AFFINA SPACE — PRIVACY POLICY

Effective date: 18 July 2026 · Lawyer-reviewed final (2026-07-20)

This Privacy Policy explains how Affina SAS collects, uses, shares and protects personal data when you access or use Affina Space, including our websites at affina.space and app.affina.space, our platform, programs, AI-assisted features, mentor sessions and community spaces (together, the "Service").

We have written this Privacy Policy in plain language because transparency is an important part of the Service.

1. Who we are

The controller responsible for the processing described in this Privacy Policy is:

Affina SAS 50 Avenue des Champs-Élysées 75008 Paris, France SIREN 940 979 263 Email: info@affina.space

In this Privacy Policy, "Affina," "we," "us" and "our" mean Affina SAS.

For any question, request or concern relating to privacy or personal data, contact us at info@affina.space.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed in connection with the Service.

It does not apply to third-party websites, applications or services that you access independently, even if they are linked from the Service. Those third parties process personal data under their own privacy policies.

3. Personal data we collect

3.1 Account and profile data

When you create or use an account, we may collect:

• your email address;
• your name;
• your project or venture name;
• your role or founder status;
• your country, city and timezone;
• your preferred language;
• your phone number, if you choose to provide it; and
• other profile information you voluntarily provide.

Your email address is used to create and secure your account, including through one-time sign-in links or authentication codes.

Certain information, such as your email address and information required to provide your program, is necessary to use the Service. Optional fields will be identified as such.

If you do not provide required information, we may not be able to create your account or provide the relevant part of the Service.

3.2 Venture and program content

The Service is built around the work you complete through the program.

We may process:

• descriptions of your idea, product or service;
• information about your intended customers and market;
• your business model, goals and plans;
• answers to exercises and assignments;
• customer-interview notes that you enter into the platform;
• research, testing and validation results;
• weekly check-ins and reflections;
• mentor-session requests and topics;
• documents, files, prompts and other materials you submit; and
• feedback you provide about the Service.

We refer to this information as "User Content."

User Content may include personal reflections that you voluntarily choose to provide, such as why your project matters to you.

Your venture ideas and original materials remain yours, as described in our Terms & Conditions.

3.3 Sensitive information

The Service is not designed to collect passwords, complete payment-card details, government identification numbers, medical records or other highly sensitive personal data through free-text fields.

Please do not submit special-category personal data, such as information about health, political opinions, religious or philosophical beliefs, sexual orientation, trade-union membership or biometric data, unless a particular feature expressly requests it and provides an appropriate explanation.

You should also avoid including unnecessary personal data about other people in your User Content.

3.4 Information about interviewees and other third parties

Customer-interview notes and other venture materials may contain information about third parties.

Where possible, you should anonymise interview notes and avoid entering names, contact information or other details that directly identify an interviewee.

If you provide personal data relating to another person, you confirm that:

• you have a lawful reason to collect and provide it;
• you have given that person any information required by applicable law;
• you provide only the information reasonably necessary for your venture work; and
• you do not provide sensitive information unless you have an appropriate legal basis.

Affina processes such information only to provide the Service and in accordance with this Privacy Policy.

3.5 Mentor-session and community data

When you participate in mentor sessions or community features, we may process:

• session-booking information;
• the topics and questions you submit;
• session attendance;
• messages and posts shared in community spaces;
• administrative notes concerning the session; and
• feedback about mentors or sessions.

Information relevant to a mentor session may be shared with the mentor assigned to support you.

Affina does not record the audio or video of mentor sessions unless participants are clearly informed in advance and any consent required by law has been obtained.

Video-conferencing platforms may process technical and meeting data under their own privacy policies.

3.6 Usage and analytics data

We operate privacy-focused, first-party analytics to understand how the Service is used and how it can be improved.

