PRIVACY POLICY Last Updated: April 29th, 2026 Our Privacy Policy detailed below (hereinafter referred to as the “Policy”) has been drafted to inform you about the practices and conditions under which Yirl, a simplified joint-stock company (SAS) with its registered office located at 60 RUE FRANCOIS IER, 75008 PARIS, FRANCE (hereinafter referred to as “Yirl” or “We”), collects, uses, and retains your personal data (hereinafter referred to as “Data”). Yirl primarily operates through third-party messaging platforms (such as Instagram, TikTok, WhatsApp, and similar services). This Policy explains the types of Data we may collect and/or process when you use our services, access the website youinreal.life (the “Site”), and any interfaces or tools we may provide (collectively, the “Solution”). The use of the Site and any interfaces or tools we may provide (collectively referred to as the “Solution”) is subject to this Policy. This Policy is updated regularly to ensure compliance with applicable regulations, including the European General Data Protection Regulation (GDPR) 2016/679 and the French Data Protection Act of January 6, 1978, as amended. 1. Data Collected by Yirl Depending on your interactions with the Solution, we collect the following Data: A. Information You Provide Directly •Identification & Account Data: Name, first name, year of birth, gender, phone number, email address, profile photo, and login credentials. •Matching Data: When you sign up, we may ask you questions to understand your personality, preferences, and interests in order to improve matching, including personality traits and demographic information (such as age and city). •Mobile Contacts:If you choose to share contacts or invite others through our Services, we may process the information you provide (such as names and phone numbers) solely for this purpose. You confirm that you have the right to share such contact information with us. •Preferences: Interests and music preferences (including data from Spotify if connected). B. Information from Third Parties •Social Media (Instagram, TikTok, etc.): If you interact with us or link your accounts, we may receive your username, profile picture, and public profile data. •Authentication Services: Data from third-party login providers (e.g., Google, Apple) to verify your identity. C. Automatically Collected Data •Browsing & Device Data: IP address, device type, operating system, browser version, and unique device identifiers (Ad ID). •Usage Data: Pages visited, time spent, and interaction patterns within the Solution. •Location Data: General location (via IP) or precise geolocation (with your explicit consent). See section 7 below for exactly how the Yirl mobile app collects location. 2. How and Why Is Your Data Used? Purpose Legal Basis Retention Period Service Provision: User matching, event coordination, and related services. Performance of contract For the duration of the account. Deleted or anonymized after 2 years of inactivity. Payments: Processing transactions for experiences and subscriptions via Stripe. Performance of contract Financial records are kept for 10 years (legal requirement). Improvement: Training our machine learning models for better matching and fixing technical issues. Legitimate interest 2 years from collection. Marketing: Sending newsletters and invitations based on your interests. Consent / Legitimate interest 3 years after the last contact. 3. Data Sharing and Processors We do not sell your personal data. We share it only with: •Other Users: Limited profile info (e.g., first name) visible during shared experiences. •Payment Processors: Stripe processes all payments. We do not store your credit card numbers; they are provided directly to Stripe. •Technical Partners: Google Cloud (Hosting), Twilio (SMS), Klaviyo (Emails), and Typeform (Surveys). •Venue Partners: We may share aggregated, non-identifiable data (e.g., group music preferences) to help venues prepare for your visit. 4. Data Controller The data controller is Yirl, a simplified joint-stock company (SAS), registered in France, with its registered office at 60 RUE FRANCOIS IER, 75008 PARIS, FRANCE. For any questions regarding your personal data, you can contact us at: [email protected] 5. International Data Transfers Some of our service providers may process your data outside of the European Economic Area. In such cases, we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent legal mechanisms in accordance with GDPR. 6. Data Security We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, or alteration. However, no system is completely secure, and we cannot guarantee absolute security. 7. Location Sharing in the Yirl Mobile App The Yirl iOS app and App Clip collect your precise location ONLY WHILE THE APP IS OPEN. We take one location reading the moment you open or return to the app, and then roughly one every 10 minutes for as long as you keep it on screen. The moment you leave the app, collection stops. We do not collect your location in the background, we do not track you when the app is closed, and we never track you 24/7. Why: so that during an in-person Yirl hangout our team can see who has arrived at the meeting point and help anyone who is lost or at the wrong venue. Who sees it: only the Yirl team. We never share your location with other users or with venues. How long we keep it: location readings are automatically and permanently deleted after 30 days. How to stop it: turn off location sharing with the in-app toggle, revoke the location permission in iOS Settings, or simply leave the app — collection stops immediately either way. Turning the toggle off also deletes the readings still queued on your device. 8. Cookies and Tracking Technologies We may use cookies and similar technologies to improve your experience, analyze usage, and personalize content. You can manage your cookie preferences through your browser settings. 9. Third-Party Platforms Yirl primarily operates through third-party platforms such as Instagram, TikTok, WhatsApp, and similar services. These platforms are owned and controlled by third parties. Your use of these platforms is subject to their own terms of service and privacy policies. Yirl does not control and is not responsible for how these third parties collect, process, store, or share your personal data. We encourage you to review their respective privacy policies. 10. Your Rights Under GDPR, you have the right to access, rectify, erase, or port your data. You may also object to processing or withdraw consent at any time. To exercise these rights, contact us at: [email protected]. You also have the right to lodge a complaint with the CNIL (www.cnil.fr). 11. Safety of Minors Yirl is strictly for users aged 18+. We do not knowingly collect data from minors and will delete any such information immediately upon discovery. Yirl 60 RUE FRANCOIS IER, 75008 PARIS, FRANCE [email protected]