Effective date
Effective date 2026-10-19
Who is responsible for your data
The administrator of the onlythroat.com service is the controller of your personal data. You can reach the administrator about any privacy question or request at [email protected].
The data we collect
- Account data. Email address, password stored in hashed form, account settings, and the 6 digit confirmation codes we send to confirm your email.
- Profile data. Stage name, profile photo, bio and posts for creators, display name for forum members.
- Age and identity verification data. For creators and co-performers, a copy of a government ID, the liveness selfie, legal name, date of birth, stage names, signed model releases and consent forms. For fans, the result of the age check and, only when the chosen method requires it, the document used.
- Payment data. Plan, price, dates, the payment status and the transaction references sent to us by our card payment partner or crypto checkout. We do not receive or store your full card number.
- Payout data. For creators, bank account or crypto wallet details and tax information.
- Usage data. Training plan answers, course progress, forum posts, subscriptions, unlocks, messages, reports you send, and technical data such as IP address, device and browser type, sign-in times and security logs.
- Arrival data. The page you first arrived on and campaign parameters in the link you followed, used to understand which pages bring visitors.
- Communications. Emails you send us and our replies.
We do not ask for data about your health. Answers you give in the training plan builder, such as how sensitive your gag reflex is, are used only to build your plan.
Why we use your data and on what legal basis
- To create and run your account, deliver subscriptions, courses, the forum and creator tools, process payments and pay creators. Basis: performance of our contract with you.
- To verify age and identity, keep 18 U.S.C. 2257 records, screen content, prevent child sexual abuse material and report it to NCMEC, answer lawful requests and keep tax and accounting records. Basis: legal obligation.
- To protect the service, prevent fraud, chargeback abuse, piracy and account misuse, enforce our policies and defend legal claims. Basis: our legitimate interests in a safe and lawful platform.
- To send service emails such as confirmation codes, receipts, renewal notices and security alerts. Basis: performance of our contract.
- To send the weekly newsletter, only if you subscribe to it. Basis: your consent, which you can withdraw at any time with the unsubscribe link.
- To measure which pages bring visitors, in aggregate. Basis: our legitimate interests.
For visitors in the European Union and the United Kingdom, these are the legal bases under the GDPR and the UK GDPR. Verification data of creators and co-performers may reveal sensitive information by the nature of the content they publish. We process it only with their explicit consent and where needed to meet our legal obligations.
Who receives your data
We share data only as far as needed, with these categories of recipients, each bound to protect it and to act on our instructions where they process it for us.
- Our hosting provider in the US and EU that stores the service and its data
- Our card payment partner and our crypto checkout provider, which process payments and payouts
- An identity and age verification provider that performs document and liveness checks
- Content screening services that check uploads against lists of known abuse material
- Our email delivery provider that sends confirmation codes, receipts and service emails
- Professional advisers such as lawyers and accountants, under confidentiality
- The National Center for Missing and Exploited Children, law enforcement, courts and authorities, where the law requires it or a person is at risk
Creators see the stage name or display name of fans who subscribe, tip or message them, and the content of messages sent to them. Creators never see your email, payment details or verification data.
We do not sell your personal data and we do not share it for cross-context behavioral advertising.
International transfers
The service is run from the United States and the European Union. When data of visitors in the EU or UK is transferred outside those areas, we rely on safeguards recognised by law, such as standard contractual clauses.
How long we keep data
- Account and usage data, for as long as your account is open and for a limited period afterwards to resolve disputes and prevent abuse.
- 2257 records, for as long as the law requires, which can extend beyond the life of the account.
- Payment and tax records, for as long as tax and accounting law requires.
- Data linked to reported child sexual abuse material, as long as the law requires for the investigation.
- Security logs, for a limited period, then deleted or anonymised.
- Newsletter data, until you unsubscribe.
How we protect your data
Data is encrypted in transit. Verification documents are stored encrypted with strict access limits. Passwords are stored in hashed form. Access to personal data is limited to people and systems that need it, and access is logged. No method is perfectly secure, and we tell you and the authorities about a breach when the law requires it.
Your rights
Depending on where you live, you have the right to access your data, to correct it, to delete it, to receive a copy in a portable format, to restrict or object to processing and to withdraw consent at any time without affecting earlier processing.
Residents of US states with privacy laws, such as California, Virginia, Colorado, Connecticut, Utah and Texas, have the right to know what data we collect, to access, correct and delete it, to obtain a copy and to opt out of the sale of data, targeted advertising and profiling. We do not sell data and do not use it for targeted advertising. We do not discriminate against anyone who uses these rights. You may use an authorised agent, and you can appeal a decision on your request by replying to our answer.
In the EU and UK you can also complain to your data protection authority.
To use any right, email [email protected] from the address on your account. We confirm your identity before we act and reply within the time the law sets. Some data cannot be deleted while the law requires us to keep it, such as 2257 records and tax records.
Minors
OnlyThroat is for adults only. We do not knowingly collect data from anyone under 18. If we learn that we have, we close the account and delete the data, except data we must keep and report under the law.
Changes to this policy
We update this policy when our processing or the law changes. The effective date at the top shows the current version. We tell you by email or in your account about material changes.
Contact
The administrator of the onlythroat.com service, [email protected].