Privacy Policy

Effective June 18, 2026. First Model Inc. (“First Model Inc.”, “we”, “us”) is the data controller for personal data processed through TetReel, FaceStatus, TET, Pointbasin, and related services (the “Services”). This Policy explains what we collect, why, and the rights you have, including under the EU GDPR, UK GDPR, California CCPA/CPRA, and other applicable laws.

1. Data we collect

  • Account data: name, username, email, phone, password hash, country, date of birth, profile photo.
  • Content: videos, images, audio, captions, comments, messages, and metadata you create or upload.
  • Usage data: views, taps, follows, watch time, search queries, device IDs, IP address, approximate location (city-level from IP), crash logs, performance metrics.
  • Device data: model, OS, browser, language, time zone, network type, advertising identifiers where you allow them.
  • Reputation and FaceStatus signals: engagement patterns, community feedback, verification signals, anti-fraud signals.
  • Wallet and rewards data: TET balances, Pointbasin activity, redemption history, and (for payouts) the limited identification needed to satisfy KYC/AML obligations.
  • Payment data: processed by our payment partners. We receive transaction metadata, not full card numbers.
  • Communications: support tickets, survey responses, and any optional info you send us.
  • Cookies and similar tech: see Section 7.

2. Why we use it and our legal bases (GDPR)

  • Provide, maintain, secure, and improve the Services. Legal basis: contract performance; legitimate interests in running a safe, reliable network.
  • Personalize feed, search, and recommendations, including FaceStatus signals. Legal basis: legitimate interests; consent where required.
  • Prevent fraud, abuse, sanctions violations, manipulation of TET or rankings, and illegal content. Legal basis: legal obligation; legitimate interests.
  • Process payments, payouts, and tax/KYC obligations. Legal basis: contract; legal obligation.
  • Send service messages and, with your consent where required, marketing. Legal basis: consent; legitimate interests.
  • Comply with law, respond to lawful requests, and defend or assert legal claims. Legal basis: legal obligation; legitimate interests.

3. Who we share data with

  • Other users: your public profile, posts, and engagement signals are visible by design.
  • Processors and vendors under written data-processing terms: cloud hosting, CDN, analytics, crash reporting, customer support, email, payment, KYC, and moderation providers.
  • Authorities and third parties where required by law, court order, sanctions regime, or to protect rights, safety, and property.
  • Corporate transactions: in a merger, acquisition, financing, or asset sale, subject to this Policy.

We do not sell personal information for money.

4. International transfers

We operate globally and may transfer personal data to the United States and other countries. For transfers out of the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK Addendum, adequacy decisions where available, or other lawful mechanisms, with supplementary measures appropriate to the data.

5. Retention

We keep personal data for as long as needed to provide the Services and to satisfy legal, tax, accounting, security, and dispute-resolution obligations. Account and content data is generally retained while your account is active and for a reasonable period after deletion to allow recovery, fight abuse, and meet legal duties. Aggregated and de-identified data may be retained indefinitely.

6. Your rights

Depending on where you live you may have the right to access, correct, delete, port, restrict, or object to processing of your personal data, withdraw consent, and lodge a complaint with a supervisory authority. EU/EEA users may complain to their local Data Protection Authority; UK users to the ICO. California residents have CCPA/CPRA rights including the right to know, delete, correct, limit use of sensitive personal information, and opt out of “sharing” for cross-context behavioral advertising. We do not knowingly sell personal information. To exercise rights, email privacy@firstmodelinc.com. We will verify your identity before acting and respond within the timeframes required by law.

7. Cookies and similar tech

We use first-party and limited third-party cookies, SDKs, and local storage for sign-in, security, preferences, analytics, and (with consent where required) measurement and marketing. You can manage cookies in your browser or device settings, and via our in-app consent controls where available.

8. Automated decisions and FaceStatus

FaceStatus and related ranking systems use automated processing to surface, rank, and moderate content and accounts. These systems are not used to produce legal or similarly significant effects on individuals within the meaning of Article 22 GDPR. If a moderation action affects your account, you may contact us at privacy@firstmodelinc.com for human review.

9. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and monitoring. No system is perfectly secure; you use the Services at your own risk and should keep your credentials safe.

10. Minors and age-tiered protections

TetReel serves both individuals and businesses, and we apply age-tiered protections to personal accounts. We do not knowingly collect personal data from children under 13, and accounts are not offered to them except through a supervised, parental-consent path where local law expressly permits it. For users aged 13 to 15 (Teen Creator accounts, where permitted by local law and with verifiable parental or guardian consent where required), accounts are private by default, direct messaging is limited, personalized advertising is off, sensitive content is filtered, and monetization, wallet, TET redemption, and business or financial features are disabled. For users aged 16 to 17, enhanced privacy and safety defaults apply, personalized advertising is limited consistent with local law, and monetization, wallet, and business or financial features remain restricted. Users aged 18 and over have full access subject to applicable KYC, AML, sanctions, and tax requirements. Business, brand, and organizational accounts must be operated by an authorized adult representative. We may use age-assurance signals (such as self-declared age, parental-consent workflows, and, where appropriate, third-party verification) and may restrict or terminate accounts that misrepresent age. If you believe a child has provided personal data in violation of this Policy, contact privacy@firstmodelinc.com and we will take appropriate steps to delete it and, where required, notify a parent or guardian.

11. Third-party links and integrations

The Services may link to third-party sites or include third-party SDKs. Those parties have their own privacy practices, which we do not control.

12. Changes

We may update this Policy from time to time. Material changes will be notified in-app or by email. The “Effective” date above shows the latest version.

13. Contact, DPO, and EU/UK representatives

Privacy questions and requests: privacy@firstmodelinc.com. Data Protection Officer: dpo@firstmodelinc.com. EU and UK Article 27 representatives can be appointed on request; contact us for current details.

See also our Terms of Service.