This Privacy Policy explains how Qylo B.V. collects, uses, stores, shares, and protects personal data when you access or use the XReelz platform, including the website located at www.xreelz.com/ and any related services, features, tools, or applications operated by us. This Privacy Policy applies to all visitors, users, and creators who interact with the platform.

We take privacy and data protection seriously. This Privacy Policy is designed to explain, in clear and simple terms, what personal data we collect, why we collect it, how it is used, and what rights you have in relation to your data. We aim to be transparent about our data practices and to comply with applicable data protection laws.

This Privacy Policy should be read together with our Terms of Service, Cookie Policy, Community Guidelines, KYC Policy, Complaints & Appeals, DMCA Notice, and other platform policies. These documents collectively govern how the platform operates and how personal data is handled. If there is any conflict between this Privacy Policy and another policy, this Privacy Policy governs matters relating to personal data and privacy.

If you have any questions about this Privacy Policy or how we handle your personal data, you may contact us using the details provided in the Contact section below.

1. INFORMATION WE COLLECT FROM GENERAL USERS

• Account Information: This includes the information you provide when you create an account, such as your username, email address, password, and any optional profile details you choose to add. We collect this to create and maintain your account and to allow you to use platform features.
• Age Confirmation: General users must confirm that they meet the minimum legal age to access adult content. At this stage, users are not required to complete formal identity verification, but they must confirm they are legally permitted to access adult material in their country.
• Purchase and Transaction Information: When you buy subscriptions, pay-per-view content, or send tips to creators, we collect data related to these transactions. This includes the items purchased, amounts paid, timestamps, and status of each transaction. Payment card information is handled directly by our payment processors and is not stored by us.
• Interaction and Engagement Data: We collect information about how you interact with the platform. This includes content you view, searches you make, creators you follow, likes, comments, and other forms of engagement. This information helps us operate core platform features and, if you have enabled personalisation, improve content recommendations.
• Device, Technical, and Log Information: When you access the platform, we automatically collect technical data such as your IP address, device type, browser type, operating system, access times, pages viewed, and referral URLs. This information is used for platform security, fraud prevention, performance improvement, and troubleshooting.
• Communication Information: If you contact us for support or submit a report about content or another user, we collect the information included in your message and any supporting evidence you provide. This helps us respond to enquiries, resolve issues, and maintain platform safety.
• Preference and Settings Information: We collect information about your chosen settings, such as language preferences, notification preferences, content filters, and whether you have opted in or out of personalised recommendations. These settings allow us to tailor your experience on the platform.
• Content Viewing and Activity History: We collect your content viewing history and activity patterns to operate features such as trending content, suggested creators, and browsing categories. Users can disable personalised recommendations but certain activity data must still be collected to operate the platform.
• Security and Fraud Prevention Data: We collect security-related information such as login attempts, unusual account activity, device fingerprinting, and flags raised by automated systems. This helps us prevent unauthorised access, detect fraud, and protect the integrity of the platform.
• Information Related to Policy Violations: If you are reported for violating platform rules, we collect the details of the report, evidence provided by the reporter, and the outcome of any review carried out by our moderation team. This information is required to enforce platform policies and maintain community safety.

