L1VE VR Streaming Service — Global Privacy Policy

L1VE Inc.

Version: 28 May 2026

Last Updated: 28 May 2026

1. Introduction and Scope

L1VE Inc. (“L1VE”, “we”, “us”, or “our”) is a corporation incorporated under the laws of the United States of America, with its registered office at 26 Broadway FL 3, New York, NY 10004, USA. L1VE is the data controller for personal data processed in connection with the L1VE Service, which consists of:

  • the L1VE webshop at https://prod.l1ve.com, where users register accounts and purchase tickets and content; and
  • the L1VE VR application for Meta Quest and Apple Vision Pro, where purchased 360° live streams and video-on-demand content is viewed exclusively.

(together, the “Service”).

This Privacy Policy explains in detail how the Service collects, uses, shares, retains, and safeguards your personal data. It also describes your rights regarding your personal data and how you can exercise them. We are committed to handling your personal information with transparency and care.

This Policy applies to all users of the Service worldwide. Where jurisdiction-specific provisions apply — in particular for users in the European Union / European Economic Area (EU/EEA), the United Kingdom (UK), California (USA), and other regions with specific legal requirements — these are clearly identified in the relevant sections below.

By accessing or using the Service, you confirm that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use the Service.

2. Data Controller, EU Representative, and Contact Details

2.1 Data Controller

The data controller responsible for your personal data is:

L1VE Inc. 26 Broadway FL 3, New York, NY 10004, United States of America. Email: info@l1ve.com. Website: https://www.l1ve.com

2.2 EU Representative (GDPR Article 27)

As L1VE Inc. is established outside the European Union but processes personal data of EU/EEA residents, it has designated L1VE Germany GmbH as its EU representative pursuant to Article 27 of the GDPR. EU/EEA residents and supervisory authorities may contact the EU representative directly on matters relating to the processing of personal data:

L1VE Germany GmbH — EU Representative for GDPR Article 27 │ DSA Single Point of Contact. Sophienstr. 32, 10178 Berlin, Germany. Commercial Register: Amtsgericht Charlottenburg, HRB 265312 B. VAT ID: DE368641657. Email: info@l1ve.com

L1VE Germany GmbH acts solely as the designated EU contact and representative pursuant to §5 TMG, §18(2) MStV, and GDPR Article 27. It is not the operator of the L1VE Service. Operational and contractual responsibility for the Service and for personal data processing rests with L1VE Inc.

2.3 Data Protection Officer

L1VE has appointed a Data Protection Officer (DPO) in accordance with GDPR Article 37. The DPO is responsible for overseeing L1VE’s data protection strategy and implementation, monitoring compliance with the GDPR and other applicable data protection laws, and serving as a point of contact for data subjects and supervisory authorities.

To contact the DPO, please write to: info@l1ve.com (marked: For the attention of the Data Protection Officer). A dedicated DPO contact address will be published at https://www.l1ve.com/privacy-policy.

3. Information We Collect

We collect various types of information from and about users to provide, maintain, and continuously improve our Service. The categories of personal data we collect are set out below.

3.1 Account Information

This includes fundamental data you provide when you register for an account or create your profile, such as your username, email address, password (stored in hashed form), date of birth, and a confirmation that you are at least 18 years of age (captured via checkbox at registration). This information is essential for managing your account, authenticating your access to the Service, and verifying that you meet the minimum age requirement (18 years of age). The 18+ confirmation and date of birth are retained as proof of compliance with our age restriction.

3.2 Usage Data

We collect information detailing how you interact with our Service. This includes your viewing history, applications used, frequency and duration of use, in-app actions, virtual events attended, purchases made, app usage within the VR environment, and interaction activity and statistics (e.g., loading times, in-app actions). This data helps us understand user engagement patterns and continuously enhance your experience.

3.3 Technical Data

We automatically log information about your device and network connection. This includes device identifiers, your IP address, headset model, operating system version, language and region settings, device attributes, system logs, settings, indicators of function success or failure, and crash reports. This data is used for troubleshooting, monitoring system performance, and maintaining security.

3.4 Financial Data

When you make purchases within the Service, we collect information related to your payment method (e.g., card brand and expiration date). We store only very limited financial information directly; most financial transactions are securely handled by accredited third-party payment processors who apply their own data protection measures. We do not store full credit card numbers.

