What data we process, why, with whom, for how long, and what you can require of us. Written from what the code actually does, not copied from a template.
Last updated : 26 October 2026 · version 2026-10-26 · The French version prevails
This is an English translation, provided for convenience. In case of any difference, the French version prevails. Read the French version
The data controller is DAR ASLI (trade name ASLI), a French simplified joint-stock company with a single shareholder (SASU). Its legal identifiers are given in the legal notice.
For any question about your data, write to donnees@asliugc.com. We reply within one month.
For everyone: email address, password (encrypted, never readable by us), role, account creation date, technical connection logs.
Creators: name, username, country, city, biography, profile photo, languages, topics, links to your social networks, videos you submit, ratings and reviews received, and your payment details (IBAN/bank details and, from 1 September 2027, CCP or BaridiMob for Algeria).
Brands: company name, sector, website, contact name, logo, published briefs, payment history and the customer identifier held by the payment provider.
Visitors and prospects: if you fill in a form on the home page (brand sign-up, waiting list) or ask to speak to a human, we keep your email address, your message and the fields you filled in. What the AI does with them is described in article 8 quater.
Reports and moderation: when you report someone, we keep the reason chosen, the context, your account of events if you give one, your identity as the author of the report, and the decision taken. When a video or a message is analysed automatically before publication, we keep the verdict and the categories detected, not the content analysed.
Linked TikTok and Instagram accounts (optional). If you are a creator, you can link your TikTok account or your Instagram professional account to ASLI. This proves that the account belongs to you and shows brands the size of your audience. When you connect, TikTok or Meta sends us, once only, the account’s technical identifier, its username, and its number of followers and published videos; for TikTok, whether it is verified by TikTok and its number of likes; for Instagram, the account type (creator or business), as well as the date and the number of likes and comments of your 25 latest posts. We do not read your messages, the content of your videos or your list of followers, and we do not post anything on your behalf. The authorisation is revoked (TikTok) or deleted (Instagram) immediately after this reading: we keep no access to your account. Brands only see “TikTok verified” or “Instagram verified” and a follower range (for example 10 k – 50 k), never your username, the exact figure or a link to the account (for a Talent’s offer, see “ASLI Talents” below). An account can be linked to only one ASLI profile. This data is kept for as long as the account stays linked: the “Remove” button on your profile, or closing your ASLI account, erases it, and you can also write to donnees@asliugc.com. Legal basis: your consent.
Linked YouTube channel (optional). You can also link your YouTube channel, with your Google account, read-only (permission “View your YouTube account”). Google sends us, once only, the channel identifier, its name or public handle, the number of subscribers (rounded by YouTube, or nothing if hidden), public videos and views, as well as the date, views, likes and comments of your 25 latest videos; the authorisation is revoked straight away. Brands see “YouTube verified” and a subscriber range. As YouTube’s rules require, this reading is deleted after 30 days unless you refresh it. By linking your channel, you agree to the YouTube Terms of Service; Google processes your data under its Privacy Policy, and you can remove access from your Google account security settings. ASLI’s use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.
ASLI Talents (optional). If you request Talent status, we use the reading of your linked accounts (platform, follower count and reading date) to check that you reach the threshold, and we keep what was read at the time of the request, with the team’s decision. If you are a Talent and your card is in the showcase (with your consent), the public /createurs page also shows the platform and a follower range: never your handle, a link or the exact number. From your latest posts, we compute four activity indicators (posts over 90 days, date of the latest, median views, median engagement): the team sees them to decide; a brand that has published a request to Talents sees, for your offer, your first name and last-name initial, and your followers and median views rounded. They are kept with the account reading and erased with it. For a mission, the Talent gives the link of their posts; we read the public figures of a YouTube video (views, likes, comments) on day 1, 7 and 30 and delete them 30 days after reading (YouTube rules). On TikTok and Instagram, the Talent declares their figures with a screenshot of their statistics, kept in a private space: only the mission’s brand, the Talent and the ASLI team see it, for the duration of the business relationship.
ASLI tracked links. For a Talent mission, the brand can create a short link (asliugc.com/l/…) that the Talent puts in their post. When someone opens it, we record the date, the site they come from (its domain name only), whether the visit comes from a bot or a link preview, and a fingerprint computed from the IP address, the browser and the day, made unreadable by a secret: neither the IP address nor the browser is kept, and the fingerprint changes every day. It is only used to count unique visitors per day and is erased after 30 days; the click remains counted. No cookie is set. Only the brand, the Talent and the ASLI team see the totals. Legal basis: our legitimate interest in measuring the mission for the brand and the Talent.
