Privacy Policy

1. Who we are and what this policy covers

DigitLumin Technologies LLC (“we”, “us”, “our”) operates PlanetJoi.com (the “Platform”) and is the controller of, and the business responsible for, the personal data described in this policy. Our postal address is published on our Copyright Policy page. The person in charge of the protection of personal data at DigitLumin Technologies LLC holds the title Privacy Officer and can be contacted at privacy@planetjoi.com.

This policy explains the categories of personal data we process when you use the Platform, the sources of that data, the purposes and legal bases for the processing, who receives the data, how long we retain it, and the rights you have over it. It applies to Fans, to Creators, to visitors who do not hold an account, to persons who feature in a Creator’s Content, and to persons who contact us. It is provided in addition to, and does not form part of, the Terms of Service.

“Personal data” means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual or household. Aggregated or de-identified information that cannot reasonably be linked to you is not personal data, and we do not attempt to re-identify it.

This policy was last updated on the effective date shown at the top of this page.

2. Categories of personal data we process

Information you provide to us:

• Account data: your email address, a password (stored only as a salted Argon2id hash, never in a form we can read), your display name and handle, and your account type.
• Profile data: your bio, avatar, public album images, languages and the tags you choose.
• Camera effect settings: if you are a Creator and turn on camera effects for live calls, the slider values and the mask you choose, and the time you confirmed the notice about them. The effects themselves run on your device, as section 3 explains.
• Content: posts, direct messages and their attachments, and anything else you upload or send. Where a message is translated for its recipient, the translation is stored with it.
• Social data: the Creators you favourite or follow, the posts you like or bookmark, and, for Creators, the notes you keep about your clients.
• Creator verification data: if you apply as a Creator, your legal name, date of birth, a government-issued photographic identity document (front and back), and a photograph of you holding it. This is sensitive personal data, and we process it only for the purposes in section 5.
• Payment addresses: if you are a Creator, the self-custody wallet address you register for withdrawals; if you are a Fan, the wallet address you register for a refund, if you choose to register one.
• Support correspondence and reports: what you write to us in a ticket, by email, or in a report about another User, and the evidence attached to a report.

Information we generate through your use of the Platform:

• Transaction data: Token purchases, the Creator Interactions on which Tokens were spent, Creator earnings, refunds and withdrawals. For each purchase, refund and withdrawal this includes the wallet address funds arrived from or were sent to, the asset and network, the amount and its United States dollar value, the timestamp and the blockchain transaction hash. This is our financial record.
• Call metadata: the accounts connected, the time, the duration, the price applied and whether a relay was used. Never the content of a call.
• Security data: IP address, user agent, an approximate country derived from your IP address, and timestamps for sign-ins, sessions and sensitive account actions, kept as an audit log.
• Technical data: request logs, error reports and performance measurements, carrying a request identifier rather than your name wherever possible.
• Moderation data: reports made about you or by you, the decisions taken on them, and the reasons.

Information we receive from others:

• Our payment gateway notifies us when a payment has been confirmed on a blockchain, together with the amount, the asset and the transaction hash.
• If you pay by card through an on-ramp provider offered in the checkout, that provider verifies your identity and processes your card under its own privacy policy, and delivers cryptocurrency to your checkout. We receive confirmation of the resulting blockchain payment only. We never receive your card number, and the identity check is the provider’s, not ours.
• Persons who report Content or conduct may provide information about you.

In terms of the categories used by California law, we collect identifiers, account and commercial information, internet activity information limited to your use of the Platform, coarse geolocation (country only), audio and visual information you choose to upload, and, for Creators only, sensitive personal data in the form of government identification. We do not collect biometric information, precise geolocation, or information about your health, and we draw no inferences about you for the purpose of building a profile.

3. What we deliberately do not collect

The following are design decisions rather than omissions.

Call content. Audio and video never reach us. Calls connect directly between the two participants and are encrypted in transit. We do not record, store, transcode, monitor or intercept them. Where a network prevents a direct connection, traffic passes through a relay we operate as opaque encrypted packets we cannot decrypt. We therefore cannot export call content to you, disclose it to anyone, lose it in a breach or produce it under legal process.

