Privacy Policy

1. Data Controller

Aquila Global Ltd trading as MyShrine (myshrine.io), registered in England & Wales, is the data controller responsible for your personal data processed in connection with your use of the Platform.

• Contact: support@myshrine.io
• ICO Registration: Aquila Global Ltd is registered as a data controller with the Information Commissioner's Office (ICO) in the United Kingdom (registration number: ZC231197).
• EU Representative: For EU residents, our representative can be contacted via support@myshrine.io.

This Privacy Policy applies to all personal data we process in connection with your use of MyShrine and is compliant with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU 2016/679), and the Data Protection Act 2018.

2. Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Identity Data

• Name and display name
• Username
• Date of birth (for age verification purposes)

2.2 Contact Data

• Email address

2.3 Verification Data (Creators)

• Government-issued photo identification (processed by Didit — see Section 5)
• Selfie / biometric data (processed by Didit — see Section 5)
• Verification status (verified / not verified) and timestamp — retained by MyShrine

MyShrine does not store your identity documents or biometric data directly. These are processed by Didit under their own Data Processing Agreement.

2.4 Financial Data

• Transaction amounts and references
• Cryptocurrency wallet addresses (Creator payouts)

We do not store card details. Payment processing is conducted via NOWPayments (cryptocurrency). We do not have access to your full payment credentials.

2.5 Technical Data

• IP address (logged on login, signup, and content uploads for security and law enforcement cooperation purposes; retained for 6 months)
• Browser type and version (user agent)
• Device information and operating system
• Approximate country of access (derived from IP address)
• Session cookies and authentication tokens

2.6 Usage Data

• Pages visited and features used
• Content purchased or accessed
• Follows, interactions, and messaging activity on the Platform

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Contract (Article 6(1)(b)): Processing necessary to perform the contract for the provision of the Services you have entered into by creating an account on the Platform.
• Legal Obligation (Article 6(1)(c)): Processing necessary to comply with applicable legal obligations, including age verification under the UK Online Safety Act 2023, 18 U.S.C. § 2257 record-keeping requirements, fraud prevention obligations, and tax and financial record-keeping requirements.
• Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate interests in maintaining platform security, detecting and preventing fraud and abuse, improving the Services, and operating the Platform effectively — where those interests are not overridden by your rights and interests.
• Consent (Article 6(1)(a)): Where you have given explicit consent, including for the receipt of marketing communications. You may withdraw consent at any time by contacting support@myshrine.io.

Where we process special category data (such as biometric data for age verification, processed by Didit), we rely on Article 9(2)(b) (employment, social security, and social protection law), Article 9(2)(g) (substantial public interest), and, where applicable, explicit consent under Article 9(2)(a).

4. Age Verification Data

Age verification is conducted by Didit (didit.me), an independent KYC and identity verification processor. Biometric data and identity documents submitted for age verification purposes are processed by Didit under their own privacy policy and data processing agreement.

MyShrine retains only the verification outcome (verified / not verified) and the timestamp of verification. We do not retain copies of your identity documents or biometric data.

Age verification session data is stored in a cookie (age_verified) which expires after 60 minutes, in compliance with the requirements of the UK Online Safety Act 2023.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

• To create and maintain your account and provide the Services;
• To process payments and maintain transaction records;
• To conduct age verification and, for Creators, identity verification;
• To send transactional emails (receipts, notifications, account updates) via Resend;
• To comply with our legal obligations, including 2257 record-keeping, anti-fraud measures, and tax obligations;
• To protect the Platform from abuse, fraud, and illegal activity;
• To moderate content: images and videos uploaded to the Platform, and still frames captured from each broadcaster's camera throughout a live stream, are automatically scanned by Project Arachnid Shield and Sightengine for illegal content (such as child sexual abuse material). Text in listings, profiles, posts, and messages is screened by our keyword filter;
• To communicate with you regarding your account or the Services;
• Where you have consented, to send marketing communications.

6. Third-Party Data Processors

We share your personal data with the following third-party processors, each operating under a Data Processing Agreement with Aquila Global Ltd:

We do not sell your personal data to third parties.

