Still loading. Your connection looks slow right now.
Privacy Policy
Last updated: April 2, 2026 — Effective immediately
This Privacy Policy describes how EXCLU LTD, operating under the brand Exclu, collects, uses, shares, and protects your personal data when you use our platform at exclu.at.
We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR) (EU Regulation 2016/679) and applicable data protection laws.
Subscription status (Free or Premium — Monthly or Annual) and any fan-to-creator subscriptions you hold or receive, including the billing country used to route payments through the correct card network
Wallet balance and transaction history
Profile analytics (view counts, sales counts)
Content metadata (titles, descriptions, pricing)
2.3 Fan-Specific Data
Purchase and transaction history
Tips sent (amount, message, anonymity preference)
Custom request submissions
Favorite creators list
Messages exchanged with creators
2.4 Payment Data
Payments on Exclu are processed by Verotel, our authorized billing partner. For billing support, please visit www.vtsup.com or contact livesupport@verotel.com. Payment card details are never stored on our servers. We only receive transaction confirmation data (transaction ID, amount, status).
2.5 Technical Data
IP address (for security and fraud prevention)
Browser type and version
Device information
Pages visited and actions taken on the Platform
3. How We Use Your Data
Account management: To create and maintain your account, authenticate your identity, and provide customer support.
Platform operation: To display creator profiles, process purchases, deliver content, and facilitate communication between users.
Payment processing: To process payments, calculate commissions, manage creator wallets, and facilitate withdrawals.
Transactional notifications: To send emails related to your account and transactions (purchase confirmations, tip notifications, custom request updates, account verification, payout notifications, security alerts). These are necessary for the operation of your account.
Marketing communications: To send product updates, new feature announcements, creator tips, promotional offers, and the Exclu newsletter to users who have either created an account (accepting our Terms of Service) or completed a paid transaction on the Platform. You may opt out at any time via the "Communications" toggle in your account Settings or the unsubscribe link in any marketing email.
Security: To detect and prevent fraud, abuse, and unauthorized access.
Legal compliance: To comply with applicable laws, regulations, and legal processes.
4. Legal Basis for Processing (GDPR)
Contract performance (Art. 6(1)(b)): Processing necessary to provide the services you requested, including transactional emails tied to purchases, tips, custom requests, and payouts.
Legitimate interests (Art. 6(1)(f)): Processing necessary for fraud prevention, security, Platform improvement, and — pursuant to Article 13(2) of the ePrivacy Directive — sending marketing communications to our existing customers and registered users regarding similar services, subject to a clear and free opt-out right exercisable at any time.
Legal obligation (Art. 6(1)(c)): Processing required by law (tax reporting, financial regulations, record-keeping).
Consent (Art. 6(1)(a)): Where required, we obtain your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.
5. Third-Party Service Providers
5.1 Payment Processing
Payments on Exclu are processed by Verotel, our authorized billing partner. For billing support, please visit www.vtsup.com or contact livesupport@verotel.com.
5.2 Infrastructure
Supabase — Database, authentication, and file storage. Data stored on AWS with encryption at rest and in transit.
Vercel — Frontend hosting and CDN. Processes minimal data (request logs, IP addresses).
5.3 Email
Mailjet (Sinch) — Transactional and marketing email delivery. GDPR-compliant, processes data within the EU.
5.4 No Analytics or Advertising
We do not use third-party analytics, advertising networks, or tracking pixels. We do not sell your data.
6. Cookies and Local Storage
Exclu uses only strictly necessary cookies and browser local storage to operate the Platform:
Authentication session token: A secure JWT token stored in your browser's localStorage to maintain your login session.
Theme preference: Your light/dark mode selection stored locally on your device.
Session state: Temporary UI state (e.g., dismissed modals) stored in sessionStorage.
We do not use marketing cookies, analytics cookies, or any third-party tracking technologies. For full details, please see our Cookie Policy.
