All UsersWebsite Policies

Privacy Policy

Version 1.0Last updated 22 October 2026Effective 22 October 2026

Preamble

We, DAAR GLOBAL LIMITED (“we”, “us”, “desioart”), operate the adult content platform at desioart.com, where creators publish their own content and fans subscribe to it, buy it and communicate with creators.

In this privacy policy we tell you, as Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) require, which personal data we process, for which purposes, on what legal basis, who we share it with, how long we keep it and what rights you have.

This privacy policy is information under Articles 13 and 14 GDPR, not a contractual term. It supplements our terms of service (Terms), the creator terms (Creator Terms) and the cookie policy (Cookies); on questions of data protection, this policy prevails where they differ.

It covers everyone whose data we process in connection with the platform: fans, creators, co-performers (people who appear in a creator’s content, including those without an account of their own), visitors without an account, people who submit a report or a takedown request, and developers of third-party apps. Section 15 has specific information for people without an account, and section 16 for users outside the EEA.

1 Controller and data protection contact

1.1 Controller

The controller within the meaning of Article 4(7) GDPR is:

DAAR GLOBAL LIMITED 1 Apriliou 52, 7600 Athienou, Larnaca, Cyprus Registration number: HE 497557 Email: privacy@desioart.com Director: Alexander Repp

1.2 Data protection contact

For anything to do with data protection you can reach us at:

Email: dpo@desioart.com Post: marked “Data protection”, 1 Apriliou 52, 7600 Athienou, Larnaca, Cyprus

1.3 Supervisory authority

Our competent (lead) data protection supervisory authority is:

Office of the Commissioner for Personal Data Protection (Republic of Cyprus) 1 Iasonos Street, 1082 Nicosia, Cyprus Tel: +357 22818456 · Email: commissioner@dataprotection.gov.cy Web: https://www.dataprotection.gov.cy/

You can also turn to the supervisory authority of the country where you live — in Germany, the data protection authority of your federal state; in Austria, the Datenschutzbehörde; in Switzerland, the FDPIC (section 9.9).

1.4 No representative required

Because we are established in the EU, we need no EU representative under Article 27 GDPR. The platform is not available in the United Kingdom (Age Verification section 7), so we have appointed no representative under the UK GDPR. Section 16 applies to users in Switzerland; given the scope of our processing we currently need no representative under Article 14 of the Swiss Data Protection Act.

2 The data we process

We process the categories of personal data set out below. Which of them concern you depends on whether you are a visitor, a fan, a creator or a co-performer.

2.1 Basic account data

All accounts: email address, username, password (stored only as an Argon2id hash — there is no password where you sign in through a third party, section 2.12), language (DE/EN/FR), time zone, account type (fan, creator, co-performer), account status, date and method of registration.
Creators in addition: legal name, date of birth, address, country of residence, any stage name or alias (also for the record-keeping obligations under 18 U.S.C. § 2257), business form and company details (company name, registration number), tax identification number and issuing country, VAT number and VAT status, tax forms (W-9, W-8BEN, DAC7 self-certification), bank details (IBAN, BIC, account holder — stored encrypted, with a 7-day waiting period after any change) or a crypto payout address.
Linked accounts: where you run several accounts under the same verified identity (Creator Terms section 2.5), we store how the accounts relate to one another and a log of switches between them.

2.2 Verification data (18+ and identity)

We use two separate procedures (how they run: Age Verification; your rights: section 4):

(a) Age verification for every user and visitor who wants to see adult content, carried out by our age verification provider (section 5.1). The check itself — an identity document check or a biometric age estimate, depending on the method chosen — happens at the provider. All we receive and store is: the outcome (passed or not passed), the assurance level, the time, the expiry date, a verification reference from the provider, and the country and region in which verification took place (for youth protection, tax and geoblocking rules). We do not receive images of identity documents, selfies or biometric data.

(b) Identity verification (KYC) for creators and for co-performers in content that is not suitable for all audiences, carried out by our identity verification provider (section 5.1). The provider processes: the identity document (scan or photo), a liveness video or selfie, a biometric comparison between the document photo and the selfie, a document authenticity check, sanctions and PEP list screening, and device and connection data. We receive and store: the outcome and, where applicable, the reason for rejection, the time, the document type, the issuing country, the date of birth, the name on the document, a hash of the identity document (to detect multiple accounts — not the document itself), the verification reference, the result of the sanctions and PEP screening and — solely for the record-keeping obligations under 18 U.S.C. § 2257 — a copy of the identity document, held in the specially protected records area (2257 Statement).

Biometric data (facial comparison data) is created at the verification provider and stays there. It never reaches us — neither as a copy nor through access to their systems; all we receive is the result of the check.

We also store event data free of personal identifiers about how verification progressed (started, abandoned, passed — with no content) for statistics and to detect misuse.

2.3 Profile and content data

Profile picture, cover image, bio, stage name, pronouns, optional location or country, links to external social media profiles (and how often they are clicked), promotional covers, intro video.
Uploaded content (posts, photos, videos, audio, polls), the media library (“vault”) including a usage record showing where an item has been published or sold, categories and tags, the “AI-generated” label and its accompanying notice, schedules and expiry dates.
Technical metadata of media (file type, size, duration, checksums or hashes, watermark reference). We strip EXIF and location data on upload.
Details of people appearing in content (co-performers): which media they relate to, consents and withdrawals, time codes, the number of people detected (section 2.13).
Interactions: follows, subscriptions, likes, comments, poll votes, saved collections, creators you have hidden.

Publicly visible — including to visitors without an account and without age verification — are: username, stage name, profile picture and cover image (retrievable through unsigned links), a bio suitable for all audiences, subscriber count, post count, social links and previews suitable for all audiences. Everything else is visible only after signing in, verifying your age and, where applicable, subscribing or buying (Creator Terms section 5.5).

2.4 Special categories of personal data (Article 9 GDPR)

Because of what the platform is for, we process data that allows conclusions to be drawn about sex life or sexual orientation. That includes:

content you upload as a creator, and how you categorise it;
content you view, subscribe to, buy or tip as a fan;
your interactions (likes, comments, messages) with particular creators;
your search queries, so far as they allow such conclusions (for statistics we assign search terms only to broad content categories, and we keep your search history only briefly, section 2.7).

We process this data only with your explicit consent (section 3.2). We do not use it for recommendations or advertising unless you have consented separately (Terms section 3.5), and we do not pass it to advertising partners.

We never ask about ethnic origin, religion, nationality or political opinion.