2. INFORMATION WE COLLECT FROM CREATORS

• Account and Profile Information: When you register as a creator, we collect your username, email address, password, profile details, display name, biography, and any links you choose to share. This information is required to create and maintain your creator profile.
• Identity and Age Verification Information (KYC): Before you can monetise your account or receive payouts, you must complete identity and age verification through our verification provider. This includes government-issued identification documents, facial images, liveness checks, and verification results. These checks are required to confirm that you are at least 18 years old and legally permitted to create adult content, and to comply with banking, payment processor, and regulatory requirements.
• Compliance Screening Information: During verification, additional compliance checks may be carried out, such as sanctions screening, PEP checks, AML checks, and fraud-prevention scoring. These checks help ensure legal and regulatory compliance and protect platform users.
• Payout and Financial Information: To process payouts, we collect payout method details such as your bank account, wallet information, or other payment details supported by our payout partners. We also collect payout history, earnings data, chargeback information, and any adjustments required under our policies.
• Content and Upload Information: We collect all content you upload, including videos, images, captions, tags, metadata, and any optional information you submit when posting content. We also collect data related to content edits, deletions, updates, and settings applied by you.
• Content Moderation and Compliance Data: We collect data related to moderation reviews, content approvals, content rejections, classification tags, compliance flags, and enforcement actions. This includes automated moderation results and manual review outcomes. Such data is required to comply with laws, safety standards, and payment processor requirements.
• Monetisation and Pricing Information: We collect the information you provide when setting prices, enabling PPV content, creating discounts, launching promotions, or adjusting subscription rates. We also collect data on revenue split arrangements where applicable.
• Communication and Messaging Data: If you use messaging features, such as private chats or group chats, we collect the content of messages for safety, abuse prevention, and compliance purposes, as permitted by law.
• Creator Activity and Engagement Data: We collect information about your activity on the platform, such as uploads, profile updates, subscription changes, user interactions, live content activity (if applicable), and other actions taken on your creator account.
• Audit Logs of Creator Actions: We maintain detailed audit logs recording actions performed by you, including upload actions, account changes, payout requests, pricing changes, consent confirmations, moderation actions, and enforcement decisions. These logs include timestamps, the nature of the action, and the reason for the action where applicable. Audit logs are retained for compliance, regulatory audits, banking reviews, fraud prevention, and dispute resolution.
• Security and Fraud Prevention Data: We collect security-related information such as login attempts, device information, unusual account activity, and automated fraud detection flags. This helps us protect creator accounts and prevent unauthorised access or improper activity.
• Information Related to Policy Violations: If a report is submitted regarding your content or behaviour, we collect the details of the report, supporting evidence, moderation findings, and the outcomes of investigations or enforcement actions.
• Sensitive and Adult-Content-Related Data: Since creators upload adult content, we process data related to content categories, metadata, moderation status, compliance checks, and the nature of the content uploaded. This information is required to operate the platform safely and in compliance with applicable laws and industry requirements.

3. DATA PROCESSING FOR LAWFUL AGE-GATING (VISITORS)

When visitors access the platform without creating an account, we collect limited information such as IP address, device information, and basic browsing activity to confirm that the visitor is located in a region where adult content may be accessed legally. We also use an age-confirmation prompt that requires visitors to confirm they meet the legal age to view adult content. These measures are necessary to restrict minors from accessing the platform and to comply with laws governing adult content and online safety.

4. KYC AND IDENTITY VERIFICATION DATA

Creators must complete identity and age verification before they are allowed to monetise their content or receive payouts. This verification is required to confirm that the creator is at least 18 years old, to comply with legal and regulatory obligations, and to meet the requirements of our payment processors, banking partners, and industry safety standards.

• Information Collected for KYC: During the verification process, we collect information such as your full name, date of birth, residential address, nationality, and details from the identity document you submit. This may include your passport, national ID card, or driver's license. We also collect facial images and liveness verification data to confirm that the document belongs to you and that you are a real person completing the verification.
• Biometric and Facial Data: The verification process includes the use of biometric data, such as facial recognition and liveness checks, to confirm your identity. This data is processed strictly for identity verification and fraud prevention. Such data is treated as sensitive personal data and handled with additional safeguards.
• Compliance and Screening Results: As part of the verification process, we may receive results from sanctions checks, politically exposed person (PEP) checks, anti-money laundering (AML) screening, and other compliance assessments. These checks help us meet regulatory obligations and protect the platform and its users.
• Verification Provider: All KYC and identity verification checks are completed using Ondato, our third-party verification provider. Ondato processes your documents, biometric data, and verification results on our behalf, in accordance with applicable privacy and data protection laws. We do not sell this data or share it for marketing purposes.
• Outcome of Verification: If your verification is successful, you may begin monetising content and receiving payouts. If your verification fails, you will not be allowed to monetise content or withdraw earnings. You may be asked to resubmit documents or complete the process again if the initial attempt cannot be verified. Repeated failures or signs of fraud may result in account restrictions or permanent suspension.
• Ongoing Monitoring and Re-Verification: After you have been verified, we may need to perform additional checks. This may include periodic re-verification, verification when documents expire, or additional checks triggered by unusual account activity, compliance requirements, or requests from our payment processors or banking partners. You must complete these checks to continue monetising and using creator features.
• Data Storage and Retention: KYC data is stored only for as long as needed to meet legal, regulatory, and compliance requirements. This includes obligations imposed by financial regulators, payment processors, anti-fraud rules, and applicable laws. After the required retention period expires, your KYC data is deleted or anonymised.
• Data Sharing for Compliance: KYC data may be shared with trusted third parties such as payment processors, banking partners, and regulatory authorities where required by law or necessary to complete payouts, comply with financial regulations, or prevent fraud. We do not share KYC data with anyone else for any other purpose.