We may record:

• pages or screens viewed;
• modules and steps completed;
• features used;
• buttons or links selected;
• dates and times of activity;
• general referral information;
• error and performance information; and
• campaign parameters, such as UTM tags, where you arrive through a marketing link.

Analytics events may be associated with a randomly generated first-party identifier stored in your browser.

We do not use this identifier to track you across unrelated websites or services.

We do not intentionally include your full IP address or create a device fingerprint in our product-analytics events. However, our hosting and security providers may process your IP address and technical request information temporarily to deliver and protect the Service.

We do not use third-party advertising pixels or cross-site advertising trackers on the Service.

3.7 Payment and subscription data

Payments are processed by Stripe.

Affina does not receive or store your complete payment-card number or card security code.

We may receive and store:

• your Stripe customer reference;
• your billing name and contact details;
• your subscription plan and status;
• payment and invoice status;
• subscription and billing-period dates;
• the amount and currency paid; and
• limited payment information, such as the card type and last four digits, where provided by Stripe.

Stripe processes payment information under its own privacy documentation and may act as an independent controller for certain processing activities.

3.8 Communication data

When we communicate with you, we may process:

• the email address or other contact details used;
• messages you send to us;
• support requests and complaint records;
• the type and time of emails sent by Affina;
• delivery, bounce and unsubscribe information; and
• your communication preferences.

We use this information to respond to you, provide Service communications, avoid duplicate messages and maintain email deliverability.

We do not use third-party advertising trackers in our emails.

3.9 Technical and security data

To operate and secure the Service, we may temporarily process:

• IP addresses;
• browser and operating-system information;
• request timestamps;
• authentication and session information;
• security events;
• failed access attempts; and
• diagnostic and error logs.

4. How we obtain personal data

We obtain personal data:

• directly from you when you register, complete the program, communicate with us or submit User Content;
• automatically from your browser or device when you use the Service;
• from payment, scheduling, email, authentication and video-conferencing providers;
• from mentors involved in delivering your program; and
• from marketing links through which you reached the Service.

5. How and why we use personal data

We process personal data only where we have an appropriate legal basis.

Where we rely on legitimate interests, those interests may include:

• operating and improving Affina;
• understanding whether the Service works effectively;
• maintaining reliable communications;
• protecting the security and integrity of the Service;
• preventing fraud and abuse;
• resolving disputes; and
• establishing, exercising or defending legal claims.

We consider the effect of this processing on your rights and do not rely on legitimate interests where your interests or fundamental rights override ours.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

6. AI processing

Affina uses third-party artificial-intelligence model providers through business or commercial APIs to generate feedback, reports, scores, suggestions and other outputs concerning your project.

At the effective date of this Privacy Policy, Affina uses Anthropic's Claude API directly.

Depending on the relevant feature and the future development of the Service, we may add or switch to other commercial AI API providers, including OpenAI or Google.

Where a new AI provider is introduced and processes personal data, we will update this Privacy Policy and, where appropriate, provide additional notice before or when the relevant change takes effect.

Only the User Content, prompts, instructions and limited technical information reasonably necessary to generate the requested output are sent to the relevant AI provider.

We do not intentionally send information that is unrelated to the relevant request.

We use business, commercial or paid API services to process production User Content. We do not use consumer-facing AI chat accounts to process User Content as part of the Service.

Under our standard commercial arrangements, we do not authorise AI providers to use identifiable User Content to train their general-purpose models unless we separately inform you and obtain any consent required by law.

The precise retention of information by an AI provider may depend on:

• the provider;
• the model used;
• the API endpoint or feature;
• the account configuration; and
• legal, security and abuse-prevention requirements.

AI providers may retain prompts, outputs and limited technical information for restricted periods where necessary to:

• provide the requested functionality;
• detect misuse or violations of their policies;
• maintain security and service reliability;
• debug technical issues;
• operate optional stateful, file-storage or caching features; or
• comply with legal obligations.

