Privacy Policy

1. Who we are

nsfw.fun (the “Service”) is operated by House of Velvet, Inc., a Delaware corporation (“House of Velvet”, “we”, “us”). For the purposes of the EU/UK General Data Protection Regulation (GDPR), House of Velvet is the data controller. This Privacy Policy explains what we collect when you use the Service and what we do with it.

2. What we collect

• Account info: email (if provided), anonymous user ID, authentication tokens, terms-acceptance record (version + timestamp).
• Profile & preferences: display name, age confirmation, NSFW preference, content settings.
• Content you submit: prompts, character configurations, reference images you upload, chat messages, and generated images and videos (“Outputs”).
• Safety signals: records of content flagged by our automated classifiers, including the original prompt and verdict.
• Usage: pages visited, features used, generations performed, approximate timestamps, click events, error reports.
• Device & technical: IP address, browser, operating system, device identifiers, cookie identifiers, language, time zone.
• Payment: we use CCBill as our third-party payment processor — we receive transaction status, billing country, the last four digits of your card, and a transaction reference, but never full card numbers or CVVs.
• Communications: when you email us, the content of the message and any attachments.

3. How we use it

We process the data above for the following purposes, with the corresponding legal bases under the GDPR shown in brackets:

• Operate and improve the Service. [Contract; legitimate interests]
• Generate the content you request and personalize your experience. [Contract]
• Enforce our Terms and Acceptable Use Policy, including automated content-safety review of prompts and Outputs. [Contract; legitimate interests; legal obligation]
• Detect, prevent, and respond to fraud, abuse, security incidents, and chargebacks. [Legitimate interests; legal obligation]
• Process payments and prevent payment fraud. [Contract; legal obligation]
• Communicate with you about your account, billing, and important product updates. [Contract; legitimate interests]
• Comply with legal obligations, including responding to subpoenas, court orders, and law-enforcement requests. [Legal obligation]
• Develop and improve our content-safety systems (no training on the underlying chat or image models with your personal content without separate notice). [Legitimate interests]

4. Cookies & tracking technologies

We use first-party cookies and similar technologies (local storage, session storage) to keep you logged in, remember your preferences, and measure performance and feature usage. We do not use third-party advertising cookies. We do not sell or share personal information for cross-context behavioral advertising. You can clear cookies and local storage at any time from your browser settings; doing so will sign you out and reset preferences.

5. Automated decision-making & content safety

We use automated classifiers (including third-party large language models) to detect prohibited content — particularly content involving minors, deepfakes, and non-consensual material. These classifiers may block generation, hide content, or flag your account for human review. You have the right to request human review of any automated decision that significantly affects you by emailing privacy@nsfw.fun.

6. Sharing

We share data only with:

• Service providers bound by contract to use data only as instructed. Our current categories of subprocessors include:
  • Supabase (database, authentication, file storage) — United States
  • Vercel (web hosting, edge functions) — United States
  • Modal, RunPod, fal.ai (image & video generation compute) — United States
  • Anthropic (content-safety classification, prompt enhancement) — United States
  • CCBill (payment processing & subscription management) — United States
  • Sentry (error monitoring) — United States
• Law enforcement and regulators when required by law or to protect the rights, safety, or property of House of Velvet, our users, or the public — including mandatory reporting of suspected child sexual abuse material (CSAM) to the National Center for Missing & Exploited Children (NCMEC).
• Successors in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our assets — subject to confidentiality protections and continued application of this Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

7. International data transfers

The Service is operated from the United States, and our subprocessors are primarily located in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S. For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and equivalent UK and Swiss mechanisms with our subprocessors. You may request a copy of the applicable safeguards by emailing privacy@nsfw.fun.

8. Retention

We retain different categories of data for different periods, balancing operational need, legal obligation, and your privacy:

• Active account data: for as long as your account is active.
• After account deletion: within 30 days we delete your profile, private characters, private media, and chat history from our active systems. Backups are purged within 90 days.
• Public content: content you made public (e.g. shared to the community Feed) may remain visible after deletion unless you remove it first. We may retain a record of the original poster and timestamp for safety and audit purposes.
• Safety records: prompt-flag records, moderation actions, and CSAM reports are retained for up to 7 years for legal-compliance and safety-research purposes.
• Billing & tax records: retained for up to 7 years to comply with tax and accounting law.
• Logs: server logs and access logs are retained for up to 90 days.

9. Your privacy rights

Depending on where you live, you have some or all of the following rights regarding your personal data:

• Access & portability — request a copy of your data in a machine-readable format.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your data (subject to the retention periods above and legal exceptions).
• Restriction & objection — limit or object to certain processing.
• Withdraw consent — where we rely on consent, you can withdraw it at any time.
• Human review of automated decisions — see Section 5.
• Complaint — you may lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact privacy@nsfw.fun. We respond within 30 days (extendable by 60 days for complex requests) and may request information sufficient to verify your identity before fulfilling a request.

10. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA gives you additional rights:

• Right to know what personal information we collect, use, disclose, and sell or share.
• Right to delete personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share personal information as defined under the CCPA. There is nothing to opt out of, but if that changes we will provide a “Do Not Sell or Share My Personal Information” link.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising these rights — we will not deny service, charge different prices, or provide a different quality of service.

Submit requests via privacy@nsfw.fun with the subject “California Privacy Request.” You may also designate an authorized agent to submit requests on your behalf.

11. Security

We use industry-standard administrative, technical, and physical safeguards designed to protect your data, including encryption in transit (TLS), encrypted requests to AI model endpoints, row-level security policies on our database, principle-of-least-privilege access control, and audit logging. No system is perfectly secure; you use the Service at your own risk.

12. Breach notification

If we become aware of a security breach that affects your personal data, we will notify you and the appropriate regulatory authorities without undue delay and, where required by law, within 72 hours of becoming aware of the breach.

13. Children

The Service is for adults only (18+). We do not knowingly collect personal information from anyone under 18. If we learn we have collected such data, we will delete it promptly. If you believe a minor has provided personal information to us, contact privacy@nsfw.fun so we can take action.

14. Changes to this Policy

We may update this Privacy Policy from time to time. The current version will always be available at this URL with the “Last updated” date. Material changes will be communicated by email or in-app notice at least 7 days before they take effect.

15. Contact

House of Velvet, Inc., a Delaware corporation.
Privacy questions: privacy@nsfw.fun
Data Protection Officer (EU/UK): dpo@nsfw.fun