Last update 11/2/2026

Ulule Privacy Policy

When you browse Ulule ("the Site") and use the Services offered on it, personal data about you is collected and processed by our teams.

The purpose of this data protection policy is to inform you of the essentials you need to know about how your personal data is processed in order to operate the Ulule service.

1. Who is the data controller?

The data controller is the person who determines the purposes and means of processing, i.e. the objective of the processing and the way it is carried out.

1.1. Ulule SAS: data controller for the use of the Site and the Services offered on it

Ulule SAS, a French simplified joint-stock company (société par actions simplifiée) with a share capital of 293,478 euros, registered with the Paris Trade and Companies Register under number 794 710 830, with its registered office at 10 rue de Penthièvre, 75008 Paris, France, publishes the Site.

In this context, we collect and process your personal data as data controller when you browse the Site and use the Services offered on it.

1.2. Ulule SAS and Creators: joint controllers for the management of your Contributions to Campaigns

The personal data about you that is collected to carry out the Contributions you make to Campaigns hosted on the Ulule Site is processed jointly by Ulule SAS, the company operating the Site, and by each Creator to whom you pay funds through your Contribution.

2. Why do we process your data and on what legal basis?

Under the applicable regulations, any processing of personal data must, in order to be lawful, be based on one of the legal bases set out in Article 6 of the GDPR, or in Article 9(2) of the GDPR where so-called sensitive data is concerned.

The table below sets out the various purposes for which we may process your data and the legal bases on which each of these purposes relies.

Payments made directly on the Ulule site are collected by our payment service providers (MANGOPAY and STRIPE), which are authorised by the French Prudential Supervision and Resolution Authority (Autorité de Contrôle Prudentiel et de Résolution, ACPR). MANGOPAY and STRIPE carry out processing of personal data for which they are responsible, as described in MANGOPAY's privacy policy and in Stripe's privacy policy.

Under their legal obligations to combat fraud, money laundering and terrorist financing, Ulule and MANGOPAY carry out processing, including combinations of data, to help their staff determine the level of fraud risk associated with a payment or a Campaign. This processing may be used to justify a decision by Ulule, MANGOPAY or STRIPE to refuse a payment.

Use of artificial intelligence tools

Review of Campaign proposals. When you propose a Campaign, our team relies on an artificial intelligence tool. It analyses the content of your proposal, your history on Ulule and public information about the project and the people behind it (press articles, websites, social media), against our moderation and eligibility rules. The tool proposes a response, with a reason: acceptance, where applicable with points requiring attention, or refusal. When the tool proposes to accept your proposal, it is accepted automatically. When it proposes to refuse it, nothing is decided automatically: your proposal is reviewed by a member of our team, who decides to confirm the refusal, to amend it or to accept your proposal. If further information is useful for the review of your Campaign after it has been accepted, any subsequent decision is taken by a member of our team. This processing is based on Ulule's legitimate interest in moderating the Campaigns published on the Site. This review is a step in the submission of every Campaign on Ulule, applied in the same way to all proposals: a Campaign cannot be put online without undergoing it. You may object to this processing, on grounds relating to your particular situation, by writing to [email protected]: your request will be examined by our data protection officer. You may also ask for explanations of a decision and for a new review of your proposal by the team.

Automatic verification of certain eligibility conditions. Certain eligibility conditions of your proposal may also be verified automatically, on the basis of the information you have provided and without the use of artificial intelligence. This is the case for the country of the Campaign: Ulule cannot host Campaigns from every country, and a proposal linked to a country that is not supported is not accepted. A proposal sent to us by a partner may also not be accepted as it stands where it does not meet our eligibility criteria, assessed on the basis of the characteristics of the project and, where applicable, your history of Campaigns on Ulule. These checks are necessary to review your request to put your Campaign online, in accordance with Article 3.2 of the Terms and Conditions. If any information is incorrect, you can amend your proposal, which will then be reviewed again. You can also write to [email protected] to obtain explanations, express your point of view and ask for your proposal to be reviewed by a member of our team.

