USA (DPF-certified) | Art. 6(1)(a) (consent) + § 25(1) TDDDG | Yes |
| Google Ads — Google Ireland Ltd. / Google LLC | Conversion tracking and remarketing for advertising campaigns | EU / USA (DPF-certified) | Art. 6(1)(a) (consent) + § 25(1) TDDDG. Controller-Controller Data Protection Terms with Google in place. | Yes |
| Meta Pixel — Meta Platforms Ireland Ltd. (EU users) / Meta Platforms, Inc. | Conversion tracking and audience building for advertising on Meta platforms (Facebook, Instagram). Joint Controllership with Meta under Art. 26 GDPR for Pixel data collection (see Section 8.6). | Ireland (EU) / USA | Art. 6(1)(a) (consent) + § 25(1) TDDDG | Yes |
| TikTok Pixel and Events API — TikTok Information Technologies UK Ltd. (EU/UK users) / TikTok Inc. | Conversion tracking and audience building for advertising on TikTok. Joint Controllership with TikTok under Art. 26 GDPR for Pixel data collection (see Section 8.6). | UK / Ireland / USA / Singapore | Art. 6(1)(a) (consent) + § 25(1) TDDDG | Yes |
| HubSpot, Inc. / HubSpot Ireland Ltd. — CRM, Marketing Hub, Website Tracking Code | CRM (contact management, customer support), marketing email (with separate double-opt-in consent), website tracking (lead identification on the Webshop) | EU / USA (DPF-certified) | Art. 6(1)(b) (CRM, customer-initiated communications); Art. 6(1)(a) (marketing email, website tracking) | Yes (for the HubSpot website tracking code and marketing email; no for purely transactional CRM use) |
| hisplayer — HISPlayer S.L. | Video streaming player and delivery optimization within the L1VE VR application | EU | Art. 6(1)(b) (contract) | No (strictly necessary for content delivery) |
| Meta Platforms, Inc. / Meta Platforms Ireland Ltd. (platform integration) | Account linking and in-app purchase processing via Meta Quest (when introduced), platform analytics | USA / EU | Art. 6(1)(b) (contract) | n/a (platform-level) |
| Apple Inc. / Apple Distribution International Ltd. (platform integration) | Account linking and in-app purchase processing via App Store / Vision Pro (when introduced) | EU / USA | Art. 6(1)(b) (contract) | n/a (platform-level) |
L1VE operates Google Tag Manager in a server-side configuration at the first-party subdomain tracking.l1ve.com. This means that tracking requests are first received by L1VE’s own infrastructure and then forwarded to the relevant providers above, in line with the consent you have given through Usercentrics. The server-side setup reduces direct browser-to-third-party data transfers and gives L1VE additional control over the data passed to advertising and analytics partners.
Non-essential cookies and similar technologies are only set after you have given consent through our Usercentrics consent banner. You can withdraw or change your consent at any time through the “Cookie settings” link in our Webshop footer or through the Usercentrics privacy settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
The L1VE VR application embeds the Amplitude SDK for product analytics. Although the VR application is not a website in the traditional sense, accessing and storing information on a user’s VR headset falls within the scope of § 25 TDDDG and the ePrivacy Directive. Accordingly, Amplitude SDK initialization in the VR application is conditional on the user’s prior consent, which is collected through an in-app consent prompt on first launch. Consent can be withdrawn at any time through the VR application’s privacy settings.
We may disclose your information if required to do so by applicable law, or in response to valid, legally compelled requests by public authorities (e.g., a court order or government agency). Where legally permitted, we will notify you of such a request before disclosing your data.
In connection with any merger, sale of company assets, financing, or acquisition of all or a portion of L1VE’s business by another company, your information may be transferred. Where such a transfer materially affects your privacy rights, we will notify you in advance and, where required by applicable law, obtain your consent.
We may share your information with third parties for other purposes with your explicit consent. You may withdraw that consent at any time.
We may share aggregated or anonymised information — which cannot reasonably be used to identify you — with third parties for research, analysis, and service improvement purposes without restriction.
For the Meta Pixel and the TikTok Pixel, L1VE Inc. and the respective advertising platform act as Joint Controllers within the meaning of Article 26 GDPR for the data collection that takes place via the Pixel on the L1VE Webshop.
Essential aspects of the joint controller arrangement:
The full joint controller arrangements are documented in:
Data subjects may exercise their data protection rights against either joint controller. L1VE Inc. will forward requests it cannot fulfil unilaterally to Meta or TikTok as appropriate.
For Google Ads, Google operates under a Controller-Controller relationship (not joint controllership) under Google’s “EU User Consent Policy” and the Google Ads Data Protection Terms. For Google Analytics 4, Google acts as our processor under the Google Analytics Data Processing Terms.
