Privacy Policy

This Privacy Policy applies to all information collected through our Platform, as well as any related services, sales, marketing, or events. It does not apply to information collected by third parties, including OnlyFans or any other platforms you may interact with through our services.

We collect personal information that you voluntarily provide to us when you:

• Register for an account on our Platform
• Complete agency or creator onboarding
• Participate in activities on the Platform
• Contact us with inquiries or support requests

This information may include:

• Identity Information: Full legal name, stage name or alias, date of birth
• Contact Information: Email address, phone number, mailing address
• Account Credentials: Username, password, security questions
• Professional Information: Agency name, business registration details, role and permissions

In compliance with 18 U.S.C. 2257 and related regulations concerning record-keeping requirements for content producers, we collect and maintain:

• Government-issued photo identification (passport, driver's license, or national ID)
• Proof of age documentation
• Legal name as it appears on official documents
• Date of birth verification
• Photo verification to confirm identity matches documentation
• Records of when verification was completed and by whom

Important: All age verification records are maintained for a minimum of 7 years as required by federal law, even after account termination.

To process commissions and payments, we collect:

• Bank account details for payout processing
• Tax identification numbers (SSN, EIN, or VAT number)
• Commission rates and earning records
• Payment history and transaction records
• Billing addresses

We automatically collect certain information when you access our Platform:

• IP address and geographic location
• Browser type and version
• Device type and operating system
• Pages visited and features used
• Time and date of visits
• Referring URLs
• Click patterns and interaction data

We use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities. See Section 9 for detailed information about our cookie practices.

We collect information directly when you:

• Create an account or complete registration
• Submit identity verification documents
• Complete your agency or creator profile
• Enter financial information for payouts
• Contact our support team
• Respond to surveys or promotional communications
• Sign contracts or agreements through our Platform

Information is automatically collected through:

• Cookies and similar tracking technologies
• Server logs and analytics tools
• Session recording and heatmap tools (for UX improvement)
• Security monitoring systems

We may receive information from:

• OnlyFans Platform: Performance metrics, subscriber counts, and earnings data (with your authorization)
• Payment Processors: Transaction verification and fraud prevention data
• Identity Verification Services: Document authentication results
• Analytics Providers: Aggregated usage statistics

• Create and manage your account
• Facilitate agency-creator relationships
• Enable content scheduling and management features
• Provide analytics and performance insights
• Deliver messaging and communication tools

• Calculate commission splits and earnings
• Process payouts to agencies and creators
• Generate invoices and financial reports
• Handle tax documentation (1099s, VAT reports)

• Send service-related notifications
• Respond to support inquiries
• Provide product updates and announcements
• Send marketing communications (with consent)

• Analyze usage patterns to enhance features
• Conduct research and development
• Test new features and functionalities
• Personalize user experience

• Maintain 2257 compliance records
• Respond to legal requests and court orders
• Prevent fraud and illegal activities
• Enforce our Terms of Service
• Protect the rights and safety of our users

Where you have given us explicit consent to process your personal data for specific purposes, such as:

• Marketing communications
• Non-essential cookies and tracking
• Third-party integrations

You may withdraw your consent at any time by contacting us or adjusting your account settings.

Processing necessary for the performance of a contract with you, including:

• Providing our Platform and services
• Processing payments and commissions
• Account management and authentication
• Customer support

Processing required to comply with legal obligations, such as:

• 18 U.S.C. 2257 record-keeping requirements
• Tax reporting obligations
• Anti-money laundering (AML) regulations
• Responding to lawful government requests

Processing based on our legitimate business interests, balanced against your rights:

• Fraud prevention and security
• Platform improvement and analytics
• Business operations and administration
• Protecting our legal rights

We share information with trusted third-party service providers who assist us in:

• Payment Processing: Stripe, PayPal, or similar payment processors
• Identity Verification: Document verification services
• Cloud Hosting: AWS, Google Cloud, or similar infrastructure providers
• Analytics: Usage analysis and reporting tools
• Customer Support: Help desk and support ticket systems

All service providers are contractually bound to protect your information and use it only for specified purposes.

