Controller and contact: The controller responsible for processing personal data within the meaning of the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR) is: FABS Media GmbH, Roosstrasse 53, 8832 Wollerau, Kanton Schwyz, Switzerland. Email: info@snapsell.org (UID CHE-313.184.253, Managing Director: Victor Herzog).

Our data minimisation principle: Personal data is any information that identifies, or could identify, a natural person. We follow the principle of data minimisation and collect as little personal data as we reasonably can.

Scope and applicable law: Since the controller is based in Switzerland, the FADP applies to our processing. Where we offer the service to people in the EU/EEA or monitor their behaviour, the GDPR applies on top. Other apps or sites linked from the service may have their own privacy policies.

Whose data we process: Uploaders (sellers): account, identity/age-verification and payout data. Downloaders (buyers): age-verification confirmation, purchase and payment data. People shown in content: identity and consent records that an uploader has to provide and that we may hold or request for compliance purposes.

Legal bases: We process personal data to set up, define, perform or manage the contract (Art. 6(1)(b) GDPR; Art. 31 FADP), on the basis of your consent (Art. 6(1)(a) GDPR), to meet a legal obligation (Art. 6(1)(c) GDPR), or where it’s needed for our legitimate interests, provided your interests and fundamental rights don’t override them (Art. 6(1)(f) GDPR). We may bring in processors under appropriate data-processing agreements, and otherwise we don’t share personal data with third parties.

Registration / login data: You need to register or log in to use the features of the service. The data you give at registration is used only for the stated purposes, on the basis of performing the contract and, where relevant, your consent.

Usage data / log files: When you visit the website or app, we collect general technical information including IP address, time, device type, length of visit, browser type and, where relevant, the page you came from. This usage data goes into a log file and may be used and stored to analyse statistics about the website and app. It isn’t linked to your other personal data.

Categories of personal data: Depending on how you use the service, we may process: device type and information about how you use the application; email address and credentials; time zone and country of origin; photos, media and content you upload; banking and transaction information (payment amount, account details, date); identity and age-verification data (see Section 4). We need this data to identify the user, run the app’s features and counter misuse.

The service is for adults and may involve content of an adult or sexual nature. Information about a person’s sex life or sexual orientation is a special category of personal data (Art. 9 GDPR) and sensitive personal data under the FADP. Where we process such data, we do so on the basis of your explicit consent or another lawful ground, and we apply enhanced safeguards.

Age verification: To confirm that uploaders, depicted persons and downloaders are adults (18+), we and/or our verification providers may process government-issued ID documents, date of birth and verification results. This is necessary to meet legal obligations and to protect minors. ID documents are processed with restricted access and kept only as long as required (see Section 7).

Consent and identity records for depicted persons: Where an uploader has to provide identity and consent documentation for people shown in content, those records may be processed and retained for compliance, audit and legal-defence purposes.

To process payments, the necessary payment data is passed to the financial institution handling the payment and to the payment service provider(s) we use. These providers process data as independent controllers and/or processors under their own terms.

Depending on your location and the products offered, our payment service provider(s) may include an adult-industry-specialised processor and, where applicable, Stripe (Stripe Payments Europe, Ltd, Dublin, Ireland for EU uploaders; Stripe, Inc., San Francisco, USA for US uploaders; further entities at https://stripe.com/legal).

We use cookies or server-side sessions to run the website. Strictly necessary cookies (e.g. spam protection for the contact form) rely on our legitimate interest and the technical needs of the site (Art. 6(1)(f) GDPR).

Cookies that personalise content and advertising, enable social-media features or analyse access are only set with your express consent (Art. 6(1)(a) GDPR). With your consent, we may share information about your use of our site with social-media, advertising and analytics partners, who may combine it with other data they hold about you. You can withdraw consent at any time.

We keep personal data only as long as we need it for the purpose it was collected for, and after that only as long as the law requires (in particular tax and accounting law).