3.5 Communication Data

If you communicate with us — such as by contacting customer support — we collect the information you provide in those correspondences. This typically includes your name, email address, phone number, and the contents of your messages or attachments. This data facilitates effective responses to your inquiries and support requests.

3.6 Information from Third-Party Platforms

When you use the Service via platform accounts (e.g., Meta Quest), we may receive basic user profile information (such as display name, username, profile picture, avatar, age group, and a list of followers and people you follow who also own the app) and usage insights as permitted by the platform. We may also receive metadata about user achievements and unlocked features if such data is generated within our own or integrated apps. The scope of data received from third-party platforms is governed by the privacy settings and terms of those platforms.

3.7 VR-Specific Data

Given the immersive nature of our Service, we also collect data unique to your VR experience. Some of this data may constitute biometric data or special category data under applicable law (including GDPR Article 9). Where that is the case, we will only process such data with your explicit consent, as described in Section 5 and Section 6.

Spatial Tracking Data: Information about your headset’s position and orientation in your physical space, and the position of your controllers. This data is essential for enabling movement within the virtual environment and accurate interaction with virtual objects. We do not map or store persistent layouts of your physical environment.

Head and Hand Movement Data: Data on your head movements (e.g., head orientation) and hand movements (e.g., controller position and gestures). This data is used to animate your avatar, facilitate interactions within the virtual environment, and improve the responsiveness of the Service.

Eye-Tracking on Apple Vision Pro: Apple Vision Pro processes eye-tracking on-device and does not share raw eye-tracking data with applications. L1VE does not receive or store raw eye-tracking data from Apple Vision Pro. We only receive coarse interaction events (e.g., a confirmed selection) that the Apple Vision Pro system surfaces to applications after user input. To the extent that any gaze data we do receive elsewhere constitutes biometric data under GDPR Article 4(14), it will only be processed with your explicit consent.

Voice Data: If you utilize voice chat features, we process your voice input for real-time communication. We do not store recordings of your voice conversations unless you have explicitly consented to specific features requiring storage (e.g., voice commands). Voice data processed in real time without storage is treated as Technical Data under Section 3.3.

VR Interaction Data: We track your interactions with virtual objects, participation in virtual events, and engagement with other users’ avatars within the VR environment. This helps us understand engagement and optimize content.

Video and Audio Stream Data: When you stream content, we collect data related to the video and audio streams, including stream quality, buffering, and playback performance, including via streaming technologies used to deliver and optimize your viewing experience.

4. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide, operate, and maintain the Service, including processing purchases and delivering content;
  • To improve, personalize, and expand the Service, including developing new products, services, features, and functionality;
  • To understand and analyze how you use the Service, including for analytics and performance monitoring;
  • To communicate with you, including for customer service, updates, and — where you have given consent or we otherwise have a lawful basis — marketing and promotional purposes;
  • To process your transactions and manage your orders;
  • To detect and prevent fraud, abuse, and security incidents;
  • For compliance purposes, including enforcing our Terms of Service, or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency;
  • To operate recommender systems and personalization features, where you have the ability to adjust the parameters of such systems as described in the Privacy Policy and in compliance with DSA Article 27 and GDPR.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

We do not sell your personal information for monetary consideration. We do, however, share certain personal information (such as device identifiers, IP addresses, and event data) with advertising partners — Meta, Google, and TikTok — for cross-context behavioural advertising purposes, as defined by the CCPA/CPRA. California residents have the right to opt out of such sharing at any time (see Section 9.2). For users in the EU/EEA/UK, this sharing is conditional on your prior consent through our Usercentrics consent banner.

5. Lawful Basis for Processing (GDPR / UK GDPR)

For users in the European Union, the European Economic Area, and the United Kingdom, we process your personal data only where we have a valid lawful basis under GDPR Article 6 (and, for special category data, Article 9). The lawful bases we rely on are set out in the table below.

