Privacy Policy

Who we are

MyLOL ("MyLOL", "we", "us") is operated by [LEGAL ENTITY NAME], a company registered in [JURISDICTION OF INCORPORATION] under company number [COMPANY NUMBER], with its registered address at [REGISTERED ADDRESS].

For the purposes of the UK GDPR, the EU GDPR and equivalent laws where they apply, [LEGAL ENTITY NAME] is the controller of the personal information described in this policy.

Data Protection Officer: [DPO IF APPLICABLE]. EU representative (Article 27): [EU REPRESENTATIVE IF REQUIRED]. UK representative: [UK REPRESENTATIVE IF REQUIRED].

Age eligibility

MyLOL operates two separate communities. Which one a person may join — and whether they may join at all — depends on their age and their country.

• Under 13

  MyLOL does not knowingly permit accounts for children under 13 in any country. See Section 17.

• Teen MyLOL

  Intended for eligible members generally ages 13–17, subject to country-specific minimum ages and consent requirements.

• Adult MyLOL

  Members 18 and over, in countries where MyLOL offers the Service.

• Country-specific eligibility

  Minimum ages, parental-consent ages and age-assurance requirements differ by country. Some countries set a minimum age for social media accounts higher than 13. MyLOL does not apply a single worldwide minimum age.

• If someone is ineligible

  Registration is refused, or an existing account is restricted or removed. Information collected during a refused registration is handled as described in Sections 5, 13 and 17.

Age and identity assurance

This section is deliberately detailed. Age assurance can involve facial analysis and identity documents, and we do not think that belongs in a footnote. Only the methods MyLOL actually uses may remain in the published version — every row below must be confirmed or removed.

Depending on the member's country, age band and the risk signals attached to a sign-up, verification may be performed by a specialist vendor, [AGE ASSURANCE PROVIDER], acting as [PROCESSOR / INDEPENDENT CONTROLLER — CONFIRM]. Where a vendor performs the check, MyLOL may receive only a result rather than the underlying material. The table records that distinction for each data type.

For teen members: In plain terms: when you sign up we need to be confident about your age. A specialist company may check a selfie or a document. We are telling you exactly what they keep and what we see, because you should know that before you hand over your face.

MyLOL does not publish the circumstances that trigger each check, because doing so would assist circumvention. That non-disclosure concerns triggering logic only — the categories of data processed are set out in full above.

How we use information

AI and automated systems

Automated systems help us operate at scale. Where a decision could significantly affect a member, a person is involved.

Decisions with a significant effect — for example permanent account removal, or refusal of eligibility — are made or confirmed by a trained person, and members are given a route to appeal. Where a decision is made solely by automated means and produces legal or similarly significant effects, the rights under UK/EU GDPR Article 22 apply and members may request human review.

• Image moderation

  Uploaded images are analysed for prohibited content — including nudity, sexual content and content involving minors — using [AI MODERATION PROVIDER]. Matches are blocked or queued for human review.

• Text moderation

  Posts, profile fields and messages are analysed for prohibited content and risk patterns such as sexual solicitation, grooming behaviour, threats, scams and off-platform migration pressure.

• Fraud and risk detection

  Signals from devices, sessions and behaviour are used to detect fake accounts, ban evasion and automated abuse.

• Age assurance

  Automated age estimation may be used as described in Section 5, with human review and an appeal route where a result is contested.

• Recommendations

  [CONFIRM whether any recommendation or ranking system operates, and whether teen accounts are excluded from profiling-based recommendation]

Parent and guardian rights

Where the law gives a parent or guardian rights over a child's personal information, we will honour them. Depending on the country and the age of the member, those rights may include being informed about processing, accessing certain information, requesting correction, requesting deletion, and withdrawing a consent previously given.

Exercising these rights requires verification of both the requester's identity and their relationship to the member. We may decline or limit a request where doing so is necessary to protect the member — for example where disclosure could expose a young person to harm — or where the member's own rights, or the privacy of third parties in a conversation, would be affected.

MyLOL does not offer a parental dashboard, does not provide access to a member's private messages on request, and does not permit a parent to control another person's account settings remotely. A parent may always raise a safety concern with us at [SAFETY EMAIL].