5. SENSITIVE AND SPECIAL CATEGORY DATA

Because XReelz is an adult-content platform, we inevitably process certain types of sensitive data. This does not include fixed profiles of sexual preferences, but it does include information linked to how you interact with adult content, such as the types of content you view, purchase, upload, or search for, as well as metadata linked to the content posted by creators. We also process sensitive data that forms part of the KYC process for creators, such as biometric data from facial verification and liveness checks. This sensitive data is processed only where necessary to operate the platform, ensure safety, carry out content moderation, comply with legal and regulatory requirements, prevent fraud, and meet the rules of our payment processors. Such data is handled with additional safeguards, is not used for unrelated purposes such as marketing, and can be limited where personalisation settings are disabled.

6. LEGAL BASIS FOR WHICH WE USE YOUR INFORMATION

• Consent: We rely on your consent when you choose to use optional features that require permission, such as enabling personalised recommendations or allowing certain cookies. You may withdraw your consent at any time through your account settings or by contacting us.
• Contractual Necessity: We must process certain information to provide you with the services you request, such as creating your account, allowing you to view or purchase content, enabling creators to upload and monetise content, processing payments and payouts, and maintaining your subscription or purchase history.
• Legal Obligations: We must process personal data to comply with laws and regulations, including identity and age verification requirements, KYC and AML checks for creators, financial reporting obligations, fraud prevention rules, and requests from law enforcement or regulatory authorities.
• Legitimate Interests: We process certain information to operate, secure, and improve the platform where doing so does not override your rights. This includes ensuring platform security, preventing fraud and abuse, moderating content, analysing platform performance, maintaining audit logs, and improving user experience.
• Protection of Users and Public Safety: We may process information where necessary to detect or prevent illegal, harmful, or non-consensual content, protect minors, investigate violations, respond to urgent safety issues, and enforce our Terms of Service and platform rules.
• Compliance with Payment Processor and Banking Requirements: We must process certain data to meet the rules set by our payment partners, including identity verification for creators, fraud checks, chargeback management, and ongoing compliance monitoring.

7. HOW WE USE YOUR INFORMATION

• To Operate and Provide the Platform: We use your information to create and manage your account, allow you to access content, enable creators to upload and monetise content, process purchases and subscriptions, and maintain the basic functions of the platform.
• To Process Payments and Payouts: We use user and creator information to complete purchases, manage subscription renewals, handle tips and PPV transactions, process refunds required by law, calculate creator earnings, and issue payouts in compliance with banking and payment processor rules.
• To Verify Identity and Age: For creators, we use identity documents, biometric data, and verification results to confirm that you meet the minimum legal age, comply with legal requirements, and are eligible to monetise content. These checks also help prevent fraud and protect users.
• To Personalise Your Experience: If you have enabled personalisation, we use your viewing activity, searches, purchases, and interaction history to recommend content, improve discovery features, and update trending creators and categories. You may disable personalisation at any time.
• To Enforce Platform Rules: We use information to detect and respond to violations of our Terms of Service, Community Guidelines, and content rules. This includes handling reports, removing harmful or illegal content, issuing warnings, restricting accounts, or taking enforcement action against serious violations.
• To Maintain Safety and Prevent Harm: We use information to detect and prevent illegal content, non-consensual content, involvement of minors, exploitation, fraud, harassment, impersonation, and other forms of abuse. This includes automated systems supported by human review.
• To Improve and Develop the Platform: We use technical, usage, and analytical data to understand how the platform is used, fix issues, improve features, analyse trends, enhance performance, and develop new tools and services for users and creators.
• To Comply with Legal and Regulatory Requirements: We use your information to meet our obligations under applicable laws, including financial reporting, AML and sanctions laws, KYC requirements, safety regulations, and valid law enforcement requests.
• To Communicate With You: We use your contact information to send service-related messages, such as account updates, payment confirmations, verification requests, policy changes, and security alerts. We do not send marketing communications without your permission.
• To Protect the Platform and Prevent Fraud: We use device information, security logs, automated checks, and behavioural signals to detect suspicious activity, prevent unauthorised access, manage chargebacks, and protect the integrity of payments and payouts.

