This Privacy Policy explains how we collect, use, share and protect personal data when you visit or use flirty-fun.com (the "Website") and the communication, chat and other services we provide through it (the "Service"). It forms part of, and is incorporated into, our Terms of Use.

The data controller responsible for the processing described in this Privacy Policy is:

Amberline Media B.V.
Prof. E.M. Meijerslaan 1
1183AV Amstelveen, The Netherlands
Chamber of Commerce (KvK) number: 42130689
VAT identification number: NL869861165B01
Email: [email protected]

If you have any question about data protection, or if you wish to exercise any of the rights described in this Privacy Policy, please write to us at [email protected]using the keyword "Data Protection". We will respond within one month. Where a request is particularly complex, we may extend that period by up to two further months and will tell you if we do.

Where You Are Located

We are established in the Netherlands, so the General Data Protection Regulation applies to our processing and our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

If you are in the United Kingdom, the UK GDPR also applies to the processing of your personal data. As we are not established in the United Kingdom, we have appointed [UK REPRESENTATIVE — NAME AND ADDRESS] as our representative under Article 27 UK GDPR. Users in the United Kingdom may contact our representative on any matter relating to the processing of their personal data, and may lodge a complaint with the Information Commissioner’s Office.

If you are in the United States, you may have additional rights under state law. These are described in section 19 below.

1) Who May Use the Service

FLIRTY-FUN.COM IS INTENDED FOR CONSENTING ADULTS OVER THE AGE OF 18, OR INDIVIDUALS WHO HAVE REACHED THE AGE OF MAJORITY IN THE JURISDICTION FROM WHICH THEY ACCESS THE WEBSITE, WHICHEVER IS OLDER.

Persons under the age of majority may not register for, use or purchase the services or products offered on the Website. We do not knowingly collect personal data from anyone under 18 years of age. If we become aware that we hold data relating to a person under 18, we delete it without delay. If you believe that a minor is using the Website, please contact us immediately at [email protected].

2) When We Process Personal Data

We process personal data that you actively provide to us, and personal data that is generated automatically through your use of the Service. In particular, your personal data may be processed in the following situations:

• Visiting the Website
• Creating and maintaining a user account
• Uploading profile photos, and completing age verification before accessing adult content
• Purchasing Coins
• Chatting with profiles on the Website, or contacting us
• Receiving emails, newsletters and platform notifications
• Moderation of content and profiles
• Analysis of how the Website is used and how effective our advertising is
• Personalisation of content and advertising
• Detection and prevention of fraud, abuse and attacks on our infrastructure

Each of these is explained below, together with the legal basis on which we rely and how long we keep the data.

3) Visiting the Website

When you visit the Website, our hosting provider records the public IP address of the device you are using, together with the date and time of access, the referring page, and your browser and platform type. An IP address is a unique numeric address through which your device sends and receives data over the internet. As a general rule, neither we nor our providers know to whom an IP address belongs, unless you provide us with data that identifies you.

We use this data to deliver the Website to you, to keep it stable, and to detect and prevent attacks on our infrastructure. Websites are attacked frequently, with the aim of blocking access, extracting data or distributing malware, and such attacks harm both us and the people who use the Website. We also convert IP addresses into an approximate geographical location, which we use to pre-fill your location during registration and to apply requirements that depend on where you are.

We may aggregate information about visitors and visit numbers into group statistics. Aggregated statistics do not identify you and may be shared with advertising partners in that form. We will not disclose your identity or identifiable data to advertising partners without your permission.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating a secure and functional website and in preventing unlawful interference. Log data is deleted or de-personalised once it is no longer needed for these purposes.

4) Creating a User Account

To use the full functionality of the Service you need to create an account. The minimum information required is your gender, sexual preference, age, geographical location, email address, username and password. Any further information — such as your name, height, body type, interests, photographs or other profile content — is entirely voluntary. You decide what to include in your profile, and you can edit or delete it at any time.

We process this data to create and administer your account, to enable you to use the Service, and to tailor the profiles, suggestions and chat content presented to you. Information that you publish in your profile or in public areas of the Website may be visible to others using the Website, so please do not publish anything you would not want others to see.

Legal basis: Article 6(1)(b) GDPR — performance of our contract with you. Data is retained until you delete your account, except where we are required or entitled to retain it for longer (see section 15).

5) Special Categories of Personal Data (Article 9 GDPR)

Information about your sexual preference, your sexual interests and your sex life is a special category of personal data under Article 9 GDPR and is subject to stronger protection than ordinary personal data. The same applies to any information you choose to disclose about your health, ethnic origin, religion or political opinions.