Selling and targeted advertising

MyLOL's business model is subscription-based rather than advertising-first. Whether MyLOL "sells" or "shares" personal information as those terms are defined under US state privacy laws, and whether any targeted advertising or cross-context behavioural advertising occurs, must be determined against actual data flows and vendor contracts. [CONFIRM BEFORE PUBLISHING]

No claim that MyLOL does not sell personal information, and no claim that MyLOL does not engage in targeted advertising, may be published until each has been verified operationally and legally. [CONFIRM BEFORE PUBLISHING]

Where a right to opt out of sale, sharing or targeted advertising applies, the mechanism will be described here and made available in account settings. [CONFIRM MECHANISM]

Data security

We use technical and organisational measures appropriate to the sensitivity of the information we hold. These include encryption of data in transit and at rest, access controls limiting personnel access to what their role requires, logging and monitoring of access to sensitive systems, staff training, vendor due diligence and an incident-response process. [CONFIRM each measure listed is actually in place; remove any that is not.]

No system is completely secure. We do not promise that personal information will never be accessed without authorisation. Where a breach occurs and notification is required, we will notify affected members and the relevant supervisory authority within the timeframes the law requires.

We do not publish details of our security architecture, monitoring thresholds or fraud-detection logic.

Your rights

Which rights you have depends on where you live. We will tell you which apply to you when you contact us, and we do not discriminate against members for exercising a right.

To exercise a right, contact [PRIVACY EMAIL]. We will verify your identity before acting. We respond within the timeframe the applicable law requires — [CONFIRM STANDARD RESPONSE TIME].

• Access

  Ask what personal information we hold about you and receive a copy.

• Correction

  Ask us to correct information that is inaccurate or incomplete.

• Deletion

  Ask us to delete your personal information, subject to the exceptions in Section 18.

• Portability

  Receive certain information in a portable format, or ask us to transmit it, where the right applies.

• Objection

  Object to processing based on legitimate interests, including profiling, where the right applies.

• Restriction

  Ask us to limit processing in certain circumstances.

• Withdraw consent

  Where processing is based on consent, withdraw it at any time. Withdrawal does not affect processing already carried out.

• Appeal

  Ask us to reconsider a decision on your request, where an appeal right applies in your jurisdiction.

• Complain to a regulator

  Lodge a complaint with your supervisory authority — for example the ICO in the UK, your Member State authority (such as the CNIL in France) in the EEA, the OPC in Canada, or the OAIC in Australia.

Children under 13

MyLOL is not directed to children under 13 and we do not knowingly permit them to register.

Where a registration attempt indicates the person is under 13, the registration is refused. Where we learn that an existing account belongs to a person under 13, we restrict the account and take steps to remove it. [CONFIRM the exact operational sequence, including what happens to information already collected during a refused registration, whether any record is retained to prevent immediate re-registration, and the timing of deletion. Do not state that information is deleted immediately unless that is both implemented and legally correct — a limited record may be required or permitted to prevent repeat attempts.]

A parent or guardian who believes a child under 13 has provided personal information to MyLOL should contact [PRIVACY EMAIL].

Law enforcement and legal requests

We disclose personal information to law enforcement, regulators or courts where we are legally required to do so, or where disclosure is otherwise permitted by law and necessary — for example to prevent or investigate serious harm.

We assess each request against applicable law and our own standards before responding, and we require valid legal process where the law requires it. In an emergency involving a risk of death or serious physical harm, we may disclose limited information without full legal process where the law permits.

Where we are legally obliged to report suspected child sexual exploitation, we do so through the appropriate reporting body and preserve relevant records. [ATTORNEY REVIEW REQUIRED — confirm the reporting body and obligations per jurisdiction.]

Where we are permitted to notify a member of a request, we may do so; where we are prohibited from notifying, we will not. [CONFIRM notification policy.]

Contact us

Privacy contact: [PRIVACY EMAIL]

Postal address: [REGISTERED ADDRESS]

Data Protection Officer: [DPO IF APPLICABLE]

EU representative: [EU REPRESENTATIVE IF REQUIRED]

UK representative: [UK REPRESENTATIVE IF REQUIRED]

Safety concerns: [SAFETY EMAIL] · Parent support: [PARENT SUPPORT EMAIL]

Jurisdictional legal-review checklist

Mentioning a law is not compliance with it. Each item below requires a determination by counsel qualified in that jurisdiction before MyLOL offers the Service there.