2.5 Payment and transaction data

Payment method: for card payments only a token from the payment service provider, the card type, the last four digits and the expiry date — we never receive the full card number, which stays with the payment service provider (section 5.1). For other methods the references the provider sends us.
Crypto payments (section 5.1): the provider’s payment ID, the cryptocurrency and network chosen, the transaction identifier (blockchain hash), the amount, the exchange rate, the network fee and the status (confirmed, underpaid, overpaid, expired); for creator payouts, the receiving address you have stored. Blockchain transactions are public and cannot be deleted.
Billing address or billing country, evidence of location for VAT purposes (country of the IP address, billing country, country of the payment method or BIN country — Article 24b of the VAT Implementing Regulation), tax and billing records.
Transaction history (date, amount, recipient creator, type: subscription, PPV, tip, custom request or media link), failed payments, refunds and who bore their cost, chargebacks and dispute notifications from the card networks, and automatic updates of expired card details (“account updater”) where enabled.
Routing decisions: which payment service provider processed a payment (country, amount, provider — with no reference to content).
For creators: the balance account (a contractual claim, Creator Earnings section 6.1), ledger entries, payout requests, fees, withholdings and reserves, set-off items, referral commission and tax reporting data (DAC7, 1099-NEC).
The spending limits you have set and how they have changed; payment problem reports; the results of sanctions screening and of fraud and anti-money-laundering checks (section 3.4).

2.6 Communication data

Direct messages between fans and creators, including attachments, paid messages (PPV), tips and custom request arrangements; read and delivery status; whether a message was generated automatically or with AI; withdrawing a message is stored as a marker (the content remains until the conversation is deleted, as evidence).
Broadcasts and automatic messages from creators: content, audience criteria, deliveries, and your unsubscribes.
Support enquiries, complaints, reports, appeals, payment problem reports, DMCA notices and counter-notices (with the contact details in them encrypted), NCII reports, and invitations to co-performers.
An access log recording when and why a member of staff looked at message content.

How we handle messages. We do not read along, and we do not search message text algorithmically for breaches. Trained staff look at a message only where someone involved reports it, where an appeal or complaint concerns it, or where the law obliges us; every such access is logged. There are three exceptions you should know about:

Every image and video file you send in messages — whether from the creator’s media library or uploaded straight into a message — goes through the comparison against databases of known abuse material on upload (section 2.10). A checksum is calculated and compared; the message itself is not read.
For media in messages we calculate a checksum (SHA-256) to confirm that everyone appearing has consented to it being sent (section 2.13); nothing about the content is assessed.
When you write to an AI persona (Community section 2.5), your message text is sent to our AI provider to generate the reply and is checked automatically for signs of an acute crisis. Where there is a match, the role play is interrupted and sources of help are shown (section 2.11).

2.7 Usage data (logs and statistics)

Server logs: IP address, time, address called up, browser and device type, error codes and a technical reference for the request (“trace ID”); error messages are stripped of personal content before being logged.
Activity signal: while the platform is visible in your browser it sends a signal every 60 seconds, from which we derive session length and the number of active users per day, week and month — with no link to your registration record. Nothing is sent where “do not track” is switched on.
Pseudonymised content statistics for creators (view, playback and purchase events for media, and profile visits): without an IP address in the clear and without a direct user identifier (a cryptographic pseudonymous hash). Linking events to an individual visitor happens only with your analytics consent (the cookie banner) and never where “do not track” or stealth mode is active — otherwise only anonymous totals are counted. No view or playback events are recorded in private messages. Purchase events are counted pseudonymously even without consent (legitimate interests, billing). Raw events are kept for 24 months.
Search history: we keep your searches for you for 90 days, then anonymise them and delete them after 180 days. For demand statistics we assign search terms to broad categories (k-anonymous, no individual profiles). Nothing is recorded where “do not track” is switched on.
App telemetry (only with analytics consent, and respecting “do not track”): installation and use as a web app, loading times (web vitals) and device class — only as aggregated daily figures, and only from 10 users upwards.
Creators’ tracking and media links: clicks on promotional links creators share away from the platform (a hashed visitor identifier, bot detection). Attributing a later purchase or registration to a link happens only with marketing consent (the tl_attr cookie, 90 days).
Referral attribution (Terms section 10): referral code, time, hashed IP; fraud signals (hashed device, IBAN and IP characteristics, clusters) — used only for financial and compliance purposes, never as an automatic ground for suspension.
Voluntary answers in surveys: multiple-choice answers feed anonymously and in aggregate into creator statistics; optional free text is seen only by the platform, never by the creator.
Presence: the time of your last activity (“last online”), used for platform features. You can hide it in your privacy settings.

We use no third-party analytics or advertising services — no web analytics, no advertising pixels, no social media plugins — and no cross-site tracking.

2.8 Marketing and notification data

Notification settings by category (service, compliance, activity, marketing) and quiet hours.
Marketing consent status with evidence (time, hashed IP, double opt-in confirmation) and unsubscribes.
A suppression list for email delivery (only a hash of your email address and the reason: undeliverable, complaint, unsubscribe). The hash survives account deletion so that we do not write to you again.
Push notifications: the endpoint address of your browser or device (only once you enable them). Push text is always generic (“new message”, “account update”) and contains no names, previews or images.
We do not record email opens or clicks.

2.9 Playback and access logs protecting content

When protected video or audio content is played, we log the access to prevent misuse and piracy and to preserve evidence. For each playback we record:

the user identifier of the account accessing it;
the hashed IP address and a hashed device and browser identifier (never in the clear — SHA-256 with a secret);
the session or playback token identifier, and the time.

In addition, a visible watermark tied to the viewer is shown over the player during playback, and every rendered copy carries a unique identifier so that leaks can be traced. These logs serve solely to protect creators’ content against unauthorised distribution and are never used for advertising or profiling. Legal basis: legitimate interests (section 3.4); retention: 90 days (section 7).

2.10 Automatic comparison of uploaded media against databases of known abuse material

Every image and every video (for videos, individual still frames) that you upload to the platform — as a post, into your media library, or as a profile or cover image — is compared automatically, before publication, against databases of known child sexual abuse material (CSAM). To do that we calculate a robust perceptual hash on our own systems — a digital fingerprint of the image from which the image cannot be reconstructed. Only that fingerprint — no image, no user identifier, no account data — is sent to a specialist matching service and compared there, in a data centre in the EU, against hash databases of verified abuse material, including those of NCMEC and other specialist bodies. No AI assessment of your content takes place: the comparison is only ever against material already known and verified by specialist bodies. We also calculate further perceptual hashes locally to recognise content already removed if it is uploaded again, and we scan every file with a virus scanner we run ourselves. The same comparison applies to image and video files you upload into private messages (section 2.6).

The file is not published until the result is in; if the service is temporarily unavailable, we repeat the comparison automatically. Where there is no match, the file is released as normal. Where there is a match, the file is blocked immediately and never published, is preserved as evidence (section 7), and the matter is handled by our compliance team and — where we are obliged or entitled to do so — reported to the National Center for Missing & Exploited Children (NCMEC) and/or the competent law enforcement authorities (section 5.3). We add the fingerprints of blocked content to an internal blocklist so that the same content cannot be uploaded again.

For each file we store the calculated hash values, the result of the comparison and — where there is a match — the match metadata supplied by the service (case reference, source database, category). Image data is neither transmitted to the matching service nor stored by it. Legal bases: our legitimate interests and those of the public in protecting children and keeping the platform free of abuse (Article 6(1)(f) GDPR, section 3.4), and, so far as reporting and retention obligations apply (Article 18 DSA; 18 U.S.C. § 2258A), Article 6(1)(c) GDPR (section 3.3). Retention: section 7.

2.11 AI features

AI text tools for creators (suggested replies, captions, drafts for broadcasts — Creator Terms section 4.7): the creator enters a prompt and we send it to our AI provider (section 5.1). Prompts contain no fan identifiers, email addresses or legal names — only the creator’s stage name and the text the creator entered. We log the use case, the provider, the model and the result of our safety filters — not the prompt or the output text.
AI personas (creator profiles operated by the company, Community section 2.5): when you write to an AI persona, the text of your message (without your name or email address) is sent to the AI provider to generate a reply. An automatic check for crisis keywords protects you (section 2.6, exception 3). The AI persona is labelled as such and keeps no profile of you beyond the ordinary message history.
Provenance records for AI-generated content (model, prompt, age attestation, checker version) are stored for the personas we operate ourselves; for the content of human creators we store the “AI-generated” label and its accompanying notice.
Our AI provider is contractually obliged not to store the text we send and not to use it to train models (sections 5.1 and 6).

2.12 Third-party sign-in (single sign-on) and login data

If you sign in with Google, Apple, Discord or Reddit, all we receive from the provider is your user identifier there and, where you release it, your email address (Reddit sends no email address). We store no access tokens from the provider and use the connection solely for signing in, never for marketing or analytics. Signing in through a third party does not replace age verification. What the provider learns about your sign-in with us is governed by its own privacy policy (section 5.2).

Further login and security data: session and device information (hashed browser and device fingerprint, country, hashed IP), the times and outcomes of login attempts, two-factor settings (the TOTP secret encrypted, recovery codes), passkeys (only the public key, a counter and a device name — the private key stays on your device), “trusted devices” (30 days), login alerts for a new device or country, and risk signals used to decide whether to ask for additional confirmation (90 days, hashes only). When you change your password we check whether it appears in known data breaches (section 5.2 — only the first five characters of a hash are transmitted, never the password). The optional app lock using fingerprint or face runs entirely on your device: biometric data never reaches us.

2.13 Data about co-performers and consents

Where other people appear in a creator’s content, we process the following about them: contact details from the invitation (email address, a time-limited invitation token), verification data under section 2.2 (age verification for content suitable for all audiences, identity verification otherwise), consents given, standing and withdrawn, each with a time, hashed IP and device identifier, the media and time codes they relate to, the number of people detected in an item (a count performed on your device — no facial recognition, no identification), any redactions, and the records required under 18 U.S.C. § 2257. The detail is in Co-Performers and in section 15.1.

2.14 Internal notes and access logs

Our support and compliance team can make internal notes on your account. They cannot be altered afterwards, are deleted with the account and in any event after 5 years, and form part of what you receive under Article 15 (without the name of the member of staff who wrote them). Every access by a member of staff to your basic data, messages or evidence is logged; bank and identity document data is shown only to staff in the roles designated for it and never in the clear.

3 Purposes and legal bases

We process your data only where one of the following legal bases applies.

3.1 Performance of the contract (Article 6(1)(b) GDPR)

To perform the user agreement with you (the terms of service and the creator terms) we process:

basic account data (section 2.1) to manage your account, sign you in and keep the account secure (section 2.12);
profile and content data (section 2.3) to provide the platform’s features, including watermarking and content protection;
transaction data (section 2.5) to handle subscriptions, tips, PPV, custom requests, media links, refunds and payouts;
communication data (section 2.6) for messages, notifications and support;
statistics for creators about their own content (section 2.7), so far as these contain nothing personal about fans;
the attribution of purchases to referral codes and tracking links, so far as it serves payment (section 2.7);
the processing of your messages to AI personas in order to generate the reply (section 2.11), if you use that feature;
for creators, identity verification as a precondition for payouts (section 2.2).

3.2 Explicit consent for special categories (Article 9(2)(a) GDPR)

For processing data about sex life or sexual orientation (section 2.4) we obtain your explicit consent at registration. Consent is given through a separate, dedicated mandatory checkbox reading as follows (or in legally equivalent words):

☐ “I expressly consent to desioart processing personal data that allows conclusions to be drawn about my sex life or sexual orientation, through viewing, subscribing to, buying or uploading adult content and my interactions with it. This consent is a precondition for using the platform. I may withdraw it at any time with effect for the future, in which case my account will be closed.”

You can withdraw this consent at any time in your privacy settings. The consequence is that your account is closed (section 7.2), because using the platform is not possible without this processing. Statutory retention obligations (section 7) are unaffected.

The biometric comparison carried out as part of age or identity verification (section 2.2) takes place at the provider concerned, on the basis of the explicit consent you give there, before the check begins. For age verification, methods without facial analysis are also available to you — an identity document, a payment card or a digital identity wallet. Identity verification of creators and co-performers requires a comparison between the document photo and a live image, without which no activation is possible.

3.3 Legal obligation (Article 6(1)(c) GDPR)

We process data to comply with legal obligations:

age and identity verification (youth protection under the JMStV and the KJM, Article 28 DSA; anti-money-laundering under Cypriot AML Law 188(I)/2007, where applicable);
records under 18 U.S.C. § 2257 (2257 Statement);
accounting, invoicing and tax reporting (Cypriot tax and company law, VAT and one-stop-shop evidence under Article 24b of the VAT Implementing Regulation, DAC7 reporting of creators’ income to the Cypriot tax authority, and US form 1099-NEC where applicable);
obligations under the Digital Services Act: notice and action procedures, statements of reasons, appeals, transparency reports, and reporting suspected serious criminal offences (Articles 16 to 24 DSA);
obligations to provide information and material to authorities (only on a valid order, section 5.3);
reporting and retention obligations concerning child sexual abuse material (Article 18 DSA; 18 U.S.C. § 2258A) — the hash comparison and preservation of evidence under section 2.10;
handling data subject requests (Articles 12 to 22 GDPR), reporting and documenting personal data breaches (Articles 33 and 34), and where applicable security incidents under NIS2 (section 13);
implementing sanctions (sanctions and PEP screening of creators and payouts);
consumer protection evidence.

3.4 Legitimate interests (Article 6(1)(f) GDPR)

We process data on the basis of legitimate interests for:

IT security and preventing misuse: protection against unauthorised access (login logs, risk signals, device recognition, two-factor checks, lockout after failed attempts), bot protection, defence against network-level attacks (IP reputation lists, geolocation of IP addresses, a web application firewall, attack detection), checking passwords against known breaches, and virus scanning of uploads — our interest: the security of the platform and of your data.
Preventing fraud, money laundering and circumvention: detecting card testing, chargeback patterns, multiple and sock-puppet accounts, referral fraud and attempts to get around a suspension (hashed characteristics of permanently suspended accounts, section 7.2), withholdings and checks before payouts, and sanctions screening — our interest: protecting the platform, creators and fans.
Enforcing our rules: handling reports, preserving evidence, strikes and suspensions, the blocklist of removed content, recognising removed content on re-upload (hash comparison), and detecting abusive reporting — our interest: a safe platform, protecting third parties, and defending legal claims.
Protecting children: comparing uploaded media against databases of known abuse material (section 2.10) and handling the resulting suspicions — our interest: protecting children and the public.
Protecting creators’ content: playback and access logs, watermarks, leak attribution (section 2.9) and handling DMCA notices — our interest: protecting content and preserving evidence where leaks occur.
Aggregated statistics and improving the platform: anonymous usage figures, error analysis (trace IDs, sanitised logs), demand statistics by country and content category (k-anonymous, from 10 people upwards), and pseudonymised purchase events for creator statistics — our interest: service quality and planning what we offer.
Payment processing in the background: choosing the right payment service provider for each payment (routing), handling dispute notifications and card updates, and payment analysis using a pseudonymised user identifier — our interest: reliable, cost-effective payment processing and avoiding chargebacks.
Communicating with existing customers: pointing creators to features and selling tips (you can unsubscribe at any time), reminders about expiring verifications, and dormancy and inactivity warnings — our interest: the business relationship.
Internal administration: internal notes, access and change logs, evidence of consents and acceptance of the terms, and handling enquiries from people without an account — our interest: being able to demonstrate compliance (Article 5(2) GDPR).
Corporate transactions: disclosure to advisers and potential acquirers in a restructuring or sale, under confidentiality (section 5.2).

You have the right to object to this processing at any time on grounds relating to your particular situation (section 9.6). You can request a summary of our balancing assessments at dpo@desioart.com.

3.5 Consent (Article 6(1)(a) GDPR, section 25(1) TDDDG)

We rely on your consent for:

marketing communications (newsletters, promotional emails, marketing push) — using double opt-in: you switch the option on (it is off by default), receive a confirmation email, and the consent takes effect only when you click the confirmation link, which is valid for 7 days. You can withdraw it at any time in your privacy settings or through the unsubscribe link in every marketing email;
non-essential cookies and similar technologies (the analytics, marketing and personalisation categories) through the cookie banner (section 8, Cookies);
visitor-level content statistics for creators (section 2.7) and attribution of purchases and registrations to tracking links (section 2.7);
platform marketing using creators’ content (“featured”, trending, previews in emails), after agreement in the creator dashboard (section 12.3);
connecting external accounts by creators for cross-posting (section 5.6).

Service emails — confirmations, payment and payout notices, security warnings, legally required notifications and changes to the terms — reach you even without marketing consent, because they are necessary to perform the contract or to comply with the law (section 12.1).

3.6 Overview: purpose, data categories, legal basis

Purpose	Data categories (section 2)	Legal basis
Creating, signing in to and securing an account	2.1, 2.12	Article 6(1)(b); security measures: 6(1)(f)
Age verification (everyone)	2.2(a)	Article 6(1)(c) (youth protection) · biometrics at the provider: Article 9(2)(a)
Identity verification of creators and co-performers	2.2(b), 2.13	Article 6(1)(b), (c) (AML and 2257 where applicable), (f) · biometrics: Article 9(2)(a)
Providing content, subscriptions, purchases, messages	2.3, 2.5, 2.6	Article 6(1)(b) · content of a sexual nature: Article 9(2)(a)
Processing payments, routing, chargebacks	2.5	Article 6(1)(b); routing and analysis: 6(1)(f); accounting: 6(1)(c)
Payouts and tax reporting	2.1, 2.5	Article 6(1)(b), (c)
Enforcing our rules, reports, appeals	2.3, 2.6, 2.14	Article 6(1)(c) (DSA), (f)
CSAM hash comparison, reports to NCMEC and authorities	2.10	Article 6(1)(f), (c) where obliged · Article 10
Protecting content (watermarks, playback logs)	2.9	Article 6(1)(f)
Preventing fraud and circumvention	2.5, 2.7, 2.12	Article 6(1)(f), (c) (AML)
Statistics for creators, platform analytics	2.7	consent (Article 6(1)(a), section 25 TDDDG); aggregated: 6(1)(f)
AI tools and AI personas	2.11	Article 6(1)(b) (at the user’s request); crisis check: 6(1)(f) or vital interests (Article 6(1)(d))
Marketing	2.8	Article 6(1)(a); notices to existing customers: 6(1)(f)
Data subject rights, data breaches	2.14, 9	Article 6(1)(c)
Internal notes, access logs	2.14	Article 6(1)(f)

3.7 Where your data comes from (Article 14 GDPR)

Most data comes from you (registration, profile, use, payments, messages) or arises from your use (logs, statistics). We also receive data:

from our verification providers (the outcomes of age and identity checks, section 2.2);
from payment service providers and card networks (payment status, chargebacks, dispute notifications, updated card tokens, fraud signals);
from sign-in providers (SSO, section 2.12);
from creators who add or invite you as a co-performer (sections 2.13 and 15.1), mention you in messages or record your payment as a custom request arrangement;
from other users or third parties who submit a report, complaint or DMCA notice about you or your content (we do not tell you who reported something, Article 16 DSA);
from authorities, courts and specialist bodies;
from referral links and tracking links through which you came to us.

4 Verification and automated decisions

4.1 Age verification

For the age verification of all users and visitors we use a specialist age verification provider (a processor bound by a contract under Article 28 GDPR, section 5.1). You are taken to the provider, choose a method there, and we receive only the outcome (section 2.2(a)). Verification is time-limited; how long it lasts follows from the result of the check and is shown in your account. We remind you before it expires (30 days, 7 days, and on the day itself). The requirements and the procedure are in Age Verification.

4.2 Identity verification

For the identity verification of creators, and of co-performers in content not suitable for all audiences, we use a specialist identity verification provider (a processor bound by a contract under Article 28 GDPR, section 5.1). The data processed is set out in section 2.2(b). The provider stores verification data on servers in Lithuania (EU), and its privacy notice is shown to you before the check begins. We may require re-verification — where a document has expired, where we suspect an account takeover, or where payout details have changed.

4.3 Automated decisions during verification (Article 22 GDPR)

Age and identity verification involve automated decisions (liveness check, document check, comparison of document photo and selfie, and age estimation where used) without human involvement, so far as the system can reach a clear conclusion. Borderline or unusual cases go to manual review by trained staff at the provider or at our end. Failing verification means you cannot see adult content or cannot act as a creator.

Under Article 22(3) GDPR you have the right:

to human intervention on our part;
to express your point of view on the decision;
to contest the decision.

You can exercise these rights at privacy@desioart.com or in your account under “verification → report a problem”; we reply within one month.

4.4 Other automated decisions

Besides verification, our systems make the following automated decisions that may significantly affect you. In every case you can ask for a human review — through an appeal (Appeals, within 6 months) or at privacy@desioart.com:

Decision	Basis	What happens	Human review
Blocking a file on a hash match against CSAM databases (section 2.10)	Article 22(2)(b) together with Article 6(1)(c)/(f)	the file is never published; the case goes to the compliance team	the compliance team reviews the case; appeal available
Temporarily hiding content once a reporting threshold is reached (Acceptable Use section 10.1)	Article 22(2)(a) (contract) / (b)	the content is temporarily invisible pending review	every report is reviewed by a person within the service level
Temporary suspension once strike points are reached (Acceptable Use section 9)	Article 22(2)(a)	the account is restricted for a time	appeal available; permanent bans are always decided by two people
Holding a payout where risk signals appear (Creator Earnings section 3.2)	Article 22(2)(a)/(b) (AML)	the payout is held pending review	compliance reviews; appeal available
Declining a payment by a payment service provider or our fraud check	Article 22(2)(a)	the payment is not carried out	contact support
Suspension on suspected circumvention (characteristics of a permanently suspended account, section 3.4)	Article 22(2)(a)/(b)	registration or sign-in refused	appeal at appeals@desioart.com
Automatic spending limit check	Article 22(2)(a) (your own limit)	payment above the limit declined	you change your own limit (24-hour waiting period)

The following are not automated decisions within the meaning of Article 22: asking for additional confirmation on an unusual sign-in, the ordering of the feed (Terms section 3.5), reminders and statistics.

5 Recipients and processors

We pass your data only to the recipients below, and only so far as this is necessary for the purpose concerned. Some services are not yet switched on at the time of this version; they are listed so that you have the full picture. Services we no longer use are removed.

5.1 Processors (Article 28 GDPR)

Service	Function	Data processed	Seat / place of processing	Transfer outside the EEA
Age verification	age verification of all users and visitors (section 2.2(a))	the check itself takes place at the provider; we receive only the outcome, level, expiry and country/region	Portugal (EU); hosting in the EU	no
Identity verification (KYC)	identity verification of creators and co-performers, liveness, document check, sanctions and PEP screening (section 2.2(b))	identity document, selfie or video, biometrics (only at the provider)	Lithuania (EU)	no
Payment service provider (cards, regional methods)	processing card and regional payments, chargebacks, account updater, dispute notifications and, where applicable, payouts (an independent controller for the payment itself, section 5.2)	payment data, billing data, email address, IP	EU or USA, depending on the provider	only for providers established in the USA: yes → SCC + DPF
Payment service provider (cryptocurrencies)	crypto payments from fans and crypto payouts to creators (section 2.5; an independent controller for the payment itself, section 5.2)	payment ID, wallet addresses, amounts, email address	Caribbean (corporate seat), contact address in the EU	yes → SCC
Hosting	server hosting for the platform and databases	all data (encrypted at rest)	data centre in the EU	no
Object storage	object storage for media, message attachments, data exports, encrypted backups and evidence (WORM)	media, backups	USA; storage region EU (Amsterdam)	processing in the EU; group access → SCC + DPF
Content delivery network (CDN), video streaming, web application firewall	delivering media through signed short-lived links, video transcoding and player, web application firewall	media, IP addresses of those retrieving them	Slovenia (EU); worldwide edge network — delivery from the node nearest to you	edge nodes outside the EU → SCC
Email delivery	sending service, compliance and — only with consent, from a separate sending domain — marketing emails; handling bounces and complaints	email address, message content, delivery status	Luxembourg (EU); Frankfurt region; US parent company	processing in the EU; group access → SCC + DPF
Hash comparison (known abuse material)	comparing image fingerprints (no images) against databases of known abuse material (section 2.10)	hash values	Ireland (EU); US parent company	group access → SCC + DPF
AI text generation (an intermediary service with model providers behind it)	generating AI text (section 2.11) — routes without logging, no training	prompt text without fan identifiers; message text sent to AI personas	USA	yes → SCC
Bot protection	bot protection on registration, invitation and reporting forms — cookieless, no tracking	IP, browser characteristics, result token	USA (processing in the EU)	yes → SCC + DPF
Hash comparison (intimate images)	comparing hashes of intimate images that are not to be shared; a non-profit reporting procedure that those affected can also use themselves (NCII Takedown)	hash values	United Kingdom	UK adequacy decision
Email mailboxes (hosting)	running our mailboxes (support, compliance and role addresses): receiving, storing and answering your emails to us	email address, content and attachments of your messages to us	Netherlands (EU); EU data centres; parent company outside the EU	group access possible → SCC
A further storage provider, independent of the others (third backup copy)	monthly backup; the copy is encrypted on our systems before transfer and the provider cannot read it	encrypted backups	–	encrypted data only

We describe our service providers by category, function, place of processing and transfer basis and — as is usual in this industry, and for security reasons — do not name them; Article 13(1)(e) GDPR expressly allows categories of recipients to be given. We provide the list of names on request at privacy@desioart.com. Contracts under Article 28 GDPR are in place with every processor, or are concluded before the service is switched on. Our core systems (database, search, queues, logging, security monitoring and error analysis) we run ourselves on rented servers in the EU; no external error analysis service is in use.

5.2 Third parties acting as independent controllers

The following third parties process data on their own responsibility; their privacy notices apply in addition:

Sign-in providers (Google, Apple, Discord, Reddit) where you use them to sign in (section 2.12) — the provider learns that you are signing in to desioart;
a service for checking passwords against known breaches: a query using the first five characters of a password hash (k-anonymity) — nothing personal is transmitted;
the push services of your browser or operating system (Google, Apple, Mozilla), which deliver push notifications — the content is generic (section 2.8);
external platforms to which a creator cross-posts content (section 5.6), and external sites creators link to — we have no influence on how they process data;
third-party apps to which a creator grants access to their account through the API (section 5.6);
card networks, acquirers and banks as part of payment processing, and payment service providers for the payment itself;
advisers (lawyers, tax advisers, auditors, insurers) under a duty of confidentiality, and, in a restructuring, sale or insolvency, potential acquirers under confidentiality;
authorities, courts and specialist bodies (section 5.3).

Libraries that run in your browser are loaded from our own servers and send nothing to their makers. We determine the country you access from using the country code our content delivery network derives from your IP address — we do not store the IP address itself for that purpose.

5.3 Authorities, law enforcement and specialist bodies

We pass data to authorities only where we are legally obliged to or where it is necessary to protect people:

Law enforcement and supervisory authorities: on a valid order in the individual case. We release identity data only on a lawful order, never on an informal request. We review every request and inform you where the law allows.
NCMEC (National Center for Missing & Exploited Children, USA): on confirmed hash matches (section 2.10) or reasonable suspicion of child sexual abuse material — what is transmitted is the blocked content, hash values, the time and, depending on the reporting level, the account data of the uploading account, so far as the report requires it.
Internet Watch Foundation (UK), jugendschutz.net and comparable reporting bodies: information about illegal content.
The reporting service for intimate images that are not to be shared (StopNCII.org — those affected can also use the service themselves, NCII Takedown section 3): hash values (section 5.1).
The EU transparency database under Article 24(5) DSA: statements of reasons for moderation decisions — without personal data.
Tax authorities: reporting creators’ income under DAC7 to the Cypriot tax authority (which forwards it to your country of residence), VAT reporting (one-stop shop) and US tax reporting (1099-NEC) where applicable.
Courts, arbitration bodies and out-of-court dispute settlement bodies (Article 21 DSA) in proceedings you are involved in.

Our principles for co-operating with authorities — review, data minimisation, logging, and no disclosure without a reason — are described in Moderation; we publish the figures annually in our transparency report (Article 15 DSA).