We process this data solely on the basis of your explicit consent, which you give when you provide the information during registration or when you add it to your profile. We use it for no purpose other than providing the functionality of the Service for which it is visibly used — personalising the profiles and content shown to you, and the chat features.

You may withdraw your consent at any time by removing the relevant information from your profile or by deleting your account. Withdrawal does not affect the lawfulness of processing carried out before it. Because this information is necessary for the personalisation and chat functions, withdrawing it means we can no longer provide those parts of the Service to you.

If you do not wish us to process data of this kind, please do not add it to your profile and do not communicate it to us through the chat features.

Legal basis: Article 9(2)(a) GDPR — your explicit consent, in combination with Article 6(1)(b) GDPR.

6) Age Verification

As set out in our Terms of Use, where the law of the jurisdiction from which you access the Website requires it, or where we otherwise consider it appropriate, you must complete an age verification process before you are granted access to adult content. Verification takes place after registration and before access to that content.

Depending on the applicable requirements and the method available to you, verification may involve facial age estimation, a government-issued photo identity document, photo identification combined with a live selfie, a payment card check, or verification through banking data. Where the law requires it, we engage certified third-party age assurance providers to carry out the check.

The data is transmitted to the provider in encrypted form. We apply data minimisation and, where available, anonymisation to all age verification processing: we receive only the result of the check and the date on which it was carried out. Identity documents, selfies and facial scans are not stored by us at any point and are deleted by the provider once verification is complete. We retain verification data only for as long as is necessary to meet our legal obligations.

If verification cannot be completed successfully, access to the relevant content is not possible. We reserve the right to request additional verification documentation and to suspend or close accounts pending or following unsuccessful verification.

Legal basis: Where the law of your jurisdiction imposes an age verification duty, Article 6(1)(c) GDPR — compliance with a legal obligation. Where it does not, Article 6(1)(f) GDPR — our legitimate interest in keeping minors off an adult service. Where an identity document, selfie or biometric age estimation is used, Article 9(2)(a) GDPR — your explicit consent.

7) Chat, Profiles and Artificial Intelligence

The Service allows you to send and receive messages. We process the content of your messages in order to transmit them, to display your conversation history, to moderate content and to prevent fraud and abuse.

As stated in our Terms of Use, all profiles on the Website are fictional and do not represent real, contactable individuals. Chat interactions are managed entertainment experiences conducted on behalf of those profiles. Conversations on the free tier of the Service are conducted by an automated system, and this is indicated to you in the chat interface at the start of the conversation, in accordance with Article 50 of Regulation (EU) 2024/1689 (the EU AI Act). Conversations with subscribers are conducted by trained chat operators.

Where artificial intelligence is used, the content of your messages and limited profile context are processed by our AI service providers for the sole purpose of generating or suggesting responses and detecting prohibited content. These providers act as our processors under a written data processing agreement and are not permitted to use your data for their own purposes or to train their own models.

We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing, with the exception of automated fraud and payment-risk checks. If such a check results in a transaction or an account being blocked, you may request human review by contacting us.

Messages are stored until you delete them or delete your account, unless we are legally required or entitled to retain them for longer.

Legal basis: Article 6(1)(b) GDPR — performance of our contract with you; and Article 6(1)(f) GDPR — our legitimate interest in the safety and integrity of the Website.

8) Purchase of Coins

When you purchase Coins, the data required to conclude and process the transaction is collected and processed by our payment service providers. Depending on the payment method, this includes your name, billing address and payment instrument details. Card details are entered directly with the payment provider and are not stored on our systems.

We process transaction data — including the amount, date, payment method and the associated IP address — in order to fulfil the contract, to handle refunds and chargebacks, and to detect and prevent fraudulent transactions.

Legal basis: Article 6(1)(b) GDPR — performance of the contract; Article 6(1)(f) GDPR — our legitimate interest in preventing fraud; and Article 6(1)(c) GDPR — compliance with statutory accounting and tax retention obligations.

9) Contacting Us

When you contact us through any of the channels we provide, we use the data you send us to handle your request. The data is deleted once your request has been dealt with, unless we are required by law to retain it for longer, in which case it is deleted at the end of that period.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in responding to your request; and, where your request concerns the conclusion or performance of a contract, Article 6(1)(b) GDPR.

10) Email, Notifications and Marketing

We use your email address to confirm your registration, to notify you of messages and activity on the Website, to inform you of changes to our Terms or this Privacy Policy, and to send service-related notifications. These messages form part of the Service and cannot be switched off entirely while your account is active, although you can adjust which activity notifications you receive in your account settings.

We also send promotional emails about our own services and offers. You can object to these at any time, free of charge, using the unsubscribe link at the end of every promotional email or by contacting us. We will only share your personal data with third parties for their own marketing purposes with your explicit, informed consent, which you may withdraw at any time.