Creators’ tax residence. To pay a creator under French law, we ask for their country of tax residence, status, tax identification number, date of birth and address and, if they do not live in France, their residence certificate for the year. Legal basis: our legal obligations (withholding tax under article 182 B of the French tax code and its tax treaties; the annual reporting of platform sellers’ income known as “DAC7”). The tax number, date of birth and address are encrypted; the certificate is kept in a private storage area. Only the ASLI team can access them, and they are passed on only to the tax authorities when the law requires it. They are kept for the duration of our accounting and tax obligations (ten years for accounting records).
If you are a brand, you can link your company’s account to follow the statistics of the videos published in your campaigns. The authorisation is stored encrypted for as long as the account stays linked, and deleted when you disconnect it.
What we do not collect: no payment card data passes through our servers — it is entered directly with the payment provider. We do not ask for an identity document; a date of birth is requested only from creators we pay, for our tax obligations (previous paragraph).
A word of honesty about sensitive data. We never ask for it. But a report whose reason is “hateful or discriminatory remarks” or “sexual content” may, by its very nature, reveal some — about the person reported as well as the person reporting. We cannot prevent this without removing the very possibility of reporting. This data is processed on the basis of article 9(2)(f) GDPR (establishment, exercise or defence of legal claims), is accessible only to the person who adjudicates, and is erased according to the schedule in article 6.
Performance of the contract — creating and maintaining your account, publishing briefs, managing applications and deliveries, paying remuneration, issuing rights assignment contracts.
Legal obligation — keeping accounting and invoicing records (10 years), responding to a request from the judicial authorities.
Legitimate interest — platform security, prevention of fraud and multiple accounts, measuring service quality, and product improvement. We limit ourselves to what is necessary, and you may object (article 8). This also covers the linguistic improvement of the service — the text corpus described in article 8 quinquies, with its own right to object.
Consent — optional connection of your TikTok or Instagram accounts to prove that they belong to you and show brands your audience (creators) or follow the statistics of your campaign videos (brands), sending of non-transactional emails, and, for a creator, display of their public card on the site’s showcase (first name and initial, niches, languages, country, declared origin and, by a separate agreement, their presentation video) — never their full name, handle or social networks. It can be withdrawn at any time from the profile, with no effect on the rest of the service: the card disappears on the next page load.
Brands see creators’ public profile (name, username, country, bio, social networks, tier, ratings) and the videos submitted to their own campaigns. They never see your bank details: these live in a separate table that cannot be accessed from a brand account — a rule enforced by the database itself, not an interface promise.
Creators see published briefs, the identity of the brand publishing them, and the exchanges relating to their own applications.
The ASLI team accesses the data needed for support, dispute resolution and payouts.
Our processors and other recipients, listed in the next article. We do not sell or rent any data to third parties, and we do not pass any on to data brokers or advertising networks.
Our processors (article 28 GDPR). They process your data on our behalf, on our instructions, and for no other purpose.
Recipients that are controllers of their own processing. These companies receive some of your data to provide a service, but also use it for their own obligations or their own needs. They are answerable for it themselves, under their own privacy policy.
Transfers outside the European Union to our processors rely on the European Commission’s standard contractual clauses. Our database is hosted in Paris, in the European Union (AWS region eu-west-3); the videos are stored in the European Union (Cloudflare R2).
These periods are not merely declared: a daily routine applies them and actually erases the data. A report closed with no further action in 2026 no longer exists in 2027 — that is the difference between a retention policy and an intention.
To close your account (ASLI website or app): sign in, open My account, choose “I want to close my account”, type CLOTURER to confirm, then submit. If you can no longer access your account, write to donnees@asliugc.com from the account’s address and ask us to close it.
What is erased immediately on closure: your name, your username, your biography, your photo, your city, your social network links, your payment details, and your email address — including in the authentication system, which frees the address for future use.
What is kept, and why: invoices and payments (10 years, accounting obligation); assignment contracts still in force and the signatory’s name as fixed on the day of approval, because a brand is entitled to prove that it holds the rights to a video it broadcasts; approved videos, with no time limit — the assignment of copyright does not expire, which is the price of the legal certainty expected by the brand that paid. Closing your account erases the creator’s identity, not the videos they delivered nor the contract that covers them.