Where reasonably practicable, Affina selects settings and API features designed to minimise the amount of User Content retained by AI providers and the period for which it is retained.

Affina does not use your identifiable User Content to provide personalised outputs to other Users or to advertise to you or others.

We may use aggregated or irreversibly anonymised information to evaluate and improve the Service.

AI-generated outputs may be inaccurate or incomplete. More information about their nature and limitations is provided in our Terms & Conditions.

7. Automated decision-making

We do not use AI outputs or other automated processing to make decisions about you that produce legal effects or similarly significant effects.

AI-generated feedback, scores and suggestions are educational and venture-building tools for your use.

They do not determine:

• your legal rights;
• access to employment;
• eligibility for credit or investment;
• access to insurance or essential services; or
• the outcome of a complaint or refund request.

Decisions concerning account suspension, complaints or claims under the Founding Cohort Money-Back Guarantee are not made solely by automated means.

8. Service providers and recipients

We share personal data only where reasonably necessary to operate the Service, process payments, communicate with you, provide mentor support, comply with law or protect our rights.

Our principal service providers and recipients include:

Our service providers are permitted to process personal data only for the relevant services and subject to applicable contractual and legal obligations.

We may also disclose personal data:

• where required by law, court order or a lawful request;
• to prevent fraud, misuse or a serious security threat;
• to establish, exercise or defend legal claims;
• in accordance with your instructions or consent; or
• as part of a merger, financing, acquisition, restructuring or sale of all or part of Affina, subject to appropriate confidentiality and data-protection safeguards.

We do not sell your personal data.

We do not use your User Content to advertise products or services to other people.

9. International data transfers

Affina is established in France, but some providers or their infrastructure may be located outside the European Economic Area, the United Kingdom or Switzerland, including in the United States.

Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, we use an appropriate transfer mechanism where required.

These mechanisms may include:

• an applicable adequacy decision;
• the EU–US Data Privacy Framework where the recipient is validly certified and the framework applies;
• the European Commission's Standard Contractual Clauses;
• the UK International Data Transfer Addendum or another UK-approved mechanism; and
• additional contractual, organisational or technical safeguards where appropriate.

You may contact info@affina.space to request further information about the safeguards used for a particular transfer.

10. Cookies and local storage

We use a limited number of cookies and similar browser-storage technologies.

10.1 Essential session technology

We may use an essential session cookie, such as affina_session, to:

• keep you signed in;
• authenticate your requests;
• maintain account security; and
• remember your session.

The session may remain active for up to 30 days.

The cookie is configured as secure and httpOnly where technically applicable.

This technology is necessary to provide the Service.

10.2 Local storage

We may use browser local storage for:

• a temporary local cache of your workspace;
• a random first-party analytics identifier;
• interface preferences; and
• small functional flags, such as whether a notice has already been displayed.

Information stored locally remains on your device until it expires, is replaced or is cleared through your browser or the Service.

10.3 First-party product analytics

We use first-party analytics to understand how Users interact with the Service, identify technical issues and improve the program.

Our analytics are not used for third-party advertising or to track Users across unrelated websites or services.

Analytics may use a randomly generated identifier stored in your browser.

Our use of analytics cookies, local storage and similar technologies is subject to applicable consent requirements. Where consent is legally required for a particular analytics technology, we will rely on consent for that technology.

Where an analytics technology qualifies for an exemption from consent under applicable law, we may use it on the basis of our legitimate interests, subject to the applicable conditions and your rights.

We retain analytics identifiers and associated events only for as long as reasonably necessary for product analytics and Service improvement. We periodically review these retention periods and apply any shorter maximum period required by applicable law.

We do not use third-party advertising cookies or pixels.

11. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, security and dispute-resolution requirements.

Our standard retention approach is:

We may retain particular information for longer where:

• required by law;
• necessary to establish, exercise or defend a legal claim;
• necessary to investigate fraud or a security incident; or
• you have requested that the information be retained.

