Privacy Policy

Last updated: 24 August 2026 · Draft for legal review.

This policy explains how [Operator Legal Name] (“we”), as data controller, processes personal data for Content Box. We aim to comply with the EU/EEA GDPR.

1. Data we collect

• Account: phone number (stored encrypted; a keyed hash is used for lookup), optional contact email, account identifiers, roles.
• Identity verification (creators): full name, date of birth, country, ID document image, and optional selfie. Stored in a private, access-controlled store.
• Financial: token purchases, wallet ledger, rentals, earnings and payout records. Card data is handled by our payment providers, not by us.
• Content & usage: content you upload, rentals, moderation records, and technical logs (e.g. IP, timestamps) for security and abuse prevention.

2. Why we process it (legal bases)

• Contract: to operate accounts, boxes, rentals, and payouts.
• Legal obligation: age/identity verification and record-keeping for adult content, tax, and responding to lawful requests.
• Legitimate interests: security, fraud and abuse prevention, and improving the service.
• Consent: optional notifications and any processing where we ask for it; you may withdraw consent at any time.

3. Sharing

We share data only with processors acting on our instructions — hosting/database (Supabase), payment providers, and SMS/email providers (Twilio, Resend) — under appropriate agreements. Between participants, accounts are pseudonymous: creators and members do not see each other’s real identity or phone number. We disclose data to authorities where legally required.

4. Retention

We keep account and transaction data for as long as your account is active and as required by law afterwards (e.g. age-verification and financial records for statutory periods). Identity documents are retained for the period required by applicable record-keeping law and then deleted.

5. Security

Phone numbers are encrypted at rest; identity documents live in a private store reachable only by authorized reviewers via short-lived links. Access is role-restricted and audit-logged. No system is perfectly secure, but we take appropriate technical and organizational measures.

6. Your rights

Subject to law, you may request access, correction, deletion, restriction, portability, or object to processing, and lodge a complaint with your supervisory authority. To exercise these rights contact privacy@content24market.space. Note that some data (e.g. age-verification and financial records) must be retained despite a deletion request.

7. International transfers

Where data is processed outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

8. Contact

Controller: [Operator Legal Name], [registered address]. Privacy contact: privacy@content24market.space.