# Privacy Policy > We care about your privacy. Learn how FansCreator collects, uses, and protects your personal information. Last updated: 23 September 2026 ## 1. Who we are and what this covers This policy explains what personal data we handle when you visit fanscreator.ai, create an account, upload or generate content, use our API, complete verification, or get in touch, and what you can do about it. It uses the same defined terms as our Terms of Use. The data controller is FansCreator OÜ, a company registered in Estonia under registration number 17605888 at Pille tn 9/3-53, Kesklinna district, Tallinn, Harju County, 10138, Estonia ("FansCreator", "we", "us"). You can reach us at legal@fanscreator.ai. The Service is for adults and for business use. We do not knowingly handle the personal data of anyone under 18. If you think we hold data about a minor, write to legal@fanscreator.ai and we will delete it and look into it. ## 2. What we collect ### 2.1 Data you give us | Category | Examples | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Account data | Name, email address, password hash, username, telephone number, account and workspace settings | | Business data | Entity name, registration number, VAT number, registered address, authorised users | | Verification data | Collected only if you enable Restricted Content features: a government-issued photographic identity document, document number and expiry, date of birth, country of residence, a selfie or liveness capture, and the verification result and timestamp. If you verify as a business, we collect the entity details above plus verification of one authorised representative | | Consent record data | Data about the people you depict, which you provide under Section 5 of the Terms: their name, date of birth, identity document, signed consent and its scope | | Content data | Photos, images, video and audio you upload to or process through the Service; text prompts, commands, descriptions and other Inputs; reference material and training sets; character models and persona assets; generated Outputs; and associated metadata, which can include how, when, where and by whom a file was captured, how it has been edited, and keywords, location and similar information added to it | | Payment data | Billing name and address, VAT number, plan, transaction history, card type and last four digits. Full card numbers are handled by our payment provider and do not reach our systems | | Communications data | Support tickets, emails, complaints, appeals and reports | ### 2.2 Data we collect automatically Device and browser type and version, operating system, hardware characteristics, IP address, approximate location derived from it, language, unique device and session identifiers, pages viewed and time spent, referring URL, navigation paths, access times, generation logs, API call logs, error logs, and email open and click data. ### 2.3 Data from third parties Verification results from our identity provider; payment, fraud and chargeback signals from our payment provider; authentication data from any login provider you use; sanctions screening results; abuse signals from safety and hash-matching databases; and information from complainants, rights holders, platforms, regulators and law-enforcement authorities. ### 2.4 Data about other people If you upload material depicting another person, or a consent record about them, you are giving us their personal data. Under the Terms you warrant that you have their documented, informed and specific consent and a lawful basis to do so. You act as controller in respect of your decision to use their data on the Service; we act as controller in respect of our own verification, moderation, safety and legal-compliance processing of it. You must give that person a privacy notice covering your use, and must tell them they can contact us at legal@fanscreator.ai. ## 3. Why we process your data, and on what basis | Purpose | Data | Legal basis | | ------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | Creating and running your account; providing generation, storage and API features; billing and support | Account, business, content, payment, communications, technical | Performance of a contract (Art. 6(1)(b)) | | Age assurance | Account, technical, verification | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) in keeping minors off the Service | | Identity or business verification for Restricted Content features | Verification data | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); explicit consent (Art. 9(2)(a)) for any special-category element | | Holding and checking consent records | Consent record data | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)) in preventing unlawful processing of other people's data; Art. 9(2)(f) and (g) | | Content moderation, safety classification, and detection of illegal material | Content, technical, account | Legal obligation under the Digital Services Act (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) in preventing illegal and harmful content; Art. 9(2)(g) | | Fraud prevention, chargeback defence, abuse and multi-account detection, sanctions screening | Account, payment, technical, verification | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) for sanctions | | Security, availability, debugging, analytics, and improving the Service | Technical, usage, and anonymised data derived from content | Legitimate interests (Art. 6(1)(f)) | | Responding to law-enforcement, regulatory and rights-holder requests; establishing and defending legal claims | Any of the above | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)); Art. 9(2)(f) | | Marketing emails and product announcements | Contact, marketing preferences, engagement | Consent (Art. 6(1)(a)), or legitimate interests (Art. 6(1)(f)) for messages to existing customers about similar services, with an opt-out in every message | | Analytics and non-essential cookies | Technical, usage | Consent (Art. 6(1)(a)) | Where we rely on legitimate interests we have carried out a balancing assessment and will provide a summary on request. You can object to that processing under Section 10. ## 4. Sensitive data Some of what we handle is special-category data under Article 9 GDPR. Verification documents and consent records linked to Restricted Content can reveal data concerning a person's sex life, and content you upload or generate may reveal that or other sensitive characteristics. We treat all of it as special-category data. Our conditions for processing it are your explicit consent, given separately when you enable Restricted Content features and withdrawable at any time (Art. 9(2)(a)); the establishment, exercise or defence of legal claims, which is why some records survive account closure (Art. 9(2)(f)); and substantial public interest, for processing aimed at detecting and preventing child sexual abuse material and non-consensual intimate imagery and reporting it to the competent authorities (Art. 9(2)(g)). If you withdraw your explicit consent we can no longer provide Restricted Content features and will restrict or close the account. Withdrawal does not affect processing carried out before it. Verification data and consent records are held in a store segregated from creative content, encrypted at rest, and accessible only to named staff with a verification, trust-and-safety, legal or compliance role, with access logged. This data is never used to train or fine-tune any AI model, never used for marketing or personalisation, and never sold or shared for any third party's own purposes. **Biometric data.** We handle two different kinds, for two different reasons. They are stored separately and are never combined. _Verification._ If you enable Restricted Content features, our identity-verification provider runs a liveness or selfie check and compares it against your identity document. That comparison produces biometric data, and its purpose is to confirm that you are the person the document describes. It is processed by the provider on our instructions under a written data processing agreement, and only for verification, age assurance and fraud prevention. We do not use it for content generation, to train any model, or for marketing. It is held for as long as we hold your verification record, as set out in Section 9, so that we can evidence that verification took place and defend legal claims. _Likeness models._ When you build a character model, persona asset, LoRA or face swap from reference images, our systems derive facial-geometry measurements and similar values from those images and store them as part of the asset. That is what lets the asset reproduce a consistent likeness, so this data lives for as long as the asset does: while your account is active and you keep the asset, we keep it, with no fixed end date. We delete it when you delete the asset or your account, within the deletion window in Section 9. We do not use it to identify, verify, authenticate, track, match or surveil anyone, we do not run facial recognition on it, we do not use it to train general AI models, and we do not sell or share it or make it available for any third party's own purposes. Where you upload reference material depicting someone else, you are responsible for their consent to this processing, and Section 2.4 applies. Some countries and US states have specific biometric-privacy laws with their own consent and retention requirements; where one applies to a person you depict, the consent you obtain must meet it. ## 5. AI models and improving the Service We use our own and third-party AI models to generate Outputs. Your Inputs and Outputs are processed to produce the result you asked for, to run moderation and safety classification, and to debug and secure the Service. We may use anonymised and aggregated data derived from that processing to maintain and improve the Service. We do not use your verification data, consent records or Restricted Content to train or fine-tune AI models, and our model providers are contractually required not to train on content processed for us. ## 6. Automated processing Generations are screened by automated safety classifiers. Automated systems can block a generation, quarantine an Output, flag an account for review or restrict functionality. Decisions that permanently terminate an account, or that lead to a report to a law-enforcement authority, involve human review before they take effect, except where immediate automated action is needed to stop ongoing illegal content. Where a decision produces legal or similarly significant effects for you and is based solely on automated processing, you can obtain human intervention, express your point of view and contest the decision. Write to legal@fanscreator.ai; Section 7.6 of the Terms sets out the appeal route. ## 7. Who we share data with We do not sell personal data. We share it only with: - **Processors and suppliers** acting on our documented instructions under a written data processing agreement: hosting and cloud infrastructure, AI model and compute providers, identity-verification and age-assurance providers, content-moderation and hash-matching providers, email delivery, support tooling, analytics and error monitoring. A current list of our sub-processors is available on request. - **Payment providers**, who process payment data as independent controllers under their own privacy notices. - **Workspace owners and administrators**, where you use the Service through an agency, team or organisation account. They can see your activity and content within that workspace. - **Professional advisers**: lawyers, auditors, accountants and insurers, where necessary. - **Law-enforcement authorities, regulators, courts and competent hotlines**, where required by law or where we consider disclosure necessary to prevent or investigate serious harm. In those cases we may disclose content, account data, verification