8. AUTOMATED DECISION-MAKING AND PROFILING

We use automated tools to help operate and protect the platform, including fraud detection, security monitoring, identity and age verification support, and content moderation assistance. These systems may flag unusual activity, identify suspected rule violations, scan uploaded content for illegal or harmful material, and detect potential risks before sending the matter to a human reviewer. If you have enabled personalisation, automated systems also analyse your viewing activity, searches, and interactions to recommend content. Automated tools may temporarily restrict an account in high-risk situations such as suspected fraud or attempts to bypass platform safeguards, but significant decisions that affect your account, earnings, or access are not made without human review. You may contact us if you believe an automated decision has affected you unfairly or if you want a human review of a decision.

9. CONTENT SCANNING

We use automated tools to scan uploaded content, including videos, images, and captions, to detect illegal, harmful, or prohibited material. This includes scanning for involvement of minors, non-consensual content, violence, exploitation, or other content that violates our Terms of Service or Community Guidelines. Automated tools may flag content for further manual review by our moderation team. These scans are required to maintain platform safety, comply with legal obligations, and meet the requirements of our payment processors and banking partners in accordance with our Community Guidelines.

10. DISCLOSURES REQUIRED UNDER VISA & MASTERCARD ADULT CONTENT RULES

Because the platform processes payments for adult content, we must comply with industry rules set by payment networks such as Visa and Mastercard. These rules require us to collect, review, and store certain information about creators and their content, including identity verification data, age-verification results, content moderation records, and evidence of compliance checks. We may also be required to review or store supporting materials related to reported content or potential violations. This processing is necessary to maintain payment services and ensure that all transactions comply with the standards imposed by payment networks and financial partners.

11. DATA RETENTION

We keep personal data only for as long as it is needed to operate the platform, provide our services, meet our legal and regulatory obligations, prevent fraud, and enforce our Terms of Service. The length of time we keep your information depends on the type of data and the purpose for which it was collected. As a general rule, account and profile information is kept for as long as your account remains active. When you delete your account, we remove or anonymise your personal data within 90 days, unless we must keep certain information for longer to meet legal, tax, compliance, anti-fraud, banking, or dispute-resolution requirements.

When you delete content such as videos, images, messages, or posts, it is removed from public view on the platform. However, copies may remain in our secure backups for a limited period as part of our regular backup cycle. We may also retain deleted content where necessary for legal, regulatory, safety, or compliance purposes, including fraud prevention, investigation of policy violations, resolving disputes, and meeting the requirements of our banking partners and payment processors. Deleted content that is kept for these purposes is not used for any other function and is permanently deleted or anonymised once the retention period ends.

KYC and identity verification data for creators is kept only for as long as required under AML, financial, and regulatory rules. This usually means a retention period of up to five (05) years after the end of your relationship with us. After this period expires, the data is securely deleted or anonymised.

