Privacy Policy

The controller of your personal data is PEACHCREAM S.R.L., a limited liability company organised under the laws of Romania, with its registered office at Șoseaua Iancului nr. 53, bl. 102B, sc. C, et. 7, ap. 111, Sector 2, Bucharest, Romania, registered with the Bucharest Trade Register under no. J2026041854006 (EUID ROONRC.J2026041854006), sole registration code (CUI) 55048995, VAT identification number RO55048995 (also our EU One Stop Shop identification number) (CreamyPeach, we, us). We operate the CreamyPeach platform at creamypeach.com and its related applications and services (the Platform).

Data Protection Officer. Our Data Protection Officer can be contacted at [email protected] or by post at the registered office, marked "Data Protection Officer". The DPO's appointment has been notified to the Romanian supervisory authority.

Privacy requests should be sent to [email protected]. General support: [email protected]. Security reports: [email protected].

CreamyPeach is established in the European Union and processes personal data under Regulation (EU) 2016/679 (the GDPR), Law no. 190/2018 implementing it in Romania, and Law no. 506/2004 on privacy in electronic communications. Where you are outside the EU, the additional rules in clause 29 apply.

This policy applies to: visitors to the Platform; people who go through age verification; registered users, subscribers and purchasers (Fans); independent content creators who contract with us under the Creator Agreement (Creators); people who appear in Creators' content (Depicted Persons); and anyone who contacts us, reports content, submits a legal notice or exercises a right.

It does not cover the independent processing of third parties whose services you use through the Platform, in particular our payment processor and our verification provider, each of which shows you its own privacy notice at the point where you use it. Their current names are published in our processor list at creamypeach.com/privacy/processors.

CreamyPeach is the controller for all personal data processed on the Platform: account administration, age verification results, payments, Wallet and purchase records, content delivery, AI chat and personalisation, moderation, fraud prevention, security, support, complaints, Creator onboarding and payouts, tax reporting and legal compliance.

Creators receive limited information about the Fans who interact with them (clause 15) and are independent controllers for that information and for the consent records they hold about Depicted Persons. The Creator Agreement binds every Creator to use that information only to provide content and interact with Fans on the Platform, never to identify, contact or market to Fans elsewhere, and to delete it when they leave the Platform.

Processors act on our documented instructions under contracts that meet Article 28 GDPR (clause 14). Independent controllers such as our payment processor, our verification provider, banks, card networks and tax authorities determine their own purposes for the data they must process under their own legal duties.

We collect only the data needed for the purpose stated; we tell you what we collect and why; we keep it only as long as clause 24 says; we protect it as clause 22 describes; we never sell personal data; we never use your adult-content interests, private messages, sexual orientation, identity documents or biometric data for advertising; and we document how we comply (records of processing, data protection impact assessments for age verification, adult-interest personalisation and AI chat memory, legitimate-interest assessments and processor contracts), which our DPO maintains.

Account data. Email address, username, password (stored only as a salted hash), country, language, date you confirmed you are an adult, consent choices, notification settings, account status, two-factor authentication status, login history and account-recovery records. Source: you, and our systems.

Age-verification data. Before you can view adult content, our verification provider verifies that you are an adult. Depending on your country, it asks for a government identity document and a live facial image (liveness check), or performs a payment-card check. The provider processes the document and the facial image; CreamyPeach receives only the result (verified or not), the method used, the date and the provider's reference number. We never receive or store your identity document or facial image. The provider's own privacy notice, shown before you start, explains its processing and retention; its current name is in our processor list at creamypeach.com/privacy/processors.

Payment data. Our payment processor processes your payment. We receive the transaction reference, amount, currency, tax, billing country, card brand and last four digits, payment-method type, authorisation result, receipt, refund and chargeback status, and the processor's fraud signals. We never receive or store your full card number or security code.

Purchase, Wallet and access data. Subscriptions and their renewal dates, Wallet deposits and balance, every spend, tip and unlock, the Creators you subscribe to, the content you have access to, and the delivery record for each item.