Suggested funding model. When you create your Campaign, a funding model may be suggested to you automatically. This suggestion is for guidance only: you remain free to choose another funding model.

Support for Creators. We also use artificial intelligence to:

• suggest replies to our coaches: these suggestions are not addressed to you; your coach reads them and decides alone whether to use, amend or discard them;

• answer your questions when you choose to ask them to our AI assistant, Ulule Assist. In the discussion thread of your Campaign, you choose to whom you address your question: your coach from the Ulule team or Ulule Assist. Ulule Assist answers on the basis of the information in your Campaign and your discussion thread, Ulule's documentation and public sources; its answers are published under its name. You can address your coach instead at any time;

• suggest improvements to the text, goal or rewards of your Campaign, either directly to you in your Campaign editor or to our team supporting you. These suggestions are based on the content of your Campaign, your username, the public links you have provided and comparable Campaigns published on Ulule. They never change your Campaign by themselves: you remain free to use them or not.

These uses are based on the performance of our terms and conditions (support for Creators) and on Ulule's legitimate interest in improving the quality of its services.

Service providers. These tools run on the Dust platform, which acts on our behalf as a processor, and on the AI model providers it uses (OpenAI and/or Anthropic, depending on the model). These providers are not permitted to use your data to train their models. For any transfers outside the European Union, see section 10.

3. What personal data about you do we process?

We collect and process:

• the personal data you have entered on our Site, in particular when creating your User Account (email, surname, first name, address, password, telephone number, etc.);

• For users who take part in Campaigns presented on the Site:

• personal data relating to the Campaigns you run through the Site (presentation of your Campaign, identity information, bank details, etc.)

• data relating to the Contributions you make to a Campaign presented on the Site (reward chosen, amount paid, transaction number, delivery address, etc.)

• For former trainees of Ulule's training organisation (activity discontinued in July 2026):

• the data in your training records, kept in archives: identity, application details, training agreement or contract, attendance sheets, certificates, evaluations and invoicing.

• data relating to your browsing on the Site (pages viewed, date and time of connection, IP address, browser type, operating system, browsing history and the contents of your basket, the products and pages you have viewed or searched for), the URL of the landing page and the URL of the website from which you arrived;

• data relating to the opening of the emails we send you, for statistical and direct marketing purposes;

• the information you provide when you leave a review on the Site;

• information about our advertisements that you view;

• the information you provide when you take part in promotional operations, competitions or events that we organise.

All this data may be provided by you when you fill in our forms or during our exchanges. It may also be collected through IT tools such as cookies. For more information on how we use these tools, please refer to our cookie policy, available at the following address: Cookie Policy.

All the data we collect about you may be combined in order to pursue the purposes described above.

4. Is the collection and processing of your data mandatory?

When you browse our website Ulule.com, access to certain features requires the creation of an account and therefore the provision of certain data. By creating an account, you become a user of the Ulule Site, which then allows you to become a Creator or a Contributor.

To create an account on the Ulule.com site, you must provide a surname, first name or username, your email address and a password. Otherwise, you will not be able to register.

As a mere visitor to the Ulule.com site, you can view certain sections, but you cannot create a project or Campaign, or contribute to existing projects and Campaigns.

To create a Campaign on the Ulule.com site, in addition to the data required when creating your account, you must provide your surname and first name, the name of your project, the category it falls into, its description, your country of residence, your delivery address, your billing address, your goal, the amount and its currency, your bank details, and provide any proof of identity needed to identify you, depending on whether you are a natural person or a legal entity.

To contribute to a Campaign on the Ulule.com site, in addition to the data required when creating your account, you must provide your surname and first name, your nationality, your country of residence, your date of birth, your delivery and/or billing address if the Creator has made this information mandatory in order to deliver the rewards you have chosen, your bank card payment details, and provide any proof of identity needed to identify you, depending on whether you are a natural person or a legal entity.