With your authorization, we may exchange data with OnlyFans to:

• Retrieve performance metrics and analytics
• Access subscriber and earnings data
• Facilitate content management features

We may disclose your information when required by law, including:

• Compliance with legal obligations or court orders
• Response to valid government requests
• Protection of our rights, privacy, safety, or property
• Prevention of fraud or illegal activities
• 2257 compliance inspections by authorized authorities

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections outlined in this policy.

We retain contract and financial information for:

• The duration of your contract with us
• Plus the applicable statute of limitations for legal claims (typically 6-10 years)
• As required for tax compliance (generally 7 years)

If you request account deletion, we will delete or anonymize your account information within 30 days, except for data we are legally required to retain (such as 2257 records).

Aggregated and anonymized usage data may be retained indefinitely for analytics and platform improvement purposes.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Withdraw Consent: Withdraw previously given consent at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information, subject to exceptions
• Right to Opt-Out: Opt-out of the sale of your personal information (we do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

See Section 13 for detailed information about California privacy rights.

To exercise any of these rights, please contact us at privacy@offairy.com or use the contact methods listed in Section 14. We will respond to your request within 30 days (or as required by applicable law).

We may need to verify your identity before processing your request. In some cases, we may not be able to fulfill your request due to legal obligations (e.g., 2257 record retention requirements).

When you first visit our Platform, you will be presented with a cookie consent banner. You can choose to accept or decline non-essential cookies. You can also manage your cookie preferences at any time through your browser settings or our cookie preference center.

We may use third-party analytics and advertising services that use their own cookies and tracking technologies, including:

• Google Analytics (analytics)
• Mixpanel (product analytics)
• Intercom (customer support)

We currently do not respond to "Do Not Track" browser signals. However, you can control tracking through our cookie preferences or by adjusting your browser settings.

• TLS/SSL encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Multi-factor authentication (MFA) options
• Regular security audits and penetration testing
• Intrusion detection and prevention systems
• Automated security monitoring and alerting

• Role-based access controls with least privilege principles
• Employee security training and awareness programs
• Background checks for employees with data access
• Confidentiality agreements and security policies
• Incident response procedures

• SOC 2 Type II compliance
• GDPR-compliant data processing
• Regular third-party security assessments

When we transfer personal data internationally, we ensure appropriate safeguards are in place:

• Adequacy Decisions: Transfers to countries with adequate data protection laws as determined by applicable authorities
• Standard Contractual Clauses: EU-approved contractual terms for data transfers
• Binding Corporate Rules: Internal policies approved by data protection authorities
• Consent: In some cases, with your explicit consent

Our primary data processing facilities are located in the United States. We may also use service providers located in other jurisdictions. All international transfers are subject to appropriate safeguards as described above.

In the past 12 months, we have collected the following categories of personal information:

• Identifiers (name, email, phone number, IP address)
• Personal information under California Civil Code Section 1798.80(e)
• Commercial information (transaction history, services purchased)
• Internet or network activity (browsing history, interactions with our Platform)
• Geolocation data (general location based on IP address)
• Professional or employment-related information
• Sensitive personal information (government ID for verification, financial account information)

We collect certain sensitive personal information (such as government ID and financial information) solely for purposes permitted under CCPA, including:

• Performing services requested by you
• Detecting security incidents and fraud prevention
• Complying with legal obligations

We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA Section 1798.121.

You may submit a verifiable consumer request by:

• Emailing us at privacy@offairy.com
• Using the privacy request form in your account settings
• Calling our privacy hotline (if available)

You may designate an authorized agent to make a request on your behalf. We will require verification of your identity and confirmation that you authorized the agent to act on your behalf.

We will respond to verifiable consumer requests within 45 days. If we require more time, we will inform you of the reason and extension period (up to an additional 45 days).

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you via email (for registered users)
• Display a prominent notice on our Platform

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.