SCROLL TO SEE ALL COLUMNS →

Data CategoryLawful Basis (GDPR)Additional Notes
Account InformationArticle 6(1)(b) — Performance of a contractNecessary to create and manage your account
Usage Data (operational, strictly necessary)Article 6(1)(b) — Performance of a contractNecessary to deliver the Service
Usage Data (analytics — Amplitude, GTM)Article 6(1)(a) — Consent (via Usercentrics) + § 25(1) TDDDGWithdrawable at any time
Technical DataArticle 6(1)(f) — Legitimate interestsSystem security, troubleshooting, performance monitoring
Financial DataArticle 6(1)(b) — Contract; Article 6(1)(c) — Legal obligationPayment processing; statutory retention requirements
Communication DataArticle 6(1)(b) — Contract; Article 6(1)(a) — Consent (marketing)Support based on contract; marketing requires opt-in consent
Third-Party Platform DataArticle 6(1)(a) — Consent; Article 6(1)(b) — ContractDepends on platform integration context
VR Spatial / Movement DataArticle 6(1)(b) — ContractRequired to deliver the core VR experience
Biometric / Eye-Tracking DataArticle 9(2)(a) — Explicit consentSeparate opt-in consent required; withdrawal available at any time
Voice Data (stored)Article 9(2)(a) — Explicit consentOnly stored where user has consented to specific features
Location Data (precise)Article 6(1)(a) — ConsentOnly collected with explicit opt-in
Location Data (coarse / IP-derived)Article 6(1)(f) — Legitimate interestsUsed for geo-blocking compliance and region-specific content
Cookies and similar technologies (non-essential)Article 6(1)(a) — Consent + § 25(1) TDDDGWithdrawable at any time
Cookies and similar technologies (strictly necessary)Article 6(1)(f) — Legitimate interests + § 25(2) TDDDGNo consent required
Marketing CommunicationsArticle 6(1)(a) — ConsentOpt-in required; withdrawal available at any time
Cross-Context Behavioural Advertising (Meta Pixel, Google Ads, TikTok Pixel)Article 6(1)(a) — Consent + § 25(1) TDDDGJoint controllership with Meta and TikTok (see Section 8.6); withdrawable at any time

Where we rely on legitimate interests (Article 6(1)(f)), we have carried out a balancing test to confirm that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests at any time (see Section 9).

Where we rely on consent as the lawful basis, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent does not affect processing carried out on other lawful bases.

6. Special Category Data (Biometric and Sensitive Data)

Certain VR-specific data we collect — in particular eye-tracking and gaze data, and stored voice recordings — may constitute biometric data or special category data within the meaning of GDPR Article 4(14) and Article 9. We take the following approach to such data:

  • Explicit consent required: Before activating any feature that involves the collection or processing of biometric or special category data, we will request your explicit, freely given, specific, informed, and unambiguous consent via a clearly presented opt-in mechanism. This consent is separate from acceptance of the general Terms of Service or Privacy Policy.
  • Right to withdraw: You may withdraw your consent to biometric data processing at any time through your account settings or by contacting us. Withdrawal does not affect processing that took place before withdrawal.
  • Data minimisation: We collect only the minimum biometric data necessary for the specific feature you have consented to. We do not use biometric data for purposes beyond those stated at the time of consent.
  • No third-party sale or sharing: We do not sell or share biometric or special category data with third parties, except with service providers acting strictly on our instructions under a data processing agreement and where legally permitted.

Spatial tracking data (headset and controller position) and general head/hand movement data not constituting biometric data are processed under Article 6(1)(b) as necessary for delivery of the VR experience.

7. Cookies and Tracking Technologies

We may use cookies or similar tracking technologies on our website and within the Service to support functionality, analyze usage, and personalize your experience. For EU/EEA/UK users, non-essential cookies (including analytics and marketing cookies) will only be placed on your device with your prior, freely given consent, in accordance with the ePrivacy Directive and applicable national implementing legislation.

You can manage your cookie preferences at any time through the cookie preference centre available on our website or through your browser settings. For full details on the types of cookies we use, their purpose, and how to manage them, please refer to our separate Cookie Policy available at https://www.l1ve.com/cookies.

We engage in cross-context behavioural advertising (via the Meta Pixel, Google Ads, and TikTok Pixel) only after you have given your explicit opt-in consent through Usercentrics. For California residents, we will honour Global Privacy Control (GPC) signals as an opt-out of the sharing of personal information for cross-context behavioural advertising.

8. How We Share Your Information

We do not sell your personal information for monetary consideration. We share certain personal information with advertising partners for cross-context behavioural advertising as described in Section 8.1.1 and Section 8.6, and otherwise share information only in the circumstances set out below:

8.1 Service Providers (Processors)

We engage third-party companies and individuals to facilitate our Service (e.g., payment processors, cloud hosting services such as AWS, analytics providers, content delivery networks). These service providers act as data processors and have access to your personal information only to perform tasks on our behalf. They are contractually obligated not to disclose or use it for any other purpose and must process data in accordance with our instructions and applicable law, including under GDPR-compliant Data Processing Agreements (DPAs) where required.

