Privacy Policy

1.Who is responsible

The data controller is Tzion Media SLU, Spain.

For anything about personal data, write to privacy@sexties.com. Please do not send identity documents unless we ask for them, which we do only if we cannot otherwise be sure a request comes from you.

2.Sensitive data

Your viewing activity on an adult website can reveal or suggest information about your sex life or sexual orientation, which the GDPR treats as a special category of data (Article 9). We therefore treat all viewing data as sensitive, whoever you are, and we take these measures:

• We process it for recommendations only on the basis of your consent, which you can withdraw at any time at the end of this page, without having to give a reason and without losing access to the Service.
• The recommendation profile sits under a random identifier, not under your name or email address, unless you sign in.
• It is not sold, and it is never given to advertisers.
• Our measurement events hold no IP address, browser details or account identity.

We do not ask for, and we would rather you did not send us, information about your health, sexual orientation, or anything similar in messages or comments. Whatever you publish in a comment or profile is public, and you make it public by your own choice.

3.What we process

• Connection data: IP address, browser and device description, requested address, referring page and time. Our network provider and our web servers process it for each request. The requested address names the page, so these logs link an IP address to the videos opened and the searches made for as long as they are kept (see below). They are used only for security, abuse prevention and fixing faults, and are never used for recommendations.
• Country: worked out from the connection, or the country you pick, for regional behaviour. We do not determine your precise location.
• Choices on this device: your age confirmation, language, country and catalogue, held in cookies (see the Cookie Policy).
• Recommendation profile: weights derived from what you watch, for categories and for traits we record about each video but do not show (what happens, the setting, how it is made and how the people on screen look, such as hair, build or an ethnic description; never a name or an age), and the last videos you opened. It is kept on our servers, under a random identifier stored in the vid cookie, and used to recommend videos and shorts, to order pages and to choose banners. Every visitor who passes the entry screen gets one, unless they turn it off. If you sign in, your account keeps a copy of the categories.
• Usage events: which videos and clips appeared on your screen, which you opened or played and for how many seconds, with the time, under the same random identifier. They measure and improve the recommendations. They include neither your IP address, nor your browser, nor your account, only whether you were signed in. They are kept in our own database. If you erase or turn off your profile, we stop recording events under that identifier and delete those already recorded within 48 hours.
• Account data, if you register: email address, username, display name, a salted hash of your password, and for each active session the IP address and browser description.
• What you do with an account: your history, likes and reactions, votes, playlists, subscriptions, comments, albums, clips, GIFs, images and contest entries.
• Messages and reports: if you use the contact form or write to us, your name, email address, topic, message, any link you give and everything else you choose to tell us. With the form we also keep a hash of your connection address, and not the address itself, to detect abuse; this hash is still personal data. Legal requests such as copyright notices and removal requests contain what those procedures require.
• Abuse counters: short-lived counters per connection or network address that limit how many requests, sign-ins, messages and reports are accepted. They expire within hours to one day.

Apart from those logs and the recent searches kept in your own browser, we do not store what you search for. A search for a word that points at minors, at people unable to agree or at animals gets no results, and all that we record of it apart from those logs is a daily count.

4.People who appear in videos

Videos, key frames, titles, tags and other information about them are personal data of the people shown. We process them to publish and moderate the catalogue, in the legitimate interest of offering the Service and, for reviewing safety, to comply with legal obligations. We obtain this material from third-party sources (Article 14 GDPR). We use no face recognition, we do not store biometric templates, and we do not name people unless the name appears in the credits of the source. Automated systems describe what they see in key frames and text; they do not identify anybody.

If you appear in a video you have the rights described below, and you can ask for its removal without proving copyright: see Consent and Removal.

5.Why we process it, and on what legal basis

• Providing what you asked for, including your account and everything you do with it: performance of a contract (Article 6(1)(b) GDPR). Whatever you publish yourself is shown because you chose to make it public (Article 9(2)(e)).
• Recommendations, ordering of pages and the measurement events behind them, and the choice of banners based on your profile: your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR), given on the entry screen, which you can withdraw at the end of this page.
• Storing or reading information on your device: strictly necessary cookies need no consent; the others rely on your consent (Article 22(2) of Spanish Law 34/2002). See the Cookie Policy.
• Security, prevention of abuse and fraud, logs, backups and the defence of legal claims: our legitimate interest in keeping the Service and its users safe (Article 6(1)(f)), and, for special category data, the establishment, exercise or defence of legal claims (Article 9(2)(f)). You may object.
• Moderation, handling of notices and complaints, responding to authorities and record keeping: compliance with legal obligations (Article 6(1)(c)), including Regulation (EU) 2022/2065, and, where no such obligation applies, our legitimate interest in keeping unlawful and harmful material away.
• Service messages (password link, notice of a password change or of the end of your account): performance of a contract and security. We send no marketing by email.

You are not required by law to give us personal data. Without connection data the Service cannot work; without an email address you cannot have an account.

6.Recommendations and automated decisions

Recommendations are automated. They use your profile, what you are watching and how others react, and the main parameters are explained on the EU Digital Services page. You can erase the profile or turn it off at the end of this page; you then get the same recommendations as everyone else. This has no legal or similarly significant effect on you.

