Draft pending company details and legal review. It describes how FansTracker works today.
Last reviewed
Who we are
FansTracker is operated by NoBrokes LLC, a limited liability company registered in [PENDING: state of formation], with its address at [PENDIENTE: dirección postal] (“we”, “us”). You can reach us about anything in this policy at [PENDIENTE: email de contacto].
Our representative in the European Union under Article 27 of the GDPR is [PENDING: EU representative].
Scope and our role
This policy covers the FansTracker website (fanstracker.com), the panel (panel.fanstracker.com) and the FansTracker desktop app.
We are the controller of the data about our customers and visitors: accounts, team members, billing and website forms.
When a creator or agency connects an OnlyFans account, the data about that account's fans (profiles, messages, lists, notes, sales) belongs to the customer. We process it only on the customer's behalf and following their instructions, as a processor under the data processing terms in our Terms of service. If you are a fan and want to exercise your rights, contact the creator or agency; we will help them answer you.
What we collect
Account: your name, email and password. Sign-in is handled by our authentication provider; we never see or store your password.
Organisation and team: the organisation name, time zone, members, their roles, the accounts assigned to them and the invitations you send.
Billing: your plan, subscription status and invoices. Card details are entered on Stripe's pages and never reach our servers.
Connected OnlyFans accounts: the session that lets the app work on your behalf, stored encrypted (AES-256-GCM), and the data synced from the account: fan profiles, conversations, lists, internal notes, vault metadata (not the files themselves) and sales figures.
AI drafts: when someone on your team asks for a reply draft, the relevant part of the conversation is sent to our AI provider to generate it.
Technical data: IP address, browser or app version and event logs, used to keep the service secure, limit abuse and fix errors.
Website forms: when you request a demo we receive what you type (name, email, optional company and role, number of accounts, team size, message and consent), the page you sent it from and any campaign parameters. We store a one-way hash of your IP address, never the address itself, and your browser's user agent.
Why we use it and on what legal basis
To provide the service you signed up for, run your account, bill you and send service emails such as invitations (performance of a contract).
To keep FansTracker secure, prevent fraud and abuse, and improve the product with aggregated usage data (our legitimate interest).
To answer demo requests and send you information you asked for (your consent or pre-contractual steps).
To keep accounting and tax records (legal obligation).
We don't sell your personal data, we don't share it for cross-context behavioural advertising, and we don't use fan data to train AI models.
Who processes data for us
We rely on these providers, each bound by a data processing agreement: Supabase (database and sign-in, hosted in the European Union), Stripe (payments), Cloudflare (email delivery), Vercel (website and panel hosting, cookieless visit counts), our cloud server provider in the European Union, and Anthropic (AI drafts, only when your organisation uses them). Optional analytics and advertising tools only run if you accept them; they are listed in the cookie policy.
We may disclose data if the law requires it or to protect our rights, and to a buyer if the business is sold, who would be bound by this policy.
International transfers
Our database is in the European Union. Some providers, and NoBrokes LLC itself, are based in the United States. Where data leaves the European Economic Area we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
How long we keep it
Account and organisation data: while the account is active, and deleted within 30 days after you close it.
OnlyFans sessions: deleted as soon as you disconnect the account. Data synced from it: deleted within 30 days after you disconnect it or close the organisation.
Billing records: for as long as tax and accounting law requires.
Demo requests: 12 months after the last contact. Security logs: 90 days.
Security
Data is encrypted in transit and at rest. OnlyFans sessions are encrypted with keys kept outside the database. Panel sessions use secure, httpOnly cookies, and access inside each organisation is limited by role and assigned accounts.
Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to its use, and you can withdraw consent at any time. Write to [PENDIENTE: email de contacto]; we answer within one month.
If you are in the EU or UK you can also complain to your data protection authority. If you are a California resident, you have the rights given by the CCPA/CPRA, and we won't treat you differently for using them.
Age
FansTracker is for adults only. We don't knowingly collect data from anyone under 18.
Cookies and analytics
We count visits anonymously and without cookies. Analytics and advertising tools that use cookies only load if you accept them in the cookie banner, and you can withdraw that consent at any time from “Cookie settings”. The full list is in the cookie policy.
Changes
If we make important changes we'll tell you by email or in the panel before they apply. The date at the top shows the latest version.