data, IP logs and payment data. - **Complainants and rights holders**, to the extent necessary and proportionate to handle a substantiated claim that your content infringes their rights or depicts them without consent. - **A buyer or successor**, in connection with a merger, acquisition, financing, reorganisation, insolvency or sale of assets, subject to equivalent protections. ## 8. International transfers We are established in Estonia and store data primarily within the European Economic Area. Some suppliers, particularly AI model and infrastructure providers, operate outside it. Where we transfer personal data outside the EEA we rely on an adequacy decision of the European Commission where one applies, and otherwise on the Commission's Standard Contractual Clauses together with a transfer impact assessment and supplementary technical measures. You can request a copy of the relevant safeguards at legal@fanscreator.ai. Verification data, consent records and Restricted Content are subject to stricter routing: we do not transfer them outside the EEA except where an adequacy decision or Standard Contractual Clauses apply and the transfer is necessary for verification, legal compliance or the defence of legal claims. ## 9. How long we keep data | Data | Retention | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Account and business data | For the life of the account, then 30 days after deletion | | Content: Inputs, Outputs, character models | For the life of the account, then 30 days after deletion, subject to any legal hold | | Verification data | 5 years from the end of the account relationship, so we can evidence that verification was performed and defend claims | | Consent records | 7 years from the last generation or publication, matching your own obligation under Section 5.6 of the Terms | | Generation logs and moderation decisions | 3 years, or longer where an investigation, legal hold or lawful request applies | | Records of content reported as illegal, and the associated account data | Retained for as long as required by law and by the authority to which it was reported, and not deleted on account closure | | Billing and accounting records | 7 years, as required by the Estonian Accounting Act | | Support communications | 3 years | | Marketing consent and opt-out records | Until withdrawn, then a suppression record indefinitely | | Server and security logs | 12 months | When a period ends we delete, anonymise or irreversibly aggregate the data. Backups are overwritten on their own cycle, typically within 90 days. ## 10. Your rights You have the right to access your personal data and obtain a copy; to have inaccurate data corrected; to have data erased where there is no overriding ground for keeping it; to restrict processing in certain circumstances; to receive data you gave us in a portable format and have it transmitted to another controller where technically feasible; to object to processing based on legitimate interests, and to direct marketing at any time and unconditionally; to withdraw consent at any time without affecting the lawfulness of processing before withdrawal; and not to be subject to solely automated decisions with legal or similarly significant effects, as described in Section 6. To exercise any of these, write to legal@fanscreator.ai. We respond within one month, extendable by two further months for complex requests, in which case we tell you within the first month. We may ask for information to verify your identity. Requests are free unless manifestly unfounded or excessive. **Limits.** We may refuse erasure or restriction where we must keep data to comply with a legal obligation, to establish, exercise or defend legal claims, or to preserve evidence of illegal content. Verification data, consent records and moderation records relating to reported illegal content are the usual cases. **If content depicting you has been generated.** You can exercise all of the above rights directly against us at legal@fanscreator.ai whether or not you hold an account. Urgent removal requests are handled under Section 7.5 of the Terms, and we will not require you to produce an identity document as a precondition of urgent removal. **Complaints.** If you are unhappy with how we have handled your data, please tell us first. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee, or to the supervisory authority in your country of residence or workplace. ## 11. Security We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, segregation of verification data and consent records from creative content, role-based access control with logged access, multi-factor authentication for staff, least-privilege service accounts, regular patching and dependency scanning, backup and recovery procedures, supplier due diligence with contractual security obligations, and a documented incident-response plan. Where a personal data breach is likely to result in a risk to your rights we notify the Estonian Data Protection Inspectorate within 72 hours, and notify you without undue delay where the risk is high. No system is perfectly secure and we cannot guarantee absolute security. ## 12. Cookies We use cookies and similar technologies that are strictly necessary to run the Service, to keep you signed in and to remember preferences, and, with your consent, for analytics. We do not use advertising or cross-site tracking cookies. You can manage your choices through our cookie banner and settings, and through your browser. ## 13. Changes We may update this policy. For material changes we will notify you by email or in-product at least 30 days before they take effect, and where the law requires consent we will ask for it. The version in force is the one published here with the date at the top. ## 14. Contact All privacy enquiries, rights requests, requests from people depicted in content, and complaints: **legal@fanscreator.ai**. General account and billing enquiries: **hello@fanscreator.ai**.