Automated tools check material and text to help moderation. Decisions about material that matters to a person, such as a permanent removal or the closure of an account, are reviewed or can be reviewed by a person (see Content Rules).

7.Advertising

We do not use advertising networks that follow you across websites, and we set no third-party advertising cookies. Each banner is chosen on our servers, and shown in an isolated frame that cannot read our cookies or your browsing.

To improve your experience we show personalised advertising, handled anonymously. Each banner is chosen only from the category weights in your recommendation profile. We never use your IP address, name or email address to choose a banner, we do not link a banner to you, and we keep no record of who saw which banner, only a total count for each one. If you are signed in, those weights also draw on the categories kept in your account, but the choice still uses nothing else. If you turn the profile off, banners are no longer personalised.

Advertisers receive only total counts from us, and never your profile or your identity. A banner may load its image from the advertiser or its provider, in which case your browser connects to them and they can see your IP address, as with any image on the internet, but not our cookies. If you click a banner, you go to the advertiser, whose own policy then applies.

8.Who receives personal data

We do not sell personal data, and we share it only as follows. These providers work on our instructions as processors, under data processing terms:

• Cloudflare, Inc. (network, content delivery, security and storage of media files): receives connection data for every request, including your IP address.
• DigitalOcean, LLC (servers in Amsterdam, the Netherlands, and encrypted backups): hosts the database, the recommendation data and the logs.
• Worldstream B.V. (server in the Netherlands used to prepare media): works on the catalogue and has access to the database for that purpose.
• Resend (delivery of service emails): receives your email address and the message.
• Discord, Inc. (the internal tool in which our team moderates): can receive the text of a report sent through the contact form and the link in it, but not your email address.
• xAI (automated description and classification of the catalogue): receives text and key frames of videos, and no data about visitors.

Other recipients: competent authorities and courts when the law requires it or to protect someone in danger (see Authorities); a person whose rights are at stake and who is entitled to it, for example a copyright owner who needs the identity of a person who infringed, only where the law allows; those who receive a counter-notice under the Copyright Policy, who may see the details the procedure requires; our professional advisers; and a successor if the business is sold or merged, under this same Policy.

Whatever you publish yourself, such as comments, a username and public pieces, is visible to all visitors and can be copied by them.

9.International transfers

Our servers are in the European Union. Some of the recipients above are in the United States or work with staff outside the European Economic Area. Where there is such a transfer, it relies on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for recipients certified under it, or on the standard contractual clauses approved by the Commission. To obtain a copy of those safeguards, write to privacy@sexties.com.

10.How long we keep it

• Web server access logs: up to 14 days. Technical logs are overwritten as they fill up.
• Abuse counters: up to one day.
• Recommendation profile: one day until it holds three signals, then 60 days after your last activity, or until you erase it. It can be lost sooner, because it is held in memory. Activity of the current visit: 30 minutes.
• Usage events: up to 90 days, or 48 hours after you erase or turn off your profile.
• Account data and what you did with it: until you delete your account or we close it. Deletion is immediate in the live database, including what you published. Replies by others under your comment threads go with them.
• Session records, with their IP address and browser description: for the life of the session, up to 30 days.
• Backups: encrypted daily backups of the database, each kept for about 14 days. A deleted account stays in them until they expire, and is not restored for any other purpose. If a backup must be restored we apply deletions again.
• Contact messages, reports, notices and complaints: for as long as needed to handle the matter and then for the period in which it can give rise to claims or we must be able to show how we acted, normally up to the applicable limitation period.
• Moderation decisions, statements of reasons and records of removals: for at least six months and for as long as needed for complaints, disputes or legal duties.
• Whatever an authority or a legal duty requires us to keep, for as long as required.
• Cookies: as listed in the Cookie Policy.

11.Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to data portability, to object to processing based on legitimate interest, not to be subject to solely automated decisions with significant effects, and to withdraw your consent at any time without that affecting what was done before.

You can do a good part of this yourself: erase your recommendation profile or turn it off at the end of this page; correct your details in Settings; delete your account in Settings.

For anything else write to privacy@sexties.com. We answer within one month, which can be extended by two further months in complex cases, as the GDPR allows. It is free unless a request is manifestly unfounded or excessive.

One limit: we cannot find a recommendation profile or usage events from your email address or name, because they are not linked to them unless you sign in. If you have no account, use this page in the browser concerned.

You may complain to a supervisory authority, in particular the one where you live or work. In Spain this is the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, https://www.aepd.es.

12.Security

Data travels over TLS. Servers are reached over private networks and key-only access. Passwords are stored as salted hashes, recommendation data is kept apart from account identity, and backups are encrypted. No system is perfectly secure. If a breach is likely to put you at risk we will inform the supervisory authority within 72 hours where required and tell you without undue delay. To report a vulnerability, write to security@sexties.com.

13.Minors

The Service is for adults only. We do not knowingly process data from anyone under 18. If you believe that a minor has given us data or has an account, write to child-safety@sexties.com and we will delete it. See the Child Safety Policy.

14.Changes to this Policy

We may update this Policy. The date at the top shows the last revision. If a change is significant we will announce it on the Service and, if you have an account, by email. If a new purpose requires your consent, we will ask for it.

Your recommendation profile

This acts on this browser and, if you are signed in, on your account. Turned off, you still get recommendations, but they are the same for everyone.