If this information is not provided, you will not be able to publish your Campaign on Ulule.com or contribute to the projects on the Ulule.com site.

These data requirements are contractual and/or regulatory in nature (in particular for your proof of identity).

To exercise your rights, as set out in section 8 of this Privacy Policy, proof of identity will be required. Failure to provide it may prevent us from responding to your requests.

This data requirement is regulatory in nature.

The collection of other data may be mandatory. All data whose collection is mandatory, the contractual or regulatory nature of this requirement, and the consequences of not providing the data concerned are then brought to your attention directly at the time of collection.

5. Sensitive data and third-party data - Important

5.1. Sensitive data

By using the Site to post comments, present your project, your user profile, etc., you may publicly disclose information about yourself that is sometimes sensitive or very personal (religious or philosophical beliefs, sexual orientation, political opinions, health, etc.).

We therefore encourage you to be careful when using the Site in order to protect your privacy.

• In your user profile: the following fields of your user profile are optional and are intended to allow you to personalise your public user profile on Ulule: surname, first name, city, description, full description, social networks and websites.

Through these fields you may publicly disclose information about yourself that is sometimes sensitive or very personal (religious or philosophical beliefs, sexual orientation, political opinions, health, etc.). Once the form has been submitted, this information will become public and accessible to everyone. We therefore encourage you to be careful when describing your user profile in order to protect your privacy.

• In the presentation of your Campaign or in news about your Campaign: when you describe a Campaign or publish news on your project page, you may disclose information about yourself that is sometimes sensitive or very personal (religious or philosophical beliefs, sexual orientation, political opinions, health, etc.). When your project is put online or your news is published, this sensitive information will become public and accessible to everyone. Ulule therefore encourages you to be careful when describing your project and writing your news, in order to protect your privacy.

• Contributing to a Campaign: by default, contributions are public and visible in a Campaign's list of contributors or on the contributing member's user profile. Contributing to a Campaign may sometimes reveal sensitive or very personal information (your religious or philosophical beliefs, your sexual orientation, your political opinions, etc.).

For example, by contributing to a Campaign with a political dimension, you indirectly reveal your political opinion. If you do not want your support to be public, Ulule allows you to make your contribution "anonymous" by going to your user profile / "my contributions" / "edit address and preferences". Your identity will then only be known to Ulule and to the Creator concerned. To make all your contributions "anonymous", go to your user profile / "preferences" / "privacy".

• Comments on Campaigns or posts: when you write a comment on a Campaign or a post, you may disclose information about yourself that is sometimes sensitive or very personal (religious or philosophical beliefs, sexual orientation, political opinions, health, etc.). Once the comment or post form has been submitted, this sensitive information will become public and accessible to everyone. Ulule therefore encourages you to be careful when writing your comments or posts, in order to protect your privacy.

• Your exchanges with Ulule: we do not ask you to provide us with sensitive information. If you mention any of your own accord in your messages to Ulule (for example to your coach in the discussion thread of your Campaign, or to our customer service), it is used only to handle your request and support you.

5.2. Third-party data

When writing the presentation of a Campaign, or news, you may provide us with, and publicly disclose, information about third parties (your collaborators, a person your project aims to help, etc.).

This data must be processed in compliance with the regulations.

You must check that you are entitled to provide this data to Ulule and to the public (for example by obtaining the written consent of these third parties) and provide them with the information on how Ulule processes their data set out in this Privacy Policy.

6. How long do we keep your personal data?

We keep your personal data only for as long as necessary for the purposes for which it was collected, in compliance with the applicable regulations.

