Last updated: 20 October 2026
1. AN IMPORTANT NOTE ABOUT SENSITIVE DATA
We sell access to adult content. The fact that you hold an account or a subscription with us can reveal something about your sex life or sexual orientation. Under Article 9 of the GDPR that is a special category of personal data, which receives additional protection.
We process this data only on the basis of your explicit consent, which you give when you create an account or purchase a subscription. You may withdraw that consent at any time (see section 7), which will end your account.
We treat this data with particular care:
- we keep it to the minimum necessary;
- we do not use it for advertising or for profiling you based on your interests;
- we do not sell, rent or trade it, and never will;
- we do not disclose your identity as a subscriber to anyone except as described in section 4.
2. WHAT WE COLLECT
You give us:
| Data | Why we have it |
|---|---|
| Email address | Account, sign-in links, service messages, newsletter |
| Name and display name (optional) | Account |
| Language and country (optional) | Showing the Site and our emails in your language |
| Subscription and payment status | Delivering your subscription |
| Correspondence with us | Handling your questions and complaints |
We do not use passwords: you sign in with a one-time link sent to your email address, with your Google account or personal Microsoft account, or with a passkey. If you choose Google or Microsoft, we receive only your name and verified email address from that provider, never your password. For a passkey we store only its public key, the device name and when it was created and last used; your fingerprint, face or screen lock never leaves your device. You can remove passkeys at any time in your account.
We do not collect or store your card or bank details. Payment is handled entirely by our payment service provider.
We collect automatically:
| Data | Why we have it |
|---|---|
| IP address | Security and fraud prevention |
| Browser, device, operating system | Making the Site work |
| Sign-ins, visits and changes to your account (with date and time) | Security, detecting account sharing, and your account history |
| Whether you opened a newsletter and which links in it you clicked | Knowing which content interests our readers |
| Technical error logs | Diagnosing faults and keeping the Site working |
Visitor statistics. We count visits ourselves, without cookies and without any external analytics service. We record the pages viewed, how long they stay open, the type of device and browser, the country, the referring website, page speed, and where on a page people click (to see which parts of a page are used). To recognise the pages of one visit, the server makes a code from the IP address and browser that changes every day and cannot be traced back; the IP address itself is not stored for statistics. We do not link statistics to your account and we do not record what you type.
What is counted inside pages. We also count, per day and only as totals: which videos are started, how much of them is watched, where viewers rewind or skip, how quickly a video starts and whether it stalls; which photos are opened and how far a shoot is scrolled through; clicks on photographers, categories and filters; the steps towards a subscription (plan chosen, order window, on to PayPal); and which way of logging in is used. Each count is added to the day's total at once: nothing is stored per visit or per person, and nothing is linked to your account. To count unique viewers of a video, the daily code described above is kept for that day only. The statistics also note whether a visit was logged in (yes or no), never who it was. Separately, to limit how many videos one account can play at the same time, the site keeps which account is playing which video while it plays; that record is deleted after one day and is never used for statistics.
We do not use advertising services. We do not collect data from public databases, data brokers or marketing partners.
3. WHY WE PROCESS IT, AND ON WHAT BASIS
| Purpose | Legal basis |
|---|---|
| Creating and running your account; giving access to content | Performance of a contract (Art. 6(1)(b)) and explicit consent for the special category aspect (Art. 9(2)(a)) |
| Taking payment and keeping financial records | Legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention, detecting unauthorised sharing | Legitimate interests (Art. 6(1)(f)) — protecting our service and our content |
| Diagnosing technical faults through error logs | Legitimate interests (Art. 6(1)(f)) — keeping the Site working |
| Answering your questions and handling complaints | Contract / legitimate interests |
| Newsletter, and measuring whether it is opened and clicked | Legitimate interests (Art. 6(1)(f)) — informing account holders and customers about new content; you can object at any time (see below) |
| Visitor statistics without cookies | Legitimate interests (Art. 6(1)(f)) — understanding how the Site is used and keeping it fast |
Newsletter. We send account holders and customers a newsletter about new galleries and videos. Every newsletter contains an unsubscribe link that works with one click, and you can switch the newsletter off in your account at any time. To see whether a newsletter is opened, it contains a small image that is loaded from our email provider; links in it pass through our email provider so that clicks can be counted. You can prevent this by not loading images in your email program.
Apart from the newsletter, we only send messages that are necessary to run your account: sign-in links, confirmations, renewal notices, changes to these documents and security alerts.
We do not make decisions about you by automated means that produce legal or similarly significant effects.
