Privacy Policy

Effective date: [EFFECTIVE DATE] · Controller: [COMPANY LEGAL NAME], [REGISTERED ADDRESS] · DPO/privacy contact: [PRIVACY EMAIL]

Draft prepared for counsel review. Using an adult platform reveals information about your sex life — several jurisdictions treat this as special-category data, and we treat every account that way by default.

1. What we collect

Category	Examples	Why
Account	email, handle, display name, password hash, 2FA secret (encrypted)	run your account (contract)
Age & identity	age-assurance result; for creators: legal name, date of birth, ID documents, model releases (encrypted at rest)	legal obligation (age laws, 18 U.S.C. §2257, KYC/AML)
Financial	wallet ledger, purchases, subscriptions, payouts, tax forms (encrypted). Card numbers are handled by our payment processor — never stored by us	contract, tax and accounting law, fraud prevention
Content & messages	posts, media, DMs, comments, reports you file	provide the service; safety
Usage	views, likes, session activity, IP address, device data, moderation logs	security, analytics, legitimate interest

2. What we never do

We do not sell personal data, run third-party advertising trackers, or disclose your membership except as described here. Billing descriptors use a discreet name: [BILLING DESCRIPTOR].

3. Sharing

Processors under contract only: payment processing, email delivery, age/identity verification, cloud hosting and storage, and content-safety scanning (e.g. CSAM hash-matching). We disclose to authorities when the law compels it — and we affirmatively report apparent child sexual abuse material to NCMEC as required by 18 U.S.C. §2258A.

4. Retention — including after deletion

Deactivating your account stops all processing except what the law requires us to keep. Some records survive deletion because a statute says they must; we document that conflict rather than hide it:

§2257 performer records (creator legal identity, releases, per-content performer lists): retained for the statutory record-keeping period even after account deletion.
Financial ledger, invoices, tax forms: retained per tax and accounting law (typically 6–10 years).
Moderation and abuse evidence (including removed content): retained where preservation duties apply (e.g. CSAM/NCII reports).
Everything else — profile, preferences, messages, analytics — is deleted or irreversibly de-identified.

5. Your rights

Depending on your jurisdiction (GDPR/UK GDPR, CCPA/CPRA and similar): access, correction, deletion (subject to §4), portability, restriction, objection, and the right to complain to your supervisory authority. Exercise them at [PRIVACY EMAIL]; we respond within the statutory window (30 days GDPR / 45 days CCPA).

6. Security

Passwords are hashed with argon2id; legal identities, tax data and 2FA secrets are encrypted at rest (AES-256-GCM); sessions use short-lived rotating tokens; access to identity documents is limited to trained reviewers and logged. No system is perfectly secure — report vulnerabilities to [SECURITY EMAIL].

7. International transfers & minors

Data may be processed in [HOSTING REGIONS] under standard contractual clauses. The service is not directed at minors; discovering an underage account leads to immediate closure and lawful reporting.