12. INFORMATION SHARING

• Service Providers: We share personal data with trusted service providers that help us operate the platform. This includes hosting providers, identity verification services (such as Ondato), payment processors, payout partners, analytics providers, security vendors, and customer support tools. These providers must follow strict confidentiality and data protection requirements and may use the data only for the services they perform for us.
• Payment Processors and Banking Partners: We share necessary information with our payment processors and banking partners to process payments, handle payouts, manage chargebacks, prevent fraud, and comply with financial and regulatory requirements. This includes transaction details, payout information, and creator verification data when required.
• Identity and Compliance Verification Partners: For creators, we share identity documents, biometric data, and screening results with our verification provider to complete KYC, age checks, sanctions checks, and AML compliance reviews. These partners process the information strictly for verification and compliance purposes.
• Law Enforcement and Legal Requests: We must share information when required to do so by law, regulation, court order, or valid request from a law enforcement authority. We may also share information where necessary to investigate illegal activity, protect users, prevent harm, or enforce our Terms of Service.
• Business Operations and Transfers: If we undergo a business change such as a merger, acquisition, restructuring, or sale of assets, personal data may be shared with the relevant parties as part of the transaction. Any new party must handle your information in accordance with this Privacy Policy.
• Analytics and Performance Tools: We may share anonymised or aggregated data with analytics providers to understand usage trends, improve features, and enhance platform performance. This data does not identify you personally.
• With Your Consent: In situations where you have given clear permission, we may share your information for the specific purpose you agreed to. This applies only to optional features where you choose to enable sharing.

13. DATA STORAGE AND SECURITY

We store personal data on secure servers operated by trusted third-party hosting providers. These providers must follow strict security and confidentiality standards and may not use your information for any purpose other than hosting and supporting the platform. Data may be stored in the European Union or in other countries that offer an adequate level of data protection, or where appropriate safeguards are in place to protect your information.

We use technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures include encryption, access controls, network security tools, monitoring systems, secure data transmission, and regular security reviews. Access to personal data is restricted to staff and authorised partners who need the information to perform their duties and are bound by confidentiality obligations.

14. INTERNATIONAL DATA TRANSFER

We may store and process your personal data outside the country where you live, including in countries that may not have the same data protection laws as your own. When we transfer data internationally, we use safeguards that meet legal requirements, such as transferring data to countries recognised as providing an adequate level of protection or using approved contractual safeguards. Our service providers, including hosting providers, verification partners, and payment processors, must follow these protections and handle your data securely and only for the purposes we allow. Regardless of where your information is processed, we ensure that it is protected in line with this Privacy Policy and applicable data protection laws.

15. LINKS TO OTHER WEBSITES

The platform may contain links to external websites, apps, or services that are not operated or controlled by us. These links are provided for convenience or promotional purposes, and accessing them is your choice. We are not responsible for the privacy practices, content, or security of these third-party platforms, and this Privacy Policy does not apply to any information you share with them. You should review the privacy policies of any external websites or services before providing your personal data or using their features.

16. RIGHTS OF EU, EEA, SWITZERLAND, AND UK USERS

This section supplements the other provisions of this Privacy Policy and applies to users located in the European Union (EU), the European Economic Area (EEA), Switzerland, or the United Kingdom.

For the purposes of applicable law, your DATA CONTROLLER for the data collected by us to provide you with our services is:

ALL YOUR USER INFORMATION WILL BE COLLECTED, STORED, PROCESSED AND SHARED STRICTLY IN ACCORDANCE, IN LINE AND FULL COMPLIANCE WITH THE FOLLOWING REGULATIONS:

Depending on the applicable law, you may have one or more of the following rights in respect of your personal information:

• Right to obtain information: to obtain information about how and on what basis your personal information is processed and to obtain a copy
• Right to rectification: You have the right to have any incomplete or inaccurate information we hold about you rectified and corrected
• Right of Erasure: to erase your personal information in limited circumstances
• Right of restriction: to restrict processing of your personal information where certain conditions apply
• Right to object: to object to decisions which are based solely on automated processing or profiling
• Right to ask for a copy: where you have provided your personal information to us with your consent, to ask us for a copy of this data in a structured, machine-readable format
• Right to withdraw your consent: You have the right to withdraw your consent on using your personal data

Estimated Timeframe for Response: We aim to respond to all valid privacy-related requests within one (01) month of receipt, or within a longer period if the request is complex or involves multiple records. In such cases, we will inform you of the delay and explain the reason for it. Exercising your rights is free of charge, unless the request is manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

17. RIGHTS OF USERS FROM CALIFORNIA

This privacy notice section for California residents supplements the information contained in our Privacy Policy. It applies solely to all visitors, users, and others who reside in the State of California where and to the extent that the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to XReelz.

