Privacy Policy
How MyLOL collects, uses, shares and retains personal information across our teen and adult communities — including age and identity assurance, moderation, subscriptions and your privacy rights.
The plain-English version
This summary is for orientation only. The full policy below governs.
- Who we are
- What we collect
- What you give us (account, profile, photos, posts, messages, reports, payment details, verification information) and what we collect automatically (device, IP, session, security logs, usage).
- Why
- To run the service, confirm you are eligible for the community you joined, keep teen and adult communities separate, moderate content, prevent fraud, take payment, support you and meet legal obligations.
- Age and identity checks
- We use age assurance at sign-up. Depending on country and risk, that may involve a vendor performing a facial age estimation, a liveness check or a document check. Which specific data we receive and keep is set out in its own section — we have not buried it.
- Advertising
- Selling data
- Sharing
- We use service providers (hosting, email, payments, verification, moderation, analytics) who process data for us. We disclose to authorities where legally required.
- Your rights
- Depending on where you live: access, correction, deletion, portability, objection, restriction, withdrawal of consent, appeal, and complaint to a regulator.
- Contact
If you're a teen member, here's the short version
Same rules, written the way we'd actually say them.
- Adults on MyLOL can't see you, find you or message you. Teen MyLOL and Adult MyLOL are separate.
- Your profile isn't on Google. It's visible inside the teen community, to the people you allow.
- We don't sit and read your private messages. Automated systems look for danger signs — grooming, threats, scams — and a person checks what gets flagged or reported.
- We don't track where you are. We know your country because eligibility depends on it, and we can tell roughly where a login came from for security. That's it.
- When you sign up we check your age. That might mean a face scan or an ID check through a specialist company. What they keep, and for how long, is in the age assurance section — ask us if it's unclear.
- If something on MyLOL scares or upsets you, report it. Reporting never gets you in trouble.
See also our Safety page, the Community Guidelines and MyLOL for Parents.
Who we are
Scope
It does not apply to third-party sites or apps a member chooses to visit, including links posted by other members, or to the independent practices of the vendors named in Section 12 where they act as controllers in their own right.
Age eligibility
MyLOL operates two separate communities. Which one a person may join — and whether they may join at all — depends on their age and their country.
Under 13
MyLOL does not knowingly permit accounts for children under 13 in any country. See Section 17.
Teen MyLOL
Intended for eligible members generally ages 13–17, subject to country-specific minimum ages and consent requirements.
Adult MyLOL
Members 18 and over, in countries where MyLOL offers the Service.
Country-specific eligibility
Minimum ages, parental-consent ages and age-assurance requirements differ by country. Some countries set a minimum age for social media accounts higher than 13. MyLOL does not apply a single worldwide minimum age.
If someone is ineligible
Registration is refused, or an existing account is restricted or removed. Information collected during a refused registration is handled as described in Sections 5, 13 and 17.
Information you provide
Categories of personal information members give us directly.
| Category | Examples | Notes |
|---|---|---|
| Account information | Email address, password (stored hashed), username, date of birth, country of residence, community (teen or adult) | Required to create an account |
| Profile information | Display name, bio, interests, profile theme, profile music selection, Top Friends, friends list | Member-controlled; teen profiles may not contain contact or identifying details |
| Photos and media | Profile photos, album photos, any images or video uploaded | Subject to moderation (Section 8) |
| Posts and content | Blog posts, guestbook entries, group posts, comments, reactions | |
| Messages | One-to-one and group message content, attachments, timestamps, participants | See Sections 6, 8 and 13 |
| Interests and groups | Groups joined, interests selected, activity within groups | |
| Support communications | Emails and support tickets, their contents and attachments | |
| Reports | Reports you submit about others, and reports submitted about you, including any evidence attached | Reporter identity is not disclosed to the reported member |
| Verification information | See Section 5 — set out separately because of its sensitivity |
Age and identity assurance
This section is deliberately detailed. Age assurance can involve facial analysis and identity documents, and we do not think that belongs in a footnote. Only the methods MyLOL actually uses may remain in the published version — every row below must be confirmed or removed.
| Data type | Collected by | Purpose | Processed where | What MyLOL receives | Retention | Who can access | Deletion |
|---|
For teen members: In plain terms: when you sign up we need to be confident about your age. A specialist company may check a selfie or a document. We are telling you exactly what they keep and what we see, because you should know that before you hand over your face.
MyLOL does not publish the circumstances that trigger each check, because doing so would assist circumvention. That non-disclosure concerns triggering logic only — the categories of data processed are set out in full above.
