1) Who this applies to

• Viewers (browse, top up, unlock/tip)
• Creators (upload content, set prices, receive payouts)
• Visitors (public pages, support)

Hypha is 18+ only. By creating an account, you confirm you are at least 18 years old (or the age of legal capacity in your country, if higher).

2) Who is the controller

• Controller: Hypha Technologies Ltd is the data controller for all personal data processed in connection with the Service (including optional paid add-ons such as Hypha Extras).
• We do not currently act as a processor on behalf of creators.
• ICO Registration: Hypha Technologies Ltd is registered with the UK Information Commissioner’s Office (ICO) under registration number ZC029469. You can verify our registration at ico.org.uk.

3) What we collect (categories of data)

• Account & profile: email, hashed password, display name, profile/channel info, avatar/brand assets.
• Usage & device: IP address, device/OS/browser, language, timestamps, session IDs, page/video views, playback events, error logs.
• Transactions & payouts: top-ups and Hypha Points activity, receipts, payout requests/status.
• Payments & KYC: handled by our authorized payment and payout providers. We do not store full card numbers or identity documents; we receive status and limited metadata needed for payouts, reconciliation, fraud prevention, and compliance.
• Content & communications: videos, thumbnails, titles, descriptions, and messages you send us (support, abuse reports).
• Sources of data: primarily from you and your devices. We also receive data from our providers (e.g., payment status/KYC state), and from other users where necessary for abuse reports or rights claims.

4) Please avoid special-category data

Do not include special-category data (e.g., health, race, political views, religious beliefs, biometrics, sex life/sexual orientation) in uploads or messages. If you publish such information in public areas (e.g., titles, descriptions, profiles), you make it manifestly public. We will remove it from Hypha on request where feasible, but we cannot control copies others have made.

5) Why we use your data & legal bases (UK/EU GDPR)

6) Cookies & similar technologies

We use cookies and similar technologies as described in our Cookie Policy.

• Strictly necessary cookies for sign-in and core functionality.
• Preference/functionality cookies (e.g., language, UI settings) where needed.
• Analytics: We run first-party, self-hosted analytics with no cookies, no device identifiers, and only aggregate, non-identifying metrics. If we later introduce analytics that uses cookies or device identifiers, we will request your consent first via a banner and update this Policy.

You can block cookies in your browser; note that blocking essential cookies may prevent sign-in or purchases.

7) International transfers

We store and process personal data in the UK and EU only. Routine data flows may occur between the UK and EEA. We currently host the Service on dedicated servers at OVHcloud in UK/EU data centres.

We do not currently transfer personal data to countries outside the UK/EU. If this changes, we will implement appropriate safeguards and update this Policy. Safeguards may include:

• EU Standard Contractual Clauses (SCCs)
• UK International Data Transfer Agreement (IDTA) / UK Addendum
• Supplementary technical and organisational measures and transfer risk assessments

8) Who we share data with (recipients)

We share personal data only as needed to run the Service and meet legal duties:

• Hosting & infrastructure: the Service is hosted and served from our own infrastructure located in UK/EU data centres, operated by Hypha for content delivery.
• Payment & payout providers: authorized providers that process top-ups, refunds/chargebacks, and Creator payouts. For those activities, such providers act as independent controllers under their own privacy notices.
• Email & support tools: for ticketing and service communications.
• Analytics: our own self-hosted platform for aggregated, cookieless usage metrics.
• Law enforcement, regulators, and rights-holders: where required by law or to handle legal claims.

9) Public information you disclose

• Your display name and channel/profile are visible when you publish.
• If you post personal data in public areas, others may copy/share it; removing it from Hypha won't remove third-party copies.
• Reports/flags you submit are used for investigations and may be shared as needed with affected parties and authorities.

10) Security

We apply appropriate technical and organisational measures, including:

• TLS/HTTPS for all connections
• Encryption at rest for stored data
• Role-based access & least-privilege admin controls
• Logging/monitoring and regular patching

No online service is perfectly secure. Keep your credentials confidential and contact support@hypha.tv if you suspect unauthorised access.

11) Retention periods

• Account data: while your account is active; if you delete your account, we delete or anonymise within 30–90 days, subject to legal holds.
• Transactions, invoices & tax records: 7 years (accounting/tax).
• Access logs: up to 12 months (some security logs up to 24 months).
• Support messages: up to 24 months.
• Backups: rolling backups typically 30–90 days.
• Content: until you retire/remove it or we remove it under our Terms; technical copies may persist temporarily in backups/caches/logs. We may anonymise and retain aggregate metrics indefinitely.

12) Your rights (UK/EU)

You may have the right to access, rectify, erase, restrict, object, and data portability, and to withdraw consent where processing relies on consent. You can object to processing based on our legitimate interests (including related processing for security/abuse prevention); we will honour your objection unless we have compelling legitimate grounds or the processing is required by law.

13) Payments & payouts

Payments and Creator onboarding/payouts are handled by authorized third-party payment and payout providers. We do not store full payment card details or identity documents. We receive: transaction status/metadata, limited reconciliation data, and KYC verification state for payout eligibility. For payments/KYC/payouts, these providers act as independent controllers under their own privacy notices.

14) Automated decision-making & profiling

We use automated systems for video fingerprinting (duplicate detection), daily upload limits, and rate limiting to protect platform integrity. These do not produce legal or similarly significant effects. If this affects you, contact support@hypha.tv for human review.

15) Data-breach notification

If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where required, notify the relevant supervisory authority within 72 hours.

16) Children

Hypha is for users 18+. We do not knowingly collect data from minors. If we learn an account is under 18, we'll suspend it and delete/anonymise personal data within 30 days, except where we must retain certain records by law. We require age self-certification at sign-up and may implement additional age-assurance measures where required by law or for platform integrity. Contact support@hypha.tv if you believe a minor has an account.

17) International users

By using Hypha, you acknowledge your data may be processed in the UK/EU and, where needed to provide the Service, in other countries under the safeguards described in §7.

18) Changes to this Policy

We may update this Policy. For material changes, we'll give at least 30 days' notice by email and/or in-product, unless changes are required by law or necessary for security/safety or to fix obvious errors (those may be immediate). The effective date appears at the top. We keep prior versions for reference. Continued use after the effective date means you accept the update.