Privacy Policy

This page explains which personal data we process when you visit vstudios-consulting.com, when you send us an application, when you fill in the onboarding form if we start working together and when you leave your details as a chatter. It also explains what we use that data for, who we share it with, how long we keep it and which rights you have under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Who is the controller of your data

For any question about your data or to exercise your rights, write to us at [email protected]. A person on our team will reply.

Quick summary

• We do not use cookies. We do not use Google Analytics, Meta pixels or other advertising or tracking tools.
• We only process the data you send us through a form, by email or by message, and the technical data needed to display the page.
• We do not sell your data and we do not use it for advertising.
• We do not make automated decisions about you. Each application is read by a person on our team.
• You can ask us at any time to tell you what data we hold about you, to correct it or to delete it.

When you visit the website

Website hosting

This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States. When you open a page, your browser automatically sends technical data: IP address, date and time, the page requested, browser type and operating system and, sometimes, the page you came from. Cloudflare needs this data to deliver the page to you and to protect the website against attacks. We do not see these IP addresses and we do not use them to find out who you are.

Legal basis: our legitimate interest in keeping the website working and secure (Article 6(1)(f) GDPR). More information in the Cloudflare privacy policy.

No cookies and no external services

We do not use cookies. Fonts, images and code are loaded from our own website, not from Google Fonts or other servers. There are no embedded videos, maps or social media buttons that send data to third parties.

There is only one thing we store in your browser: if you reach the home page from another page of our website, the browser notes the address of that page in its session storage (sessionStorage, key vs-vino), for example /es/guia/. It is not a cookie, it contains no data about you and it deletes itself when you close the tab. It only leaves your browser if you submit the application form, so that we know which page helped you decide.

Visit measurement with Cloudflare Web Analytics

To find out which pages are read and to improve the website, we use Cloudflare Web Analytics, provided by Cloudflare, Inc. (United States). It does not use cookies, it does not store anything on your device and it does not create profiles. We only see aggregated figures, for example how many times a page has been viewed, from roughly which country or with which type of browser.

Legal basis: our legitimate interest in understanding how the website is used and improving it (Article 6(1)(f) GDPR).

Application form

When you submit the application form on our website, we receive what you write in it:

• full name, Instagram username, country and WhatsApp number
• your OnlyFans username or link, or a note that you do not have an account yet
• roughly how much OnlyFans pays you per month and how many new fans you get per day
• what is holding you back right now and your message

We also store the date of submission, the page of our website you came from to reach the form and, if you arrived through a campaign link, the data of that link (for example utm_source or utm_campaign).

What we use it for

• To read your application, decide whether we can help you and contact you via WhatsApp or Instagram. Legal basis: steps taken at your request prior to entering into a contract, which you ask for by submitting the form (Article 6(1)(b) GDPR).
• To find out which pages and links bring us applications. Legal basis: our legitimate interest in improving the website (Article 6(1)(f) GDPR).

Where it is stored

The form is sent encrypted to start.vstudios-consulting.com, our own server. We rent this server from Hostinger International Ltd. (Cyprus, European Union) and it is located in a data center in Frankfurt, Germany. The connection reaches the server through the Cloudflare network (Cloudflare Tunnel), always encrypted. Only the members of our team who handle applications can see the data, in an internal dashboard with protected access.

Spam protection

We do not use a captcha. To stop spam, the form has a hidden field that people do not see and a limit on submissions per hour. For that limit, the server uses your IP address for one hour at most. The IP address is only held in the server's memory, it is not written to any database and it is not stored together with your application.

Internal notification via Telegram

So that we can reply quickly, when an application arrives our server sends a short notification to an internal Telegram group of our team. The notification contains only your name, your Instagram username, your country, your WhatsApp number and a link to our internal dashboard. Your message and your answers about OnlyFans are not sent to Telegram.

Telegram is a messaging service based in Dubai (United Arab Emirates) and may process this data on servers outside the European Union, in countries for which the European Commission has not issued an adequacy decision. Legal basis for the notification: our legitimate interest in handling your application without delay (Article 6(1)(f) GDPR). The transfer relies on Article 49(1)(b) GDPR, because it is necessary to process the application you ask us for. You can object by writing to us, and we will then stop sending Telegram notifications containing your data. More information in the Telegram privacy policy.

Application via Telegram

You can also send us your application by writing to our Telegram bot. When you write to it, the bot greets you, shows you a short notice with a link to this page and asks you the application questions. You can stop and delete your answers at any time with /cancelar.

