Version 2026-10 · Draft for review by US, EU and Swiss counsel before launch

Privacy policy

What we collect, why, how long we keep it, and your rights under Swiss (FADP) and EU (GDPR) law.

1. Who is responsible

ALPICAP Sàrl, 12 quai du Seujet, 1201 Geneva, Switzerland is the controller of your personal data and operates Avatique. Write to [email protected] or to that address.

Account data (email, date of birth, display name), payment references (never full card numbers), content and messages, device and security logs.
For creators: identity verification (ID document images, a selfie, what was read from the document and the result), payout details and tax information. ID images are encrypted and never shown to fans.
Face data: during identity and age checks we compute face templates to compare your selfie with your document. Our biometric data policy (/legal/biometrics) says what we keep and when we delete it.

Identity verification and consent records: 7 years (legal record-keeping for adult content). Fans' age checks: the images are deleted right after the check; we keep only the date you passed.
Face templates: deleted 30 days after a failed check, and within 3 years after a successful one, or when the account closes.
Payment and accounting records: 10 years (Swiss bookkeeping law).
Messages and content: until you delete them or close your account, then removed within 30 days, except where a legal hold applies.
Security logs: 12 months. Rate-limit data: 1 day.

Service providers who process data for us under contract: CCBill (payments), Infomaniak (hosting and storage, Switzerland), Cloudflare (network and security), Amazon Web Services (email delivery, Zurich region) and Hive (safety scanning of uploaded media, United States). Transfers outside Switzerland and the EU rely on standard contractual clauses or an adequacy decision. Authorities receive data only when the law requires it.
Identity verification runs on our own systems; ID images and face data are never sold or shared for marketing. Creators never see fans' email addresses.
Creators' business tools: a creator you follow or buy from can connect a CRM (such as HubSpot, Attio or Airtable), a webhook or our API. We then send that creator's tools a fan profile limited to your activity with that creator: an ID made only for that creator, your display name, spend, purchases, subscriptions and the creator's own tags. Never your email, real name, location, payment details or media. If the creator allows it, the software they use to answer you can also read your conversation with them. The creator decides how to use it within our creator data terms (/legal/creator-data) and is responsible for it. You can opt out at any time in Settings → Privacy; we then delete you from those tools.

We only use strictly necessary cookies: your session, your age confirmation, theme, referral attribution and tracking-link attribution. No analytics or advertising cookies, so no banner.

Access, correction, deletion, portability and objection. We answer within 30 days. Write to [email protected]. You can also complain to the Swiss FDPIC or your EU data protection authority.