[This section contains comprehensive CCPA/CPRA rights including categories of personal information collected, right to know, right to opt-out, right to delete, right to correct, non-discrimination, authorized agent provisions, and response timeframes]

18. NOTICE FOR USERS FROM NEVADA

Under Nevada law (NRS Chapter 603A), certain Nevada residents have the right to opt out of the sale of their "personally identifiable information" for monetary consideration to a person who then licenses or sells such information to additional persons.

XReelz does not sell your personal information to anyone. However, if you are a Nevada resident and wish to exercise your statutory right to opt out of any future potential sale of your personal information, you may submit a request to info@xreelz.com.

19. RIGHTS UNDER OTHER PRIVACY LAWS

[This section outlines general privacy rights available under various jurisdictions including rights to obtain information, rectification, erasure, restriction, objection, data portability, and consent withdrawal]

20. RESPONDING TO LEGAL REQUESTS

We may access, preserve, or disclose your personal information if we are required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that such action is necessary to comply with legal obligations, enforce our Terms of Service, protect our rights and property, investigate fraud or security concerns, or ensure the safety of our users and the public. Any disclosure will be limited to what is legally required, and we will make reasonable efforts to notify you where permitted by law before releasing your information.

21. CHILDREN PRIVACY

The platform is strictly intended for adults only. We do not allow anyone who is under the legal age required to access adult content in their country to use our services. We do not knowingly collect, store, or process personal information from anyone who is under 18 years old or below the minimum legal age in their jurisdiction. If we become aware that personal data has been collected from someone who does not meet the age requirement, we must take immediate steps to remove the information and permanently close their account. Because the platform hosts adult content and creator monetisation features, we take age restrictions very seriously. We may use technical measures, age-gating prompts, and identity or age verification tools where required by law to prevent access by minors. If you believe a minor is using the platform or that a minor's information has been provided to us, please contact us at info@xreelz.com so we can take prompt action.

22. OPTING OUT

• Opting Out of Personalised Recommendations: You can disable personalised content recommendations at any time through your account settings. When you opt out, we stop using your viewing history, searches, and interactions to suggest content, but we may still collect basic activity data needed to operate the platform.
• Opting Out of Marketing Communications: If we send optional marketing emails or creator updates, you can opt out by clicking the unsubscribe link in the email or by contacting us. Service-related messages, such as account updates, payment confirmations, or security notices, cannot be opted out of.
• Opting Out of Cookies and Tracking Technologies: You can adjust your cookie preferences through your browser settings or through the cookie banner on the platform. Essential cookies cannot be disabled because they are required for the website to function.

23. GOVERNING LAW AND DISPUTE RESOLUTION

This Privacy Policy is governed by the same governing law and dispute resolution terms described in our Terms of Service. Any dispute or concern relating to this Privacy Policy or to our handling of personal data will follow the procedures set out in the Terms of Service, including any requirements for informal resolution, jurisdiction, or venue. This does not limit your right to raise a complaint with a data protection authority or any other supervisory authority where such a right is provided under applicable privacy laws.

24. QUESTIONS ABOUT THIS PRIVACY POLICY

In the event you have any grievance regarding anything related to this Privacy Policy, or with any content or service of XReelz, in that case you may freely write your concerns through your registered email to Grievance Officer/Designated Representative at below:

• Name: Luke van Kooten and Thijs Maarse
• Email: info@xreelz.com
• Postal: Staverenstraat 15, 7418 CJ Deventer, The Netherlands

25. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our business practices, legal obligations, or the way we handle your personal information. When we make changes, we will revise the "Last updated" date at the bottom of the Policy and, if the changes are significant, we may notify you by email or through a notice on our website. We encourage you to review this Privacy Policy periodically so you stay informed about how we protect your information and your rights. Your continued use of the website after any changes to this Policy will constitute your acceptance of those changes.

26. WELCOMING OF SUGGESTIONS

We welcome your comments regarding this Privacy Policy. Please write to us at info@xreelz.com.

Last updated on January 15, 2026