Privacy policy

Who is responsible

DataResellTech OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, is the controller of the personal data processed on privit.me. For any question, write to privacy@privit.me.

The principle: as little as possible

privit.me was designed to run on very little data. To create an account, we do not ask for your name, your date of birth or your phone number: an email address and a passkey are enough.

Creators also choose a username, which becomes their public pseudonym. Their legal identity never appears on the service.

Our commitments

No advertising trackers and no analytics cookies.

We never sell your data, to anyone.

No biometric data: Face ID and your fingerprint never leave your device.

Your data is stored in the European Union.

The data we process

Email address: stored encrypted and never shown to creators. We use it to recover your account and for messages about your account.

Username, for creators: the pseudonym you appear under.

Your passkey’s public key: it lets us check that it really is you signing in. The secret part of the key never leaves your device.

Country, derived from your IP address: used to apply the right taxes and legal rules. It is not stored together with your IP address.

Purchases and balance movements: top-ups, subscriptions, single photos, tips and payouts.

Photos uploaded by creators: metadata such as location is removed in the browser before upload.

Page chat conversations, encrypted: messages from visitors and from creators, and replies from their AI when it is switched on.

To let a page’s AI reply: the latest messages of the conversation, an encrypted conversation sheet (language, what has been said) and descriptions of the photos the page has published, processed by Cloudflare Workers AI.

For creators, before their first publication with nudity or their first payout: the data used to check their age and identity.

Technical logs, used to keep the service secure.

How passkey sign-in works

A passkey is a pair of keys created by your device. The secret key stays on your phone or computer, protected by Face ID, your fingerprint or your device code.

We only receive the public key, which cannot be used by anyone to sign in as you. Recognition of your face or fingerprint happens entirely on your device: nothing of it ever reaches us.

Why, and on what legal basis

Contract: creating and running your account, managing your balance, subscriptions and purchases, displaying collections, delivering messages and paying creators.

Legal obligation: accounting, tax, reporting creators’ income (DAC7), and handling reports under the Digital Services Act (DSA).

Legitimate interest: keeping the service secure and preventing fraud and abuse.

Cookies

We use five cookies, all needed for the service, and none is used to track you.

__Host-pp_f and __Host-pp_s: session cookies, to stay signed in as a member and to your page. Lifetime: 30 days, or 12 hours for the page if you do not ask to stay signed in.

pp_pref: remembers your language. Lifetime: 1 year.

pp_adulte: remembers whether you choose to see pages for adults. Lifetime: 1 year.

pp_chat: finds your conversation in a page’s chat when you are not signed in. Lifetime: 30 days.

You can delete these cookies from your browser. Without a session cookie, you simply sign in again; without the others, you will need to make your choices again.

How long we keep your data

Photos and files: until they are deleted or the account is closed, then 5 years in a restricted-access archive, used only to answer authorities or a dispute, before being erased.

Chat conversations: 12 months after the last message, then erased. They are also erased with your account, 30 days after the deletion request. A reported conversation is kept while the report is handled.

Account data: until you close your account. After a deletion request, the account can be recovered for 30 days, then your email address is erased.

Purchases and balance movements: 10 years, for accounting.

Technical logs: 90 days.

Payments and top-ups

When you top up your balance, the payment is handled by the relevant provider: facture.tel for phone payments, a card payment provider for cards, or the USDC network. These providers process the data needed for the payment under their own rules.

A USDC payment is recorded on a public blockchain: that is how this payment method works, and we cannot erase it.

Payments appear on bank statements under a neutral descriptor.

Who can access it

Only the members of our team who need it, and our processors:

Cloudflare, Inc., for hosting, with storage in Cloudflare’s European Union jurisdiction, and for the chat AI (Workers AI), whose processing may take place outside the European Union.

The payment providers that process balance top-ups.

Didit (Barcelona, Spain), which verifies the age and identity of creators before their first publication with nudity. We keep only the result (age verified or not): not the identity document, the images or the date of birth.

Some data may also be passed to the authorities when the law requires it, for example to the tax administration (DAC7) or in cases of illegal content.

Creators never see members’ email addresses.

Security

There is no password to steal: you sign in with a passkey. Email addresses are encrypted. Photo metadata is wiped before it even reaches us.

Within our team, access to personal data is limited to the people who need it for their work, and every access to the service runs over an encrypted connection.

Your rights

You can ask to access, correct, erase or port your data. You can also object to processing or ask us to restrict it.

Access: get a copy of the data we hold about you.

Rectification: correct inaccurate data, such as your email address.

Erasure: have your data deleted, except what the law requires us to keep.

Portability: receive your data in a machine-readable format.

Objection: object to processing based on our legitimate interest.

Restriction: ask us to freeze the use of certain data while a question is checked.

Write to privacy@privit.me from the address linked to your account. We reply within one month.

You can lodge a complaint with a supervisory authority at any time: the CNIL in France, or the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) in the publisher’s country.

Minors

The service is for adults only. We do not knowingly collect data about minors, and any account opened by a minor is deleted.

Updates

If our practices change, we will update this policy and let you know about any significant change. The date of the latest update appears at the top of the page.