Privacy Policy

This policy explains what lalalust collects about you, why, on what legal basis, how long it is kept and what you can demand. The controller is the operator named in the Imprint; that is also the address for every right described below, and privacy@lalalust.com reaches the same person.

0. Which law applies to you

lalalust is operated from Switzerland and reachable worldwide, so more than one regime applies at once. We do not pick one and hope:

• Switzerland — the revised Federal Act on Data Protection (revFADP / revDSG, in force since 1 September 2023) applies to us as a controller seated in Switzerland. Much of what this page says about rights is the same under both laws; where the Swiss wording differs it is named in section 5.
• European Union / EEA — the GDPR applies because lalalust is offered to people in the Union: the site is published in thirteen languages, prices can be shown in euro, and EU consumer rules are referred to throughout. We therefore state a GDPR legal basis for every kind of processing in the table below rather than treating the GDPR as somebody else's problem.
• United Kingdom — the UK GDPR applies on the same reasoning.

Because a lot of what happens here concerns sexual preferences and sexual life, most of it is sensitive data: special category data under Art. 9 GDPR, and besonders schützenswerte Personendaten under Art. 5 lit. c revFADP. We process it on your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7) revFADP), which you give when you create an account on lalalust, a site for adults (18+), and which you may withdraw at any time by closing the account. Nothing on lalalust needs that data for anything other than running what you asked for.

1. What we collect

2. What we deliberately do not have

• Your card details. The card payment is taken by the payment provider on its own pages. No card number, no expiry date and no security code reaches our servers. What we store from a payment is the provider's transaction and subscription reference, the amount, the currency, the event type and the raw text of the provider's notification to us — so a payment can be traced and a double booking prevented. That raw text is what the provider sends; it does not contain the card number.
• Creators' identity documents. The verification partner checks them on its own pages and sends us its decision. The passport photo or scan never reaches us; the decision data that comes with it does — see section 1.
• Advertising or tracking profiles. There are no third-party trackers, no pixels, no advertising cookies, and no data sold or shared with advertisers — we do not sell advertising.

3. Who else sees it

• The person you are dealing with sees your display name and what you wrote in the order — never your email, real name or payment details.
• Authorities, where the law obliges us — in particular reports concerning minors.

Everyone else is a processor acting on our instructions under a contract (Art. 28 GDPR / Art. 9 revFADP). We do not sell data, we do not share it with advertisers, and we do not licence it to anyone. These are the categories, what they get, and where they sit:

Where a recipient sits in a country without an adequacy decision — the United States in particular — the transfer rests on the European Commission's standard contractual clauses, on the Data Privacy Framework where the recipient is certified under it, or, for the necessary steps of a contract you asked for, on Art. 49(1)(b) GDPR. Switzerland recognises transfers to the United States under the Swiss–US Data Privacy Framework and otherwise requires the same safeguards with the Swiss addendum. A copy of the safeguards for a specific recipient is available on request at privacy@lalalust.com.

Who processes data for us

CCBill is not our processor for the card itself: it is a separate controller for the payment, and it never passes us a card number, expiry date or security code. What we receive is listed in the table further up.

Every processor is named above. Where a row says on request, the detail — the contracting entity or the safeguard for a transfer — follows from the signed contract with that provider, and we send it to you on request at privacy@lalalust.com (Art. 13(1)(e)–(f) GDPR, Art. 19 revFADP).

4. How long

Be aware of what is automated and what is not. Three things delete themselves reliably: the verification event log described below, after 24 months, swept once a day; a call request with our team, swept every hour (see below); and whatever you remove yourself. Further automatic deletions: a signed-in session ends after 14 days without use and at the latest 30 days after sign-in, a session without an account after 24 hours (swept every 6 hours); a guest wish whose email address was not confirmed is deleted with its guest account after 7 days; a confirmed guest account that was never finished and has no order and no payment 90 days after the last visit, with one email 7 days before; an unconfirmed waitlist address after 7 days; entries of the blocked-term log after 90 days; and the salted hashes of the partner programme after 90 days. Everything else below is a period we apply by hand — on your request, or when we clear out old data — not a timer running in the software. If you want something gone sooner, ask; we would rather delete it than keep it.