When a retention period ends, personal data is deleted or irreversibly anonymised.

If your account remains inactive for an extended period, we may contact you and delete or anonymise account information that is no longer needed. Where reasonably practicable, we will provide advance notice before deleting an inactive account.

12. Your data-protection rights

Subject to the conditions and exceptions established by applicable law, you may have the right to:

• obtain confirmation that we process your personal data;
• access a copy of your personal data;
• correct inaccurate or incomplete personal data;
• request deletion of personal data;
• restrict certain processing;
• object to processing based on legitimate interests;
• receive certain personal data in a structured, commonly used and machine-readable format;
• transmit portable data to another controller where technically feasible;
• withdraw consent at any time where processing is based on consent;
• object at any time to direct marketing;
• receive information about applicable international-transfer safeguards; and
• where applicable, provide instructions concerning the use of your personal data after your death.

To exercise your rights, contact:

info@affina.space

Please describe your request clearly and provide the email address associated with your account.

We may request reasonable information to verify your identity before acting on a request. We will not request more information than is reasonably necessary for verification.

We will normally respond within one month.

Where permitted by law, this period may be extended by up to two further months where a request is particularly complex or where we have received numerous requests. We will inform you if an extension is required.

Exercising your rights is normally free of charge. We may refuse or charge a reasonable fee for a request only where applicable law permits this, including where a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a competent data-protection supervisory authority.

In France, the supervisory authority is the:

Commission nationale de l'informatique et des libertés — CNIL

You may also contact the supervisory authority in the country where you live, work or believe a data-protection infringement occurred.

13. Marketing and Service communications

Certain communications are necessary to provide the Service, including:

• one-time sign-in links and security messages;
• receipts and subscription information;
• program tasks and weekly instructions;
• mentor-session information;
• important reminders;
• changes affecting your account or subscription; and
• legally required notices.

These communications form part of the Service.

You cannot opt out of communications that are strictly necessary to operate your account or provide a program you requested. You may stop receiving them by ending the relevant Service and closing your account, subject to information that we must retain by law.

We may also send occasional product news, event information and useful content where:

• you have consented; or
• applicable law permits us to contact an existing customer about similar Affina services.

Every non-essential marketing email includes an unsubscribe mechanism.

You may also opt out by contacting info@affina.space.

Opting out of marketing does not affect your access to the Service or your receipt of essential Service communications.

14. Security

We use reasonable technical and organisational measures designed to protect personal data.

Depending on the relevant system, these measures may include:

• passwordless authentication using one-time email links;
• signed, secure and httpOnly session cookies;
• encryption of data in transit;
• restricted access to production systems;
• access controls based on operational need;
• secure management of credentials and API keys;
• monitoring and protection against misuse;
• controls applying to vendors and processors; and
• procedures for responding to security incidents.

Payment-card details are submitted directly to Stripe and do not pass through or remain in Affina's systems.

No internet service or storage system can be guaranteed to be completely secure.

You are responsible for maintaining the security of your email account, devices and access links.

If we become aware of a personal-data breach, we will investigate it and notify the relevant supervisory authority and affected individuals where required by applicable law.

15. Children

The Service is intended only for adults aged 18 or older.

We do not knowingly collect personal data from children.

If you believe that a person under 18 has provided personal data through the Service, contact info@affina.space so that we can investigate and take appropriate action.

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to:

• the Service;
• our processing activities;
• the AI models and other providers we use;
• applicable law; or
• our security and compliance practices.

The current version will be published through the Service with its effective date.

If a change is material, we will provide reasonable notice by email or through the Service before the change takes effect where appropriate.

Where processing depends on consent, we will request new consent if the proposed change requires it.

17. Contact

For any question, request or complaint relating to privacy or personal data, contact:

Affina SAS 50 Avenue des Champs-Élysées 75008 Paris, France SIREN 940 979 263 Email: info@affina.space