If you are located in the EU, EEA, or UK, you have the following rights under the GDPR (or UK GDPR) with respect to your personal data:
To the extent that L1VE Inc. meets the applicable thresholds under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have the following rights:
We will honour Global Privacy Control (GPC) signals as an opt-out of sale or sharing of personal information where required. To exercise your California privacy rights, please contact us at info@l1ve.com.
To exercise any of your rights described in this Section, please contact us at: info@l1ve.com (subject line: “Privacy Rights Request”). EU/EEA/UK users may alternatively contact our EU representative, L1VE Germany GmbH, at the address in Section 2.2.
We may need to verify your identity before processing your request to ensure the security of your data. We are committed to responding to your requests within 30 days (or such other period as required by applicable law). We do not condition deletion on any reason and we do not discriminate against users exercising their privacy rights.
We retain personal data only for as long as necessary to provide the Service, fulfil the purposes outlined in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention periods vary depending on the type of data and the purpose for which it was collected:
When personal data is no longer required, it is securely deleted or anonymised in a manner that prevents reconstruction. You may request deletion of your personal data at any time as described in Section 9.
We implement robust technical and organisational measures designed to protect your personal information from unauthorised access, alteration, disclosure, or destruction. These measures include data encryption in transit and at rest, secure servers, role-based access controls, regular security assessments, and incident response procedures.
While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.
Data Breach Notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (GDPR Article 33). Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay (GDPR Article 34).
L1VE Inc. is based in the United States. As our Service utilises cloud infrastructure including AWS, your personal information may be transferred to, stored, and processed in countries outside your country of residence, including the United States, where data protection laws may differ from those in your jurisdiction.
For EU / EEA / UK Users — Transfer Safeguards
For transfers of personal data from the EU/EEA or UK to countries not deemed adequate by the European Commission (or UK authorities), we rely on the following legal transfer mechanisms to ensure your data remains protected:
By using the Service, you acknowledge that your data may be transferred internationally as described above. You may request a copy of the applicable transfer safeguards by contacting us at info@l1ve.com.
The L1VE Service is intended exclusively for adults aged 18 and older. During registration, users are required to confirm by checkbox that they are at least 18 years of age. L1VE does not knowingly collect or process personal data of persons under 18.
L1VE Inc. does not direct the Service to minors. The 18+ age restriction is enforced at registration through a mandatory self-declaration checkbox and the date-of-birth field. L1VE Inc. reserves the right to suspend or terminate any account where there are reasonable grounds to believe that the user is under 18.
If we become aware that we have collected personal data from a person under 18, we will terminate the relevant account and delete the associated personal data without undue delay, subject to legal retention obligations (e.g., financial records under § 257 HGB and § 147 AO in Germany, and equivalent obligations elsewhere).
If you are a parent or legal guardian and become aware that a person under 18 in your care has registered for or used the Service, please contact us at info@l1ve.com so that we can take appropriate action.
We do not engage in advertising directed at minors and we do not engage in profiling of minors. Where we discover personal data of an under-18 user prior to deletion, we apply strict data minimization and do not use that data for any purpose other than identification and deletion.
L1VE relies on self-declaration at registration as the primary age verification measure. L1VE may implement additional verification measures (e.g., ID verification, payment-method verification, or third-party age assurance services) where lawful, proportionate, and required to comply with local law or platform policy.
Consistent with the Children’s Online Privacy Protection Act (COPPA), L1VE Inc. does not direct the Service to children under 13, does not knowingly collect personal information from children under 13, and operates an adults-only (18+) service. Any data inadvertently collected from a child under 13 will be deleted promptly upon discovery, subject to legal retention obligations.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
For material changes — in particular, changes that affect the purposes for which we process your personal data, the legal bases we rely on, or your rights — we will notify registered users by email and/or prominent in-app notification at least 30 days before the changes take effect. Where a material change requires a new lawful basis (including renewed consent), we will obtain that consent before implementing the change.
For non-material updates (e.g., clarifications, contact detail changes), we will update the “Last Updated” date at the top of this Policy. Your continued use of the Service after any changes indicates your acceptance of the updated Policy. We encourage you to review this Policy periodically.
For any questions, concerns, or complaints regarding this Privacy Policy, or to exercise your data protection rights, please contact us using the details below.
L1VE Inc. — Data Controller. 26 Broadway FL 3, New York, NY 10004, United States of America. info@l1ve.com
L1VE Germany GmbH — EU Representative (GDPR Art. 27). Sophienstr. 32, 10178 Berlin, Germany. HRB 265312 B │ VAT: DE368641657. info@l1ve.com
EU/EEA/UK data subjects may direct data protection queries to L1VE Germany GmbH as the GDPR Article 27 representative. You also have the right to lodge a complaint with your local supervisory authority at any time.
© L1VE Inc. 2026 | All Rights Reserved
26 Broadway FL 3, New York, NY 10004, USA | info@l1ve.com | www.l1ve.com