A list of our current sub-processors and service providers is available upon written request to info@l1ve.com. We will notify you of material changes to our sub-processor list in accordance with our sub-processor notification procedure described in the Privacy Policy.

8.1.1 Principal Processors and Tracking Technologies

The table below identifies our principal processors and tracking technologies, their purpose, country of processing, the legal basis under GDPR, and whether consent is required under the ePrivacy Directive and § 25 TDDDG (Germany). A full list of sub-processors is available on request.

SCROLL TO SEE ALL COLUMNS →

ProviderPurposeCountryLegal basis (GDPR)Consent required (§ 25 TDDDG)
Amazon Web Services (AWS) — Amazon Web Services EMEA SARL / Amazon Web Services, Inc.Cloud hosting and storage for the ServiceEU (primary), USA (failover)Art. 6(1)(b) (contract) and Art. 6(1)(f) (legitimate interest in providing the Service)No (strictly necessary)
Google Tag Manager (server-side, at tracking.l1ve.com) — Google Ireland Ltd. / Google LLCFirst-party server-side tag management for the Webshop. The container itself loads strictly under Consent Mode v2; consented tags are then routed to the providers listed below.EU / USAArt. 6(1)(a) (consent) for non-essential tags; Art. 6(1)(f) for the strictly-necessary container infrastructureYes, for non-essential tags
Usercentrics — Usercentrics GmbHConsent Management Platform: capture, storage, and proof of consentEU (Germany)Art. 6(1)(c) (legal obligation to obtain and document consent)No (strictly necessary)
Stripe Payments Europe Ltd. (EU users) / Stripe, Inc.Payment processing (Stripe Elements integrated in the Webshop checkout) and fraud preventionIreland (EU) / USA (DPF-certified)Art. 6(1)(b) (contract) and Art. 6(1)(c) (legal obligation, tax/accounting)No (strictly necessary for the payment transaction)
Amplitude, Inc. — Web SDK and VR Application SDKProduct analytics: feature usage, retention, conversion, funnel analysis (across Webshop and VR application)USA (DPF-certified)Art. 6(1)(a) (consent) + § 25(1) TDDDGYes (in both Webshop and VR application)
Google Analytics 4 — Google Ireland Ltd. / Google LLCWeb analytics on the Webshop. IP anonymization enabled; data retention set to 14 months; Google Consent Mode v2 active.EU / USA (DPF-certified)Art. 6(1)(a) (consent) + § 25(1) TDDDGYes
Google Ads — Google Ireland Ltd. / Google LLCConversion tracking and remarketing for advertising campaignsEU / USA (DPF-certified)Art. 6(1)(a) (consent) + § 25(1) TDDDG. Controller-Controller Data Protection Terms with Google in place.Yes
Meta Pixel — Meta Platforms Ireland Ltd. (EU users) / Meta Platforms, Inc.Conversion tracking and audience building for advertising on Meta platforms (Facebook, Instagram). Joint Controllership with Meta under Art. 26 GDPR for Pixel data collection (see Section 8.6).Ireland (EU) / USAArt. 6(1)(a) (consent) + § 25(1) TDDDGYes
TikTok Pixel and Events API — TikTok Information Technologies UK Ltd. (EU/UK users) / TikTok Inc.Conversion tracking and audience building for advertising on TikTok. Joint Controllership with TikTok under Art. 26 GDPR for Pixel data collection (see Section 8.6).UK / Ireland / USA / SingaporeArt. 6(1)(a) (consent) + § 25(1) TDDDGYes
HubSpot, Inc. / HubSpot Ireland Ltd. — CRM, Marketing Hub, Website Tracking CodeCRM (contact management, customer support), marketing email (with separate double-opt-in consent), website tracking (lead identification on the Webshop)EU / USA (DPF-certified)Art. 6(1)(b) (CRM, customer-initiated communications); Art. 6(1)(a) (marketing email, website tracking)Yes (for the HubSpot website tracking code and marketing email; no for purely transactional CRM use)
hisplayer — HISPlayer S.L.Video streaming player and delivery optimization within the L1VE VR applicationEUArt. 6(1)(b) (contract)No (strictly necessary for content delivery)
Meta Platforms, Inc. / Meta Platforms Ireland Ltd. (platform integration)Account linking and in-app purchase processing via Meta Quest (when introduced), platform analyticsUSA / EUArt. 6(1)(b) (contract)n/a (platform-level)
Apple Inc. / Apple Distribution International Ltd. (platform integration)Account linking and in-app purchase processing via App Store / Vision Pro (when introduced)EU / USAArt. 6(1)(b) (contract)n/a (platform-level)