Messages and chat. The messages you send and receive, including with AI Chat Assistants and Virtual Creators; attachments; the prices of paid messages; timestamps; and the conversation memory described in clause 18. Messages may contain intimate statements, preferences and fantasies you choose to share. Who reads them: a message to a Creator is read by that Creator or by an assistant the Creator has authorised under the Creator Agreement; a message to a Virtual Creator is answered either by AI (shown with the AI notice) or by CreamyPeach staff who operate that fictional persona. Do not share identity documents, financial details, health information or other people's personal data in chat.

Content you submit. Custom-content requests, reports, complaints, support tickets, screenshots and feedback.

Device, network and usage data. IP address, approximate location derived from it, device and browser type, operating system, language, session identifiers, cookies and similar identifiers (clause 20), pages and content viewed, media playback events, searches, clicks, errors, timestamps and referral source. Precise geolocation is never collected.

Security and fraud data. Login attempts, failed authentications, device changes, velocity and risk scores, links between accounts, chargeback history and investigation notes.

Moderation data. Reports you make or that are made about you, automated classifier results, reviewer notes, warnings, decisions and appeals.

Marketing data. Your email address, marketing preferences, campaign engagement and opt-out records, only as described in clause 21.

Forensic watermark identifiers. Content delivered to you carries visible and invisible identifiers that encode your account identifier, the item and the time of delivery, so that leaked content can be traced to the account that received it. These identifiers are personal data and are processed only to detect and act on unauthorised distribution.

Location evidence for tax. To determine your country and charge the correct VAT if you are in the EU, or a similar tax where it is due elsewhere, we record, for each payment, your billing country, the country of your payment card and the country of your network address, as EU VAT law requires, and we keep this evidence for the period in clause 24.

Everything in clause 5 that applies to your use of the Platform, plus:

Identity verification. Our verification provider verifies your identity and age with a government identity document and a liveness check. We receive the result, the method, the date, the provider's reference and your verified legal name and date of birth, which we must hold for tax reporting and Creator Agreement acceptance records. Creators re-perform identity verification every six months, with 30 days to complete it after we notify them, so that the information we hold stays up to date; each re-verification replaces the previous result and we keep the date and reference of each one for the period in clause 24.

Tax Status Declaration. Your business form, registration documents, fiscal registration code, VAT status, tax residence, tax identification number, certificate of tax residence where you are a non-resident, and the declarations in Schedule 4 of the Creator Agreement.

Payout data. The payout account you register with our payout provider (held by the provider; we receive the account identifier and status), payout history, reserves, deductions and failed-payment information.

Earnings data. Gross fan payments attributed to your content, deductions, Creator Earnings, Self-Billed Invoices and statements, and for business Creators the beneficial-owner information required by Law no. 129/2019 on preventing money laundering.

Content and consent records. The content you upload, its metadata, the AI flag you set, and the Performer Documentation you provide on request for Depicted Persons (clause 7).

Acceptance records. Your acceptance of the Creator Agreement and each of its versions, with the data listed in its Schedule 5.

AI Studio data. If you use the AI Studio, we process the prompts, settings and reference material you enter, the outputs you generate, save or publish, and generation logs (time, model used, safety-filter results). If you create an AI persona of your own likeness, we process your facial images and, where you enable it, your voice to build and run that persona model. Because this data can identify you biometrically, we process it only with your explicit consent given in the AI Studio (Article 9(2)(a) GDPR), we never use it for any other persona or for any other purpose, and we delete the persona model, with its training material, within 30 days of your request or when your Creator Account closes.

Where a real person other than the Creator appears in a Creator's content, that person completes identity and age verification through our verification provider and signs the Co-Performer Release and Consent Form in the Platform before the content is published. We receive the verification result, the method, the date, the provider's reference and the person's verified legal name and date of birth, and we hold the signed release and a cross-reference to the content, for the period in clause 24. The Creator additionally holds a copy of that person's identity document and the signed release under the Creator Agreement and provides them to us on request for compliance with Law no. 196/2003, the Content Standards and payment-network rules. We process these records only to verify age, identity and consent, to investigate reports, and to respond to authorities. We are the controller for the verification result and the release we hold; the Creator is the controller for the copies the Creator holds.