What data we receive

• from your first message: your Telegram name, your Telegram username if you have one and the numeric identifier of your account
• your answers: name, Instagram username, where you are from, your OnlyFans username or a note that you do not have one yet, how much OnlyFans pays you per month, how many new fans you get per day, what is holding you back and what you tell us about yourself

What we use it for

To process your application in the same way as if you used the website form: read it, decide whether we can help you and contact you via Telegram. Legal basis: steps taken at your request prior to entering into a contract, which you ask for by writing to the bot (Article 6(1)(b) GDPR). When you finish, your application is stored on our own server in Frankfurt, as explained above, and our team receives a short notification in its internal Telegram group with your name, your Instagram username, your country, your Telegram username and a link to our internal dashboard.

Telegram, outside the European Union

The conversation with the bot goes through Telegram's servers. Telegram is a service based in Dubai (United Arab Emirates) that may process your messages outside the European Union, in countries for which the European Commission has not issued an adequacy decision. The transfer relies on Article 49(1)(b) GDPR, because it is necessary to process the application you ask us for. More information in the Telegram privacy policy.

How long and how to delete it

While you are answering, the server stores your Telegram data and your answers so that the conversation can continue. Our team sees unfinished conversations in its internal dashboard and may write to you on Telegram to help you finish your application. When you finish, we move your answers to your application and delete that copy; only a marker without your answers remains for 7 days, so that the bot knows you have already submitted it. If you do not finish, we delete everything no later than 30 days after your last message. You can stop and delete your answers at any time by writing /cancelar or /borrar to the bot. Your completed application is kept for the period explained below. If you want us to delete it sooner, write to us at [email protected].

Onboarding form for creators

If we decide to work together, we send you a link to the onboarding form at start.vstudios-consulting.com. This form is not public on our website and is only filled in by creators we are going to work with.

What data we collect

• first name, last name, email address, WhatsApp number and language
• your answers about your profile, your social networks and the content you want to create
• the IP address from which you submit the form, as proof of submission and to detect abuse

Some questions ask what kind of adult content you want to create and what kind you do not. Those answers may reveal data about your sex life, which the GDPR protects in a special way (Article 9). You decide which content you make and which you do not. We use those answers only to respect your limits and plan your content, and only our team sees them.

Purposes and legal basis

• To prepare and carry out our collaboration: creating your content folder, organizing the work and contacting you (Article 6(1)(b) GDPR).
• We process the answers about adult content only with your explicit consent (Article 9(2)(a) GDPR). You can withdraw it at any time by writing to us; what we did before remains valid.

Where it is stored and who receives it

• Our server at Hostinger in Frankfurt, Germany, the same as for applications.
• Google Drive and Google Sheets: we create a folder for your content in our shared Google Drive and copy your answers to an internal spreadsheet. Only our team has access. Provider: Google Ireland Limited (Ireland) and Google LLC (United States). More information in the Google privacy policy.
• Telegram: we send a notification to our internal group with your name, your email and the links to your folder and to our dashboard. Your answers are not sent to Telegram. What is explained above also applies to Telegram.

Form for chatters (Artivate)

On the Chat Support & Sales Agent page you can leave your name and email if you are looking for work as a chatter. That role is already filled, so we pass your details to our recruiting partner Artivate, who emails you with chat job offers.

What data we receive

• your first name, last name and email address
• the date and time of submission, the page address and the version of the notice you saw above the form
• your IP address, only in the server's memory to limit submissions, as explained below

What we use them for and who we pass them to

Only to pass them to Artivate Administration LLC, 66 West Flagler Street, Suite 900, Miami, FL 33130, United States (artivate.de), so that they can contact you by email about chat jobs. We do not write to you and we do not use these details for anything else. Artivate receives your first name, last name, email, the date of submission, the text of the notice and the page address. From then on Artivate is responsible for your data under its own privacy policy. Legal basis: steps prior to a contract that you request by sending the form (Article 6(1)(b) GDPR).

United States

Artivate is based in the United States. For Artivate we do not rely on an adequacy decision of the European Commission. The transfer is based on Article 49(1)(b) GDPR, because it is necessary for what you ask us to do, and we send only the data listed above.

How long

Your details are stored on our server in Frankfurt only until Artivate confirms it has received them. After that we delete them. If the transfer does not work, we delete them after 30 days at the latest. Our team only receives a technical alert on Telegram when a transfer fails, without your name or email. If you want us to delete your details before they are sent, write to us at [email protected]. If Artivate already has them, write to them as well.

Email, WhatsApp and Instagram

If you write to us by email, we use your address and your message only to reply to you. Legal basis: steps prior to entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest in handling your enquiry (Article 6(1)(f) GDPR).

