Privacy notice

1. Who the controller is

The data controller is [Full name / company name], [address], email [privacy email]. [The controller is based outside the EU: name the EU representative under Art. 27 GDPR, with name and address.]

2. What data we collect

Data you give us: name, email, city, links to your public social profiles, the photos you upload, your answers to the application questions and, if you choose, your consent to marketing.

Identity check result: Stripe only tells us that your identity is verified and that you're at least 18. We don't receive or keep your ID, your selfie or any biometric data.

Payment data: the fee is processed by Stripe. We never see or keep your card details.

Technical data: IP address and browsing data needed to run the site. [List any analytics or advertising cookies and the cookie banner.]

3. Why we use it and on what basis

To manage your application and profile: performance of a contract (Art. 6.1.b GDPR).

To verify age and identity: legal obligation to keep the service adults-only and legitimate interest in preventing fake profiles (Art. 6.1.c and 6.1.f). Biometric verification is carried out by Stripe based on your explicit consent collected by Stripe (Art. 9.2.a). [Check with the lawyer whether Stripe acts as independent controller or processor.]

To send you news, offers and targeted social ads, including uploading your email in hashed form to platforms such as Meta or TikTok to build custom audiences: only with your consent (Art. 6.1.a), which you can withdraw anytime.

To handle reports and defend our rights: legitimate interest (Art. 6.1.f).

4. Membership, collaborations and offers

Plus membership: we process the data needed to manage your subscription and the visit stats for your profile (performance of a contract). Payment data is handled by Stripe.

Collaborations: if you turn the option on, we use your profile data to assess brand proposals. We give your name and contact details to a brand only after you accept that specific proposal (contract and your consent).

Partner offers: we send emails with our own and partners' offers ourselves, only with your consent (Art. 6.1.a). We never share or sell emails to partners. [To check: if partners receive aggregated campaign data, state it here.]

5. Who receives the data

Stripe (payments and identity verification), our hosting and storage provider [name], our email provider [name] and, only if you consented to marketing, advertising platforms [Meta, TikTok]. Some providers are outside the EU: transfers use the safeguards required by the GDPR [standard contractual clauses / Data Privacy Framework].

6. What is public

If you're accepted, your profile shows: your name as you choose to give it, city, approved photos, a short bio and social links. Profiles aren't indexed by search engines. If you're not accepted, nothing is public.

7. How long we keep it

Applications not accepted: [90 days] after the answer, then deleted. Active profiles: as long as you're in the club. Removed profiles: deleted within 30 days of the request. Marketing emails: until you withdraw consent. Accounting records: as long as the law requires.

8. Your rights

You can ask for access, correction, deletion, restriction, portability, or object to processing by writing to [privacy email]. You can withdraw marketing consent anytime with the link in every email. You can complain to the Italian data protection authority, the Garante (garanteprivacy.it), or the authority where you live.

9. Minors

The service is for people aged 18 or over. If we find data belonging to a minor, we delete it immediately.