If you visit the Platform without an account, we process the device and network data in clause 5.7 and your cookie choices. If you report content, submit a legal notice, exercise a right or contact us, we process your name, email, the content of your message and our response.

We derive operational records from the data above: content classifications, entitlement records, conversation memory, recommendation signals, fraud and risk scores, moderation outcomes and aggregated statistics. Where these remain linked to you they are personal data and are covered by this policy, including your rights under clause 26. We do not infer sensitive characteristics about you for any purpose other than safety and the personalisation you have explicitly enabled.

The GDPR requires a legal basis for each purpose. The table lists every purpose, the data used and the basis. Where a purpose touches data about your sex life or sexual orientation, or biometric data, an additional condition under Article 9 GDPR applies (clause 11).

Sex life and sexual orientation. Your use of an adult platform, the content you view, your messages and your purchases can reveal information about your sex life or sexual orientation, which is special-category data under Article 9 GDPR. We process it only to provide the service you asked for (Article 9(2)(a) explicit consent, given when you confirm at registration that you wish to receive adult content and personalised interactions), to keep the Platform safe and lawful (Article 9(2)(f) and (g)), and to defend legal claims. We treat all of it as confidential, restrict access to it inside the company, never use it for advertising or profiling for advertising, never sell it, and never infer sexual orientation for any purpose.

Biometric data. Where our verification provider performs a facial liveness check, it processes biometric data to confirm that the document belongs to you. This is done only with your explicit consent, given on the provider's screen before the check starts, and CreamyPeach never receives the biometric data. You may choose another verification method offered in your country instead. The only other biometric processing we carry out is the optional Creator likeness model described in clause 6.8, which also rests on your explicit consent and can be withdrawn at any time.

Sensitive personalisation. If you enable preference-based personalisation of AI chat (for example, remembering your stated preferences and boundaries), we ask for your explicit consent in the setting that enables it. You may withdraw it at any time in Account settings, which deletes the stored preference memory within 30 days.

Other sensitive information you volunteer in messages (health, religion, politics, ethnicity) is not requested by us and is not used for any purpose other than delivering the message, moderation and your own rights requests.

We do not make decisions about you based on sensitive data except to protect safety and comply with the law.

Where we rely on legitimate interests, we have documented an assessment that weighs our interest against your rights, taking into account the sensitivity of adult-context data. Our legitimate interests are: keeping the Platform safe and free of illegal content; preventing fraud, chargebacks and account takeover; securing our systems; recommending relevant content; measuring and improving the Platform; evidencing compliance; and establishing, exercising or defending legal claims. You may object to any processing based on legitimate interests (clause 26.8). Safeguards include data minimisation, pseudonymised analytics, restricted access, short retention and exclusion of sensitive fields from analytics and marketing.

Where we rely on consent, we ask for it separately, in plain language, through an affirmative action. Pre-ticked boxes and silence are never consent. We keep a record of each consent (version, wording, timestamp, account or device identifier). You may withdraw consent at any time in Account settings or by writing to [email protected]; withdrawal does not affect processing that took place before it. If a feature cannot work without the consent you withdraw, that feature stops; the rest of the Platform is unaffected.

We do not accept consent from minors; the Platform is for adults only.

We share personal data only with the recipients below, only the data each needs, and under contracts that restrict their use of it.

We do not use advertising networks, social-media pixels or cross-site tracking on the Platform.

The current name and location of every processor and independent recipient in this clause are published in our processor list at creamypeach.com/privacy/processors. We update that list before a new provider starts processing your data, and where a change materially affects you we also notify you under clause 32.

A Creator you interact with sees your username, whether you subscribe to that Creator, your purchases, tips and paid-message activity relating to that Creator's profile, the messages you exchange, and aggregated statistics about their own audience. A Creator never sees your legal name, email address, age-verification data, payment details, Wallet balance or your activity with other Creators. Creators may not export this information or use it to identify, contact or market to you outside the Platform.