Information collected automatically
Collected when you use the Service, whether or not you are logged in.
| Category | Examples |
|---|---|
| Network information | IP address (which indicates approximate region — see note below), connection metadata |
| Device and browser | Device type, operating system, browser type and version, language, screen characteristics |
| Security logs | Failed login attempts, suspected automation, rate-limit and abuse-prevention events |
| Cookies and similar identifiers | See Section 18 and the Cookie Policy |
| Approximate region | Derived from IP address and/or the country of residence you provide |
| Referral information | Referring URL, campaign parameters where present |
Important accuracy point: MyLOL does not use precise or GPS location, and does not offer location-based discovery for teen members. That is not the same as collecting no location information at all — an IP address indicates an approximate region, and we use it for security, fraud prevention and eligibility purposes.
How we use information
| Purpose | What this involves | Main categories used |
|---|---|---|
| Provide the Service | Create and maintain your account, display your profile, deliver messages, run groups and feeds | Account, profile, content, messages |
| Authenticate you | Log you in, keep sessions secure, detect account takeover | Account, session, device, security logs |
| Verify eligibility | Confirm age and country eligibility and place you in the correct community | Account, verification (Section 5) |
| Keep communities separated | Enforce that teen and adult accounts cannot discover, view, search or contact each other | Account, community flag |
| Moderation | Review content and behaviour against the Community Guidelines, act on reports | Content, messages, media, reports, moderation records |
| Safety | Detect grooming, sexual solicitation, exploitation, threats, harassment and other harms; escalate serious cases | Content, messages, reports, risk signals |
| Prevent fraud and abuse | Detect fake accounts, ban evasion, scams, spam and automation | Device, session, security logs, verification outcome |
| Process subscriptions | Take payment, manage renewals, cancellations and refunds | Payment and subscription information |
| Customer support | Answer questions, investigate issues, handle appeals | Support communications, account, relevant records |
| Analytics and improvement | Understand usage, fix failures, improve the product | Usage analytics, device |
| Legal compliance | Meet legal obligations, respond to lawful requests, keep required records, establish or defend legal claims | Any category, as necessary and proportionate |
Legal bases (UK/EU/EEA)
Where the UK GDPR or EU GDPR applies, we rely on a lawful basis for each purpose. Consent is not a catch-all and is not used where another basis is more appropriate. The mapping below is proposed and must be confirmed.
| Purpose | Proposed lawful basis | Status |
|---|
AI and automated systems
Automated systems help us operate at scale. Where a decision could significantly affect a member, a person is involved.
Decisions with a significant effect — for example permanent account removal, or refusal of eligibility — are made or confirmed by a trained person, and members are given a route to appeal. Where a decision is made solely by automated means and produces legal or similarly significant effects, the rights under UK/EU GDPR Article 22 apply and members may request human review.
Image moderation
Text moderation
Posts, profile fields and messages are analysed for prohibited content and risk patterns such as sexual solicitation, grooming behaviour, threats, scams and off-platform migration pressure.
Fraud and risk detection
Signals from devices, sessions and behaviour are used to detect fake accounts, ban evasion and automated abuse.
Age assurance
Automated age estimation may be used as described in Section 5, with human review and an appeal route where a result is contested.
Recommendations
Teen member data
Teen MyLOL is designed to a higher privacy standard than the adult community. This section describes those differences.
No teen/adult crossover
Teen accounts and adult accounts cannot discover, search, view, message or share groups with each other. Teen personal information is not made available to adult community members through the product.
Search-engine indexing
Location
No precise location collection, no location-based discovery, no distance sorting and no live location sharing for teen members. Approximate region derived from IP is used for security and eligibility only.
Profiling and advertising
Privacy defaults
Data minimisation
Contact details, school names and other identifying information are not permitted in teen profile fields and are removed when detected.
Parental involvement
Where a country requires verifiable parental consent, that is obtained through a separate process. Payment by a parent is not treated as parental consent.
For teen members: Short version: adults can't reach you, you're not on Google, we don't track where you are, and we keep as little about you as we can while still running the service.
Parent and guardian rights
Where the law gives a parent or guardian rights over a child's personal information, we will honour them. Depending on the country and the age of the member, those rights may include being informed about processing, accessing certain information, requesting correction, requesting deletion, and withdrawing a consent previously given.
Exercising these rights requires verification of both the requester's identity and their relationship to the member. We may decline or limit a request where doing so is necessary to protect the member — for example where disclosure could expose a young person to harm — or where the member's own rights, or the privacy of third parties in a conversation, would be affected.
Selling and targeted advertising
Data retention
We keep personal information only as long as necessary for the purposes described in this policy, or as required by law. No period below has been invented — each must be supplied and justified.
| Category | Retention period | Rationale |
|---|
Data security
No system is completely secure. We do not promise that personal information will never be accessed without authorisation. Where a breach occurs and notification is required, we will notify affected members and the relevant supervisory authority within the timeframes the law requires.