7. Data Retention
We retain personal data only for as long as necessary for the purposes described in this policy:
Account data: Retained for the duration of your active account plus 30 days after deletion request.
Transaction records: Retained for the period required by applicable accounting and tax law.
Communication logs: Messages between users are deleted when either party's account is deleted.
Server logs: Automatically purged after 90 days.
Payment card data: Not stored by Exclu — handled entirely by our payment processors (TagadaPay and Flowguard).
Bank details (IBAN): Retained while the creator account is active. Deleted within 30 days of account deletion, except as required by financial regulations.
8. Your Rights Under GDPR
As a data subject under the General Data Protection Regulation, you have the following rights:
Right of access (Art. 15): You may request a copy of your personal data in a structured, commonly used format.
Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
Right to restriction (Art. 18): You may request that we limit the processing of your data in certain circumstances.
Right to data portability (Art. 20): You may request your data in a machine-readable format for transfer to another service.
Right to object (Art. 21): You may object to processing based on our legitimate interests.
Right to withdraw consent (Art. 7): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right not to be subject to automated decision-making (Art. 22): We do not make decisions based solely on automated processing that produce legal effects concerning you.
To exercise any of these rights, contact us at contact@exclu.at. We will respond within 30 days. If the request is complex, we may extend this period by an additional 60 days, with prior notification.
9. Data Security
We implement appropriate technical and organizational measures pursuant to Article 32 of the GDPR:
SSL/TLS encryption for all data in transit (HTTPS enforced)
AES-256 encryption at rest for stored data (provided by AWS/Supabase)
Secure password hashing using bcrypt with appropriate cost factors
Row-Level Security (RLS) policies enforced at the database level on all tables
API authentication and authorization on all endpoints
Rate limiting to prevent brute-force and denial-of-service attacks
Regular dependency updates and security patches
10. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
Notify the Commissioner for Personal Data Protection of the Republic of Cyprus within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR.
Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR).
Document the breach, its effects, and the remedial actions taken.
11. Automated Decision-Making and Profiling
Exclu does not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Commission calculations and payment processing are deterministic operations based on published rates, not individual profiling.
12. International Data Transfers
Your data may be processed outside the European Economic Area (EEA), specifically:
United States: Supabase (database infrastructure on AWS) and Vercel (frontend hosting).
TagadaPay and Flowguard (payment processing): Refer to each processor's privacy policy for their data processing jurisdiction and safeguards.
For transfers to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). You may request a copy of the applicable safeguards by contacting us.
13. Children's Privacy
Exclu is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data, we will delete it within 48 hours of discovery and terminate the associated account.
14. AI-assisted chat
Some creators may enable AI tools to assist with chat replies on their behalf. When this is the case, we process the following data to enable the AI to respond contextually within a conversation:
Conversation context: the last 20 messages of the active conversation (including fan messages) are sent to our AI provider Featherless.ai as transient context. They are not stored beyond inference.
Creator personalization: the creator's own past replies (sender side only — never fan-side data) may be anonymized (emails, phone numbers, URLs stripped) and used as few-shot examples to personalize her own AI persona. Fan-side messages are never aggregated for cross-creator training.
What we never transmit: personally identifiable fan information (full names, addresses, payment data, account identifiers) is never sent to the AI provider.
The AI provider operates under a zero data retention policy by default — your conversation context is not stored on their side beyond the inference call. Each AI-generated reply is logged on our infrastructure with a provenance flag (sender_type='ai') so the creator and platform can audit the conversation.
You can identify AI-assisted conversations through the chat footer notice ("This creator may use AI to assist replies") and, if the creator opted in, an "AI-assisted chat" badge on her public profile. To exercise your rights regarding AI-processed data (GDPR Articles 15-22), contact contact@exclu.at.
15. Changes to This Policy
We may update this policy. Changes are effective when posted. Continued use constitutes acceptance.
This Privacy Policy is governed by the laws of Cyprus. You may lodge a complaint with the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy).