Privacy Policy

Last updated: [DATE]

Template document. This text is a good-faith starting point drafted for an adult user-generated-content platform — it is not legal advice and has not been reviewed by a lawyer. It must be reviewed, completed and adapted by qualified counsel for [JURISDICTION], and every bracketed placeholder filled in, before DefoHub relies on it.

1. Who is responsible

[LEGAL ENTITY NAME], of [REGISTERED ADDRESS] (“DefoHub”), is the controller of personal data processed through defohub.com. Privacy questions and rights requests go to compliance@defohub.com. Our data protection contact is [DATA PROTECTION CONTACT].

2. What we collect

Account data — email address, handle, password hash, display name, avatar, language and playback preferences, and your communications with support.
Age assurance result — when you complete an age check we receive a pass/fail result, the method used, and a timestamp from our age assurance provider. We do not receive or store your identity document image, and we do not store your date of birth beyond the derived “over 18” flag.
Creator verification (KYC) data — if you monetise, our verification and payout providers collect identity documents and tax/payout details. We store the verification outcome, the reference number, and the minimum record set described in our §2257 statement.
Payment data — handled by our payment processor. We receive the transaction amount, currency, status, subscription state, and a truncated card descriptor. We never receive your full card number.
Usage and device data — IP address, approximate country, browser and device type, pages and videos viewed, watch progress, and error/security logs.
Content you submit — uploads, thumbnails, titles, comments, messages, and reports, together with automated moderation signals derived from them.

3. Why we process it, and on what legal basis

To provide the service (accounts, playback, subscriptions, payouts) — performance of our contract with you.
To keep minors out and illegal content off the Platform (age assurance, moderation, CSAM detection, records) — legal obligation and substantial public interest.
To secure the Platform (fraud, chargeback and abuse prevention, rate limiting) — legitimate interests.
To measure and improve (aggregate analytics, crash reporting) — legitimate interests, or consent where local law requires it.
To send marketing email — consent, withdrawable at any time from any such email.

4. Cookies and analytics

We set strictly necessary cookies for sign-in, session security, theme, and to remember that you passed the age gate. Analytics and error monitoring are limited to what we need to run the service and are configured to avoid recording the specific adult content you view where technically possible. Non-essential cookies are set only where you have consented; you can change or withdraw that choice at any time in your browser or in the consent control.

5. Who we share it with

We do not sell personal data. We share it only with processors acting on our instructions, and only with what they need: payment and payout processing, age assurance, identity verification, content moderation and hash-matching (including CSAM detection), hosting, storage and CDN delivery, transactional email, and error monitoring. We also disclose data where the law requires it — to respond to a valid legal request, to protect someone’s safety, or to report suspected child sexual abuse material to law enforcement and NCMEC. Where data leaves your region, we rely on an adequacy decision or standard contractual clauses.

6. How long we keep it

Account data — while your account is open, then up to 90 days after closure for reversal and abuse-prevention purposes.
Transaction records — as required by tax and accounting law in [JURISDICTION], typically 7–10 years.
Performer age and consent records — retained for at least 7 years in line with 18 U.S.C. §2257 record-keeping expectations, even after the content is removed.
Age assurance results — for the life of the account plus any statutory audit period.
Moderation, report and enforcement logs — up to 5 years, so repeat offenders can be identified.
Security and access logs — typically 12 months.

7. Your rights

Subject to your local law, you may request access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests, and withdraw any consent you gave. Email compliance@defohub.com; we respond within 30 days and may ask for proof that the account is yours.

Deletion has limits. Closing your account does not erase records we are legally required to keep — performer age and consent records, transaction and tax records, and evidence preserved in connection with an abuse report or law enforcement matter. Those are retained in restricted storage for their statutory period and then destroyed. You also have the right to complain to the supervisory authority in [JURISDICTION].

8. Children

The Platform is strictly for adults and is not directed to anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account or appears in content, tell us immediately at compliance@defohub.com — see our Complaint & Abuse Policy and Content Removal Request pages.

9. Security and changes

We use encryption in transit, encrypted storage, access controls, and signed, expiring media URLs. No system is perfectly secure, so please use a strong, unique password. We will post any change to this policy here with a new “last updated” date and, for material changes, notify you directly.