PRIVACY POLICY

Last updated: 4 November 2026 · Version 2026-11-04

This policy explains how Friends of MJ handles personal data when you visit the platform, create an account, follow a club, publish or interact with content, attend an event, donate, shop, or contact us. We process data under the GDPR and applicable local data-protection and cookie rules. Acknowledging this policy confirms you have been shown it; it is not blanket consent to every use of your data.

Personal data we use

• Account and contact data: name, email address, password credential, verification status, profile image and account preferences.
• Profile and community data: city, country, fan-club or ambassador profile details, public contact details, links, images, stories, events, news, follows, saved events, attendance and event responses.
• Account activity and security data: sign-in sessions, IP address and browser or device user-agent information, plus security and moderation records.
• Referral and rewards data: referral link visits and attribution, referral relationships, commissions, payout requests, Humanity Coins and reward activity.
• Purchase and support data: orders, ticket or donation records, amounts, refunds, payment status and provider identifiers, along with messages or requests sent to the team.
• Content you submit: text, images, event details and other material you choose to upload. Please do not include sensitive personal information or information about another person unless you have a clear reason and permission.

Why we use it and our legal grounds

• Provide accounts and platform features such as profiles, follows, saved events, event responses and member benefits — to perform our contract with you or take steps you request before entering it.
• Review and publish community content, protect the service, prevent fraud and administer referrals — for our legitimate interests in running a safe community and attributing referrals, balanced against your rights and expectations.
• Process payments, donations, orders, refunds and accounting records — to perform the relevant transaction and meet legal obligations.
• Send essential account and transaction messages — to perform our contract and protect account security. Optional newsletters or promotional messages are sent on the basis required by local law; you can opt out at any time.
• Use non-essential cookies or similar technologies only where required after obtaining your permission. Essential sign-in and security storage is used to provide a service you request.

Public profiles and moderation

Information you submit for a public club or ambassador profile, event, news item or story may be visible to anyone, including people who do not have an account. Do not submit personal details you do not want published. Submitted content may be checked with AI-assisted moderation supplied through OpenRouter; an administrator reviews publication decisions. The AI does not make decisions with legal or similarly significant effects about you.

Who receives data

We disclose only what is needed to provide the service to our hosting and database providers, email delivery provider when configured, Stripe for payments, OpenRouter for AI moderation or image generation, and service providers that help operate the platform. YouTube videos may be embedded using YouTube’s privacy-enhanced domain. Public content is visible to visitors. We may also disclose data where required by law or to establish, exercise or defend legal claims. Card details are entered with Stripe and are not stored in the Friends of MJ database.

International processing

Some service providers may process data outside the European Economic Area. Before launch, the controller must list the providers and relevant countries, and confirm the applicable transfer mechanism and safeguards, such as an adequacy decision or Standard Contractual Clauses. Contact us for the current transfer information.

Cookies and local storage

The platform uses authentication cookies to keep you signed in. Referral links can also set a first-party, HTTP-only referral cookie so a visit can be attributed if you register later; its lifetime is set by the platform and defaults to 30 days. The platform may store your shopping cart or form progress in your browser. Browser settings let you remove cookies and local storage, though sign-in and saved progress may then stop working. We do not describe a cookie as “essential” merely because it is useful: the operator must confirm whether referral tracking requires opt-in under the rules that apply to the visitor and implement a consent control where required.

How long we keep data

We keep account and profile data while the account is active and for a limited period needed to handle closure, disputes and platform security. Session records expire. Public content may remain where it has been shared or must be retained for a legal claim; we will remove or anonymise it when appropriate. Transaction and accounting records are kept for the retention period required by applicable law. Referral, moderation, security and support records are kept only as long as needed for their stated purpose. The controller must set and document exact retention periods for each category before launch.

Your GDPR rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction or portability; object to processing based on legitimate interests; and withdraw consent where processing relies on consent. You can update some profile and email preferences in account settings. To exercise other rights, use the privacy contact above. We may need to verify your identity. We normally respond within one month; where the law allows an extension, we will explain why. You may complain to the data-protection authority where you live, work, or believe an infringement occurred. If Adventure of Humanity is the controller, its published contact is info@adventureofhumanity.com, Villa Oxygene, 137 Av. des Cactus, 06220 Vallauris, France; confirm this is the correct controller contact before relying on it.

Children

The platform is not designed to collect children’s personal data without appropriate authorisation. If you believe a child has provided personal data inappropriately, contact the controller so it can review and take appropriate action.

Changes and contact

We will update the version and date when this policy changes. If a change requires fresh consent under applicable law, we will ask for it separately. For privacy questions or requests, contact the controller using the verified details shown at the top of this policy.