Sign inCreate site

Privacy policy

Last updated 2026-11-01

This policy explains how personal data is handled on MySexyApp (https://mysexyapp.com) and on websites built with it.

1. Who is responsible

  • For the platform and advertiser accounts the controller is [to be completed], [to be completed] (company ID [to be completed]). Contact: [to be completed].
  • For a site built on the platform the controller is the advertiser who runs that site. We process the data of that site's visitors only on the advertiser's behalf and on their instructions, as a processor.

2. Data we process

Advertiser accounts

  • Account data: email address, password (stored only as a one-way hash), language and time zone. Needed to provide the service (contract).
  • Site content: names, texts, photos, videos, rates and contact details that the advertiser chooses to publish. Needed to provide the service (contract).
  • Billing data: credit purchases, balance history and the payment status reported by the payment provider. We do not receive or store full card numbers. Needed for the contract and for accounting and tax duties (legal obligation).
  • Domain owner details: when you buy a domain through us, we pass your name, address, email and phone to the domain registrar and registry, because registries require the real owner. We ask for private WHOIS where the registry allows it. We keep these details encrypted for renewals and transfers (contract and the registry's rules).
  • Telegram link: when an advertiser links Telegram for booking requests, we store their Telegram chat ID. Needed to provide the feature they turned on (contract).
  • Security data: IP address and browser details of sign-in and form requests, used briefly for rate limits and abuse prevention (legitimate interest in a secure service).

Visitors of sites

  • No tracking cookies. Public sites set no cookies and use no third-party analytics, advertising or tracking scripts.
  • Statistics are counted per day as totals only: page views and taps on contact buttons. No IP address, identifier or profile of a visitor is stored with them.
  • Booking requests: if a site uses the request form, we process the name, contact and message the visitor enters, and pass them to the advertiser in the cabinet and, if they linked it, by Telegram. The advertiser is the controller of this data. Requests are deleted after 90 days.
  • Technical logs: the web server briefly records requests (IP address, time, page, browser) to keep the service secure and working (legitimate interest). Logs are rotated and deleted after at most 14 days.

Reports

When someone sends a report through the Report link in the footer of every site, we process the report text, the optional email address and a one-way hash of the IP address used to stop abuse of the form. Reports are kept for 365 days, or longer when needed for a legal claim or an authority request (legal obligation and legitimate interest).

3. Cookies

The cabinet uses only the cookies strictly needed to keep you signed in and to protect forms. They are not used for tracking and need no consent. Public sites built on the platform set no cookies.

4. Who receives data

We share data only as far as needed with:

  • hosting and infrastructure providers who store the service data on our behalf;
  • payment providers, for processing a purchase;
  • the domain registrar and the registry of the domain ending, when you buy a domain through us;
  • Telegram, only for advertisers who link it, to deliver booking requests;
  • partner catalogs, only when an agency turns on its catalog feed, and only the published profile data it chooses to share;
  • authorities, when the law requires it.

All our processors are bound by a data processing agreement. When data leaves the European Economic Area, we use an adequacy decision or the EU standard contractual clauses.

5. How long we keep data

  • Account and site data: while the account exists. After an account is deleted, its data is removed within 30 days, and from backups when they rotate out.
  • Billing records: as long as accounting and tax law requires.
  • Booking requests: 90 days.
  • Reports: 365 days.
  • Server logs: up to 14 days.

6. Your rights

Under the GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. Where processing is based on consent, you may withdraw consent at any time.

  • Write to [to be completed]. We answer within one month.
  • If your request concerns a site built on the platform, we pass it to the advertiser who controls that site and help them answer it.
  • You can also complain to the data protection authority in [to be completed] or in the country where you live.

7. Security

Connections are encrypted with TLS. Passwords are hashed. Access to the data is limited to people who need it to run the service. Photos are stripped of their hidden metadata such as GPS location when they are uploaded.

8. Age

The platform and the sites on it are for adults only. We do not knowingly process the data of anyone under 18.

9. Changes

We will publish any change to this policy on this page and tell account holders about material changes by email or in the cabinet.