Privacy Policy

This policy explains how the Operator processes your personal data when you use the Platform, in accordance with Regulation (EU) 2016/679 ("GDPR"). It applies to fans, creators and anyone who contacts us.

We have written this policy in plain terms. It sets out which data we process, why, with whom we share it, how long we keep it and how you can exercise your rights. It supplements the terms. If anything seems unclear, write to us: we will reply in your language, in French, English or Spanish.

1. Controller

The controller is [RAISON SOCIALE], [FORME JURIDIQUE], with its registered office at [ADRESSE], registered under number [NUMÉRO D'ENTREPRISE] (the "Operator").

You may contact our data protection officer: [DPO], at [EMAIL DPO].

2. Data we process

2.1 All users

• Account data: email address, username, encrypted password, language, country, account creation date.
• Age verification data: verification result, method used, provider reference, date and country. No image and no document is kept by the Operator.
• Payment data: technical token provided by the payment processor, card type, last four digits, history of purchases and refunds. The Operator never receives your full card number or security code.
• Messages: content of messages exchanged on the Platform and their metadata.
• Technical logs: IP address, device and browser type, connection dates and times, security events.
• Cookies and trackers, described in section 10.
• Exchanges with support, reports and complaints.

2.2 Creators

• Verified identity data: status of the verification carried out by Ondato and case reference. The Operator keeps no copy and no image of your identity document or your face.
• Published content: media, texts, descriptions, prices and offer settings.
• Payout data: bank details, required tax information, payout history.
• Links to your profiles on other platforms, if you choose to display them.

2.3 Sensitive data

Your use of the Platform may reveal information about your sex life or sexual orientation. This data is processed only to provide the service you request, on the basis of your explicit consent, and with enhanced security measures.

2.4 Sources of data

We collect most data directly from you, when you create your account, publish content, purchase an offer or write to us. Some data is sent to us by third parties: the payment processor sends us the payment status, the technical token, the card type, the last four digits and any fraud or dispute alerts; verification providers send us the verification result and its reference; other users may send us data about you in a report.

2.5 Data we do not collect

The Operator does not collect or keep:

• your full card number or security code;
• any copy, photograph or scan of your identity document;
• images of your face taken during a verification;
• your precise geolocation.

3. Purposes and legal bases

• Creating and managing your account, providing access to content and paid offers: performance of the contract.
• Processing payments, refunds and payouts: performance of the contract and legal obligations.
• Verifying the age of fans and the identity of creators: legal obligation and legitimate interest in protecting minors and preventing fraud.
• Processing data relating to your sex life linked to use of the service: explicit consent.
• Moderating content, handling reports and complaints: legal obligations, in particular under the Digital Services Act, and legitimate interest.
• Ensuring security, preventing fraud and abusive disputes: legitimate interest.
• Keeping accounts and responding to authorities: legal obligations.
• Sending you service related messages: performance of the contract.
• Sending you promotional communications: consent, which you may withdraw at any time.
• Measuring audience using non essential trackers: consent.

Where processing is based on your consent, you may withdraw it at any time, without affecting processing already carried out.

3.1 Age verification of fans

Age verification of fans takes place at the first purchase or first access to media or a live, not at sign up. It is carried out by a specialised third party provider. The method may depend on your country. It never relies on your bank card. The provider only tells us whether the verification succeeded, the method used, its reference, the date and the country. Any images or documents you submit to it are processed by the provider, under its own policy, and are not sent to us.

3.2 Automated decisions

We use automated tools to detect payment fraud, identify potentially prohibited content and limit abuse. These tools may lead to a temporary block of a payment or to content being put on hold. Any decision to suspend an account, permanently remove content or withhold funds is subject to human review. You may challenge a decision using the complaint procedure set out in the terms.

3.3 Legitimate interest

Where we rely on our legitimate interest, we check that this interest is not overridden by your rights and freedoms. You may obtain information on this balancing test by writing to us.