We do not publish details of our security architecture, monitoring thresholds or fraud-detection logic.
International transfers
Your rights
Which rights you have depends on where you live. We will tell you which apply to you when you contact us, and we do not discriminate against members for exercising a right.
Access
Ask what personal information we hold about you and receive a copy.
Correction
Ask us to correct information that is inaccurate or incomplete.
Deletion
Ask us to delete your personal information, subject to the exceptions in Section 18.
Portability
Receive certain information in a portable format, or ask us to transmit it, where the right applies.
Objection
Object to processing based on legitimate interests, including profiling, where the right applies.
Restriction
Ask us to limit processing in certain circumstances.
Withdraw consent
Where processing is based on consent, withdraw it at any time. Withdrawal does not affect processing already carried out.
Appeal
Ask us to reconsider a decision on your request, where an appeal right applies in your jurisdiction.
Complain to a regulator
Lodge a complaint with your supervisory authority — for example the ICO in the UK, your Member State authority (such as the CNIL in France) in the EEA, the OPC in Canada, or the OAIC in Australia.
Account deletion
Where information is retained, it is limited to what is necessary for that specific purpose, and is deleted or anonymised at the end of the applicable retention period in Section 14.
Children under 13
MyLOL is not directed to children under 13 and we do not knowingly permit them to register.
Law enforcement and legal requests
We disclose personal information to law enforcement, regulators or courts where we are legally required to do so, or where disclosure is otherwise permitted by law and necessary — for example to prevent or investigate serious harm.
We assess each request against applicable law and our own standards before responding, and we require valid legal process where the law requires it. In an emergency involving a risk of death or serious physical harm, we may disclose limited information without full legal process where the law permits.
Changes to this policy
We update this policy when our practices or the law change. The effective date appears at the top.
Contact us
Vendor information checklist
MyLOL must complete one row per vendor before this policy can be published. A vendor cannot be described in the policy until every column is answered.
Columns required for every vendor
- Vendor / placeholder
- Service
- Personal data received
- Processor or controller
- Processing locations
- Transfer mechanism
- Retention by vendor
- Sub-processors
- DPA signed
- Security certifications
Jurisdictional legal-review checklist
Mentioning a law is not compliance with it. Each item below requires a determination by counsel qualified in that jurisdiction before MyLOL offers the Service there.
United States
- — COPPA and current FTC amendments — including the treatment of information collected from attempted under-13 registrations, verifiable parental consent methods, retention limits and the safe-harbour landscape.
- — State comprehensive privacy laws in each state of operation — notice content, opt-out rights, sensitive-data rules, and any prohibition on targeted advertising or sale involving known minors.
- — Biometric privacy laws (including Illinois BIPA, Texas CUBI, Washington My Health My Data) — written notice, written release, published retention schedule, and whether any element of age assurance falls in scope.
- — State age-appropriate design and youth online safety laws, and their current litigation status.
- — Subscription/auto-renewal requirements (including federal negative-option rules and state ARLs) — disclosure, consent and cancellation mechanics.
United Kingdom
- — UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act — confirm which changes are in force and their effect on this policy.
- — ICO Age Appropriate Design Code (Children's Code) — a documented conformance assessment covering defaults, profiling, geolocation, transparency for children and DPIA.
- — PECR — cookies and electronic marketing.
- — Online Safety Act interfaces where they affect privacy, including age assurance duties and any Ofcom guidance applicable to the Service.
- — ICO position on age assurance and biometric age estimation.
EU / EEA
- — GDPR — lawful bases, Article 9 conditions for any biometric processing, Article 8 child consent age per Member State and the mechanics of verifying parental authorisation.
- — DSA obligations where applicable — statements of reasons, internal complaint handling, minor-protection provisions and the prohibition on advertising based on profiling of minors.
- — ePrivacy / national cookie rules.
- — EDPB guidance relevant to children's data and age assurance.
France
- — CNIL guidance on minors' data and consent.
- — French requirements applicable to users under 15, including parental authorisation.
- — Any French-specific age-verification requirements applicable to the Service.
Canada
- — PIPEDA and applicable provincial privacy laws (including Quebec Law 25 requirements on consent, defaults and privacy impact assessments).
- — Current OPC guidance on age assurance and children's privacy.
- — Breach reporting obligations.
Australia
- — Privacy Act obligations as applicable to the Service, including any Children's Online Privacy Code developments.
- — Online Safety Act and social-media minimum-age requirements affecting certain under-16 accounts — including whether MyLOL may offer Teen MyLOL in Australia at all, and to which ages.
- — eSafety Commissioner expectations and any applicable industry codes.
All other markets
Privacy questions
Write to us and we will tell you which rights apply where you live, and how to use them.
Use the reporting and help options inside MyLOL — reports and requests go to our team from there.