What remains without identifying you: aggregated statistics and technical traces that have been made anonymous.
Closure is refused while a commitment is in progress or while a sum remains owed in either direction. We then tell you what is blocking it, rather than failing silently.
You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to set out instructions regarding what happens to your data after your death.
Most of them can be exercised directly from your area: your profile can be edited, your data can be exported and your account can be closed from the account area. For anything else, write to donnees@asliugc.com.
One limit, and it deserves an explanation. Your right of access covers the reports that YOU have filed — they appear in your export. It does not cover those directed at you: disclosing their content to you would amount to identifying their author, which article 15(4) GDPR allows us to refuse where it would adversely affect the rights of a third party. If a decision concerns you, you receive the reason for it; on written request, we give you its substance, never the identity.
For the same reason, a person who is reported is not informed of the report itself (article 14(5)(b) GDPR). Without this reservation, reporting harassment would expose people to reprisals, and nobody would report any more — which would amount to protecting the person reported at the expense of everyone else.
If you are not satisfied with our reply, you may lodge a complaint with the CNIL — the French data protection authority (3 place de Fontenoy, 75007 Paris — cnil.fr).
Delivered videos and exchanged messages undergo automated analysis before publication, intended to filter out content that is manifestly contrary to our rules. In practice: a few frames are extracted from the video when it is sent and submitted to a classification model, and the text of messages is analysed in the same way.
We keep the verdict and the categories detected, not the frames nor a copy of the content analysed. Legal basis: our legitimate interest in not distributing unlawful content, and our obligations as a hosting provider.
This is not an automated decision within the meaning of article 22. No account is suspended by a machine. The worst an automated verdict can do is hold back a video until a person looks at it — and that person can publish it in one click if the verdict was unfounded — or refuse a message when it is sent: the message is then not delivered, and you can rephrase it immediately. Any sanction against an account is taken by a human, notified with its reason, and can be challenged.
Contact details in messaging. To enforce the non-circumvention commitment (Terms of Service, article 10 ter), phone numbers, email addresses, IBANs, card numbers and links to an external messaging service are automatically masked in messages, and the recipient sees “contact details masked”. When this happens, or when a message mentions an exchange or a payment outside the platform, an alert is sent to the team with only the passage concerned — nobody reads your conversations. Legal basis: our legitimate interest in preventing fraud and protecting creators’ payments. Alerts are kept for 12 months.
Purpose. When you apply as a creator, your application first goes through an automated analysis tool whose role is to prepare the human review: prioritise applications, flag what a person should check first, and prepare a draft reply in your language. It does not replace that review — it makes it faster.
Data used. Only what you provided in your application: name, country and city, biography, languages, niches, and the social network links supplied. The tool does not look at your videos or at the content of your accounts: it reads the application, nothing else. We keep the result of the analysis (score, recommendation, points noted) with your application; it is included in the export of your data (article 8).
No automatic rejection — a human always decides. The tool can neither accept nor reject an application: every decision, including every rejection, is taken by a person who has your application in front of them and who can entirely disregard the tool’s recommendation. It is therefore not a solely automated decision within the meaning of article 22 GDPR. Legal basis: our legitimate interest in examining every application seriously within a reasonable time. You can challenge a decision or ask for an explanation at donnees@asliugc.com.
What is sent, and what is not. To sort the requests we receive, we use Anthropic (Claude model, United States, article 5). The message and its context (the page language, the company name, the plan of interest, the content wanted, the website or account given) are sent to the AI provider; the email address is not, nor is your name as an individual. If you type an address yourself into a free-text field, it is masked before sending. The address is added back on our side, on our servers, when we write to the person: the AI does not need it to prepare a draft.
The brand form. When a brand fills in the sign-up form on the home page, an AI (Anthropic) receives the fields filled in — brand name, website or account given, plan of interest, content wanted, language — and, if it is a website, a short excerpt of public text from that site (title, description, top of the page) read by our servers; social networks are not consulted. It prepares for the team a preliminary analysis (likely sector, estimated size, needs, questions to ask) and a draft follow-up, presented as estimates to be checked. This analysis is not stored in our database: it appears in the internal email the team receives. Three days after the form is submitted, if the request has not been handled, the AI prepares overnight a draft follow-up based on the brand name, the plan of interest and the content wanted, stored with the request. Here again, nothing is sent until a person has reread it and decided to send it.