Legal basis: Article 6(1)(b) GDPR for service messages; Article 6(1)(f) GDPR, in conjunction with Article 13(2) of the ePrivacy Directive as implemented in the Dutch Telecommunications Act, for marketing our own similar services to existing customers; and Article 6(1)(a) GDPR where consent is required.

11) Cookies and Comparable Technologies

We use cookies and comparable technologies — local storage, pixel tags, tracking pixels and other identifiers — to operate the Website, to remember your settings, to understand how the Website is used and to adapt our advertising. Cookies are small text files stored on your device by your browser, which we can read again when you return to the Website. Session cookies are deleted when you close your browser; permanent cookies remain for a defined period.

We use the following categories of cookie:

• Strictly necessary cookies, without which the Website cannot function — for example to recognise that you are logged in. These cannot be disabled.
• Functional cookies, which enable specific features you have chosen to use.
• Analytics cookies, which help us understand how the Website is used.
• Marketing cookies, including those of third-party providers, which are used for advertising and to measure its effectiveness.

Analytics and marketing cookies are only placed with your consent. We ask for that consent through our cookie banner before any non-essential cookie is set. You can change or withdraw your choices at any time through the "Cookie Settings" link in the footer of the Website — withdrawing consent is as simple as giving it. You can also delete cookies and restrict them through your browser settings, although this may mean that parts of the Website no longer work correctly.

Legal basis: Article 6(1)(a) GDPR and Article 11.7a of the Dutch Telecommunications Act for non-essential cookies; Article 6(1)(f) GDPR for strictly necessary cookies.

12) Analytics and Advertising

To understand how the Website is used, and to reach people who are likely to be interested in our services, we work with analytics and advertising providers. These providers may set cookies or comparable identifiers in your browser, and may assign your browser a pseudonymous identification number so that they can record which advertisements have already been shown to you. These identifiers do not contain your name or contact details.

The Cookie Settings manager described in section 11 is the primary way to withdraw your consent, and we recommend using it. In addition, you can set industry opt-out cookies through Your Online Choices at https://www.youronlinechoices.eu if you are in Europe, or through the Digital Advertising Alliance at https://optout.aboutads.info if you are in the United States. You can also adjust your browser so that it rejects third-party cookies, or install a browser extension that blocks third-party data transfers. Please note that this may affect how the Website functions. Details of the individual providers we work with are available on request at [email protected].

Legal basis: Article 6(1)(a) GDPR — your consent, given through the cookie banner.

13) Content Moderation and Platform Safety

We maintain a platform free of violent, exploitative and otherwise unlawful content. Profile text, photographs and videos submitted for publication are reviewed against our content standards using a combination of automated screening and human review, and material that does not comply is blocked or removed. Chat content is screened for prohibited material and may be reviewed by trained staff where a report is made or where automated screening flags a conversation.

We also process account, device and transaction data in order to identify fraudulent registrations, payment fraud and breaches of our Terms of Use, and to enforce them.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in the safety and integrity of the Website and in protecting the people who use it; and Article 6(1)(c) GDPR where the processing is required to comply with a legal obligation.

14) Recipients of Your Personal Data

We share personal data with the following categories of recipient, in each case only to the extent necessary and, where they act as our processor, under a written data processing agreement:

• Payment service providers, acquiring banks and payment gateways, for processing payments, refunds, chargebacks and fraud prevention
• Hosting, cloud infrastructure and content delivery providers
• Email and CRM platforms, for service and marketing communications
• Artificial intelligence and chat infrastructure providers, for generating and moderating chat content
• Providers of profile content and media
• Analytics, attribution and advertising providers
• Age assurance providers
• Professional advisers, auditors, courts and public authorities, where required by law

We may also transfer personal data to a successor in interest in connection with a sale of the Website, the Service or a substantial part of our assets.

We do not sell your personal data for money. Where the use of advertising cookies qualifies as “selling” or “sharing” under United States state privacy laws, section 19 applies and you can opt out as described there.

Beyond this, we disclose personal data only where necessary to protect the vital interests of you or another person, to detect, prevent or investigate fraud, abuse or unlawful activity, to enforce our Terms of Use, or to establish, exercise or defend legal claims. Any such disclosure is limited to what is necessary for that purpose.

A current list of the processors we use is available on request at [email protected].

15) International Data Transfers

Some of the providers we work with are located outside the European Economic Area. Where the European Commission has adopted an adequacy decision for the country concerned, the transfer takes place on the basis of that decision. Where it has not, we conclude the European Commission’s Standard Contractual Clauses with the provider and carry out a transfer impact assessment, supplemented by additional technical and organisational measures where necessary.

