Privacy Policy

FimAGogo SAS, as the data controller, only collects data that is strictly necessary for the operation of the service. No unnecessary data is collected.

Data provided directly

Identity : first name, last name, email address, password (hashed and salted, never stored in plain text)

Payment : billing information

Preferences : language, playback quality, profile settings

Communications : messages sent to our support team, reviews, reports

Data collected automatically

Navigation Data : IP address, browser type, operating system, pages visited, session duration

Viewing Data : titles watched, playback duration, progress, selected quality, watch history

Technical Data : unique device identifier, authentication token, error logs

Cookies : see our Cookie Policy

Your data is used exclusively for the following purposes:

Purpose	Data Used	Legal Basis
Account management	Identity, email	Contract
Payment processing	Billing	Contract
Providing streaming service	Viewing, preferences	Contract
Personalized recommendations	Watch history	Legitimate interest
Service improvement	Navigation, errors	Legitimate interest
Security & anti-fraud	IP, sessions, activity	Legitimate interest
Newsletter dispatch	Email	Consent
Legal obligations	Per legal requisitions	Legal obligation

In accordance with the General Data Protection Regulation, each data processing operation relies on an explicit legal basis:

Performance of Contract (Art. 6.1.b) : processing necessary to provide the subscription service

Legitimate Interest (Art. 6.1.f) : service improvement, security, fraud prevention, recommendations

Consent (Art. 6.1.a) : newsletters, non-essential cookies, marketing communications

Legal Obligation (Art. 6.1.c) : retention of accounting data, response to judicial requisitions

You may withdraw your consent at any time for consent-based processing, without affecting the lawfulness of processing carried out prior to withdrawal.

Recipient	Data Shared	Role	Location
MONCASH	Payment data	Payment processor	Port-au-Prince, Haiti
AWS CloudFront	Technical logs	CDN & hosting	Multi-region EU
Judicial authorities	Upon legal requisition	Legal obligation	Applicable

In the event of a merger, acquisition, or asset sale, your data may be transferred to the new entity under the same protections. You will be notified in advance.

Your data is stored for the duration strictly necessary for the purposes for which it was collected, in accordance with applicable legal obligations.

Data Type	Retention Duration
Active account data	Duration of subscription + 1 year
Watch history	3 years after last viewing
Payment & billing data	10 years (accounting obligation)
Technical logs	Rolling 12 months
Customer support data	3 years after resolution
Deleted account data	30 days (permanent deletion)
Security & fraud data	5 years

Upon expiration of these periods, your data is securely and irreversibly deleted, or anonymized for statistical purposes.

In accordance with GDPR, you have the following rights regarding your personal data, which you may exercise at any time:

Right of Access (Art. 15) : obtain a copy of all personal data we hold about you

Right to Rectification (Art. 16) : correct inaccurate or incomplete data

Right to Erasure (Art. 17) : request the deletion of your data ('right to be forgotten')

Right to Restriction (Art. 18) : temporarily restrict the processing of your data

Right to Data Portability (Art. 20) : receive your data in a structured, machine-readable format

Right to Withdraw Consent : withdraw your consent at any time without justification

You are solely responsible for keeping your login credentials confidential.

TLS 1.3 encryption for all communications between your devices and our servers

Passwords hashed with bcrypt (cost factor 12), never stored in plain text

Internal data access restricted strictly on a need-to-know basis (least privilege principle)

Quarterly security audits conducted by certified independent third parties

Privacy Policy

Collected Data

Purposes of Processing

Legal Basis for Processing

Data Sharing

Data Retention Periods

Your GDPR Rights

Data Security