Who is responsible for your data
The controller of your personal data is the administrator of the onlyeighteen.com service. You can reach the administrator, including for any privacy request, at [email protected]. There is no contact form, so email is the only channel, and we answer every privacy request.
The data we collect
We collect only what we need to run a platform for verified adults.
- Account data. Email address, password (stored as a hash), creator name or handle, profile text, settings, language and region, and the content you upload or send.
- Verification data for creators, co-performers and team members. Images of a government issued ID, the details printed on it (legal name, date of birth, document number and expiry), a live selfie, the result of the comparison between the selfie and the document, and signed consents for each release.
- Age assurance results for fans. Whether you passed, the method used, the date and the region rule that applied. Where a document check is required, the same ID and live selfie data as above. Where a facial age estimate is used, we keep the result and not the image.
- Payment data. Amounts, dates, items bought, payout requests and payout details. Card numbers are handled by a card processor that supports adult creator platforms and are never stored by us. For crypto payments we keep the transaction reference and wallet address used.
- Usage data. Sign in times, IP address, device and browser type, security logs, reports you send or receive, and the actions team members take in an account.
- Messages with support. Anything you write to [email protected].
Why we use your data
- To create and run your account, publish content and process fan payments and payouts.
- To verify that every creator, co-performer, team member and fan is an adult, and to keep the identity and consent records the law requires.
- To moderate content, detect wording or media that breaks our rules, handle reports and takedown notices and prevent fraud, chargebacks and account takeovers.
- To apply region rules, such as which age check method applies and which countries a creator has blocked.
- To send emails you need, such as sign in codes, receipts, renewal notices and security alerts.
- To meet tax, accounting and legal obligations and to respond to lawful requests from authorities.
- To keep the service secure and working and to fix errors.
We do not sell personal data, we do not use it for advertising profiles, and we do not show ID documents or selfies to fans. The public profile shows only the creator name.
Legal bases under GDPR style rules
Where data protection laws such as the GDPR apply, we rely on these legal bases.
| Purpose | Legal basis |
|---|---|
| Running your account, payments and payouts | Performance of the contract with you |
| Age checks and 2257 style records | Legal obligation, and where no law requires it, our legitimate interest in keeping anyone under 18 and unverified people off the platform |
| Face comparison of a selfie with an ID | Your explicit consent given at the check, and legal obligation where a law requires it |
| Moderation, fraud prevention and security | Legitimate interests in a safe service and in protecting creators and fans |
| Tax and accounting records | Legal obligation |
| Service emails | Performance of the contract |
Where we rely on consent, you can withdraw it at any time. Withdrawing consent to verification means we cannot keep your account active, because verification is a condition of using OnlyEighteen. Data already required as a legal record is kept as described below.
How long we keep data
- Account data is kept while your account is open and deleted or anonymized within a reasonable time after closure, unless we need it for an open dispute, report or legal claim.
- Verification and consent records for creators and co-performers are kept for as long as the law requires for 18 U.S.C. 2257 records and similar laws elsewhere. Under the current US rules that is generally at least seven years after the record was created or last changed, and longer if the law requires it. These records stay after an account is closed.
- The facial data used to compare a selfie with an ID is used for that comparison and is not kept as a reusable template.
- Fan age assurance results are kept while your account is open, so you do not need to verify again until your region's rule asks for it.
- Payment and tax records are kept for the period tax and accounting laws require.
- Security logs are kept for a limited period and then deleted, unless needed to investigate an incident.
- Evidence linked to a report of illegal content is preserved for as long as authorities or the law require.
Who receives data
We share personal data only with the categories of recipients below, each bound by contract to use it only to provide their service to us and to protect it.
- A hosting provider that stores and serves the platform.
- A card processor that supports adult creator platforms, and crypto payment providers where you choose crypto.
- An identity verification partner that performs ID, live selfie and age estimate checks.
- An email delivery provider that sends account and security emails.
We also disclose data to authorities and organizations where the law requires it, including reports of sexual abuse material involving anyone under 18 to NCMEC and the relevant authorities, and to professional advisers where needed to establish or defend legal claims.
International transfers
OnlyEighteen serves users in many countries, so your data may be processed in a country other than yours, including the United States. Where data leaves the European Economic Area, the United Kingdom or another region with transfer rules, we use safeguards recognized by those rules, such as standard contractual clauses, and we limit transfers to what each recipient needs.
Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its processing, receive a copy in a portable format and withdraw consent. Residents of US states with privacy laws may also have the right to know what we collect and to ask for deletion. We do not sell or share data for targeted advertising, so there is nothing to opt out of there.
To use a right, write to [email protected] from the email address on your account. We may ask you to confirm your identity before acting. We answer within the time the law sets, usually within one month. Some requests have limits: we cannot delete verification and consent records that the law requires us to keep, and we cannot remove a co-performer's records while content showing that person is still published. You also have the right to complain to the data protection authority where you live.
How we protect data
Verification documents are stored separately from content, encrypted and accessible only to the small number of people who need them for verification, records and legal requests. Access is logged. Agency accounts must use two factor sign in for the whole team. Media shown to fans carries a watermark with the viewer's handle to deter leaks. No system is perfectly secure, and if a breach affects your data we tell you and the authorities as the law requires.
Adults only
OnlyEighteen is not for anyone under 18 or under the legal age where they live. We do not knowingly collect data from such people. If we learn that an account belongs to someone under 18, we close it and keep only what the law requires. You can report a concern at our report page.
Changes to this policy
We update this policy when our processing or the law changes. Material changes are announced by email or in your account before they take effect. Related pages are the terms of service and the 2257 statement.