Privacy & GDPR

The controller for this site is John Colt, operating from Romania. For any privacy question, or to exercise a right, write to legal@ratedcreators.com.

Directory profiles (unclaimed). A creator’s public handle, display name, the public facts shown on her own page (subscription price, photo / video / like / post counts, stated city or country, free-trial availability) as published by the listing site OnlyFinder and the public post counter FansMetrics, the dates we read them, and an editorial note and rating we write about the service. No real names, no images, no private data. Lawful basis: legitimate interest (Art. 6(1)(f)) in operating a consumer directory of commercial pages; for the fact that a page sells adult content, Art. 9(2)(e) — information the creator herself has manifestly made public by advertising the page. Any creator can have the profile removed within 48 hours through the takedown form, no questions asked.

Claimed profiles. On top of the above: the facts, links, bio and SFW photos the creator supplies herself, the claim email address, and the changes she proposes with the moderator’s decision. Lawful basis: consent, given at claim and recorded with a timestamp. Photos are hosted on our servers only for claimed profiles and only when supplied by the creator.

Reader accounts. If you open an account: your email address (to send the sign-in link and the alerts you asked for), the profiles you choose to watch, and a record of the changes we told you about. Sign-in is by single-use link; we hold only a hash of your session. Lawful basis: performance of the service you asked for (Art. 6(1)(b)). Your email is never shown to creators or agencies and never used for marketing. You can delete the account, and everything in it, from the account page in one step.

Agencies. Agency name, website, country, a description, and a contact email (private) used for verification and the dashboard link; the creators an agency declares and whether each creator confirmed. Lawful basis: performance of the service requested.

Featured placement. When a claimed creator buys placement, the order (which hubs, how long, the amount) and a receipt email. Payment is taken on the payment provider’s own page; we never see card details. The start of every paid placement is written to the public moderation log, because a paid slot must not be a secret.

Reviews. When public reviews open, we process the reviewer’s email address (to confirm they are a real, reachable person), a chosen pseudonym, the review text, and a hashed form of the IP address for abuse control. Lawful basis: legitimate interest in operating a review platform that is not overrun by fraud, balanced against the rights of everyone involved. Reviews are only ever published on profiles whose creator gave explicit consent (Art. 9(2)(a)).

Forms and abuse control. Listing requests, claims, reports and takedown notices process the name and email you give us, plus a salted hash of the IP address. Rate limits are counted per hashed address. Profile pages count views in aggregate (a daily total and a daily count of distinct hashed visitors) so that a creator can see how often her page was opened; no visitor is identifiable from that count.

Special category data. We recognise that information connecting a named person to the adult industry can constitute data concerning a person’s sex life under Article 9 GDPR. This is why we publish handles rather than real names, why nothing beyond what the creator herself advertises is recorded, why reviews require her explicit consent, and why erasure requests are honoured without argument.

Strictly necessary, first-party cookies only: rc_member holds a reader’s session after sign-in (90 days, or until sign-out); rc_mod holds a moderator’s session (12 hours). A third, rc_featured_return, exists only for the 30 minutes around a Featured checkout so the payment provider never sees a dashboard link, and is deleted the moment you return. A fourth, rc_reveal, is set only on the moderation panel: a dashboard link that could not be emailed, held for up to 15 minutes so the moderator can send it by hand, then deleted. The dismissed 18+ notice is remembered in your browser’s local storage. There are no advertising, analytics or third-party cookies, which is why there is no cookie banner. Page views are counted with Vercel Web Analytics, which sets no cookie and stores nothing on your device: it counts a visit with a hash of the request that Vercel discards within a day, keeps no IP address, and does not follow you to other sites. Dashboard, account, moderation and confirmation pages are never reported, and query strings are stripped before anything is sent.

• •We do not store raw IP addresses. They are salted and hashed on arrival.
• •We do not ask for identity documents. Creator verification is a code in your public bio; agency verification is control of the agency website.
• •We do not publish real names, addresses, workplaces, or anything else that identifies a person behind a handle. Attempting to post such information gets the post removed and the account banned.
• •We do not sell or share personal data with advertisers or data brokers, and we run no advertising scripts. The one analytics script is Vercel Web Analytics: cookieless, aggregate page views only.
• •We do not copy or re-host images from platforms or from other sites. The only photos on this site were supplied by the claimed creator they show.
• •We do not store or display estimates of subscriber numbers or earnings, even where listing sites publish them.

Under GDPR you can ask us to:

• •Access — tell you what we hold about you.
• •Rectify — correct anything inaccurate.
• •Erase — delete your profile and everything under it (Article 17).
• •Restrict or object — pause processing while a dispute is resolved.
• •Port — receive your data in a machine-readable form.

Use the takedown form or email legal@ratedcreators.com. We answer within 30 days, usually much sooner, and always in writing.

You can have your entire profile erased, and we will do it. We want to be straight with you about what that does and does not mean, because other platforms are not.

Erasure removes the profile as a whole — including reviews that were favourable to you and any replies you published. It is not a mechanism for deleting individual criticism while keeping the rest. If your objection is to one specific review, the route is a dispute with evidence, not erasure.

After erasure we keep a minimal, non-identifying tombstone record showing that a profile existed at that address and was erased. This exists so the moderation log stays coherent, and it contains no personal data.

• •Creator profiles: until you ask us to remove them. Dated public facts are kept as a history of checks while the profile exists.
• •Reader accounts: until you delete them; an address that asked for a sign-in link but never used it is removed after a day; sign-in links expire after 20 minutes and are removed after a day; ended sessions after 30 days.
• •Agencies: while listed. Ended roster links are kept as dated history while both parties are listed.
• •Featured orders: 7 years, as accounting records require.
• •Reviews: while published, or until removed under policy. Removed reviews are retained in non-public form only as long as needed for the audit trail.
• •Takedown, claim and agency correspondence: 24 months, so we can show how a decision was reached.
• •Hashed IPs and rate-limit counters: 12 months at most; rate-limit rows are deleted after two days.
• •Page-view counts: daily aggregates for 13 months; the hashed visitor rows behind the distinct count for 35 days.
• •Vercel Web Analytics: aggregate page views (page, referrer, country, device type) for as long as our Vercel plan keeps them; the request hash behind a visit is discarded within a day.

We use a managed PostgreSQL provider for the database and Vercel for hosting the site and its cookieless page-view analytics, both under data-processing terms; an email delivery provider for sign-in links, alerts and form confirmations; and a payment provider for Featured placement, which handles card details on its own pages. Public facts on unclaimed profiles are read from OnlyFinder and FansMetrics, which publish them; nothing about you is sent to them. We keep this list short on purpose: fewer processors means fewer places your data can go.

If you think we have handled your data badly, tell us first — we would rather fix it. You also have the right to complain to your national data protection authority.