Privacy policy

The controller responsible for processing your personal data within the meaning of the GDPR is:

Data protection officer: [Name and contact details of the data protection officer, if one is appointed]

Drafting note: Under § 38 BDSG a data protection officer is required once at least 20 people regularly process personal data, and in some other cases. Delete the line if none is appointed.

This policy covers three situations:

• visiting this website;
• applying for management through the application form;
• data held in our internal management tool (the “CRM”) about applicants, the creators we work with, their audiences and our own team.

Platforms you use as a creator, such as OnlyFans or Fansly, process data under their own privacy policies.

When you open this website, our hosting provider automatically processes the information your browser sends: IP address, date and time of the request, the page requested, the referring page, browser type and version, and operating system. We need this to deliver the website and keep it secure.

These server logs are deleted after [retention period, e.g. 7 days] unless they are needed to investigate a specific security incident.

When you apply, we receive the answers you enter:

• About you: stage name, email address, Telegram username or WhatsApp number (optional), country of residence, and your confirmation that you are 18 or older.
• Your accounts: the platforms you sell on, your main handle, and ranges for monthly earnings, subscribers and social followers.
• Your goals: the services you are interested in, the time you can commit, how you heard about us, and anything you add in the free-text field.

Providing this data is neither required by law nor by a contract. However, we need every answer that is not marked “Optional” to assess your application: without them we cannot review it, and the form cannot be sent. The Telegram or WhatsApp contact and the free-text field are optional; leaving them empty has no effect on your application (Art. 13 (2) (e) GDPR).

We do not ask for your legal name, photos or identity documents in the form. Please do not send them, or any explicit content, through it.

Drafting note: The fact that someone works as an adult content creator may reveal information about their sex life, a special category of data under Art. 9 GDPR. Have counsel assess whether Art. 9 applies to the application and CRM data and, if so, which exception is relied on (for example explicit consent collected in the form).

We run the agency on an internal tool that only our team can access. It holds:

• Applicants: your application answers, our notes from calls and messages, and the status of your application.
• Creators we manage: contact details, contract terms, account handles, revenue and payout figures, content and shift schedules, and the information needed to pay you.
• Fans of the creators we manage: platform usernames, purchase and tip history, and conversation notes our chat team needs to reply consistently.
• Our team: name, work email, role, assigned creators, shifts, and sign-in and access logs.

Drafting note: Define the agency’s role for fan data: processor on behalf of each creator (then sign a data processing agreement under Art. 28 GDPR with every creator) or joint controller with them (Art. 26 GDPR). The wording above must match that decision.

We only process personal data where the GDPR allows it:

Where we rely on legitimate interests, you can object at any time (see Your right to object below). Where we ask for consent, you can withdraw it at any time with effect for the future.

Drafting note: Art. 21 (4) GDPR requires this notice to be brought to the data subject’s attention explicitly, clearly and separately from any other information, at the latest with the first communication. Keep it as its own section and framed block, and have counsel confirm the wording, which processing it covers and whether the direct-marketing paragraph applies at all.

Inside the agency, only team members who need the data for their work can see it, and everyone on the team is bound by a confidentiality agreement (NDA). We do not sell personal data and do not share it for advertising.

We use these service providers (processors under Art. 28 GDPR), each under a data processing agreement:

Website hosting

[Provider name], [location]

CRM hosting and database

[Provider name], [location]

Email

[Provider name], [location]

Payouts to creators

[Payment providers or bank]

We also pass data to tax advisors and authorities where the law requires it, and to the platforms on which we manage accounts, to the extent needed to provide our services.

Some team members or providers may work from countries outside the EU or the European Economic Area. We only transfer personal data there if the European Commission has found an adequate level of protection for the country or if appropriate safeguards are in place, such as the EU Standard Contractual Clauses (Art. 46 GDPR).

Countries and safeguards: [List the countries where team members or providers process data and the safeguard used for each]

• Applications that do not lead to a collaboration: deleted [period, e.g. 6 months] after our decision, unless you agree to a longer period.
• Creators we manage: for the duration of the agreement, then for as long as claims can arise from it, [period].
• Records the law requires us to keep: for the statutory periods under German commercial and tax law (§ 257 HGB, § 147 AO).
• Access logs of the CRM: [period].
• Server logs of the website: see “Data we collect when you visit”.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interests (Art. 21; see Your right to object);
• withdraw consent at any time, with effect for the future (Art. 7 (3)).

To use any of these rights, email [Privacy contact email]. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: [Competent supervisory authority].

This website does not use tracking or advertising cookies, analytics that profile you, or third-party social media plugins.

We only store what is strictly necessary for a function you use (§ 25 (2) TDDDG). For example, the internal CRM remembers the display palette a team member chooses in their own browser’s local storage, and team sign-in will use a session cookie.

Drafting note: Update this section before adding any analytics, embedded media or marketing tools: most of them need prior consent.

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections (TLS), access to the CRM limited to named team members, logging of that access and confidentiality agreements for everyone on the team. [Describe any further measures]

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you. [Who decides on applications, e.g. “A member of our team reviews every application.”]

Drafting note: Confirm with the founder how applications are reviewed before stating it here. If any tool scores or filters applications automatically, this section must describe it (Art. 13 (2) (f) and Art. 22 GDPR).

We update this policy when our processing changes. The date at the top shows the current version. If a change affects you as a creator we work with, we will tell you directly.

Questions about your data: [Privacy contact email]. For everything else, see the imprint.