Face data. A Creator can turn on camera effects (beauty filters, makeup, masks and stickers) for a live call. To place the effect, the software detects the position of your face in your own camera feed. That detection runs only in your browser, on your device. The measurements it produces are used solely to position the effect, are discarded with each frame, and are never stored, sent to us or used to identify anyone. This processing does not create a biometric identifier and is not used for identification. We store only the settings you chose and the time you confirmed the notice; the other person on the call sees only the processed video. You can turn effects off at any time.

Fan identity. We do not ask Fans to verify their identity. Purchasing Tokens in cryptocurrency requires no identity check by us. Where an on-ramp provider verifies your identity in order to accept a card payment, it does so on its own account; we receive neither the documents nor the result.

Card details. We hold no payment card numbers for anyone. Card payments, where offered, are made to an independent on-ramp provider.

Advertising and tracking. We run no advertising, embed no third-party trackers or advertising pixels, build no advertising profiles, and do not fingerprint your device. We do not use analytics services operated by third parties.

4. Sources of personal data

We obtain personal data from you directly, from your use of the Platform, from our payment gateway and the public blockchains it observes, from persons who report Content or conduct to us, and from the third-party security check that protects registration. We do not purchase personal data from data brokers or from any other source.

5. Purposes and legal bases

We process personal data for the following purposes. Where the GDPR or the UK GDPR applies, the legal basis relied on is stated after each.

• To provide the Platform you have asked for: your account, your Content, your messages and their translation, your calls and your Token purchases. Performance of a contract.
• To settle payments, credit Tokens, pay Creators, process refunds and keep financial records. Performance of a contract, and compliance with our legal obligations in respect of financial records.
• To verify that Creators are adults and are who they say they are, and to keep the records the law requires of us. Compliance with a legal obligation, and, in respect of the identity document, substantial public interest in preventing the sexual exploitation of minors and our legitimate interest in the lawful operation of an adult platform. We also rely on your explicit consent, which you give when you submit the application and may withdraw by withdrawing the application.
• To keep the Platform safe: distinguishing people from automated traffic at registration, preventing fraud, detecting abuse, rate limiting, handling reports, and enforcing our policies. Our legitimate interests and those of other Users, and the protection of persons who may be depicted in Content.
• To comply with legal duties, including reporting child sexual abuse material, responding to valid legal process, honouring legal holds, and meeting sanctions obligations. Compliance with a legal obligation.
• To communicate with you about your account, your transactions, security events and changes to these documents. Performance of a contract, and our legitimate interests.
• To establish, exercise or defend legal claims. Our legitimate interests.

We do not send marketing email. We do not use personal data for solely automated decisions that produce legal or similarly significant effects for you, and we do not profile you for advertising. Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights, and you may object as described in section 9.

Providing your email address and a password is a requirement of holding an account; providing Creator verification data is a requirement of holding a Creator account. If you do not provide them, we cannot open the account concerned.

6. Who receives your personal data

Other Users see what you choose to show them: your profile, your posts and the messages you send. A Fan’s profile is not visible to other Fans. The other participant in a call may learn your network address through the direct connection between your devices, which is inherent in a peer-to-peer call.

We engage a small number of service providers, each of which processes personal data on our behalf, under a written contract, and only as we instruct. They fall into these categories:

• infrastructure hosting, content delivery and object storage;
• a transactional email provider, to deliver sign-in codes and account notifications;
• PayRam, whose payment-gateway software we run on our own infrastructure. In operation, that software communicates with PayRam’s servers to create checkouts and dispatch payouts, and with public blockchain node providers to observe incoming payments and broadcast outgoing transactions;
• Cloudflare, whose Turnstile service checks at registration that you are not an automated program, and whose public address-discovery (STUN) server your browser may contact to find a route for a call. Each of those services processes your IP address and, for Turnstile, characteristics of your browser, under Cloudflare’s privacy policy;
• a message-translation engine and a call relay (TURN) server, both of which we operate ourselves on our own infrastructure. The relay carries only encrypted traffic, and only when a direct connection is impossible.

On-ramp providers. Where a card-to-crypto on-ramp is offered in the checkout, the provider you choose, which is identified at checkout, accepts your card payment and may collect identity documents from you. It does so as an independent controller, under its own terms and privacy policy, and not on our instructions. Please read the provider’s policy before using it.

