What we collect, why, and the controls you keep. Written to be read, not skimmed past.
Fandash ("we") runs an operations platform for agencies that manage creators on Fanvue. This policy covers the FanDash Posts website and the FanDash Posts application, and explains what we do with personal data in both.
Questions, requests, and complaints all reach us at privacy@fandash.io. We answer within one month, and we tell you if a request will take longer than that and why.
For your account, your team's data, and this website, we decide how data is used, so we are the controller and this policy is our notice to you.
For the creator and fan data an agency brings into FanDash Posts, the agency decides and we act on its instructions, so we are the processor and our Data Processing Agreement governs it, not this policy.
If you are a fan or a creator and want to exercise rights over posts, media, or comments, the agency or creator you deal with is the controller and is the right first contact. Write to us anyway if that is easier: we will forward your request to them without delay, help them answer it, and tell you we have done so.
As controller, for your account and your team:
As processor, on your instructions, once a creator authorizes the connection:
Where we act as controller, these are our purposes and the legal bases we rely on:
Providing account data is necessary to have an account; without it we cannot provide the service. Where we rely on legitimate interest you can object at any time, and you can withdraw consent at any time without affecting processing that already happened.
FanDash Posts is used on an adult content platform. The media a creator posts, the labels attached to it, and the comments fans leave under it can reveal information about a person's sex life or sexual orientation, which is special category data under Article 9 of the GDPR. That deserves saying out loud rather than burying.
We do not seek out this data and we do not use it to profile anyone for our own purposes. It reaches us because it is part of the posts, vault details, and comments an agency instructs us to work with. For that data the agency is the controller: it is responsible for holding explicit consent or another Article 9 condition, and it warrants to us that it does. We process it only on the agency's documented instructions, apply the same protections described below, and restrict internal access to staff who need it.
If you are a fan or creator and you are not comfortable with an agency processing your content or comments this way, raise it with that agency or creator, and tell us at privacy@fandash.io if you want us to pass it on. An agency that cannot evidence its lawful basis is in breach of our terms and we will act on that.
FanDash Posts sends content to third-party AI providers for two features. The first is drafting post captions: a request carries the creator's saved persona and a link to the media being posted, which the provider opens in order to describe it. The second, which your team switches on per creator, is drafting replies to comments fans leave on her posts: a request carries the fan's comment, the caption of the post it was left on, and the persona. It does not carry the fan's handle or any other detail about the fan. Anthropic is tried first and OpenAI next, with Replicate as a last resort for captions only, so that one provider being unavailable does not stop the queue.
Providers act as our subprocessors, process the content only to return the result, and are contractually barred from using it to train their models. We send the minimum the feature needs and we do not send your billing details or your team's credentials. Captions are stored with your agency's posts, and replies are published on Fanvue.
We do not send fan conversations, direct messages, or any audio to an AI provider, because this product does not hold them, and we do not clone voices, translate messages, or score fan sentiment. When your team writes a post by hand, a generated caption is a draft they can edit. When Autopilot is switched on for a creator, it schedules posts with generated captions and, if comment replies are enabled, publishes generated replies on her account without a person approving each one. Your team decides whether to switch that on, can edit or remove what it schedules, and can pause it at any time. Nothing here produces a decision with a legal or similarly significant effect within the meaning of Article 22.
Production data is stored in the United States: our database, authentication, and file storage run in a US region (North Virginia), and the application runs in the same region.
If you are in the European Economic Area, this means your data is transferred outside it, because the providers in the table above process data in the United States. For those transfers we rely on the European Commission's Standard Contractual Clauses, together with supplementary measures including encryption in transit, access controls, and sending the minimum data the feature needs. Where an adequacy decision applies we rely on that instead. You can ask us for a copy of the safeguards for a specific provider at privacy@fandash.io.
We keep your agency's data for as long as your workspace exists, because the product's job is to hold the mirror. Deleting the workspace starts the deletion immediately rather than after a waiting period: the workspace is marked deleted, everyone loses access at once, and the data is removed from our production systems in the background, including the files in our storage buckets. Backups containing it roll off within 35 days, and we do not restore a backup to retrieve deleted data except to recover from an incident. Export what you need BEFORE you delete, because deletion is not reversible and there is no grace period to change your mind.
Some things outlive that. Accounting and tax records are kept for as long as the law requires. A record that a workspace was deleted, and when, is kept after deletion so that we can evidence the deletion itself. Aggregated, de-identified statistics are not personal data and may be kept indefinitely.
Where we act as processor, deletion of creator and fan data happens on the agency's instruction and on the timetable in the DPA. If you want data erased sooner than the schedule above, ask us at privacy@fandash.io and we will do it unless the law requires us to keep it.
Data is encrypted in transit and at rest. Each agency's data is isolated in the database itself, by row-level security tied to the signed-in identity, rather than by application code remembering to filter, so a bug in a query cannot return another agency's rows. Creator connection tokens are encrypted with AES-256-GCM before they are stored, and they are never written to logs.
Creators connect through Fanvue's official authorization flow and never share a password with us, and access can be revoked in one click. Access by our own staff is least-privilege and limited to people who need it to operate or support the service. Significant actions are recorded in an audit trail. We keep dependencies patched and review changes before they ship.
No system is perfectly secure. If a breach affects your personal data we will notify the competent supervisory authority within 72 hours where the GDPR requires it, and tell you without undue delay where the risk to you is high. Where we act as processor we notify the agency instead, without undue delay, so it can meet its own deadline.
Under the GDPR you can ask for access to your data, correction of it, deletion of it, restriction of processing, and a portable copy. You can object to processing based on legitimate interest, including profiling. Where processing rests on consent you can withdraw it at any time without affecting what happened before. You will never be treated worse for exercising a right.
Write to privacy@fandash.io. We may need to verify your identity first, and we will not use what you send for verification for anything else. We answer within one month and can extend by two further months for complex requests, telling you if we do. Requests are free unless they are manifestly unfounded or excessive.
You can also complain to the supervisory authority in the country where you live or work, or where you think the problem happened. We would rather you told us first so we can fix it.
FanDash Posts is a business tool for adults. You must be 18 or older to use it, and we do not knowingly process data about anyone younger. Content involving minors is forbidden by our terms, ends the account immediately, and is reported to the competent authorities. If you believe we hold data about a child, tell us at privacy@fandash.io and we will delete it.
When this policy changes we update the date at the top of the page. If the change is material we email account owners before it takes effect, and where the change needs your consent we ask for it rather than assuming it. The current version always lives at this address, and we keep previous versions available on request. Anything unclear, ask: privacy@fandash.io.