4. WHO WE SHARE IT WITH
We share personal data only with the following categories of recipient, and only as far as necessary:
| Recipient | Role | Location |
|---|---|---|
| Our hosting provider | Running the Site, its database and file storage, delivering pages and media, technical logs | United States — see section 5 |
| Our email provider | Sending sign-in links, confirmations and the newsletter; counting opens and clicks | European Union (servers in the EU) — see section 5 |
| Our payment service provider | Processing your payment (separate controller) | European Union |
| Only if you choose to sign in with Google (separate controller) | United States — see section 5 | |
| Microsoft | Only if you choose to sign in with a Microsoft account (separate controller) | United States — see section 5 |
| Our accountant | Bookkeeping — receives transaction totals, not customer identities | Belgium |
| Public authorities | Only where legally required | Belgium / EU |
Our payment service provider acts as an independent controller for the payment itself and applies its own privacy policy, which is shown to you at checkout.
We may disclose data where we are legally obliged to, or where necessary to establish, exercise or defend legal claims — for example in a copyright enforcement action against someone who has distributed our content without permission.
If the Site is transferred to another operator, your data may transfer with it. We would notify you first and you would be free to close your account.
You may ask us for the identity of any recipient by emailing contact@infinite-aura.space.
5. TRANSFERS OUTSIDE THE EEA
Our hosting provider is established in the United States and is certified under the EU-US Data Privacy Framework, which the European Commission has recognised as offering an adequate level of protection.
Our email provider stores and processes our email data on servers in the European Union. Its parent company in the United States is certified under the EU-US Data Privacy Framework.
If you sign in with Google or Microsoft, that provider processes your sign-in under its own privacy policy; Google and Microsoft are certified under the EU-US Data Privacy Framework.
Our payment service provider is established in the European Union.
6. HOW LONG WE KEEP IT
| Data | Retention |
|---|---|
| Account data (email, names, language, country) | While your account is open, then deleted within 30 days |
| Account history (sign-ins, visits, purchases, changes) | While your account is open |
| Newsletter preferences, opens and clicks | While your account is open, or until you unsubscribe as a non-member |
| Subscription and payment records | As long as tax and accounting law requires, at most 10 years |
| Correspondence with us | 3 years after the matter is closed |
| Technical error and security logs | Up to 30 days |
| Visitor statistics | Individual visit records 3 months; aggregated figures without any link to a person are kept |
Where we are legally required to keep records, we restrict them so that they are used only for that legal purpose and are not accessible for any other reason.
7. YOUR RIGHTS
You have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict processing in certain circumstances;
- receive your data in a portable format;
- object to processing based on our legitimate interests, including the newsletter and the measuring of opens and clicks;
- withdraw your consent at any time — this does not affect the lawfulness of processing before withdrawal.
Because the fact of your subscription is sensitive data, withdrawing consent means we can no longer run your account, and it will be closed. Any unused part of a paid period will be refunded.
To exercise any right, email **contact@infinite-aura.space**. We respond within one month. This is free of charge.
We may ask you to confirm control of the email address on the account before we act on a request — this protects you, not us.
Deleting your account: you can delete your account yourself in your account settings, or ask us to do it. We delete your account, its history and your access data within 30 days. Financial records must be retained as set out in section 6.
8. SECURITY
We use encrypted connections (HTTPS) and do not use passwords: you sign in with a one-time link that expires after a short time, with Google or Microsoft, or with a passkey. We store only a scrambled (hashed) form of your session key, restrict access to account data to those who need it, and rely on our payment service provider's certified infrastructure for payments.
No system is completely secure. If a breach occurs that is likely to result in a high risk to your rights, we will inform you without undue delay, as required by Article 34 GDPR.
9. MINORS
This Site is strictly for adults. We do not knowingly process data relating to anyone under 18, and we do not market to minors.
If we discover that an account belongs to a minor, we will close it immediately and delete the associated data.
If you believe a minor has created an account, contact us at contact@infinite-aura.space.
10. COOKIES
We only use cookies that are strictly necessary for the Site to work, such as keeping you signed in and remembering that you confirmed you are an adult. Our visitor statistics do not use cookies. See our Cookie Policy for details.
11. WHO IS RESPONSIBLE FOR YOUR DATA
The controller of your personal data is Infinite Aura.
Email: contact@infinite-aura.space
We have not appointed a Data Protection Officer, as we are not required to. Send all privacy questions to the email address above.
12. COMPLAINTS
If you are unhappy with how we handle your data, please contact us first at contact@infinite-aura.space.
You also have the right to complain to a supervisory authority. In Belgium:
Gegevensbeschermingsautoriteit / Autorité de protection des données Drukpersstraat 35, 1000 Brussels contact@apd-gba.be — https://www.gegevensbeschermingsautoriteit.be
If you live in another EU country, you may complain to your own national authority instead.
13. CHANGES
We may update this notice. If a change is material, we will notify account holders by email at least 30 days in advance. The "Last updated" date above always shows the current version.