Emails you send to @vstudios-consulting.com addresses, for example [email protected], are first received by Cloudflare Email Routing, a service of Cloudflare, Inc. (United States). Cloudflare does not store the content of the email: it forwards it automatically to our Gmail inbox, a service of Google LLC (United States) and Google Ireland Limited (Ireland). In Gmail we keep your email and our reply for the period explained below. For forwarding, Cloudflare processes your email address, the recipient's address, the subject and technical data about the message. Legal basis: our legitimate interest in receiving and organizing emails securely (Article 6(1)(f) GDPR). More information in the Google privacy policy.

When we contact you or you contact us via WhatsApp or Instagram, those services are provided by Meta (WhatsApp Ireland Limited and Meta Platforms Ireland Limited, Ireland). Their own privacy policies also apply there. We only write to you if you have asked us to, for example with your application.

Who receives your data

We do not sell or transfer your data to other companies. Only the providers we need in order to operate receive it:

• Cloudflare, Inc. (United States): website hosting, secure connection to our server and email forwarding.
• Hostinger International Ltd. (Cyprus): server in Frankfurt, Germany.
• Telegram (Dubai, United Arab Emirates): internal notifications to our team.
• Google (Ireland and United States): Gmail for our email; Drive and Sheets only for creators who have been onboarded.
• Meta (Ireland): WhatsApp and Instagram, when we talk to you there.
• Artivate Administration LLC (United States): recruiting partner, only the name and email of people who ask for it in the form for chatters.

In addition, if a law or an authority requires it, we may have to hand over data to authorities or courts.

Transfers outside the European Union

Our company is registered in Florida, United States, and part of our team is in Spain and the United States. That is why your data is also accessed from the United States.

• United States: Cloudflare, Inc. and Google LLC participate in the EU-US Data Privacy Framework, for which there is an adequacy decision of the European Commission. They also use the European Commission's standard contractual clauses.
• Telegram: there is no adequacy decision. The transfer relies on Article 49(1)(b) GDPR, as explained above, and we send only the minimum data.
• Artivate: the transfer is based on Article 49(1)(b) GDPR, as explained above, and we send only name, email and the submission details.

How long we keep your data

• Applications without a collaboration: we delete them no later than 12 months after our last contact with you, or sooner if you ask us to.
• Onboarding form data: we keep it while we work together. When the collaboration ends we delete it, except what we must retain by law, for example billing data, and only for the period set by that law.
• Telegram notifications: we delete them from the internal group when we delete your application or your onboarding data.
• Emails and messages: for as long as needed to handle your enquiry and no later than 12 months after the last contact, unless they are part of a collaboration.
• Telegram bot: Telegram data and answers from an unfinished conversation, no later than 30 days after your last message; when you finish, they move to your application and the submission marker is deleted after 7 days.
• Form for chatters: until Artivate confirms receipt; if the transfer fails, 30 days at the latest.
• Submission limit: the IP address disappears from the server's memory after one hour at the latest.

Your rights

Under Articles 15 to 22 GDPR you, as the data subject, have the right to:

• Access: know what data we hold about you and receive a copy.
• Rectification: correct data that is not accurate.
• Erasure: ask us to delete your data.
• Restriction: ask us to only store your data, without using it, while something is being clarified.
• Data portability: receive the data you gave us in a common digital format.
• Objection: object to processing based on our legitimate interest, for example the Telegram notifications.
• Withdraw your consent at any time, without affecting what we did before.

To exercise any of these rights, write to us at [email protected]. We reply within one month at most. If it is not clear that the request comes from you, we may ask you to confirm it, for example from the same WhatsApp number or the same Instagram account you gave us.

You can also lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the data protection supervisory authority of your country. It helps us a lot if you write to us first, so that we can resolve it.

Minors

Our services are only for people over 18. If you are a minor, do not send us any data. If we learn that we have received data from a minor, we delete it.

Security

The whole website and the forms work over an encrypted connection (HTTPS). Our server is only accessible through Cloudflare, the internal dashboard is protected by access controls and only the members of our team who need to can see your data. No system is perfect, but if a security incident affecting your data occurs, we will act in accordance with the GDPR.

Automated decisions

We do not make decisions based solely on automated processing, and we do not carry out profiling within the meaning of Article 22 GDPR. Each application is reviewed by a person.

Changes to this policy

We may update this policy when our services or the law change. The date of the last update is at the top.

Contact

If you have any question about this policy or about your data, write to us at [email protected].