Privacy Policy

The company responsible for your personal data (the “controller”) is [company legal name], [registered address]. Questions about your data: [privacy email address].

Our representative in the European Union: [EU representative, if required]. Our data protection officer: [data protection officer, if required].

What you give us

• Your account: your email address or your crypto wallet address, depending on how you sign in.
• Your profile: name, username, gender, bio, profile photo and cover. When you first sign in, we create a username and a profile photo for you; the gender you choose sets how that photo looks.
• What you post and send: posts, stories, photos, videos, voice messages, captions, comments, messages and the prices you set. When you upload a photo, we remove its location and other hidden details.
• Money: the amounts you top up, pay, earn and withdraw, and, if you are a creator, the payout addresses you add.
• If you are a creator and turn on an authenticator app: the secret key the app shares with us, sealed so that only our payout server can read it.
• If you are a creator and confirm a payout address: for each code we send to your email, the time, how many times you tried it and whether it was right; the code you type is deleted as soon as it is checked. We keep these records as long as your identity check results, also after your account is erased (see section 9). If you change your email address, we keep the old one only until our payout server has sent it a message about the change (or, if that message can’t be delivered, until our team has dealt with it), then delete it.
• Reports, appeals and copyright notices: what you write in them. If you report without an account, we ask for your name and email address (optional for reports about minors). A copyright notice needs your name, postal address, phone number, email address and signature, and a counter-notice your full name, postal address, phone number and signature, because the US Digital Millennium Copyright Act (DMCA) requires them.
• Emails you send us.

What we record when you use Bit Models

• Who you follow, subscribe to, block and restrict; what you buy, tip, like, comment on and save; and when you have read a message, which the sender sees as “Seen”.
• Which stories you have watched and when, so that a creator’s story ring turns grey once you have seen all of their stories, and so that the creator sees you among the people who watched a story while it is up (section 5).
• Your balance, your deposit address on each network, your payments and subscription renewals.
• Your sign-ins: when each started and when it ends. We don’t store your network (IP) address or your device with your sign-ins; the addresses we do keep from signing in are described below.
• The notifications we show you and our decisions about your content or account.
• For every photo, video, profile photo and cover you upload: a fingerprint (a short code computed from the picture, which matches the same or a very similar picture) and the network (IP) address and time of the upload.
• When you ask for a sign-in code, report something with the form for people without an account or send a copyright notice: a key computed from your network (IP) address. It can’t be turned back into the address. We use it to limit how many sign-in codes, reports or notices come from one place, and to recognise a sender we have marked for unfounded reports or abusive copyright notices.
• Your sign-in codes: for each code we send, your email address, the time and that key (never the code itself, which only your email contains).
• Which version of our terms you accepted and when: when you create your account (by continuing from the sign-in page), and, if you become a creator, when you agree to the creator terms. We record the version of the terms, the time and your network (IP) address as they were at that moment.
• If “Show activity status” is on (Settings → Messages; it is on until you turn it off): one time, when you last had Bit Models open in a visible browser tab, accurate to about a minute. We keep no history of it. While you type a message, the person you write to sees that you are typing; we don’t store that.
• Counters that limit how often some things can be done, such as comments.

What we get from others

• Other people on Bit Models: reports and copyright notices about you or your content, and the nicknames, notes and lists a creator keeps about their fans (only that creator sees them).
• Ondato, our identity check provider: whether your check passed, why it failed and a reference to the check. Ondato also gives us your date of birth: we use it only to confirm that you are 18 or older and don’t store it.
• Chainalysis: whether a blockchain address is on a sanctions list.
• Blockchains: for every transfer to your deposit address, the sending address, the amount, the time and the transaction ID; for our transfers to your payout address, the transaction ID and its result; and whether Tether, the company that issues USDT, has blocked a payout address.

We don’t use analytics or advertising tools, don’t follow you across other websites and don’t collect your contacts.