Where a Creator uses an AI Chat Assistant, your messages to that Creator are processed by the AI provider in clause 14 to generate replies within the limits the Creator configures.

We disclose personal data to courts, law-enforcement authorities, regulators (including ANSPDCP, ANPC and ANCOM), tax authorities (including ANAF, to which we report Creator earnings under DAC7 each year) and child-protection bodies where the law requires it or where a valid legal request obliges us. We assess each request for authority, scope and proportionality and challenge requests that are unlawful or disproportionate.

We disclose data without a request where necessary to protect life or physical safety, or to report child sexual abuse material, which we are required to report, including to the National Center for Missing and Exploited Children where applicable. The content and account data connected to such a report are preserved for at least one year from the report, or longer if an authority requires, and are accessible only to our safety team and the authorities.

We notify you of a disclosure where the law permits and notification would not endanger a person or an investigation. We keep a record of every request and disclosure.

We are in Romania and keep primary storage in the European Economic Area. Some recipients in clause 14 may be in the United States (for example AI, security and email providers, and a payment processor where we use one established there), as shown in our processor list. Transfers to them are made under: the EU-US Data Privacy Framework where the recipient is certified and the transfer is within its scope; otherwise the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), with a transfer impact assessment and supplementary measures such as encryption in transit and at rest, pseudonymisation of chat data sent to AI providers, and data minimisation.

Transfers to the United Kingdom and Switzerland are covered by the European Commission's adequacy decisions. Transfers from the United Kingdom use the UK International Data Transfer Addendum.

We do not rely on Article 49 derogations for routine processing. If a transfer mechanism becomes unavailable, we suspend the transfer or move the processing. A copy of the safeguards used for any recipient is available from [email protected].

What AI does on the Platform. AI generates the content of Virtual Creators, generates and edits images, video and short-form clips for Creators who use the AI Studio, generates chat replies for Virtual Creators (when the persona is in AI mode) and for Creators who enable an AI Chat Assistant, recommends content, and screens content and messages for prohibited material.

What is sent to AI providers. To generate a chat reply, the recent messages in the conversation, the persona configuration and your stored conversation memory are sent to the AI provider in clause 14, pseudonymised: your name, email, payment details and verification data are never included. To generate images, video or clips, only the prompt, the generation settings and the persona assets the Creator has chosen are sent; a Creator's likeness model is sent only to the provider that runs it, under a contract that prohibits any other use.

Conversation memory. To keep conversations coherent, we store summaries of your conversations with each Creator or Virtual Creator, including preferences and boundaries you state. You can view and reset this memory for any conversation in Account settings; resetting deletes it within 30 days. Memory is deleted when you close your Account.

No training on your data. Your private messages, media you purchase and your personal data are not used to train or fine-tune general AI models, by us or by our providers, whose contracts prohibit it. We use aggregated, de-identified statistics and synthetic examples to test and improve safety filters. If we ever wish to use identifiable data to train a model, we will ask for your separate opt-in consent first.

Human review. AI outputs are not routinely read by people. A person reviews an AI-assisted conversation only where it is flagged by automated safety tools, reported, part of a complaint or dispute, or required by law. The exception is a Virtual Creator persona that CreamyPeach staff are operating at the time, where the staff member reads and answers your messages as clause 5.5 explains. Access is logged in every case.

Labels. You are told when you are interacting with an AI Chat Assistant, and AI-generated media is labelled, as required by Regulation (EU) 2024/1689.

We use automated tools to screen content and messages, score fraud risk, apply spending limits and recommend content. These may temporarily block a message, hold a payment, require re-verification or restrict a feature while a person reviews the matter.

We do not take decisions that produce legal or similarly significant effects for you (such as permanently closing your Account or refusing a payout) solely by automated means. Every such decision is reviewed by a person. Where an automated step affects you, you may ask for human intervention, express your point of view and contest the decision through the complaints process in the Terms (clause 38) or by writing to [email protected].