Public blockchains. The address a payment came from, the address a refund or withdrawal was sent to, and the amount and time of each transaction are recorded on a public ledger that anyone can read and no one can alter. We do not publish which address belongs to which account, but the ledger is public by design and is not under our control.

We disclose personal data beyond the above only where necessary: to comply with law or valid legal process, as described in our Notice to Law Enforcement; to report child sexual abuse material as the law requires; to protect the life or safety of any person; to establish, exercise or defend legal claims, including by providing a person harmed by a User’s conduct with information needed to pursue that User where the law permits; to our professional advisers under a duty of confidence; or to a successor in connection with a merger, acquisition, reorganisation or sale of assets, in which case we will notify you before your data is transferred and this policy will continue to apply to it.

We do not sell personal data, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law and comparable laws of other states. We have not done so in the preceding twelve months, and we do not knowingly sell or share the personal data of anyone under 16. Because we do not sell or share personal data, there is no opt-out to exercise; we treat an opt-out preference signal such as Global Privacy Control as confirming a choice we already honour. We do not use or disclose sensitive personal data for any purpose other than those permitted by law for the provision of the Platform and the verification of Creators.

7. International transfers

The Platform is operated from the United States, and personal data is processed there and in the locations where our service providers operate. If you use the Platform from outside the United States, your personal data is transferred to the United States, whose data-protection law may differ from that of your country.

Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where it applies, or on another transfer mechanism recognised by the applicable law. Further information about the specific safeguards used is available on request at privacy@planetjoi.com.

8. Retention

We retain personal data only for as long as it is needed for the purpose for which it was collected, or as the law requires. The periods below are those currently applied by our systems.

• Account, profile and social data: for the life of your account.
• Content you uploaded, including images and video: deleted from object storage when your account is erased.
• Message content: retained for 30 days after your account is erased, so that a dispute about a paid message can be reviewed, then purged. The record that a message existed, and any charge attached to it, remain in the ledger.
• Transaction and call records, including wallet addresses, transaction hashes, amounts and timestamps: retained after erasure, unlinked from your identity where possible, because payment disputes can arise long after the event and we are obliged to keep financial records.
• Raw IP addresses and user agents in sign-in and audit records: 30 days, after which only the approximate country remains.
• Revoked and expired sessions: 90 days.
• Audit log entries: 12 months, or 24 months for security and moderation events.
• Reports about Users and the decisions taken on them: 24 months.
• Creator identity documents and verification data: for as long as you hold a Creator account and thereafter for as long as the law requires us to hold records relating to Content that was published on the Platform, and no longer. We are reviewing the retention period that applies to those records under United States federal law, and we will update this policy when that review concludes.
• Data export archives: 7 days from the time they are ready, after which they are deleted.
• Backups: rotate on a 35-day cycle. An erasure is not applied retroactively to a backup, and a backup is never restored for the purpose of recovering erased data.
• An erased-accounts register: a minimal record that a specific account was erased, kept so that the account is not recreated and the erasure can be evidenced.
• Records preserved under a legal hold, a preservation request, or a report to the National Center for Missing and Exploited Children: for the period the hold, the request or 18 U.S.C. §2258A requires.

What is recorded on a public blockchain remains there. Erasing your account removes the association between your account and a wallet address from our systems; it cannot remove a transaction from a public ledger, and we have no ability to do so.

Deactivation is reversible and hides your profile. Deletion is not reversible. A Fan who deletes their account is erased immediately and forfeits any unspent Tokens. A Creator who deletes their account is held for 30 days, with the option to cancel, because earned balances must be settled. When the erasure completes, the remaining balance is sent to the withdrawal address on file; where it cannot be sent, because no address is registered or because the network fee would consume it, it is recorded as an amount we owe and is paid when it can be.

9. Your rights

Wherever you are located, you may:

• access your personal data and obtain a copy of it: an export is available at any time from Settings, is delivered as an archive by a link sent to your email address, and assembles everything our systems hold about you, except identity-document images, which are described but not included for your own protection;
• correct inaccurate or incomplete data;
• delete your account and have your personal data erased, subject to the retention described in section 8;
• object to, or ask us to restrict, processing that relies on our legitimate interests;
• withdraw any consent you have given, without affecting the lawfulness of processing before the withdrawal;
• receive your data in a portable, machine-readable format for transfer to another service; and
• lodge a complaint with a supervisory or privacy authority.