5.4 What creators and fans see of each other

The platform shows users only what a feature needs:

What creators see about their fans: username and profile picture, subscription status and duration, follower status, purchases, tips and spending with that creator (including totals over periods, “top supporter” rankings and segments), reactions to messages, whether a broadcast was delivered, the country of origin as a rough distribution (countries with fewer than 3 fans are grouped together), and whether a fan was recently active. Creators can keep private notes and labels about fans (stored encrypted; only that creator sees them). Creators never see: legal name, email address, payment data, address, spending with other creators, or your searches.

What fans see about creators: stage name and profile (section 2.3), post and subscriber counts, prices and badges (verified, AI). Never: legal name (section 5.5), address, bank details or turnover.

Your options as a fan: send tips anonymously, hide your country, use stealth mode (you do not appear in lists or statistics), hide “last online”, and set your profile to non-public. Creators may use fan data only on the platform (Creator Terms section 10.7).

5.5 Protecting creators’ legal names

Public profiles and the interface show only the stage name.
The legal name is used internally only for payouts, compliance, identity verification and legally required reports (DAC7, 1099-NEC, 2257).
We do not pass your legal name to fans or to other creators unless you expressly ask us to. The exceptions are lawful orders from authorities (section 5.3) and, after our review, legitimate DMCA counter-notice procedures (DMCA, in which the person filing the counter-notice discloses their own contact details).

5.6 Third-party apps and cross-posting

Third-party apps (API): creators can grant third-party apps access to their account (Creator Terms section 17). The creator decides which permissions (“scopes”) the app receives — up to and including fan lists, messages and turnover. The app provider is responsible for its own processing; we log API access (hashed IP, time, scope) for 90 days and the creator can revoke access at any time. Fans can tell from a notice on a creator’s profile that the creator has connected third-party apps which may process fan data.
Cross-posting: creators can announce posts on external platforms (Bluesky, Telegram, Discord, Mastodon, Reddit, X). All that goes there is a preview card suitable for all audiences, with the stage name and a link. We store the creator’s credentials for those platforms encrypted and use them solely for posting the creator has initiated.

6 International transfers

Our servers are in the EU. Where we transfer data to countries outside the European Economic Area — to the USA for payment processing, bot protection, AI text and group access by cloud providers; to the United Kingdom for StopNCII; and to NCMEC for reports — we do so on the basis of the following safeguards:

adequacy decisions of the European Commission (the United Kingdom and Switzerland, and the USA for companies certified under the EU-US Data Privacy Framework (DPF) — the General Court of the EU upheld the DPF on 3 September 2025 and an appeal is pending before the Court of Justice);
the European Commission’s standard contractual clauses (SCCs), controller-to-processor or controller-to-controller as applicable, with supplementary measures where the DPF does not apply;
derogations under Article 49 GDPR in individual cases for reports to NCMEC and to authorities on important grounds of public interest or to protect vital interests;
supplementary technical safeguards (encryption at rest and in transit, pseudonymisation, EU regions, and sending hashes instead of content to the matching services).

You can request a copy of the specific SCC agreements and an overview of our transfer impact assessments at privacy@desioart.com.

7 How long we keep data

7.1 Retention periods

We keep your data only for as long as it is needed for the purpose, or for as long as the law requires. After that we delete or anonymise it. The main periods:

Data category	Retention	Basis
Account and profile	for as long as you use the platform; then the lifecycle in section 7.2 (about 74 days in total until final deletion)	contract; Article 17
Content (posts, media) after you delete it	30 days, then permanently (2257 records remain without the media item)	contract; § 2257
Direct messages	until both participants have deleted their account or the conversation, plus 30 days; withdrawn messages remain, marked as such, until then	contract; preserving evidence
Accounting and transaction records (payments, invoices, ledger, payouts, refunds, tax evidence)	6 years after the end of the tax year (Cypriot tax and company law); our ledger is technically designed for 10 years	Article 6(1)(c)
VAT location evidence (one-stop shop)	10 years	Article 369k VAT Directive
Evidence of purchases and unlocks (PPV, media links) and creators’ agreement to price changes	10 years; your buyer identifier is removed when the account is deleted	evidence; section 195 BGB by analogy
Identity verification data (KYC)	5 years after the business relationship ends (extendable to 10 years on the order of an authority)	Cypriot AML law
Records under 18 U.S.C. § 2257 (copy of identity document, alias, releases)	7 years, stored unalterably (WORM)	28 C.F.R. § 75
Age verification result	until expiry or re-verification, then history for 5 years	youth protection
Evidence of serious breaches (CSAM, NCII, trafficking, official proceedings) including the access log	5 years, unalterable (WORM); longer while proceedings are running (“legal hold”)	Article 6(1)(c)/(f); Article 17(3)(b)/(e)
Reports, statements of reasons, appeals, strikes, suspensions	5 years after conclusion; strikes expire as set out in Acceptable Use section 9 (CSAM strikes never do)	DSA; defending legal claims
DMCA notices and counter-notices	5 years after conclusion	17 U.S.C. § 512; defending legal claims
Hash comparison log per file (section 2.10)	the life of the file; for blocked content, 5 years as evidence	preserving evidence / reporting duty
Blocklist of removed content (hash values only, no image, nothing personal)	permanently, for as long as the blocklist is kept	Article 6(1)(f)
Circumvention protection — hashed characteristics of permanently suspended accounts (IP at registration, device identifier, IBAN)	beyond deletion of the account	Article 6(1)(f)
Playback and access logs (section 2.9)	90 days	protecting content
Sign-in history and risk signals (hashes only)	90 days	security
Sign-in alerts (new device or country)	2 years	security
Security, verification and suspension events free of personal identifiers (statistics)	2 years (730 days)	security; DSA transparency
Sessions: access token 15 minutes; sign-in session 7 days (extendable); “trusted device” 30 days	as stated	contract; security
Security audit log (administrative and security events)	by severity: informational 90 days · low 180 days · medium 1 year · high 2 years · critical indefinitely	Article 32; accountability
Log of staff access to user data; log of switches between linked accounts	7 years	accountability; AML
Network security data (IP reputation lists, attack detection)	30 days; archived security logs 2 years (WORM)	Article 6(1)(f)
Server logs with IP address and trace ID	30 days	Article 6(1)(f)
Internal notes by support	with the account; at the latest after 5 years	Article 6(1)(f)
Data subject requests (DSAR register)	3 years after conclusion	accountability
Evidence of consents (cookie banner, marketing double opt-in, Article 9 consent, co-performer consents)	3 years after withdrawal or expiry; co-performer consents for as long as the media item or a 2257 record exists	section 195 BGB; accountability
Acceptance of the terms, and versions	10 years	evidence
Changes to spending limits; log of changes to settings	5 years	consumer protection evidence
Email suppression list (hash only)	indefinitely	Article 6(1)(f) (respecting your unsubscribe)
Push endpoints	until deactivated or delivery fails	contract
Raw content statistics, activity signals, profile visits	24 months; daily figures without personal reference indefinitely	consent / Article 6(1)(f)
Search history	90 days with personal reference, deleted after 180 days; search term statistics 12 months	contract / Article 6(1)(f)
Payment event data (pseudonymised)	context fields 24 months, remaining data 10 years	Article 6(1)(f), (c)
Clicks on tracking and media links	24 months; purchase attribution up to 3 years (cookie 90 days); referral attribution log 30 days; referral audit log 10 years	contract / consent
API access log of third-party apps	90 days; app registrations 7 years	Article 6(1)(f)
Invitations to co-performers (token)	valid 48 hours; the invitation record until completion plus 3 years	contract
Files in quarantine (malware)	90 days	security
Backups (encrypted)	30 days rolling plus monthly archive copies for 12 months	technical recovery

Deleted data can persist in encrypted backups for up to 12 months. It is no longer actively processed there and is deleted again if a backup is restored.