“Talk to a human”. If you ask to talk to a human from the assistant in your logged-in area, your message (300 characters at most), your latest questions to the assistant and your email address are recorded as a contact request, and kept in accordance with article 6. An AI (Anthropic) reads the message, those questions and the page language — not your email address — to classify the request (category, urgency), summarise it in one line and suggest a draft reply. This result is stored with the request and flagged to the team by email. Nothing is sent automatically and nothing is decided by the machine: a person reads the request and replies personally; the draft is only a suggestion they can ignore.
Legal basis for this sorting: our legitimate interest in replying seriously and within a reasonable time to the requests we receive. No decision producing an effect on you is taken by the AI: it is not a solely automated decision within the meaning of article 22 GDPR. How long Anthropic retains the exchanges is governed by its own terms and by the contract between us — not by us, so we do not promise a retention period on its behalf. You can request access to these items, their rectification or erasure, or object to this sorting, at donnees@asliugc.com.
Purpose. Checking that a video really is in the requested dialect — Algerian, Moroccan or Tunisian darija, Kabyle, Arabic — and improving the tools that do this check. To that end, DAR ASLI builds a corpus of texts used internally, by the team and by its language-checking tools.
Data concerned. The text of brands’ briefs (description and instructions — never the brand kit, the product link or contact details), and the transcript of what is said in the videos delivered by creators (the text, never the picture nor the voice). Before entering the corpus, every text goes through automatic masking of email addresses, phone numbers, IBANs, card numbers, links and account handles. The corpus holds no account name and no campaign or video identifier; only a technical link to the originating account is kept, so that your texts can be removed if you object.
Legal basis. Our legitimate interest in improving a service whose dialectal quality is its very reason for being (article 6.1.f GDPR), with a right to object at any time (article 21): with a checkbox in your account area (brands) or your profile (creators), or by email at donnees@asliugc.com. Objecting removes your texts from the corpus and prevents any new addition. It has no consequence on the service, campaigns, prices or remuneration.
Retention. As long as your account exists. At closure, the link between you and your texts is erased for good — an irreversible anonymisation — or, if you ask, the texts themselves are deleted.
No transfer to third parties. The corpus is neither published, sold nor passed on. It is stored in our database, hosted in Paris (European Union). When the team has a text checked by a language model, the masked text is submitted to Anthropic, a subprocessor listed in article 5, on our instructions and as data to be analysed — never as a dataset handed over.
We only use strictly necessary cookies: the session cookie, which keeps you logged in, and a language cookie that remembers your choice between French, Arabic and English. No advertising cookies, no third-party cookies.
We measure the site’s audience with Vercel Web Analytics, our hosting provider, already listed as a processor in article 5. This tool sets no cookies and writes nothing to your browser: each visit is linked to a fingerprint calculated from the request, which is discarded after 24 hours. What is recorded is the page viewed, the page you came from, the country, the type of device and the browser — never your IP address as such, never your name, never the content of what you do on the platform.
These measurements are used solely on ASLI’s behalf, are not cross-referenced with anything else, and do not allow you to be tracked from one site to another: they fall under audience measurement exempt from consent within the meaning of the CNIL’s recommendations. That is why there is no banner to click — the absence of a banner is not an oversight, it is the consequence.
Legal basis: our legitimate interest in knowing how much our site is visited (article 6(1)(f) GDPR). You may object at any time by writing to us, or by enabling the “Do Not Track” signal or a blocker in your browser — the site works exactly the same without it.
Exchanges are encrypted in transit. Access to data is partitioned at database level by row-level security rules: an account can only read what concerns it, even in the event of an application flaw. Social network access tokens are encrypted at rest. Videos are stored in a private space, accessible only through a temporary signed link.
In the event of a data breach likely to result in a risk to your rights, we notify the CNIL within 72 hours and inform you directly when the risk is high.
The platform is reserved for persons who are adults under the law of their country of residence: 18 in most of the countries where ASLI operates, 19 in Algeria, 19 in Canada. Article 3 of the Terms of Service sets out the rule and the reason — a creator who is a minor under their personal law cannot validly assign their rights.
If a minor appears in a video, the creator must hold the written authorisation of their legal representatives.
Any substantial change to this policy — a new purpose, a new processor, a longer retention period — is announced by email before it takes effect. The date at the top of the page indicates the current version.