• Which creators you follow, subscribe to and pay can say something about your sex life or sexual orientation, which the law treats as sensitive. We use it only to give you what you ask for (showing content, taking payments, delivering messages), never for advertising, and share it only as this policy describes. [legal basis for this data, to be confirmed by our lawyer]
• Creators’ content often shows their sex life and that of the people who appear in it. Creators choose to publish it on Bit Models, and everyone in it must have agreed (Terms of Service).
• Ondato’s identity check compares your selfie with the photo in your ID document, and a later selfie (to turn your authenticator app off without it) with that first check. This uses biometric data. Ondato does it for us with your explicit consent, [how consent is given]. Your photos and face data stay with Ondato, and we receive only the result; our team can look at a check in Ondato’s dashboard, for example to compare the name on the document with the account. You can withdraw your consent by writing to us. Without the check, an account can’t become a creator account. A new payout address is not confirmed with a selfie: it is confirmed with a code we send to your email.

Data protection law lets us use personal data only for a reason it accepts (a “legal basis”). For each purpose, this is the data we use and our legal basis under the EU General Data Protection Regulation (GDPR):

• Running Bit Models for you. Signing you in, your profile, showing what you post to the people you choose, messages, notifications, follows, likes and comments. Data: your account, profile, content and activity. Legal basis: we need it to provide the service you signed up for (contract, article 6(1)(b)).
• Payments. Your balance, top-ups, subscriptions and renewals, purchases, tips, earnings and withdrawals. Data: your account, money and blockchain data. Legal basis: contract; and keeping payment records as accounting and tax law requires (legal obligation, article 6(1)(c)) [which record-keeping laws apply].
• Checking creators’ identity and age. Data: Ondato’s result and your date of birth (not stored); your face data, at Ondato. Legal basis: our legitimate interest in keeping minors and impostors off Bit Models and paying the right person (article 6(1)(f)) [or a legal obligation, to be confirmed]; your explicit consent for face data (article 9(2)(a)).
• Protecting payouts. Confirming a new payout address with a code we send to your email, holding earnings and reviewing large withdrawals. Data: your account, your email address, money data and the check’s result. Legal basis: contract, and our legitimate interest in stopping theft and fraud.
• Sanctions checks. Data: the addresses that send your top-ups, and your payout addresses. Legal basis: legal obligation [which sanctions laws apply].
• Moderation. Reviewing content, handling reports and appeals, explaining our decisions and banning accounts. Data: your content, profile, reports and our decisions. Legal basis: legal obligation (the EU Digital Services Act) and our legitimate interest in enforcing our terms and protecting the people on Bit Models.
• Copyright. Handling copyright notices and counter-notices, and repeat infringers. Data: the notices and the content they name. Legal basis: our legitimate interest, and that of rights holders and creators, in a lawful process for copyright claims [or a legal obligation, to be confirmed].
• Protecting children and victims. Fingerprints of uploads, refusing re-uploads of removed content, upload network addresses, keeping evidence and reporting child sexual abuse material. Legal basis: legal obligation [which laws apply] and our legitimate interest in stopping the spread of child sexual abuse material and intimate content shared without consent.
• Security and preventing abuse. Sign-ins, limits, the codes computed from network addresses, the 18+ screen and our servers’ technical logs. Legal basis: our legitimate interest in a secure site that only adults use.
• Legal claims and requests. Defending or making legal claims, answering lawful requests from authorities and, in a dispute, showing which terms you accepted and when. Data: the record of your acceptance of the terms. Legal basis: legal obligation, and our legitimate interest in defending our rights.

Where we rely on our legitimate interests, we have weighed them against your rights, and you can object (section 12).

To have an account, you must give us an email or a wallet address, and a name and gender when you first sign in. To receive money, a creator must pass the identity check. The rest of your profile is up to you.

