Privacy Policy

Effective Date: October 2, 2026

2.1 Who We Are

APOTHEOSIS SNC, operating the Website submitlife.com, is the data controller for personal data processed in connection with the Service. Country: Belgium.

Contact: info@submitlife.com

2.2 Scope of This Policy

This Privacy Policy describes how we collect, use, share, and protect personal data when you visit the Website or use the Service. It applies in addition to the Terms of Service.

2.3 Personal Data We Collect

We collect personal data in the following categories:

2.3.1 Data You Provide Directly

• Account registration: email address, password (hashed), chosen pseudonym, age confirmation, country of residence;
• Assessment responses: answers to the entry questionnaire, including identity orientation, BDSM experience level, motivations, daily commitment, and life context;
• Profile data: preferences, language, communication settings;
• Lady verification for profiles requesting public visibility: legal first and last name, date of birth, phone number, residential address and a copy of an identity document. These details remain private, are never displayed on the public profile and are used only for identity, adult-age and compliance verification;
• Communication: emails you send to us, support requests, feedback;
• User-submitted content: journal entries, reports, testimonials.

2.3.2 Data Collected Automatically

• Technical data: IP address, browser type, device type, operating system, language, referring URL;
• Usage data: pages visited, time spent, features used, click patterns, completion of challenges;
• Cookies and similar technologies (see Cookie Policy).

2.3.3 Data from Third Parties

• Payment data: the provider shown at checkout processes the information required for payment. New payments are being prepared for Pay4Coins after merchant activation; historical data may relate to earlier Stripe payments. We do not receive or store the full card number;
• Authentication data: if you sign in through a third-party identity provider, the information that provider shares with us according to its own terms;
• Digital ID age verification (when enabled): SubmitLife requests only an age-over-18 attestation, without requesting full name, street address, portrait, document number, or full date of birth, and marks the identity attributes as not intended for retention. Sandbox/test verification never grants access to restricted adult content.

2.4 Sensitive Data

Some of the data you may provide (e.g., responses concerning your sexuality, gender identity, or sexual practices) constitutes "special categories of personal data" under Article 9 of the GDPR.

We process such data only on the basis of your explicit consent, given at the time of registration and assessment. You may withdraw this consent at any time by deleting your account or by writing to info@submitlife.com.

2.5 Why We Process Your Data — Legal Bases

We process personal data on the following legal bases:

Purpose	Legal Basis
Providing the Service	Performance of contract
Payment processing and access purchases	Performance of contract
Account security and fraud prevention	Legitimate interest
Sending transactional emails	Performance of contract
Sending marketing emails	Consent (opt-in)
Personalization based on assessment	Explicit consent
Compliance with legal obligations	Legal obligation
Improving the Service	Legitimate interest

2.6 With Whom We Share Your Data

We share personal data only with the following categories of recipients, each bound by appropriate confidentiality and security obligations:

• Pay4Coins / CIPA Media S.L.U. — intended provider for new payments after merchant activation;
• Stripe Inc. — former payment provider, limited to historical data linked to earlier payments;
• Resend Inc. — transactional and marketing email delivery (United States, with appropriate safeguards);
• Lovable — website hosting and infrastructure (European Union);
• Supabase Inc. — database and authentication services (United States, with appropriate safeguards);
• Cloudflare Inc. — content delivery and security (worldwide);
• Legal and tax advisors — when strictly necessary for compliance;
• Public authorities — when required by valid legal request.

We do not sell your personal data. We do not share your data with advertisers.

2.7 International Transfers

Some of our service providers are located outside the European Economic Area, including in the United States. For these transfers, we rely on:

• Standard Contractual Clauses approved by the European Commission;
• Where applicable, the EU-US Data Privacy Framework certification of the recipient;
• Additional safeguards including encryption and access controls.

2.8 How Long We Keep Your Data

• Account data: for the duration of your account, plus thirty (30) days after deletion to handle final operational matters;
• Lady identity-verification data and documents: only for as long as needed for verification, the contractual relationship and applicable legal or compliance obligations, then deleted;
• Payment data: ten (10) years, as required by Belgian accounting law;
• Communication logs: three (3) years;
• Backup copies: up to ninety (90) days after deletion of primary data;
• Anonymized analytical data: indefinitely.

2.9 Your Rights Under GDPR

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Right of access: obtain a copy of your data;
• Right to rectification: correct inaccurate data;
• Right to erasure ("right to be forgotten"): request deletion;
• Right to restriction: limit how we process your data;
• Right to data portability: receive your data in a structured format;
• Right to object: oppose certain processing;
• Right to withdraw consent: at any time, for processing based on consent;
• Right to lodge a complaint: with your national data protection authority. For Belgium, this is the Autorité de protection des données (APD), Rue de la Presse 35, 1000 Brussels.

To exercise these rights, write to info@submitlife.com. We will respond within thirty (30) days. We may request additional information to verify your identity before processing requests involving sensitive data.

2.10 Account Deletion

You may delete your account at any time from your account settings or by writing to info@submitlife.com. Upon deletion:

• Your personal profile data is erased within thirty (30) days;
• Your user-submitted content (journals, reports) is anonymized or deleted at your choice;
• Your payment history is retained for the legally required period (see Section 2.8);
• You lose access to any digital products previously purchased.

2.11 Security Measures

We implement technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS) and at rest;
• Hashing of passwords using industry-standard algorithms;
• Access controls and role-based permissions;
• Regular security reviews;
• Incident response procedures.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with GDPR Article 33 and 34.

2.12 Children's Privacy

The Service is strictly for adults aged 18 or older. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will delete it without delay. If you believe a minor has provided us with personal data, please contact us at info@submitlife.com.

2.13 Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be notified to active users by email or through a prominent Website notice.

2.14 Contact

For any privacy-related question, contact: info@submitlife.com

---