Privacy Policy

Version 2026-05-05 — Daway (Collective 1X3, New Mexico, USA). Contact: contact@daway.club.

1. Data Controller

Daway, operated by Collective 1X3, State of New Mexico (USA). Daway is a US company; it applies the GDPR (Regulation (EU) 2016/679) to Users covered by it and provides equivalent safeguards to other Users. Email: contact@daway.club.

2. Data Collected

Identity (name, email, username, avatar, date of birth); contact details and external identifiers (social media); payment data (via Stripe and, where applicable, other payment providers — no card data is stored by Daway); community and subscription data; affiliate and commission data; credits, rewards and entries; email marketing data; browsing and analytics data (IP address, user-agent, pages, sessions, country/region geolocation); A/B experiment data.

3. Purposes of Processing

Account management, service delivery, payment processing, affiliate tracking, consented email marketing, improvement analytics, legal compliance, fraud prevention and detection, product improvement, and defense against disputes and chargebacks (collection of evidence of use: timestamps, encrypted IP, user-agent, lesson events, watch time, legal acceptances with versions).

4. Legal Bases

4.1 Performance of contract (Art. 6(1)(b)): account, service, payments. 4.2 Consent (Art. 6(1)(a)): email marketing, analytics cookies, A/B experiments. 4.3 Legitimate interest (Art. 6(1)(f)): security, fraud prevention, defense against chargebacks. 4.4 Legal obligation (Art. 6(1)(c)): accounting, tax.

5. Recipients

Payment providers (Stripe and, where applicable, others — receive the evidence file upon dispute); Resend (email delivery); Mux (video hosting); PostHog (analytics, after consent). The application and the database (PostgreSQL), including real-time messaging, are hosted on private/dedicated servers that we administer, with their infrastructure providers acting as processors; we do not use a consumer cloud host (such as Vercel or AWS) for the production application. Daway does not sell, rent or trade your data. All providers act as processors or recipients governed by contract.

6. International Transfers

Data may be processed in the United States and other countries. Safeguards: Standard Contractual Clauses (Art. 46 GDPR) or an equivalent mechanism where applicable, encryption in transit (TLS 1.2+) and at rest.

7. Retention Periods

Account: duration of activity + 3 years. Payment: 10 years (accounting). Browsing/analytics: 13 months. Application: 2 years. Cookies: 13 months. Email marketing: subscription duration + 3 years. Affiliate: duration + 5 years. Lesson events (defense): 18 months. Encrypted evidence file: 24 months. Anonymised aggregates: 5 years. Legal acceptances: 10 years.

8. Your Rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), portability (Art. 20), objection (Art. 21), restriction (Art. 18), withdrawal of consent at any time. Users under other regimes (for example California residents) have equivalent rights (access, deletion, objection to "sale" — which we do not perform). Exercise at contact@daway.club — reply within 30 days.

9. Security

Encryption at rest and in transit (TLS 1.2+), access control, OTP authentication (no passwords stored), regular audits, incident response plan.

10. Data Breach

In the event of a breach presenting a risk, notification to the competent authorities (within 72h where the GDPR applies) and notice to affected persons in case of high risk.

11. Complaint

To the data protection authority of your country of residence (for example the CNIL in France) or any competent authority.

12. Changes

Any substantial change is notified by email or in-app banner before it takes effect.

13. Contact

contact@daway.club — reply within 30 days.