7.2 Deactivating and deleting your account

You can deactivate or delete your account yourself at any time under settings → account (Terms section 11.1):

Deactivated (30 days): profile and content invisible, subscriptions paused; you can reactivate at any time.
Withdrawal window (14 days): deletion has been started and you can still call it off.
Marked for deletion (30 days): no more access; reactivation only through support.
Final deletion: personal data is deleted or irreversibly anonymised.

Exceptions — this data remains after deletion: records we must keep by law (accounting, tax, KYC/AML, 2257 — section 7.1) in a separate area with restricted access; evidence of breaches and of ongoing proceedings; the hash blocklists; for permanently suspended accounts, the hashed circumvention-protection characteristics; the hash of your email address in the suppression list; messages, for as long as the other participant keeps their account (where you appear as “deleted user”); content fans have lawfully bought stops being available when a creator’s account is deleted (Terms section 8.4); and statistics with no personal reference.

Any outstanding balance is paid out before deletion (Creator Earnings section 6.4). Ongoing disputes, chargebacks or investigations can delay final deletion — we tell you if that happens.

8 Cookies, local storage and tracking

The detail is in our cookie policy (Cookies). In summary:

Technically necessary storage (sign-in session, CSRF protection, language, cookie settings, “trusted device” for 30 days, a role identifier for page control, a visitor identifier to store your cookie decision, privacy screen and app lock settings, and accessibility and appearance settings in local storage) — no consent needed (section 25(2) no. 2 TDDDG; Article 6(1)(b)/(f) GDPR).
Bot protection — sets no cookies and builds no advertising or tracking profiles; legitimate interests.
Analytics (only with consent): visitor-level content statistics for creators, activity and app telemetry (section 2.7) — without consent, only anonymous counters.
Marketing (only with consent): attributing purchases and registrations to tracking and referral links (the tl_attr cookie, 90 days).
Personalisation (only with consent): remembering feed and display preferences across sessions.

We store your decision on our servers (for visitors, under a random visitor identifier) and ask again when the banner text changes; you can change it at any time under settings → privacy → cookies. In any event we ask again after 12 months. We respect the browser signals “do not track” and “global privacy control” (analytics is then not collected, even with consent) and we use no third-party cookies or pixels for advertising.

9 Your rights

You have the following rights under the GDPR. We deal with requests within one month (Article 12(3) GDPR); where requests are complex or numerous we may extend that by up to two months and will tell you, with reasons, within the first month.

9.1 Right of access (Article 15 GDPR)

You can ask us to confirm whether we process data about you, and for a copy of that data together with information about purposes, recipients and retention. Internal notes (section 2.14) are included — without the name of the member of staff who wrote them (Article 15(4)). We do not reveal the identity of people who have reported you.

9.2 Right to rectification (Article 16 GDPR)

You can ask us to correct inaccurate data. You can edit most data directly in your account; verified identity data is changed only after a fresh check.

9.3 Right to erasure (Article 17 GDPR)

You can ask us to delete your data, so far as no statutory retention obligation or overriding ground (section 7.2) stands in the way. You can start the deletion of your account yourself under settings → account (section 7.2). Where we have to keep some data, we tell you what and why.

9.4 Right to restriction (Article 18 GDPR)

You can ask us to process your data only in a restricted way. Your account is then placed in a read-only state.

9.5 Right to data portability (Article 20 GDPR)

You can receive your data in a structured, commonly used, machine-readable format (a ZIP file with JSON files and an index) — self-service under settings → privacy → data. Depending on your role the export contains your profile, settings, purchases, subscriptions, content, comments and messages (with the other participants anonymised); the download link is valid for 7 days and can be used once.

9.6 Right to object (Article 21 GDPR)

You can object, on grounds relating to your particular situation, to processing based on legitimate interests (section 3.4). We review your objection and stop the processing unless there are compelling legitimate grounds to continue. You can object to processing for direct marketing at any time and without giving reasons.

9.7 Right to contest automated decisions (Article 22 GDPR)

See sections 4.3 and 4.4.

9.8 Withdrawing consent (Article 7(3) GDPR)

You can withdraw any consent at any time with effect for the future — in the privacy area, through unsubscribe links, or by email. This does not affect the lawfulness of processing carried out before you withdrew it.

9.9 Right to complain to a supervisory authority (Article 77 GDPR)

You have the right to complain to a data protection supervisory authority — the Cypriot authority (section 1.3), or the authority where you live or work. We would welcome the chance to sort the matter out first (dpo@desioart.com), but that is not a precondition.

9.10 How to exercise your rights

Matter	How
Deactivate or delete your account	self-service: settings → account
Data export (Article 20)	self-service: settings → privacy → data
Manage consents (marketing, cookies, Article 9)	self-service: settings → privacy
Correct individual details	self-service: settings → profile / account
Access, deletion of individual data, restriction, objection, correction of verified data, contesting automated decisions	the data request portal: settings → privacy → data requests (you can see the status at any time) or email privacy@desioart.com
Requests from people without an account (co-performers, visitors, people who report something)	email privacy@desioart.com

For access, portability, erasure and rectification we need to confirm your identity (Article 12(6) GDPR) to prevent misuse. A request from your signed-in account, with a fresh password or two-factor confirmation, is normally enough; for requests by email we may ask about account details, but never for a copy of an identity document unless there is no alternative. For objection and restriction we require no additional proof. Where a representative acts for you, we need evidence of their authority. Exercising your rights is free; where requests are manifestly unfounded or excessive we may charge a reasonable fee or refuse to act (Article 12(5)). You suffer no disadvantage for exercising your rights.