We never profile you for advertising, and we never use sensitive inferences for recommendations beyond the personalisation you have enabled.

We use cookies, local storage and similar technologies for: strictly necessary purposes (login session, security, age-gate and consent status, payment routing, fraud prevention), which need no consent; functional preferences (language, display settings), which we ask you to allow; and analytics, which run only with your consent. We use no advertising or social-media cookies.

The consent banner shown on your first visit lets you accept all, reject all or choose, with equal prominence, as required by Law no. 506/2004. You can change your choice at any time through the "Cookie settings" link in the footer. The Cookie Policy lists every cookie, its provider, purpose and lifetime, and is updated whenever a cookie is added or removed.

Where the law requires it, we honour the Global Privacy Control signal sent by your browser as an opt-out of analytics.

We send service emails (receipts, renewal reminders, security alerts, policy changes) because they are necessary for your contract with us; you cannot opt out of them while you have an Account.

We send marketing emails only if you opted in, or, where Law no. 506/2004 Article 12 allows it, because you bought from us and we offer you similar services, in which case you were offered an opt-out when we collected your address. Every marketing email has an unsubscribe link; opting out takes effect within 48 hours. We do not send marketing to anyone who has not completed age verification, and marketing emails never reveal the adult nature of the Platform in the subject line or sender name.

We keep a suppression record of your opt-out so that we do not email you again.

We protect personal data with measures appropriate to its sensitivity: encryption in transit (TLS) and at rest; passwords stored only as salted hashes; two-factor authentication offered to all users and required for Creators and staff; role-based access with least privilege, logged and reviewed; segregation of identity, payment, chat and content data; private media served only through signed, time-limited links to verified accounts; pseudonymised data in analytics, testing and AI prompts; vulnerability scanning, patching and penetration testing; staff confidentiality obligations and training; and contractual security requirements for every processor.

No system is perfectly secure. You help by using a unique password, enabling two-factor authentication and telling us at once at [email protected] if you suspect unauthorised access. Security researchers may report vulnerabilities to the same address; good-faith reports made without accessing other people's data or disrupting the service will not be pursued.

We maintain a breach-response procedure. Where a breach is likely to result in a risk to your rights and freedoms, we notify ANSPDCP within 72 hours of becoming aware of it, as Article 33 GDPR requires. Where the breach is likely to result in a high risk to you, we also notify you without undue delay, by email and, where appropriate, by a notice in your Account, describing what happened, the likely consequences, what we have done and what you can do. We document every breach, whether or not it is notifiable.

We keep personal data only as long as needed for the purpose for which we collected it, and then delete or anonymise it. The periods below are our commitments. A period may be extended only by a legal hold for a specific dispute, investigation, chargeback or authority request, which is documented and reviewed, and only for the data concerned.

When you close your Account, or when a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you. Deletion is applied in live systems within 30 days and in backups within the 90-day cycle. Data retained under a legal obligation is kept in minimised form, restricted from ordinary use and never used for marketing or personalisation. Derived data (memory, risk scores, classifications) is deleted with the data it was derived from. We instruct our processors to delete their copies on the same schedule.

Access. You may ask whether we process your personal data and receive a copy of it, together with the information in this policy. The first copy is free.

Rectification. You may have inaccurate data corrected and incomplete data completed. Most account details can be changed in Account settings.

Erasure. You may have your data deleted where it is no longer needed, where you withdraw consent, where you object and we have no overriding ground, or where the processing is unlawful. Closing your Account is treated as an erasure request. We retain only what clause 24 requires under a legal obligation or for legal claims, and we tell you what we keep and why.

Restriction. You may ask us to restrict processing while accuracy or an objection is being assessed, or instead of erasure.

Portability. You may receive the data you provided to us (account details, messages, purchase history) in a machine-readable format, and have it transmitted to another controller where technically feasible. You can export it from Account settings.

Withdraw consent. At any time, in Account settings or by writing to us, without affecting earlier processing.

Human review. Where an automated step affects you, you may request human intervention, express your view and contest the decision.