6.1. Users without financial transactions

For users who have made no financial transaction on the Ulule platform (neither a contribution to a project nor fundraising as a project owner), we apply the following retention periods:

• Inactivity period: 3 years from the last activity on your account (last login, last contact with Ulule, or last action on the platform)

• Notification before deletion: Before your data is deleted, we will send you a notification email informing you that your account is inactive and giving you the opportunity to log in again to keep your account active

• Complete deletion: At the end of this 3-year period of inactivity, and if your account has not been reactivated, all your personal data will be permanently deleted, including:

• The information in your user profile (surname, first name, email, postal address, telephone number, etc.)

• Your account preferences and settings

• Your browsing and login history

• Your comments published on projects or articles

• Any project proposals or Campaign pages you may have that have not received any transaction

• Your data held by our processors (Mangopay, Brevo, Mailjet, etc.)

6.2. Users with financial transactions

For users who have made at least one financial transaction on the Ulule platform (a contribution to a project or fundraising as a project owner), we apply the following retention periods:

• Inactivity period: 5 years from the last activity on your account (last login, last contact with Ulule, or last action on the platform)

• Legal basis: This 5-year retention period is required by our legal obligations relating to the fight against money laundering and terrorist financing (Article L. 561-12 of the French Monetary and Financial Code)

• Notification before deletion: Before your data is deleted, we will send you a notification email informing you that your account is inactive and giving you the opportunity to log in again to keep your account active

• Partial deletion and anonymisation: At the end of this 5-year period of inactivity, and if your account has not been reactivated:

• Your identification data (surname, first name, email, postal address, telephone number, etc.) will be deleted

• Your transaction data will be anonymised in order to preserve statistics and the history of funded projects

• In project owners' data exports (list of contributors), your name will be replaced by the words "Contributor deleted due to inactivity", and only the contribution data (amount, date, reward chosen) will be kept

6.3. Other specific retention periods

The following retention periods also apply:

6.4. Notification in the event of account inactivity

To allow you to keep your account and your data, we have set up an automatic notification system:

• Daily detection: We check daily for inactive accounts approaching the 3-year (users without transactions) or 5-year (users with transactions) thresholds

• Notification email: Before any data is deleted, we will send an email to the address associated with your account to inform you of the inactivity and offer you the opportunity to reactivate your account

• Response time: You will have a reasonable period of time to log in again and keep your account active

• Logging: Data deletions are logged and the logs are kept for 1 year for traceability purposes

6.5. Reactivating your account

At any time before your data is deleted, you can reactivate your account by logging in to the Ulule platform again or by contacting us. This will stop the deletion process and reset the inactivity period.

7. Who receives your personal data?

Your personal data is intended for Ulule's internal departments and may be shared with the following third parties:

7.1. Payment service providers

We use payment service providers (PSPs) to manage the financial transactions carried out on the Site. These PSPs are:

• MANGOPAY SA - Payment institution authorised by the ACPR (French Prudential Supervision and Resolution Authority)

• STRIPE - Authorised payment service provider

These providers collect and process your payment data as data controllers. We invite you to consult their respective privacy policies for more information.

7.2. Processors

We use processors to help us provide our services. These processors may have access to your personal data in the course of their services, in particular:

• Data hosting providers

• Email delivery providers (Brevo, Mailjet, etc.)

• Artificial intelligence providers (the Dust platform and the model providers it uses: OpenAI and/or Anthropic)

• Analytics and statistics tools

• Customer support providers

• IT service providers

All our processors are subject to strict contractual obligations regarding the protection of personal data and may only use your data for the purposes defined by Ulule.

7.3. Creators of Campaigns

When you contribute to a Campaign, the personal data needed to carry out your Contribution is shared with the Creator of the Campaign concerned, in particular:

• Your surname and first name

• Your email address

• Your delivery address (if needed to send rewards)

• The amount of your contribution

• The rewards chosen

The Creator is a joint controller with Ulule for this data and must process it in compliance with the applicable regulations.

