Privacy policy

Last updated: September 27, 2026

Who is responsible for your data

The data controller is The LoopHole Project, the publisher described in the legal notice. For any question about your data, or to exercise your rights, write to hello.loopholeproject@gmail.com.

What we collect

your email address, verified with a one-time code when you submit;
your videos (16:9 master and optional 9:16 version);
the Instagram, X and YouTube profiles and the tools you choose to share (optional);
your confirmation that you are 18 or older and your acceptance of the license and the rules;
your consent to receive emails about future challenges, if you tick that box;
your entry number, submission date and moderation status;
technical data needed to run and secure the service (IP address, browser information, server logs).

We do not use analytics or advertising trackers.

Why we use it and on what legal basis

Managing your participation (verifying your email, storing your entry, enforcing one entry per person): performance of the terms you accept when submitting.
Moderation (reviewing entries, rejecting them, banning abuse): our legitimate interest in keeping the challenge fair, safe and lawful.
Publication and credit (Community Film, Random Picks, Top 100, promotion, crediting you with the profiles you shared): performance of the license you grant in the terms.
Security (logs, abuse prevention, rate limits): our legitimate interest in protecting the service.
Transactional emails (verification code, confirmation, moderation outcome, announcement of the films you are part of): performance of the terms.
News about future challenges: your consent, which is optional, never pre-ticked, and can be withdrawn at any time.

Who receives it

Your data is only accessed by the The LoopHole Project team. We never sell it. It is processed on our behalf by trusted technical providers (hosting, storage and email services) acting only on our instructions. Their list is available on request.

Videos embedded from YouTube are served by Google in privacy-enhanced mode; Google may process data when you play them. If you choose to support the project on Ko-fi, Ko-fi processes that support under its own policy; we do not receive your payment details.

Your entry is only made public, with the credit you chose, once it has been approved and published as part of a film or selection.

Transfers outside the European Union

Some of these providers are based in the United States or may process data there. These transfers rely on the safeguards provided by the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

rejected entries and their videos: deleted automatically 30 days after rejection;
other entries: for the duration of the project and as long as the works they appear in remain published, unless you ask us to delete them earlier;
ban records: as long as necessary to enforce the ban;
consent to news emails: until you withdraw it;
technical logs: a few days at most, according to our providers' settings.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its processing, to receive it in a portable format, and withdraw your consent at any time. Write to hello.loopholeproject@gmail.com from the email address you used to submit, so we can confirm the request is yours. We answer within one month.

To delete your entry and data, send a request titled "Delete my data" to hello.loopholeproject@gmail.com. We remove your entry, your videos and your contact details. Works already included in published films or compilations may remain online, as described in the terms, but will not be used in new ones.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of the country where you live.

Cookies

We only use cookies that are strictly necessary for the service: a short-lived session cookie during email verification (closed as soon as your entry is saved) and the team's login. No consent is needed for them, and we use no tracking cookies.

Adults only

The service is for people aged 18 or older. We do not knowingly collect data from minors.