• Account data — while the account exists. Deleting the account in Settings overwrites the email address, password, display name, biography, categories, tags, preferences and payout details, erases the avatar and the portfolio files from storage, empties the text of the messages you wrote in orders, chats and support (the rows stay so the other person's thread keeps its order), and closes the account for good. It does not erase order records, deliveries, reviews, the ledger, case files, support conversations, or the age and consent declarations — those stay attached to an account that no longer names you, for the reasons in the lines below. Files you uploaded as physical-goods listings or as vault items are removed by hand on request; ask and we do it.
• Messages and order records — kept at least 12 months after the order completes (unless you delete your account: then the text of your own messages is emptied at once, see above), so a late dispute or a chargeback can still be judged. They are not deleted automatically after that; ask and we remove what is no longer needed.
• Invoices and accounting records — 10 years, because tax law at the operator's seat requires it. These survive account deletion.
• Age and consent declarations for published content — kept for as long as the law requires records to be available for inspection. These also survive account deletion.
• Security records — the IP address and browser string stored with a signup, a consent declaration or a report stay with that record; they are not on a separate 30-day clock.
• Support conversations — kept until the account is removed.
• Callback requests — deleted automatically 60 days after they were sent, or 30 days after the call is marked done if that comes first; at once if you use the withdrawal link shown after sending, or delete the request in your studio.
• The verification event log — 24 months, deleted automatically by a daily clean-up. It holds only the state, the time, the partner's session reference, the result, the age read from the document and the stated reason — and, where the selfie comparison found one, the number of the other lalalust account it matched, with how close the match was. No name, no date of birth from the document, no document number, no links to images: those are never written in the first place. The current verification state stays on the account, because it is what makes the profile visible.

5. Your rights

You can demand: access to your data, correction, deletion, restriction of processing, portability in a machine-readable form, and objection to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time with effect for the future.

Under Swiss law the same rights exist under different numbers: information (Art. 25 revFADP), correction (Art. 32), deletion or blocking, and objection. There is no fee for the first request, and we do not ask you to justify it.

Export and deletion are both built into Settings — you do not have to write to us for either. The export covers your account record, wishes, offers, messages, deliveries, ledger, payouts, reviews, portfolio, catalogue, consent records, notifications, support tickets and cases, and also your spending limit, withdrawal declarations, goals, profile questions, recommendations, delivery days, the welcome-series log, your own reports, a guest access, your consents before a purchase, an age check result, your passkeys (public details only) and your time zone, where you have them; the uploaded files themselves are not in it, and you download those from the pages they belong to. If you want anything the export does not cover, ask and you get it: privacy@lalalust.com. We answer within one month.

You may complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern; in the EU, the authority of the member state where you live or work; in the UK, the Information Commissioner's Office.

If a breach of security leads to a high risk to your rights, we tell you, and we notify the competent authority — the FDPIC as soon as possible under Art. 24 revFADP, and, where the GDPR applies, the lead supervisory authority within 72 hours under Art. 33 GDPR.

lalalust has not appointed a data protection officer. Under the GDPR that is a judgement call (Art. 37(1)(b)–(c)) that turns on the scale of the monitoring and of the sensitive data involved, and for a platform of this kind it is a close one; under Swiss law an adviser (Art. 10 revFADP) is voluntary for a private controller.

Automated decisions. Decisions to remove content, case decisions and suspensions are made by a person. Some routine steps follow fixed written rules without a person: text-only wishes and offers without any risk signal go live after a waiting time; a report about something that has already been removed is closed with a statement of reasons; anything flagged waits for a person. Two further things are automatic, and we would rather name them than let you find out: the verification partner's result is applied by the software — an "approved" switches a creator profile live, a "declined" or "expired" hides it again, and a result reading an age under 18 blocks the account outright; and an order completes and pays out by itself after the approval window passes. Both are governed by rules written on these pages, not by a model that scores you. If either goes against you, you can demand that a person look at it and say so — write to privacy@lalalust.com or support@lalalust.com, and a person will. There is no profiling and no scoring of you as a person.

6. Security

Everything travels over TLS. Passwords are hashed, never stored in a readable form. Sessions rotate on sign-in. Two-factor authentication is available to everyone and strongly recommended for creators, because those accounts hold money. Uploads are identified by their actual content rather than by their file name, and file types that can carry a script are refused. JPEG photographs have their EXIF, XMP and IPTC blocks removed on upload — that is where GPS coordinates and camera serial numbers live — and MP4 video and audio have their metadata boxes removed. Other formats (PNG, WebP, GIF) are stored as they arrive, so if you are worried about what a tool wrote into such a file, export it as JPEG. Files are served only to people entitled to see them.

We do not claim to be unbreakable, we hold no security certification, and we do not describe ourselves as PCI-compliant: card data is handled by the payment provider on its own pages precisely so that we do not have to be.

7. Children

lalalust is for adults. We do not knowingly process data of anyone under 18. If we learn that we have, the account is closed and the data deleted immediately.

8. Changes

If this policy changes materially, you are told by email and in your account before it takes effect. The date at the top is always the version in force.