Privacy Policy

Last updated: 11 September 2026 · Applies to lalalust.com · Adults only (18+)

Written by the operator, in plain English. A lawyer reviews this before card payments open. What it describes is what the software actually does today — if a practice changes, this page changes with it and the date above moves.

This policy explains what lalalust collects about you, why, on what legal basis, how long it is kept and what you can demand. The controller is the operator named in the Imprint. Where the operator's seat is outside the EU, no representative in the Union under Art. 27 GDPR has been designated; write to the operator or to the address below instead.

1. What we collect

Data	Why	Legal basis (GDPR)
Email address, password hash	To create and secure your account	Art. 6(1)(b) — contract
Display name, avatar, profile text, tags	So others can find and recognise you	Art. 6(1)(b)
Date of birth (entered after signup)	Age assurance — the one thing we cannot be wrong about	Art. 6(1)(c) — legal obligation
Wishes, offers, orders, messages, deliveries	To run the commission and settle disputes	Art. 6(1)(b)
Balance and ledger records (amounts, times, order reference)	To hold, release and refund money; accounting	Art. 6(1)(b), Art. 6(1)(c)
Verification decision for creators, as the partner sends it (status, date, age read from the document, warnings or review comments)	Proof that everyone producing content is an adult	Art. 6(1)(c)
Age and consent declarations attached to uploads	18 U.S.C. 2257 record-keeping	Art. 6(1)(c)
IP address, user agent, timestamps, session cookie	Security, rate limiting, fraud and abuse prevention	Art. 6(1)(f) — legitimate interest
Language and theme preference	To show the site the way you left it	Art. 6(1)(f)

2. What we deliberately do not have

Your card details. We do not accept cards at all yet, so no card number, no expiry date and no security code ever reaches our servers.
Creators' identity documents. The verification partner checks them on its own pages and sends us its decision. The passport photo or scan never reaches us; the decision data that comes with it does — see section 1.
Advertising or tracking profiles. There are no third-party trackers, no pixels, no advertising cookies, and no data sold or shared with advertisers — we do not sell advertising.

The person you are dealing with sees your display name and what you wrote in the order — never your email, real name or payment details.
Our verification partner checks a creator's ID and returns a decision.
Our hosting and email providers process data on our instructions, under contract.
Authorities, where the law obliges us — in particular reports concerning minors.

No payment provider receives your data today, because no card or bank payments are processed here yet. Where a processor is outside the EU, we rely on the European Commission's standard contractual clauses; which processors we use and where they sit is answered on request at the address in section 5.

4. How long

Be aware of what is automated and what is not. Only two things delete themselves today: signed-in sessions, which expire after 30 days, and whatever you remove yourself. Everything else below is a period we apply by hand — on your request, or when we clear out old data — not a timer running in the software. If you want something gone sooner, ask; we would rather delete it than keep it.

Account data — while the account exists. Deleting the account in Settings anonymises the profile immediately and permanently.
Messages and order records — kept at least 12 months after the order completes, so a late dispute can still be judged. They are not deleted automatically after that.
Invoices and accounting records — 10 years, because tax law at the operator's seat requires it. These survive account deletion.
Age and consent declarations for published content — kept for as long as the law requires records to be available for inspection. These also survive account deletion.
Security records — the IP address and browser string stored with a signup, a consent declaration or a report stay with that record; they are not on a separate 30-day clock.
Support conversations — kept until the account is removed.

5. Your rights

You can demand: access to your data, correction, deletion, restriction of processing, portability in a machine-readable form, and objection to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time with effect for the future.

Export and deletion are both built into Settings — you do not have to write to us for either. For anything else: privacy@lalalust.com. We answer within one month.

You may also complain to a supervisory authority in the EU member state where you live or work.

6. Security

Everything travels over TLS. Passwords are hashed, never stored in a readable form. Sessions rotate on sign-in. Two-factor authentication is available to everyone and strongly recommended for creators, because those accounts hold money. Uploads are checked by content, stripped of embedded location data, and served only to people entitled to see them.

7. Children

lalalust is for adults. We do not knowingly process data of anyone under 18. If we learn that we have, the account is closed and the data deleted immediately.

8. Changes

If this policy changes materially, you are told by email and in your account before it takes effect. The date at the top is always the version in force.

Questions about our policies: legal@lalalust.com · Safety and reports: abuse@lalalust.com · Questions & answers