Your email address is provided to the Creators of the Campaigns you sign up to follow as a fan, in particular through the "coming soon" feature, which lets you be kept informed of the launch of an upcoming Campaign.

The personal data about you needed to deliver your Reward is also shared with the carrier selected by the Creator.

7.4. Commercial partners of operations in which you take part

Where you have expressed your wish to take part in a specific partner operation, for example as a Creator, if you apply for a prize or a partner offer managed directly by Ulule, we must share your contact details with the partner so that it can award you the promised prize if you win, or provide you with the promised offer if you are eligible.

7.5. Authorities

Your personal data may be disclosed to the authorities pursuant to a law or regulation or under a decision of a competent regulatory or judicial authority.

In general, we undertake to comply with all legal rules that may prevent, limit or regulate the disclosure of information or data, and in particular to comply with the French Data Protection Act (loi Informatique et Libertés) and the GDPR.

7.6. Third-party applications and assistants that you connect to Ulule

If you connect a third-party application or assistant, for example an artificial intelligence assistant, to your Ulule account, you authorise it to access some of your Ulule data and to act on your behalf. This includes viewing and editing your proposals and your Campaigns. This authorisation does not give access to your contributors' data. Before you give it, you can see the application concerned and the access requested. You can withdraw it at any time from the application concerned where it allows this, by changing your Ulule password, or by writing to [email protected]. If it is not used for 60 days, it expires automatically. The application then processes your data under its own responsibility and in accordance with its own privacy policy. Ulule does not control it.

8. What are your rights over your personal data?

In accordance with the applicable personal data protection regulations, you have the following rights:

• Right of access: You have the right to obtain confirmation as to whether or not data about you is being processed and, where it is, access to that data

• Right to rectification: You have the right to have inaccurate data about you rectified

• Right to erasure: You have the right to have data about you erased in certain cases provided for by the regulations

• Right to restriction of processing: You have the right to obtain the restriction of the processing of your data in certain cases provided for by the regulations

• Right to data portability: You have the right to receive the data about you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to processing of data about you that is based on legitimate interest. You also have the right to object to the processing of your data for direct marketing purposes

• Right to set guidelines regarding what happens to your data after your death: You have the right to set guidelines regarding the retention, erasure and disclosure of your personal data after your death

• Right to withdraw your consent: Where processing is based on your consent, you have the right to withdraw that consent at any time

• Right to lodge a complaint with the CNIL: If you consider that the processing of your data infringes the regulations, you have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL). To find out more about your rights over your data, please visit the CNIL website: www.cnil.fr

9. How can you exercise your rights?

You can submit any request relating to the exercise of your rights:

• by email by writing to [email protected]

• by post (with a copy of your proof of identity) to the following address:

Ulule For the attention of the Data Protection Officer (DPO) 10 rue de Penthièvre 75008 Paris FRANCE

Our teams will respond to you as soon as possible and at the latest within one month of receiving your request.

10. Is your personal data transferred outside the European Union?

Some of the processing operations that we entrust to our processors are carried out outside the European Union. Agreements have been signed with each of these providers to ensure that transfers of your personal data are carried out securely and in compliance with the applicable data protection regulations.

These transfers may take the form of remote access (for example by a provider's support team) or of processing by an artificial intelligence model provider. They are governed by the standard contractual clauses adopted by the European Commission or, where the recipient is certified under it, by the EU-U.S. Data Privacy Framework. You can obtain a copy of these safeguards by writing to [email protected].

11. Contacting the Data Protection Officer

For any question about the processing of your personal data or to exercise your rights over your data, the Data Protection Officer (DPO) appointed by Ulule SAS can be contacted:

• by email by writing to [email protected]

• by post (with a copy of your proof of identity) to the following address:

Ulule For the attention of the Data Protection Officer (DPO) 10 rue de Penthièvre 75008 Paris France

Language. This policy is available in several languages. In the event of any discrepancy between the language versions, the French version shall prevail.