Last updated: 6 September 2026 · Version 1.0
1. Introduction & Controller
This Privacy Policy explains how MIVALDI SAS ("MIVALDI", "we", "us"), 8 Avenue Montaigne, 75008 Paris, France, processes personal data when you use the MIVALDI platform — the landing site, the Agency Master Hub, model portfolio sites, subdomains and related services (the "Service"). We act as data controller for account and billing data and as data processor on behalf of agencies and talent for portfolio content (see our Data Processing Agreement).
For questions or to exercise your rights, contact our Data Protection Officer at dpo@mivaldi.com or privacy@mivaldi.com.
2. Data We Process
- Account data: name, email address, agency affiliation, role, username and password hash.
- Profile & portfolio content: photographs, videos, measurements, biographies, booking details and contact information you choose to publish.
- Billing data: invoice details, payment references. Full card data is processed exclusively by our PCI-DSS-compliant payment providers and never touches our servers.
- Usage & device data: IP address, browser type, device class, referring pages and timestamps, processed in aggregated or pseudonymized form for security and analytics.
- Correspondence: support and booking-request messages.
3. Legal Bases (GDPR Art. 6)
- Performance of a contract (Art. 6(1)(b)): providing your portfolio, billing, support, and tenant management.
- Consent (Art. 6(1)(a)): publication of imagery (including model releases), and any optional cookies or newsletters. Consent may be withdrawn at any time.
- Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, service analytics and product improvement, balanced against your rights.
- Legal obligation (Art. 6(1)(c)): tax and accounting retention, and responses to lawful requests.
4. Purposes of Processing
We process personal data to: deliver and render portfolio websites; optimize and transform media (resizing, WebP/AVIF conversion); provision subdomains and TLS certificates; generate comp cards and invoices; authenticate users and protect the platform; respond to support and booking requests; and comply with law.
5. Edge Delivery & International Transfers
To deliver media at sub-50ms worldwide, portfolio content is replicated to edge cache nodes operated by our subprocessors. Transfers outside the EEA occur only (a) to countries with an EU adequacy decision, or (b) under the EU Standard Contractual Clauses with supplementary measures where required. A list of subprocessors and their locations is maintained in Annex 2 of our Data Processing Agreement.
6. Retention
- Account data: for the life of the account plus 12 months after termination.
- Portfolio content: deleted within 30 days of account termination (see Terms §10).
- Invoices and billing records: 10 years (French tax law).
- Security logs: 6 months; aggregated analytics: 26 months.
7. Your Rights (GDPR Art. 15–22)
You have the right to access, rectify, erase, and port your data; to restrict or object to processing; and to withdraw consent at any time. We do not use automated decision-making with legal or similarly significant effects. To exercise any right, email privacy@mivaldi.com — we respond within 30 days and may verify your identity. You may also lodge a complaint with a supervisory authority, in particular the CNIL (cnil.fr) in France.
8. Security
We implement technical and organisational measures appropriate to the risk: TLS 1.2+ in transit, encryption at rest, hashed passwords (bcrypt), role-based access control, tenant isolation, audit logging, rate limiting, and continuous monitoring. See Annex 3 of the Data Processing Agreement for details.
9. Cookies & Local Storage
We use only strictly necessary storage: a session token for authentication and localStorage preferences (language, theme). We do not use tracking or advertising cookies. Embedded media from YouTube or Vimeo may set their own cookies subject to their policies.
10. Children
The Service is intended for users aged 16 and over. Where portfolio imagery depicts minors, valid parental consent and, where required by law, age-verification documentation must be held by the account holder and provided to us on request.
11. Subprocessors
We engage carefully vetted processors, including hosting providers, CDN/edge networks, payment processors, email providers and analytics tools. Each is bound by a data processing agreement providing at least the protections of this Policy and of our DPA. Contact dpo@mivaldi.com for the current list.
12. Changes & Contact
We may update this Policy to reflect legal or technical changes; material changes are announced by email and on the Platform 14 days in advance. Contact: MIVALDI SAS, 8 Avenue Montaigne, 75008 Paris, France — privacy@mivaldi.com · dpo@mivaldi.com.