L1VE operates Google Tag Manager in a server-side configuration at the first-party subdomain tracking.l1ve.com. This means that tracking requests are first received by L1VE’s own infrastructure and then forwarded to the relevant providers above, in line with the consent you have given through Usercentrics. The server-side setup reduces direct browser-to-third-party data transfers and gives L1VE additional control over the data passed to advertising and analytics partners.

Non-essential cookies and similar technologies are only set after you have given consent through our Usercentrics consent banner. You can withdraw or change your consent at any time through the “Cookie settings” link in our Webshop footer or through the Usercentrics privacy settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

8.1.2 Tracking in the VR Application

The L1VE VR application embeds the Amplitude SDK for product analytics. Although the VR application is not a website in the traditional sense, accessing and storing information on a user’s VR headset falls within the scope of § 25 TDDDG and the ePrivacy Directive. Accordingly, Amplitude SDK initialization in the VR application is conditional on the user’s prior consent, which is collected through an in-app consent prompt on first launch. Consent can be withdrawn at any time through the VR application’s privacy settings.

8.2 Legal Requirements

We may disclose your information if required to do so by applicable law, or in response to valid, legally compelled requests by public authorities (e.g., a court order or government agency). Where legally permitted, we will notify you of such a request before disclosing your data.

8.3 Business Transfers

In connection with any merger, sale of company assets, financing, or acquisition of all or a portion of L1VE’s business by another company, your information may be transferred. Where such a transfer materially affects your privacy rights, we will notify you in advance and, where required by applicable law, obtain your consent.

8.4 With Your Consent

We may share your information with third parties for other purposes with your explicit consent. You may withdraw that consent at any time.

8.5 Aggregate and Anonymised Data

We may share aggregated or anonymised information — which cannot reasonably be used to identify you — with third parties for research, analysis, and service improvement purposes without restriction.

8.6 Joint Controllers (Meta Pixel, TikTok Pixel)

For the Meta Pixel and the TikTok Pixel, L1VE Inc. and the respective advertising platform act as Joint Controllers within the meaning of Article 26 GDPR for the data collection that takes place via the Pixel on the L1VE Webshop.

Essential aspects of the joint controller arrangement:

  • L1VE Inc. determines the placement of the Pixel on the Webshop, the events that trigger Pixel calls (e.g., page view, booking confirmation), and the parameters transmitted. L1VE Inc. is the primary point of contact for data subjects in respect of the data collection.
  • Meta Platforms Ireland Ltd. / TikTok Information Technologies UK Ltd. further process the data received via the Pixel for the optimisation and measurement of advertising delivered to their respective users. The further processing is governed by Meta’s and TikTok’s own privacy policies.

The full joint controller arrangements are documented in:

  • Meta: “Controller Addendum” / “Joint Controller Addendum”, available at https://www.facebook.com/legal/controller_addendum;
  • TikTok: “Jurisdiction-Specific Terms” for EU/EEA/UK advertisers.

Data subjects may exercise their data protection rights against either joint controller. L1VE Inc. will forward requests it cannot fulfil unilaterally to Meta or TikTok as appropriate.

For Google Ads, Google operates under a Controller-Controller relationship (not joint controllership) under Google’s “EU User Consent Policy” and the Google Ads Data Protection Terms. For Google Analytics 4, Google acts as our processor under the Google Analytics Data Processing Terms.