Age-verification records and consent/identity documentation are kept for the period required by applicable law and in any case for no less than 7 years, after which they’re deleted or anonymised.

All data on our website and in our services is protected by appropriate technical and organisational measures against loss, destruction, unauthorised access, alteration and disclosure.

If a personal data breach happens that’s likely to put your rights at risk, we’ll notify the competent supervisory authority and, where required, the affected people, in line with applicable law.

We process personal data within Switzerland, the EU/EEA and countries recognised as offering adequate protection. Where data goes to a country without an adequacy decision (including the USA), we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the Swiss addendum, and, where applicable, providers certified under the EU-US Data Privacy Framework (and its Swiss extension). The outdated "Privacy Shield" framework is no longer relied upon.

Google Analytics: This website uses Google Analytics, a web-analytics service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It uses cookies to analyse how you use the site and builds pseudonymous usage profiles. IP anonymisation is switched on, so your IP address is shortened within the EU/EEA before transmission; only in exceptional cases is the full IP sent to a Google server in the USA and shortened there. The transmitted IP isn’t combined with other Google data, and pseudonymous profiles aren’t merged with personal data without your separate consent. Google Analytics runs only with your consent (Art. 6(1)(a) GDPR). You can opt out via your browser settings or the plugin at http://tools.google.com/dlpage/gaoptout.

Google Web Fonts: We use web fonts from Google Ireland Limited to show a standardised font. These are stored in your browser cache when you visit our pages. If your browser doesn’t support them, a standard font from your device is used. Google’s privacy policy: https://www.google.com/policies/privacy/.

Social-media login: You can log in via an existing social-media account (Google, Facebook/Meta Platforms Ireland Ltd., or Apple Inc.) so you can reach your content across devices. You’ll be redirected to the relevant provider, whose data-protection terms and terms of use apply to that login.

Google Firebase and Firebase Cloud Messaging: Our service may use Google Firebase (Google Ireland Limited). This processes data such as time-stamped "instance IDs" assigned to a user, used in aggregated, pseudonymised form to analyse and improve behaviour (e.g. crash reports). Google may use the advertising ID for Firebase Analytics; you can limit this in your device settings. Firebase Cloud Messaging is used to send push and in-app messages via a pseudonymised push reference and can be switched off in your device settings. Transfers to the USA can’t be ruled out. Legal basis: your consent (Art. 6(1)(a) GDPR). Privacy policy: https://firebase.google.com/support/privacy/.

Information / access (Art. 15 GDPR): to know whether and how we process your personal data and to receive the further information the law specifies.

Rectification (Art. 16 GDPR): to have inaccurate data corrected and incomplete data completed.

Erasure (Art. 17 GDPR): to have your data deleted where, for example, it’s no longer needed, you withdraw consent and there’s no other basis, or it was processed unlawfully. This doesn’t apply where the data is needed to establish, exercise or defend legal claims.

Restriction (Art. 18 GDPR): to restrict processing in the cases the law provides for.

Data portability (Art. 20 GDPR): to receive data you provided in a structured, common, machine-readable format and pass it to another controller, where processing is based on consent or contract and is automated.

Objection (Art. 21 GDPR): to object to processing based on legitimate interests on grounds relating to your particular situation, and at any time to processing for direct marketing.

Withdrawal of consent: where processing is based on consent, you can withdraw it any time with effect going forward.

Complaint: exercising these rights is generally free. You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you’re in the EU/EEA, to the supervisory authority where you live or where the alleged infringement happened.

The service is strictly for adults (18+). We don’t knowingly collect personal data from minors. If we find out that a minor’s data has been collected, we delete it without undue delay.

We may update this Privacy Policy to reflect legal, regulatory or technical changes. The current version is always published within the service with its validity date.

For data-protection enquiries, contact the controller: FABS Media GmbH, Roosstrasse 53, 8832 Wollerau, Kanton Schwyz, Switzerland; info@snapsell.org.