7. Data Retention

We retain personal data for the following periods:

• Account data: Retained while your account is active and for 7 years following account closure (to comply with legal and tax obligations).
• Age verification records: Retained for 7 years in accordance with 18 U.S.C. § 2257 compliance requirements.
• Transaction records: Retained for 7 years in accordance with UK HMRC requirements and EU VAT obligations.
• Marketing data: Retained until you withdraw your consent.
• Technical and log data: Retained for 90 days.
• Live stream frames: Frames that pass automated moderation are deleted immediately after scanning. Frames that are flagged are retained as moderation evidence with the related moderation record.
• Moderation records: Records of flagged content are retained for at least 1 year. Suspected child sexual abuse material is quarantined and retained for 1 year from the date it is reported to the National Crime Agency, as required by law.

Following expiry of the applicable retention period, personal data will be securely deleted or anonymised.

8. Your Rights Under UK GDPR / EU GDPR

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data, subject to any overriding legal retention obligations (for example, transaction records required for tax compliance).
• Right to restrict processing: You may request that we restrict processing of your personal data in certain circumstances.
• Right to data portability: You may request your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds.
• Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, subject to limited exceptions.

To exercise any of these rights, please email support@myshrine.io with the subject line "Data Rights Request". We will respond within 30 days of receipt of your request.

9. Your Rights Under California Law (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights regarding your personal information:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., legal retention obligations).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information. We do not sell or share your personal information as defined under the CCPA/CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
• Right to Limit Use of Sensitive Personal Information: You may limit the use and disclosure of sensitive personal information to purposes necessary to provide the Services.

We honour the Global Privacy Control (GPC) browser signal as a valid opt-out request under the CCPA/CPRA. If your browser sends a GPC signal, we will treat it as a request to opt out of the sale or sharing of personal information.

To exercise your California privacy rights, email support@myshrine.io with the subject line "California Privacy Request". We will verify your identity before processing your request and respond within 45 days.

You may also submit requests via our Do Not Sell or Share My Personal Information page.

10. Your Rights Under Brazilian Law (LGPD)

If you are a resident of Brazil, the Lei Geral de Protecao de Dados (LGPD — Law No. 13,709/2018) provides you with additional rights regarding your personal data:

• Confirmation and access: You may request confirmation of whether we process your personal data and access to such data.
• Correction: You may request correction of incomplete, inaccurate, or outdated personal data.
• Anonymisation, blocking, or deletion: You may request anonymisation, blocking, or deletion of unnecessary or excessive personal data, or data processed in non-compliance with the LGPD.
• Data portability: You may request portability of your personal data to another service provider.
• Deletion: You may request deletion of personal data processed with your consent.
• Information about sharing: You may request information about public and private entities with which we have shared your data.
• Consent withdrawal: You may withdraw your consent at any time.
• Opposition: You may oppose processing carried out on grounds other than consent where there is non-compliance with the LGPD.

To exercise your LGPD rights, email support@myshrine.io with the subject line "LGPD Data Request". We will respond within 15 days. You may also file a complaint with the Autoridade Nacional de Protecao de Dados (ANPD) at gov.br/anpd.

11. Supervisory Authority Complaints

If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the relevant supervisory authority:

• UK residents: Information Commissioner's Office (ICO) — ico.org.uk
• EU residents: Your local data protection supervisory authority (the relevant authority in the EU member state of your habitual residence, place of work, or the place of the alleged infringement).
• California residents: The California Attorney General's Office — oag.ca.gov/privacy
• Brazil residents: Autoridade Nacional de Protecao de Dados (ANPD) — gov.br/anpd

12. Cookies

We use the following cookies on the Platform:

• age_verified — Session cookie confirming age verification status. Expires after 60 minutes in compliance with the UK Online Safety Act 2023. Essential for use of the Platform.
• Authentication session cookie — Manages your login session. Essential for use of the Platform.

We do not use advertising, tracking, or third-party analytics cookies. Cookie preferences can be managed via your browser settings; however, disabling essential cookies will prevent you from using the Platform.

13. International Transfers of Personal Data

Some of our third-party processors are based outside the UK and EU, in particular in the United States. Where we transfer personal data outside the UK or EU, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the relevant supervisory authorities, or adequacy decisions where applicable.

14. Children's Privacy

Our Platform is strictly for persons aged 18 and over. We do not knowingly collect personal data from persons under 18 years of age. If you believe that a minor has registered on the Platform or that we have inadvertently collected personal data from a minor, please contact us immediately at support@myshrine.io. We will take immediate steps to delete such data.

This policy is consistent with the requirements of the Children's Online Privacy Protection Act (COPPA) in the United States and the UK Age Appropriate Design Code (Children's Code).

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users via email. The "Last updated" date at the top of this page indicates when this policy was most recently revised. Continued use of the Platform following notification of changes constitutes acceptance.