• Everyone, including search engines: your profile (name, username, profile photo, cover, bio and counts such as followers) and creators’ free preview posts.
• Creators see the name, username and profile photo of the people who follow, subscribe to, pay, comment on or message them, how much each fan has paid them, and the nicknames, notes and lists they keep about their fans. Their notifications also name the latest person who liked a post.
• Stories: while a story is up (24 hours), the creator who posted it sees the name, username and profile photo of the people who watched it. A block, in either direction, keeps you off that list.
• People who can see a post and are signed in see its comments and who wrote them, and the author of a comment is told who liked it or replied to it. Visitors who aren’t signed in see only the number of likes and comments.
• The people you message see your messages, whether you liked theirs, when you have read them and while you are typing. If you both have “Show activity status” on, they also see when you were last active, up to 48 hours ago; a block or a restriction hides it.
• Only you see the full list of who you follow, what you saved and bought, your balance, your payout addresses and your reports.
• Our team sees what it needs to review content, handle reports, appeals and copyright notices, and run payments.
• Reports: we don’t tell the person you reported who you are.
• Copyright notices: the creator whose content a notice names sees the sender’s name, company, email address, the work and the links, but not their postal address or phone. If the creator sends a counter-notice, we send it to the sender of the notice, with the creator’s name, postal address, phone number and explanation, as the DMCA requires.
• Watermark: creators’ photos and videos usually carry the address of the creator’s profile.

We don’t sell your personal data or share it for advertising. We share it only with:

• Companies that work for us, under contract and only on our instructions:
  • Amazon Web Services: our servers, database, photos and voice messages, the keys of our wallets and alerts to our team. In the European Union (Frankfurt, Germany).
  • Cloudflare: storing and playing videos. [location]
  • Cloudflare Turnstile: a check that tells people from bots. It runs when you send your email on the sign-in page, and when a wallet signs in for the first time. Only then does your browser load Cloudflare’s script, and Cloudflare receives signals from your browser and device and your network (IP) address, under Cloudflare’s own privacy terms for Turnstile. We receive the result of the check. Cloudflare’s servers are around the world, and Cloudflare keeps records of this traffic in its data centers in the United States and Europe; it doesn’t name places for Turnstile alone. For transfers to the United States it relies on the EU-U.S. Data Privacy Framework (with its UK and Swiss versions), and otherwise on the EU standard contractual clauses.
  • Ondato: identity checks and selfie checks. [location]
  • Chainalysis: checking blockchain addresses against sanctions lists; it receives only the address. United States.
  • [email provider]: sending sign-in codes, payout address codes and emails about reports, copyright notices and payout addresses. [location]
  • [blockchain node providers]: reading the TRON and Ethereum networks and sending our transfers; they see the addresses and transfers involved. [location]
• The wallet you choose. The code that connects crypto wallets loads only when you choose to sign in or top up with a wallet (and, if you used a wallet here before, when you sign out, to disconnect it), and we have turned off the usage statistics it can send. Then your browser talks to the wallet you pick, and the company behind that wallet may receive your network (IP) address and wallet address, under its own privacy policy: a wallet installed in your browser works directly; a wallet on your phone connects through WalletConnect’s server, which passes on encrypted messages it can’t read; MetaMask on a phone connects through MetaMask’s server; Coinbase Wallet opens a window on Coinbase’s website.
• Public blockchains (section 8).
• Authorities. We report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) in the United States, which may pass the report to the police. We give data to courts, police or regulators when the law requires it.
• People in a copyright dispute, as described in section 5.

Our database, photos and voice messages are stored in the European Union; videos are stored by Cloudflare (section 6). Some of the companies that work for us are in other countries, or can reach the data from there, including the United States. When data leaves the European Economic Area, we rely on [the safeguard for each company: an adequacy decision such as the EU-US Data Privacy Framework, or the European Commission’s standard contractual clauses]. You can ask us for a copy of these safeguards.

• Top-ups and withdrawals are USDT transfers on public blockchains (TRON and Ethereum). Anyone can see every transfer: the sending and receiving addresses, the amount and the time.
• Your deposit address is yours alone, and we move what arrives there to Bit Models’ wallets; withdrawals come from Bit Models’ wallets. So someone who knows one of these addresses may be able to tell that a transfer has to do with Bit Models.
• Nobody, including us, can change or erase a transfer on a blockchain. We never write your name, email or profile to a blockchain: our transfers show only addresses and amounts.

• Your account, profile, content and activity: while your account exists, until you or we delete them.
• When you delete your account (Settings → Personal details), it disappears for everyone straight away and you are logged out. During the 30 days, people you messaged still see your messages in their conversation, under “Deleted user”, without your name or profile. If you are a creator and fans have paid for days that haven’t passed yet, your account stays open until the last of those days, with no new subscribers or payments, and disappears then. To keep your account, sign in within 30 days of it disappearing and choose Keep account. After that date it can’t be kept, even if erasing it takes longer.
• 30 days after your account disappears, we erase your email or wallet address, your profile, posts, stories, photos, videos, voice messages, comments, likes, saved posts, follows, blocks, restrictions, lists, notes, notifications, settings, activity status and sign-ins. Messages you sent stay in the other person’s conversation under “Deleted user”, without your name or profile; the photos, videos and voice messages in them are erased unless someone bought that message. The network (IP) addresses of your uploads go with them, except for content we removed or are still reviewing and evidence we must keep. Your username stays reserved for 14 days, then anyone can take it. Your email or wallet can be used for a new account; nothing from the old one comes back.
• What we keep after your account is erased, under its ID, without your email, sign-in wallet address or profile, because the law requires it or we need it for legal claims: payment records and balances, subscriptions (free ones included), your deposit and payout addresses, identity check results and the records of payout address codes, the record of the terms you accepted, your past usernames, moderation and copyright records, content we removed or a report hid (the text of a profile name or bio we removed stays as a moderation record), and messages someone paid for, which stay with the buyer with their text and media. A copyright counter-notice you sent keeps the name, address and phone number you gave in it. We don’t erase an account while a report, copyright notice, counter-notice, appeal or review about the person or their content, or a report about a message in a conversation with you, is still open, or while the account is banned or suspended.
• What you delete: a post, comment, like, saved post, follow, list or note is deleted straight away. Deleting a post keeps its photos and videos in your Vault; a photo, video or voice message you delete from your Vault is deleted together with its file. A deleted photo or voice message stays in a backup copy for up to 30 days, then it is erased for good. Unsending a message hides it from the other person, but we keep it [retention period], and a fan who bought a paid message still sees it.
• Content we removed or a report hid: you can’t delete it. We keep it at least as long as it can be appealed (6 months after our decision) [retention period]; a profile photo or cover we removed is deleted straight away.
• Sign-ins: a sign-in lasts 24 hours; a sign-in code works for 15 minutes. We keep the record of each sign-in code we send (your email address, the time and the key computed from your network address, never the code itself) for no more than two days, then delete it.
• Payment records (top-ups, payments, earnings, withdrawals and payout addresses): our ledgers can’t be changed. We keep them [period required by accounting, tax and anti-money-laundering law].
• Your acceptance of our terms (which version, when, and your network (IP) address at that moment): kept while your account exists and, because we may need it as evidence in a dispute, after your account is erased, for as long as we keep the payment records above. It can’t be changed.
• Moderation and copyright records (decisions, statements of reasons, appeals, reports, copyright notices and the log of every moderation action): [retention period]. The link to the status of a copyright notice works for 12 months.
• Uploads: the network (IP) address of an upload is kept for 12 months; the fingerprint of removed content, as long as we refuse uploads of it [retention period]. Evidence of child sexual abuse material is kept for at least a year after we report it to NCMEC, and longer if the police ask us to keep it.
• Old usernames: after you change your username, the old one stays reserved for you for 14 days. We keep a record of past usernames [retention period].
• Activity status: we keep only the time you were last active. It is deleted when you turn “Show activity status” off, within a day once it is more than 48 hours old, and with your account.
• Stories: a story is shown for 24 hours. After that, or when you delete it sooner, its photo or video stays in your Vault. We keep the record of the story itself (which photo or video, when and for whom it was posted) with that photo or video until it is deleted from your Vault, so that reports about the story can still be decided. The record of who watched a story is deleted within a day once the story was posted more than 48 hours ago, straight away when its creator deletes it, and with your account. If a story is reported for child sexual abuse material or for intimate images shared without consent, we keep the record of who watched it until the report is resolved, because it may be needed for reports to the authorities. If its photo or video is removed as child sexual abuse material, we keep a copy of who watched the story and when with the evidence, as long as we keep that evidence.
• Notifications: the latest 100 about likes and comments, and the latest 100 of all other kinds.
• Identity checks: we keep the result and the reference to the check with your account. Ondato keeps your photos for [Ondato’s retention period].
• Backups of our database: up to 35 days. Technical logs of our servers: [log retention period].
• Cookies: see our Cookie Notice.