9. Your Rights

9.1 Rights Under GDPR / UK GDPR (EU/EEA/UK Users)

If you are located in the EU, EEA, or UK, you have the following rights under the GDPR (or UK GDPR) with respect to your personal data:

  • Right of Access (Article 15): You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data and supplementary information about how it is processed.
  • Right to Rectification (Article 16): You have the right to request that we correct inaccurate or incomplete personal data.
  • Right to Erasure / Right to be Forgotten (Article 17): You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other lawful basis applies), where you have objected and we have no overriding legitimate interests, or where the data has been unlawfully processed. Note: erasure requests may affect the UGC licence granted under our Terms of Service; please refer to Section 3.3 of the Terms for details.
  • Right to Restriction of Processing (Article 18): You have the right to request that we restrict the processing of your personal data under certain conditions (e.g., while the accuracy of the data is contested).
  • Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where technically feasible.
  • Right to Object (Article 21): You have the right to object at any time to processing of your personal data based on our legitimate interests (Article 6(1)(f)). We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of prior processing.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or place of the alleged infringement. For users in Berlin, the competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), https://www.datenschutz-berlin.de. For users in other German states or other EU/EEA member states, the competent state or national data protection authority applies.

9.2 Rights Under CCPA/CPRA (California Residents)

To the extent that L1VE Inc. meets the applicable thresholds under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have the following rights:

  • Right to Know: The right to know what personal information we collect, use, disclose, and share. We do not sell personal information for monetary consideration; we do share certain information with advertising partners for cross-context behavioural advertising as described in Section 8.1.1.
  • Right to Access: The right to request a copy of the personal information we hold about you.
  • Right to Delete: The right to request deletion of personal information we have collected from you, subject to certain exceptions.
  • Right to Correct: The right to request correction of inaccurate personal information.
  • Right to Opt-Out of Sale or Sharing: We do not sell personal information for monetary consideration. We do share personal information with advertising partners (Meta, Google, TikTok) for cross-context behavioural advertising. California residents may opt out of such sharing at any time through the “Do Not Sell or Share My Personal Information” link in our Webshop footer, by adjusting their cookie preferences in the Usercentrics consent banner, or by sending a request to info@l1ve.com. We honour Global Privacy Control (GPC) signals as a valid opt-out request.
  • Right to Limit Use of Sensitive Personal Information: The right to limit our use of your sensitive personal information to purposes permitted by the CPRA.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

We will honour Global Privacy Control (GPC) signals as an opt-out of sale or sharing of personal information where required. To exercise your California privacy rights, please contact us at info@l1ve.com.

9.3 How to Exercise Your Rights

To exercise any of your rights described in this Section, please contact us at: info@l1ve.com (subject line: “Privacy Rights Request”). EU/EEA/UK users may alternatively contact our EU representative, L1VE Germany GmbH, at the address in Section 2.2.

We may need to verify your identity before processing your request to ensure the security of your data. We are committed to responding to your requests within 30 days (or such other period as required by applicable law). We do not condition deletion on any reason and we do not discriminate against users exercising their privacy rights.

10. Data Retention

We retain personal data only for as long as necessary to provide the Service, fulfil the purposes outlined in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention periods vary depending on the type of data and the purpose for which it was collected:

  • Account Information: Retained for the lifetime of the user account. Upon account deletion request, account data will be deleted or anonymised within 30 days, except where we are required to retain it by law.
  • Usage Data (analytics in Amplitude): Retained for up to 14 months in Amplitude, after which it is aggregated or anonymised.
  • Financial Transaction Records: Stored for the legally required retention periods (10 years in Germany under § 257 HGB and § 147 AO; equivalent periods apply in other jurisdictions, typically 6–10 years) to comply with tax, accounting, and financial reporting obligations.
  • Biometric / Special Category Data: Retained only for as long as necessary for the specific feature for which consent was given. Deleted promptly upon withdrawal of consent, unless legal retention is required.
  • Communication Data: Support correspondence retained for up to 3 years from the date of last contact.
  • Technical / Log Data: Operational logs retained for up to 30 days; security-related logs retained for up to 12 months, unless a longer period is required for an active investigation.
  • Consent Records (Usercentrics): Retained for 3 years from the last consent action, as proof of consent under Art. 7(1) GDPR.

When personal data is no longer required, it is securely deleted or anonymised in a manner that prevents reconstruction. You may request deletion of your personal data at any time as described in Section 9.

11. Data Security

We implement robust technical and organisational measures designed to protect your personal information from unauthorised access, alteration, disclosure, or destruction. These measures include data encryption in transit and at rest, secure servers, role-based access controls, regular security assessments, and incident response procedures.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

Data Breach Notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (GDPR Article 33). Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay (GDPR Article 34).