You may request further information about the safeguards in place for a specific transfer by writing to [email protected].

16) How Long We Keep Your Data

We keep personal data only for as long as is necessary for the purposes for which it was collected:

• Profile and account data: until you delete your account
• Chat and message content: until deleted by you, or on account deletion
• Transaction and invoicing data: 7 years after the end of the financial year, as required by Dutch tax law
• Communication data (support correspondence): 2 years after account deletion, for legal compliance
• Marketing data: until you withdraw consent or object, or your account is deleted
• Age verification data: the result and date of the check only, for the life of the account
• Security and log data: de-personalised or deleted once no longer required for security monitoring

Where we are legally required to retain data for longer — for example to meet accounting obligations — or where we are legally entitled to do so, for example in connection with ongoing legal proceedings, we delete it as soon as that obligation or entitlement ends.

17) Security of Your Information

We take appropriate technical and organisational measures to protect the confidentiality, integrity and availability of personal data. Following our risk assessment, these include access controls, admission controls, encryption in transit, and procedures for regularly testing, assessing and evaluating the effectiveness of those measures.

Your account is protected by a password. You should choose a unique and secure password, avoid reusing it on other services, and sign out when you have finished using a shared device. No system can be guaranteed secure: unauthorised access, hardware or software failure and other factors may compromise security at any time.

Information that you publish in your profile or in public areas of the Website is visible to others and should not be regarded as private. Information you provide in connection with your account, your payments and your private communications is treated as confidential and is protected by the measures described above.

Data Breach Notification

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, and we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, as required by Articles 33 and 34 GDPR.

18) Your Data Protection Rights

Right of access (Article 15 GDPR). You may ask us to confirm whether we process personal data concerning you and, if we do, to give you access to that data together with the further information set out in Article 15.

Right to rectification (Article 16 GDPR). You may ask us to correct inaccurate personal data without delay, and to complete incomplete data.

Right to erasure (Article 17 GDPR). You may ask us to delete your personal data, and we will do so without delay where the conditions of Article 17 are met.

Right to restriction of processing (Article 18 GDPR). You may ask us to limit our processing of your data where the conditions of Article 18 are met — for example while we verify data whose accuracy you contest.

Right to data portability (Article 20 GDPR). Where processing is based on your consent or on a contract and is carried out by automated means, you may ask to receive the data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller.

Right to object (Article 21 GDPR). You may object to processing based on our legitimate interests, including profiling. Where we process your data for direct marketing, you may object at any time and we will stop that processing immediately and free of charge.

Right to withdraw consent. Where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint (Article 77 GDPR). You may lodge a complaint with a supervisory authority, in particular in the country where you live, where you work, or where the suspected infringement took place.

To exercise any of these rights, write to us at [email protected]using the keyword "Data Protection". We may need to verify your identity before acting on a request. You may use an authorised agent to submit a request on your behalf.

Deleting Your Account

You can delete your account at any time in your account settings. Once you confirm the deletion, we send a confirmation link to your registered email address, and the account and its associated data are deleted when you follow that link. If the email does not arrive, please check your spam folder. You can also request deletion by writing to [email protected]. Data that we are legally required to retain — in particular transaction records — is kept for the periods set out in section 16 and is not used for any other purpose.

19) United States — State Privacy Rights

If you are a resident of California, or of another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access and obtain a copy of it; to correct inaccurate information; to delete it; and to opt out of the sale or sharing of your personal information and of targeted advertising. We will not discriminate against you for exercising these rights.

Information about your sexual orientation and the contents of your communications is treated as sensitive personal information under California law. You have the right to limit our use and disclosure of sensitive personal information to what is necessary to provide the Service.

To exercise these rights, write to [email protected]or use the "Do Not Sell or Share My Personal Information" link in the footer of the Website. We honour Global Privacy Control signals sent by your browser as a valid opt-out request. You may use an authorised agent to submit a request on your behalf, and we will verify your identity before acting on it.

20) Supervisory Authority

Our lead supervisory authority is the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag, The Netherlands
https://autoriteitpersoonsgegevens.nl

If you are located in another country of the European Union or the European Economic Area, you may also contact your local data protection authority. A list is available at https://edpb.europa.eu/about-edpb/board/members_en.

If you are located in the United Kingdom, you may lodge a complaint with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom — https://ico.org.uk.

21) Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in law, new functions, or changes in our business practices. The most current version is always the valid version and is available in the footer of every page of the Website, together with the date on which it was last updated. Where the changes are material — including any change to the identity of the controller, to the purposes of processing, or to the categories of recipients — we will give you reasonable notice by email or by a message through the Service before the changes take effect.

If you have any questions about this Privacy Policy, please contact us at [email protected].