If the GDPR or the UK GDPR applies to you, these are your rights under Articles 15 to 22, and you may complain to the supervisory authority of your member state or to the UK Information Commissioner’s Office.

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another United States state with a comprehensive privacy law, you have the rights to know what personal data we collect, use and disclose, to access it, to delete it, to correct it, to obtain a portable copy, to opt out of the sale or sharing of personal data and of targeted advertising and profiling (none of which we do), and to limit the use of sensitive personal data to what is necessary to provide the Platform (which is already the case). We will not discriminate against you for exercising any of them. You may authorise an agent to make a request on your behalf; we will ask the agent for evidence of the authority and may ask you to confirm it directly. Where your state provides a right to appeal our decision on a request, you may appeal by writing to privacy@planetjoi.com, and we will tell you the outcome and how to contact your state attorney general if you remain dissatisfied.

If you are in Canada, you have the rights of access, correction and withdrawal of consent provided by the Personal Information Protection and Electronic Documents Act and, where applicable, by provincial law including the Quebec Act respecting the protection of personal information in the private sector, and you may complain to the Office of the Privacy Commissioner of Canada or to your provincial commissioner.

One limit we cannot remove: erasure reaches our systems, not a public blockchain. Section 8 explains.

To exercise any right, write to privacy@planetjoi.com, or use Settings where the Platform provides the function directly. We respond within 30 days, and in any event within the time the applicable law allows; where a request is complex we may extend that period as the law permits and will tell you why. Before acting on a request that would disclose or destroy data, we will ask you to confirm that you control the account, typically by a code sent to the email address on it, and where a request is made on your behalf we will ask for evidence of the authority to make it. We do not charge for a request unless the law permits and the request is manifestly unfounded or excessive.

10. Security

Passwords are hashed with Argon2id and an additional secret held outside the database. Sessions use httpOnly cookies with rotating, single-use refresh tokens, and a reused token revokes the session. Traffic is encrypted in transit. Sensitive actions, including changing a withdrawal or refund address, changing your email address, exporting your data and deleting a Creator account, require a code sent to your email address each time. Access to production data is restricted to personnel who need it and is logged; access to Creator identity documents is individually audited. We never log a password, a one-time code, a session token or the body of a message.

No system is perfectly secure, and we cannot guarantee the security of any data. You are responsible for the security of your own credentials and device. If you believe you have found a vulnerability, contact support@planetjoi.com and we will work with you in good faith.

11. Data breaches

If a breach of security involving your personal data occurs and the applicable law requires us to notify you or an authority, we will do so without undue delay and within the time the law prescribes, describing the nature of the breach, the data concerned, the likely consequences and the measures we have taken. We keep a record of every security incident involving personal data for the period the law requires.

12. Cookies and browser storage

We use cookies and similar browser storage only for functions the Platform cannot operate without: keeping you signed in, protecting forms against cross-site request forgery, completing the security check at registration, remembering your language, time zone and theme, and remembering that you confirmed your age. We set no advertising or analytics cookies. The Cookie Policy lists every item by name.

13. Children

The Platform is strictly for adults and is not directed to anyone under 18. We do not knowingly collect personal data from a minor. If we learn that a minor has created an account, we close and erase it.

If you believe that a minor is using the Platform, or that Content depicting a minor is present on it, contact support@planetjoi.com immediately. Such reports are handled ahead of all others, and we report child sexual abuse material to the National Center for Missing and Exploited Children as the law requires.

14. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Creator applications, complaints, appeals, refunds and withdrawals held for review are each decided by a member of our staff. Automated systems are used only for rate limiting, for the security check at registration, and for enforcing the limits on account creation and messaging described in the Terms of Service; any resulting restriction of an account is reviewed by a person on request.

15. Changes to this policy

We will update this policy as the Platform changes. The effective date at the top always reflects the current version, and we give notice within the Platform or by email before a material change takes effect. We do not apply a material change retroactively to personal data collected under an earlier version without your consent where the law requires it.

16. Contact

Data protection and privacy rights, and the Privacy Officer: privacy@planetjoi.com
All other matters, including content removal and legal notice: support@planetjoi.com
Postal address: as published on our Copyright Policy page.