A person makes every decision to remove content or ban an account. These things happen automatically, by fixed rules:

• Hiding after a report. A report that content shows a minor, or intimate content shared without consent, hides the content straight away until a person decides; for at most 3 items of one person within 24 hours.
• Refused re-uploads. If we removed a photo or a report hid it, uploading the same picture again is refused: its fingerprint matches.
• Identity check. Ondato’s result is applied by itself. An account becomes a creator account when Ondato approves the check, the date of birth shows 18 or older and the ID document isn’t used by another account; otherwise it doesn’t. There are 3 attempts.
• Copyright counter-notices. Content removed after a copyright notice comes back by itself 12 business days after the counter-notice reached the sender of the notice, unless they told us they have gone to court.
• Sanctions checks. A top-up from an address on a sanctions list is held and not added to your balance. A payout address that is on a list, or that Tether has blocked, is refused; a listed payout address also stops all withdrawals from the account until a person reviews it.
• Withdrawals. A withdrawal over 1,000.00 USDT, or over our daily limits, waits for a person; earnings may be held for up to 90 days after a payment.
• Marked senders. Reports from someone we marked for unfounded reports don’t hide content, and copyright notices from a sender we marked as abusive are refused (from their network address, for 30 days).
• Limits. Some actions, such as comments, reports and uploads, are limited per hour or per day; beyond the limit the site asks you to try later.

You can ask for a person to look at any of these, tell us your view and contest the result: write to [privacy email address]. A removal can also be appealed under Settings → Account status; a removal after a copyright notice is answered with a counter-notice instead.

You have the right to:

• see the personal data we have about you and get a copy of it;
• have it corrected;
• have it deleted;
• ask us to limit how we use it;
• get the data you gave us in a common format, or have it sent to another service;
• withdraw your consent at any time where we rely on it, without affecting what we did before;
• have a person review a decision made only automatically that affects you significantly (section 10);
• complain to a data protection authority, in particular in the country where you live or work. Ours is [lead supervisory authority].

How to use your rights

• Yourself, on Bit Models: change your name, username, gender, bio, profile photo and cover in Settings; change your email address and delete your account under Settings → Personal details (section 9); turn your activity status off under Settings → Messages; delete posts, stories, Vault items, comments, likes, saved posts, follows, lists and notes; unsubscribe, block and restrict; see our decisions about your content under Settings → Account status and your reports under Settings → Reports.
• Everything else, such as a copy of your data: write to [privacy email address] from your account’s email address, or tell us your wallet address. We may ask you to prove that the account is yours. We answer within one month, free of charge.
• We may keep data that the law requires us to keep or that we need for legal claims, such as payment records and moderation decisions, and nobody can change or erase a transfer on a blockchain.

Where we use your data because of our legitimate interests (section 4), you can object at any time, for reasons relating to your situation: write to [privacy email address]. We then stop, unless we have compelling reasons that override your interests, rights and freedoms, or we need the data for legal claims.

Bit Models is only for people who are 18 or older and adults where they live. We don’t knowingly collect data about anyone younger. If we learn that an account belongs to someone under 18, we ban it. If you think a minor uses Bit Models or appears in content, please report it.

• Bit Models works only over encrypted connections (HTTPS).
• Creators’ photos and videos are shown only through links that work for a few hours, given only to people who may see them.
• The keys of our wallets are kept in Amazon’s key management and secrets services and used only by a separate payout server, not by the website. The same server makes, sends and checks the code that confirms a new payout address, so the website never sees it; authenticator secrets are sealed so that only that payout server can read them.
• Network addresses from sign-in codes, the report form and copyright notices are kept only as a code that can’t be turned back into the address.
• No system is perfectly secure. If a breach puts you at risk, we tell you as the law requires.

We don’t sell your personal information and don’t share it for advertising based on your activity on other websites. [rights under US state privacy laws, to be confirmed by our lawyer]

When we change this policy, we publish the new version on this page with its date. If a change matters to you, we’ll also tell you before it takes effect.