4. Recipients and processors

Your data is accessible only to authorised staff of the Operator, within the limits of their duties. It is also shared with the following categories of providers, who act on our instructions or as separate controllers where the law requires:

• Payment processor: [PROCESSEUR DE PAIEMENT], for payment collection, fraud prevention and dispute handling.
• Identity and age verification providers: Ondato for creators, and [PRESTATAIRE DE VÉRIFICATION D'ÂGE] for fans.
• Media hosting: Bunny.net, in the European Union.
• Live streaming: LiveKit.
• Application and database hosting: [HÉBERGEUR].
• Email delivery: [PRESTATAIRE D'EMAILING].

Creators see the username of fans who interact with them and the messages sent to them. They receive neither the email address nor the payment data of fans.

We may disclose data to judicial or administrative authorities where required by law.

4.1 Data shared with creators

When a fan exchanges messages with a creator or places a custom order, the creator receives the information needed for that exchange. The creator undertakes not to use this information outside the Platform, not to disclose it and not to try to identify the fan. Any breach may lead to the suspension of their account.

5. Transfers outside the European Union

We favour providers that host data in the European Union. Where a transfer outside the European Economic Area is necessary, it is covered by an adequacy decision of the European Commission or by standard contractual clauses, supplemented where needed by additional measures. You may obtain a copy of these safeguards by writing to us.

6. Retention periods

• Account data: for the life of the account, then [DURÉE] after it is closed.
• Age and identity verification status: for the life of the account, then [DURÉE] to respond to any requests from authorities.
• Transaction data and accounting records: for the period required by accounting and tax law, namely [DURÉE LÉGALE].
• Published content: until deleted by the creator or the account is closed, unless retention is needed for proceedings or an investigation.
• Messages: for the life of the account, then [DURÉE].
• Technical logs: [DURÉE].
• Data relating to reports and moderation: [DURÉE].
• Cookies: thirteen months at most.

At the end of these periods, data is deleted or anonymised.

7. Your rights

You have the following rights over your data:

• right of access and to obtain a copy;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to data portability;
• right to object, in particular to processing based on legitimate interest and to direct marketing;
• right to withdraw your consent at any time;
• right not to be subject to a decision based solely on automated processing producing legal effects, and to request human intervention.

To exercise your rights, write to [EMAIL DPO] from the address linked to your account, or use your account settings. We reply within one month, which may be extended by two months if the request is complex. We may ask you to confirm your identity, without ever requiring a copy of an identity document where other means are sufficient.

Some rights may be limited by our legal obligations, for example the retention of accounting data.

You may delete your account from your settings. Deletion immediately deactivates the profile and erases the data within the periods set out in section 6, except data we must keep to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

8. Complaint

If you believe your rights are not respected, you may lodge a complaint with the competent supervisory authority: [AUTORITÉ DE CONTRÔLE]. You may also contact the authority of your country of residence.

9. Security

We implement technical and organisational measures suited to the sensitive nature of the data: encrypted communications, encrypted passwords, strict access control, signed and temporary URLs for media, logging of sensitive access, separation of environments and no real data in test environments. No card data and no identity document is stored by the Operator. In the event of a data breach presenting a risk, we notify the supervisory authority and, where necessary, the persons concerned.

You also contribute to the security of your account: choose a unique password, never share it and report any suspicious activity to us without delay. We will never ask for your password by email or message.

10. Cookies

The Platform uses cookies that are strictly necessary for it to work, which do not require your consent:

• session cookie, to keep you logged in;
• security cookie, to prevent attacks;
• age_gate_ack cookie, which records that you confirmed you are an adult when entering the Platform;
• language preference cookie.

Non essential cookies, for example for audience measurement, are only set with your consent. You may change your choice at any time using the cookie settings link at the bottom of the page.

11. Minors

The Platform is prohibited to minors. We do not knowingly collect data about minors. If we learn that an account belongs to a minor, we close it and delete the associated data, except data we must keep to report an offence. If you are aware of such an account, write to [EMAIL DE SIGNALEMENT].

12. Changes

We may amend this policy. In the event of a significant change, we inform you by email or in your account before it takes effect. The version date appears at the top of the document.

The French text prevails. The English and Spanish versions are translations.