Privacy Policy

This policy explains which personal data Alexela Maren uses, why, for how long, and what you can do about it, under the EU General Data Protection Regulation (GDPR).

Who is responsible

The controller is the company that runs Alexela Maren. Its name, address and registration are in the Legal notice. Send any privacy question or request to support@example.com.

The short version

An account is an email address and a password. We do not ask for your name, birthday or address, and card details never reach us. What you unlock and watch here can say something about your sex life, so we treat it as sensitive. We ask your explicit consent for it, use it only to run your account, keep it on our own servers in Germany, and never use it for advertising.

Your consent at sign-up

When you create an account you tick two boxes. Both are required:

• that you are 18 or older and accept the Terms of Service and this Privacy Policy;
• separately, your explicit consent (GDPR Art. 9(2)(a)) that we keep what you unlock and watch here with your account, so the site can show your library and your place in each story. What someone unlocks or watches on an adult site can reveal their sexual preferences, which the GDPR treats as special-category data.

We record each consent with the time you gave it. The account cannot work without the second one. Only the few people who run the site can see this data, every time our staff open a fan’s details in the admin it is logged, and we never use it for advertising or share it for anyone else’s purposes.

Withdrawing your consent

You withdraw your consent by deleting your account on the account page. That does not affect what we did before, but it ends your library. When you delete your account:

• any backing still going is cancelled and its credits come back first, so nothing you backed keeps your credits;
• we delete what you unlocked (single photos included), your votes, your free steps, your daily rolls, your rewards and spending settings, and our copies of the emails we sent you;
• we also delete your email address, password, sign-in sessions, favourites, reminders, viewing positions and sign-up region;
• our own counts (views, unlocks and steps chosen) stay, but without any link to you;
• the credit history keeps only amounts and dates, not what the credits were spent on, and orders stay for the accounts, no longer linked to your email (see “How long we keep it”).

What we use, why, and on what legal basis

• Account: your email address, your password in a hashed form we cannot read, when you joined and last signed in, and whether your account is paused or blocked. To run your account (contract).
• Age: when and how you confirmed you are 18 or older; where a verified age is required, the check’s result, method, time and reference. To keep minors out (legal obligation, legitimate interest).
• Place: your country (in the US, your state), worked out from your IP address on each visit (see “How we place you”). We store it at sign-up and with each order, together with your card’s country. To apply the rules of each place, and as tax evidence (legal obligation, legitimate interest).
• Purchases: orders, amounts, payment status, the payment processor’s reference, and every credit added or spent. To give you what you paid for (contract) and keep our accounts (legal obligation).
• What you unlock and do here: what you unlocked, your steps in the game, your votes and path backings, favourites, where you stopped in a video, and reminders. To run your library and the game (your explicit consent, and contract).
• Rewards and safer spending: your welcome-offer clock, daily rolls, free steps, level, monthly limit, breaks and notification switches. To run these features (contract).
• Our own counts: items viewed, unlocks and game steps chosen, linked to your account and kept on our own servers, to learn what fans like (your explicit consent). No outside analytics.
• Emails we send you: receipts and account messages, reminders you ask for, and new-release emails only if you opt in; you can turn those off on the account page at any time, and we log each change. To confirm your purchases and inform you (legal obligation, contract; consent for new-release emails).
• Proof of consent: what you agreed to at sign-up, and when. To show that we asked (legal obligation).
• Reports: what you write in the complaints form, your email if you give it, and our decision. To handle the report and keep a record (legal obligation, legitimate interest).
• Security: a session code, stored only as a hash; your IP address, held briefly in memory to limit repeated attempts; and our web server’s logs (time, page address, browser type and a shortened IP address). To keep the site and accounts safe (legitimate interest).

How we place you

When you open a page, our own server looks up your IP address in a copy of the DB-IP “IP to City Lite” database to find your country (in the US, your state). Your IP address is not sent to DB-IP or anyone else for this, and it is used only in passing: we store the place, not the address. Our web server’s logs keep only a shortened address (for IPv4 the first two of its four parts, for IPv6 the first 32 bits), which can no longer identify you. IP geolocation by DB-IP, licensed under CC BY 4.0.

What we do not collect

• No name, date of birth, postal address or phone number.
• No card details: you enter them on the payment processor’s page, never on this site.
• No ID documents and no selfies. From an age check we keep only its result, method, time and reference.
• No photos or files from you: fans cannot upload anything.
• No advertising trackers, outside analytics or social media pixels.

Who receives data

Service providers that process data for us, on our instructions and under a contract (GDPR Art. 28):

• DigitalOcean, LLC: servers, database and storage, in Frankfurt, Germany.
• An email service, which sends our emails.
• An age-assurance provider, only where your region requires a verified age.

Our payment processor takes your payment and is responsible for it under its own privacy policy. We receive from it the payment’s status, its reference and your card’s country. Our accountant and auditors see order records, and authorities receive data only where the law requires it. The AI tools we use to make content receive only our own texts and pictures, never data about you. We do not sell data.

Transfers outside the EU

Our data is stored in the EU. DigitalOcean is a US company, so data may be accessible from the US. Such a transfer, and any other outside the European Economic Area, relies on a safeguard the GDPR recognises, such as the EU-US Data Privacy Framework or the EU standard contractual clauses. Ask us for details.

How long we keep it

• Account, library, game, rewards and settings: while you have an account. “Withdrawing your consent” above says what deleting it does.
• Sign-in sessions: up to 30 days, or until you sign out.
• Copies of the emails we sent you: while you have an account.
• Web server logs: they hold only shortened addresses, and older entries are overwritten as new ones come in.
• Backups: 14 days. A deleted account disappears from the backups within that time.
• Orders and the credit history: for as long as accounting and tax law requires (in Estonia, generally seven years). After you delete your account they are no longer linked to your email.
• Proof of consent and the log of your new-release email choices: also after you delete your account, so we can show what was agreed.
• Reports: as long as we need to handle them and to show how they were handled.

Your rights

You can ask to see your data and get a copy, correct it, delete it, limit or object to its use, and get it in a portable form. You can withdraw consent at any time. On the account page you can download your account details, orders, credit history, what you unlocked and your favourites, switch new-release emails on or off, and delete your account. For anything else, including a copy of everything we hold about you, write to support@example.com; we answer within one month.

Automatic decisions

The site decides automatically, from where you connect, whether purchases and paid content are open to you (see Age and access). If you think it placed you wrongly, write to us and a person will look at it. We make no other automatic decisions about you.

Security

Passwords and session codes are stored only as hashes. Paid files are served only through short-lived links made for one account. When our staff open a fan’s details in the admin, that is logged.

Cookies

Only two cookies, both strictly necessary: one keeps you signed in, one remembers the age warning. See the Cookie Policy.

Adults only

The site is not for anyone under 18. If we learn that an account belongs to a minor, we close it.

Complaints

If you think we handle your data wrongly, please tell us first. You also have the right to complain to a supervisory authority: in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or the authority of the EU country where you live or work.

Changes

We update this policy when what we do changes, and tell account holders about important changes.