12. International Data Transfers

L1VE Inc. is based in the United States. As our Service utilises cloud infrastructure including AWS, your personal information may be transferred to, stored, and processed in countries outside your country of residence, including the United States, where data protection laws may differ from those in your jurisdiction.

For EU / EEA / UK Users — Transfer Safeguards

For transfers of personal data from the EU/EEA or UK to countries not deemed adequate by the European Commission (or UK authorities), we rely on the following legal transfer mechanisms to ensure your data remains protected:

  • The EU–US Data Privacy Framework (DPF) where the recipient is DPF-certified (this applies, for example, to AWS Inc. and Amplitude, Inc.); the UK Extension to the DPF and the Swiss–US DPF are applied for users in the UK and Switzerland respectively;
  • Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) for transfers from the EU/EEA where DPF is not available; and equivalent International Data Transfer Agreements (IDTAs) for transfers from the UK;
  • Where required by applicable guidance (including from the European Data Protection Board), we supplement SCCs with appropriate technical and organisational supplementary measures, informed by transfer impact assessments.

By using the Service, you acknowledge that your data may be transferred internationally as described above. You may request a copy of the applicable transfer safeguards by contacting us at info@l1ve.com.

13. Age Restriction (18+) and Protection of Minors

The L1VE Service is intended exclusively for adults aged 18 and older. During registration, users are required to confirm by checkbox that they are at least 18 years of age. L1VE does not knowingly collect or process personal data of persons under 18.

13.1 Adults-Only Service

L1VE Inc. does not direct the Service to minors. The 18+ age restriction is enforced at registration through a mandatory self-declaration checkbox and the date-of-birth field. L1VE Inc. reserves the right to suspend or terminate any account where there are reasonable grounds to believe that the user is under 18.

13.2 Discovery of Under-18 Users

If we become aware that we have collected personal data from a person under 18, we will terminate the relevant account and delete the associated personal data without undue delay, subject to legal retention obligations (e.g., financial records under § 257 HGB and § 147 AO in Germany, and equivalent obligations elsewhere).

If you are a parent or legal guardian and become aware that a person under 18 in your care has registered for or used the Service, please contact us at info@l1ve.com so that we can take appropriate action.

13.3 No Advertising or Profiling Directed at Minors

We do not engage in advertising directed at minors and we do not engage in profiling of minors. Where we discover personal data of an under-18 user prior to deletion, we apply strict data minimization and do not use that data for any purpose other than identification and deletion.

13.4 Age Verification Measures

L1VE relies on self-declaration at registration as the primary age verification measure. L1VE may implement additional verification measures (e.g., ID verification, payment-method verification, or third-party age assurance services) where lawful, proportionate, and required to comply with local law or platform policy.

13.5 COPPA Statement (US Users)

Consistent with the Children’s Online Privacy Protection Act (COPPA), L1VE Inc. does not direct the Service to children under 13, does not knowingly collect personal information from children under 13, and operates an adults-only (18+) service. Any data inadvertently collected from a child under 13 will be deleted promptly upon discovery, subject to legal retention obligations.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

For material changes — in particular, changes that affect the purposes for which we process your personal data, the legal bases we rely on, or your rights — we will notify registered users by email and/or prominent in-app notification at least 30 days before the changes take effect. Where a material change requires a new lawful basis (including renewed consent), we will obtain that consent before implementing the change.

For non-material updates (e.g., clarifications, contact detail changes), we will update the “Last Updated” date at the top of this Policy. Your continued use of the Service after any changes indicates your acceptance of the updated Policy. We encourage you to review this Policy periodically.

15. Contact Us

For any questions, concerns, or complaints regarding this Privacy Policy, or to exercise your data protection rights, please contact us using the details below.

L1VE Inc. — Data Controller. 26 Broadway FL 3, New York, NY 10004, United States of America. info@l1ve.com

L1VE Germany GmbH — EU Representative (GDPR Art. 27). Sophienstr. 32, 10178 Berlin, Germany. HRB 265312 B │ VAT: DE368641657. info@l1ve.com

EU/EEA/UK data subjects may direct data protection queries to L1VE Germany GmbH as the GDPR Article 27 representative. You also have the right to lodge a complaint with your local supervisory authority at any time.

© L1VE Inc. 2026 | All Rights Reserved

26 Broadway FL 3, New York, NY 10004, USA | info@l1ve.com | www.l1ve.com