Object. You may object to processing based on legitimate interests, including recommendations, on grounds relating to your situation; we stop unless we show compelling grounds. You may object to direct marketing at any time and we stop immediately.

Conversation memory and AI data. You may view, reset or delete conversation memory in Account settings and request access to or deletion of other derived data through [email protected].

Write to [email protected] from the email address registered on your Account, or use the privacy tools in Account settings. You do not need to use legal terms. We acknowledge your request within two business days and respond within one month. For complex or multiple requests we may extend by up to two further months and tell you why within the first month.

Before acting, we verify that the request comes from you: normally by confirmation from your registered email or an authenticated session. For sensitive data (chat, purchase history, verification records) we use stronger verification. We never ask for your password, full card number or more identity information than needed.

Requests are free. We may refuse or charge a reasonable fee only for requests that are manifestly unfounded or excessive, and we explain why. If we refuse a request, we tell you the reason and how to complain.

You may act through an authorised representative who provides proof of authority. A Creator cannot exercise a Fan's rights.

If you believe that content on the Platform depicts you without your consent, impersonates you or exposes your personal data, report it through the report tool or to [email protected]. We restrict the content while we assess the report, normally within 24 hours, and remove it where the report is substantiated. We may use proportionate identity checks to prevent fraudulent takedowns, and we preserve evidence where the law requires.

United Kingdom. UK GDPR and the Data Protection Act 2018 apply to our processing of your data. You have the rights in clause 26 and may complain to the Information Commissioner's Office (ico.org.uk). Transfers from the UK use the UK International Data Transfer Addendum.

United States. We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use sensitive personal data for any purpose other than those permitted without opt-out under applicable state law (providing the service you requested, security, fraud prevention and legal compliance). Where a state privacy law applies to you, you may exercise the rights to know, access, correct, delete and port your data, to opt out of profiling in furtherance of significant decisions, and to appeal a refusal, through [email protected]. We honour Global Privacy Control signals. Age verification is performed in states that require it for adult websites.

Switzerland. The Federal Act on Data Protection applies; you may complain to the Federal Data Protection and Information Commissioner.

Other countries. Canada: the Personal Information Protection and Electronic Documents Act applies, and you may complain to the Office of the Privacy Commissioner of Canada. Brazil: the Lei Geral de Proteção de Dados applies, our contact for LGPD matters is [email protected], and you may contact the Autoridade Nacional de Proteção de Dados. Australia: the Privacy Act 1988 applies, and you may complain to the Office of the Australian Information Commissioner. Elsewhere, where the law of your country gives you additional rights, we honour them on request. Where we cannot lawfully offer the Platform in your country, we do not.

The Platform is for adults only and we do not knowingly process the data of anyone under 18. If we learn that a minor has created an Account or passed the age gate, we close the Account immediately, delete the data within 30 days, and keep only the minimum evidence the law requires us to preserve or report. A parent or guardian who believes a minor has used the Platform may write to [email protected]; we verify the request and act on it without disclosing adult-service account details to third parties.

Please contact us first at [email protected] or [email protected]; we answer complaints within 14 days and route them to someone not involved in the original decision.

You have the right to lodge a complaint with a supervisory authority at any time. Our lead authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, Romania; [email protected]; dataprotection.ro. You may also complain to the authority of the EU member state where you live or work. You also have the right to an effective judicial remedy and to compensation for damage caused by an infringement, under Articles 79 and 82 GDPR.

We update this policy when our processing, our providers or the law change. The current version and its date appear at the top. We notify you of material changes at least 15 days before they take effect, by email and in your Account, and we ask for a fresh consent where a change requires one; continued use is never treated as consent to a new sensitive processing. Previous versions are available on request.

Controller: PEACHCREAM S.R.L., Șoseaua Iancului nr. 53, bl. 102B, sc. C, et. 7, ap. 111, Sector 2, Bucharest, Romania. Data Protection Officer: [email protected]. Privacy requests: [email protected]. Support: [email protected]. Security: [email protected]. Legal notices: [email protected].