10 Security of processing

We take technical and organisational measures under Article 32 GDPR:

encryption in transit (TLS 1.2+/1.3 on all connections, HSTS) and at rest (encrypted volumes, plus additional field-level encryption with AES-256-GCM and key versioning for bank details, two-factor secrets, credentials for connected external accounts, creators’ notes about fans and contact details in DMCA notices; copies of identity documents and 2257 records are held in the separate area);
passwords stored only as an Argon2id hash, checked against known breaches; sign-in protection (rate limiting, lockout after failed attempts, confirmation on a new device or country, two-factor authentication and passkeys for users; mandatory two-factor authentication for all staff);
access control: role-based, fine-grained permissions; sensitive staff actions require fresh confirmation; two people are required for permanent bans, forfeiture of balances and opening evidence; every access to user data is logged (section 2.14);
media: delivery only through short-lived signed links, viewer-specific watermarks, EXIF removal, virus scanning and quarantine, and separation of public media suitable for all audiences from protected media;
network and operations: web application firewall, DDoS protection, IP reputation filtering, attack detection and central security monitoring on separate systems, strict separation of production, backups, the evidence store (unalterable, WORM) and operational servers; encrypted backups in two independent locations;
development: logs sanitised of personal data, security and dependency checks in the build, emergency switches for AI and payment features, checks for known vulnerabilities, and vulnerability reporting through security@desioart.com and desioart.com/security/disclosure-policy (security.txt);
organisation: confidentiality undertakings and staff training, a data protection impact assessment, a record of processing activities, a deletion concept, an incident response plan with 72-hour reporting (section 13), and regular security reviews including external penetration tests.

What you can do yourself: switch on two-factor authentication or passkeys, use a unique password, check your active sessions regularly (settings → security), and use the discretion features (privacy screen by keypress, app lock — both work only on your device and do not replace signing out).

Please bear in mind: no system is completely secure. In particular we cannot prevent recipients taking screenshots or recordings of content; watermarks and access logs help us trace leaks (Creator Terms section 9.7).

11 Minors

The platform is accessible only to people aged 18 or over. Adult content becomes visible only after successful age verification (section 4.1); telling us your age at registration does not replace it. We knowingly process no data about minors.

Where we suspect an account belongs to a minor, we suspend it immediately, review the case as a priority and delete the data, so far as no reporting or retention obligations (sections 2.10 and 7.1) stand in the way; no balance is paid out (Acceptable Use section 1.2). You can report suspected minors, or content showing minors, at any time — anonymously if you wish — at desioart.com/report or abuse@desioart.com. The detail is in Age Verification.

12 Marketing and communication

12.1 Categories of message

Category	Covers	Can you unsubscribe?
A – service	confirmations, payment and payout notices, security warnings, sign-in from a new device	no (contract)
B – compliance	statements of reasons for moderation decisions, verification reminders, changes to the terms, inactivity warnings, replies to data requests	no (required by law)
C – activity	new message, new subscriber, comments, weekly statistics summary for creators	yes, by type in your notification settings
D – marketing	newsletters, news about features, promotions	only with consent; you can unsubscribe at any time

We send category D at most once a day and 7 times in 30 days. Every marketing email contains a one-click unsubscribe link and a list-unsubscribe header. After an unsubscribe or a failed delivery we put a hash of your address on a suppression list (section 2.8).

12.2 Push notifications

You receive push notifications only if you have switched them on. Their text is always generic and contains no names, previews or images; the app icon shows the number of unread items. You can switch push off at any time in your browser or operating system, or in your notification settings.

12.3 Platform marketing using creators’ content

If you are a creator, we may — with your agreement, set in the creator dashboard — use previews of your content that are suitable for all audiences for marketing within the platform, in line with the licence under Creator Terms section 5.1. You can opt out at any time.

12.4 No personalised advertising, no sale of data

We do not sell personal data, we do not release it for third-party targeted advertising, and we run no cross-site tracking. Recommendations within the platform are based on your follows, subscriptions and settings (Terms section 3.5).

13 Personal data breaches and security incidents

Where a personal data breach is likely to result in a high risk to your rights and freedoms, we inform you under Article 34 GDPR without undue delay, by email and in your account, telling you what happened, the likely consequences and what we recommend you do.

We report personal data breaches to the competent supervisory authority within 72 hours of becoming aware of them (Article 33 GDPR) and we document every incident. So far as we fall within the NIS2 Directive as an essential or important entity, we also report significant security incidents to the competent CSIRT within 24 hours (early warning) and 72 hours.

14 Updates to this privacy policy

We adapt this privacy policy to new legal, technical or business circumstances. For significant changes — new purposes, new categories of recipient or transfers to third countries — we tell you actively by email and in your account at least 30 days before they take effect; we implement new purposes only after that information has been given (Article 13(3) GDPR), and where consent is needed we obtain it. Editorial changes are published without separate notice.

You find the current version and a record of changes with earlier versions at legal.desioart.com.

15 Particular groups of people

15.1 Co-performers without an account of their own

If you appear in a creator’s content without being a creator yourself, we first receive your data from the creator (an invitation by email or link). We process the data listed in section 2.13 in order to check that you are an adult and — for content not suitable for all audiences — your identity, to evidence your consent to publication (including for the record-keeping obligations under 18 U.S.C. § 2257), and to give effect to your withdrawal. Legal bases: your consent (Article 6(1)(a), Article 9(2)(a)), our legal obligations (Article 6(1)(c)) and our legitimate interest in content that is legally sound (Article 6(1)(f)). You can withdraw your consent at any time — the creator must then remove the media item or obscure you, and we enforce that (Co-Performers). You have the full rights set out in section 9; contact privacy@desioart.com. The creator sees your verification status, not your identity document data.

15.2 Visitors without an account

From visitors we process server logs (section 2.7), the cookie decision under a random visitor identifier, clicks on tracking links (hashed) and — with consent — anonymous statistics. Public parts of profiles (section 2.3) are visible without an account; adult content only after age verification, the result of which we tie to the session for visitors without an account.

15.3 People who report something, complain or request a takedown

Reports at desioart.com/report are possible without an account and anonymously (we store a hash of the bot protection token and a rough country of origin). For NCII requests (NCII Takedown) we need no legal name, only a way to contact you; for DMCA notices (DMCA) we need the information the law prescribes, which we store encrypted and disclose to the other side only to the extent the law requires. We do not reveal the reporter’s details to the person reported. We tell you the outcome if you gave us a way to reach you.

15.4 Developers of third-party apps

If you register an app for our interface, we process your contact and company details, app metadata, access logs and webhook deliveries in order to administer the app and protect our users (Article 6(1)(b), (f)). The detail is in API Terms.

16 Users outside the EEA

United Kingdom: the platform is not available in the United Kingdom (Age Verification section 7). Where we nevertheless process data about people in the United Kingdom the rights under the UK GDPR apply accordingly, and complaints can be made to the Information Commissioner’s Office (ico.org.uk).
Switzerland: the rights under the Swiss Data Protection Act (DSG) apply in addition; the competent authority is the Federal Data Protection and Information Commissioner (FDPIC).
USA: we do not sell personal data and we run no targeted advertising (section 12.4). Where individual US state laws come to apply to us, we will give separate information here. Users in certain US states can have our decision on a data request reviewed by contacting privacy@desioart.com.

17 Contact

For anything to do with data protection, please contact:

Data protection contact (DAAR GLOBAL LIMITED) Email: dpo@desioart.com Post: marked “Data protection”, 1 Apriliou 52, 7600 Athienou, Larnaca, Cyprus

Data requests and exercising your rights: privacy@desioart.com · Security vulnerabilities: security@desioart.com · General enquiries: support@desioart.com