1. Introduction and Data Controller

ReallyYou (the "Platform") is operated by VERSONA DIGITAL LTD, a company registered in the Republic of Cyprus (Company Registration Number: HE 490964), with its registered office at Souliou 1, Mezzanine, Strovolos 2018, Nicosia, Cyprus (the "Company", "we", "us", or "our"). We are the data controller responsible for your personal data processed through this Platform.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform. It applies to all users, including content consumers ("Supporters") and content creators ("Creators"). This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the Cyprus Processing of Personal Data (Protection of Individuals) Law, and other applicable data protection legislation.

Important Notice Regarding Special Category Data: Due to the nature of our Platform, we may process data that reveals information about your sexual preferences or sexual orientation. Under GDPR Article 9, such data constitutes "special category" personal data requiring explicit consent and enhanced protections. By using this Platform, you explicitly consent to the processing of such data as described in this Policy.

2. Data Protection Officer

Given the nature and scale of our data processing activities involving special category data, we have appointed a Data Protection Officer (DPO) as required under GDPR Article 37. You may contact our DPO for any matters relating to the processing of your personal data or the exercise of your data protection rights:

• Email: compliance@reallyyou.com
• Address: Souliou 1, Mezzanine, Strovolos 2018, Nicosia, Cyprus

3. Categories of Personal Data We Collect

3.1 Account Information

• Full legal name, email address, username, and password
• Date of birth (to verify you are 18 years or older)
• Profile information (biography, profile photo, display name)
• For Creators: government-issued identification documents, tax identification numbers, and banking/payout details

3.2 Financial and Transaction Data

• Payment method details (processed by our third-party payment processor; we do not store full card numbers)
• Transaction history including amounts, dates, content purchased, and request details
• Payout records and earnings history for Creators

3.3 Content Data

• Content you upload, post, or create on the Platform
• Content requests you submit and their descriptions
• Messages and communications between users

3.4 Usage and Technical Data

• IP address, browser type, device information, operating system
• Pages visited, content viewed, search queries, interaction patterns
• Cookies and similar tracking technologies (see our Cookie Policy)

3.5 Pre-Launch Waitlist Data

If you join our pre-launch waitlist on the public landing page, we collect your email address, whether you are interested as a fan or a creator, your confirmation that you are at least 18 years old, and the timestamps of your signup and of your email confirmation (double opt-in).

• Purpose: Notifying you when the Platform launches and your early access opens. We do not send marketing emails to the waitlist.
• Legal basis: Your consent (Article 6(1)(a) GDPR), given when you submit the form and confirmed via the double opt-in email.
• Withdrawal: You can withdraw at any time via the unsubscribe link in any email or by contacting us; we will then stop emailing you and delete your waitlist entry.
• Retention: Waitlist entries are deleted once launch communications have concluded, or earlier on withdrawal.

3.6 Special Category Data (Article 9 GDPR)

Given our Platform's nature, the following types of special category data may be processed:

• Data concerning your sex life or sexual orientation, as inferred from content preferences, viewing history, or content requests
• Content you create that reveals such information

Processing of this data is based on your explicit consent, which you provide when accepting these terms and using the Platform.

4. Legal Bases for Processing

We process your personal data based on the following legal grounds under GDPR Article 6 (and Article 9 for special category data):

1. Contractual Necessity (Article 6(1)(b)): Processing necessary to perform our contract with you, including: account creation and management, facilitating transactions between Supporters and Creators, processing payments and payouts, delivering purchased content and fulfilling requests.
2. Explicit Consent (Article 6(1)(a) and Article 9(2)(a)): For processing special category data related to sexual preferences, personalized content recommendations based on viewing history, and marketing communications (where applicable).
3. Legal Obligation (Article 6(1)(c)): Processing required to comply with applicable laws, including: 18 U.S.C. §2257 record-keeping requirements, anti-money laundering (AML) and know-your-customer (KYC) obligations, tax reporting requirements, responding to lawful requests from authorities.
4. Legitimate Interests (Article 6(1)(f)): Where we have a legitimate interest that is not overridden by your rights, including: fraud prevention and platform security, service improvement and analytics, enforcing our Terms of Service.

5. Data Protection Impact Assessment

In accordance with GDPR Article 35, we have conducted a Data Protection Impact Assessment (DPIA) for our processing activities involving special category data at scale. This assessment evaluates the necessity, proportionality, and risks of our processing, and identifies measures to mitigate identified risks. A summary of this DPIA is available upon request to our DPO.

6. How We Use Your Information

We use your personal data for the following purposes:

• Service Delivery: Creating and managing your account, processing content requests and fulfillment, facilitating payments between Supporters and Creators, delivering purchased content.
• Verification: Age attestation for all users at registration, identity and age verification (KYC) for Creators, 2257 compliance verification.
• Communication: Service notifications, payment confirmations, content delivery notifications, responding to support inquiries, policy updates.
• Personalization: Content recommendations (with your consent), remembering your preferences.
• Security and Fraud Prevention: Monitoring for unauthorized access, investigating suspicious activities, enforcing our Terms of Service.
• Legal Compliance: Maintaining records required by law, responding to legal requests, tax reporting.
• Platform Improvement: Analyzing usage patterns, improving functionality, developing new features.

7. Data Sharing and Disclosure

We do not sell or rent your personal data. We may share your information in the following circumstances:

7.1 Service Providers

We engage trusted third-party service providers who process data on our behalf, including: cloud hosting providers (data storage), payment processors (transaction processing), identity verification services (KYC), email service providers (communications), analytics providers (usage analysis). All service providers are bound by data processing agreements ensuring GDPR-compliant processing.

7.2 Payment Processor

Our payment processing is handled by our appointed payment processor(s). When you make a payment, your payment details are processed directly by our payment processor under their own privacy policy. We receive only limited transaction information necessary to fulfill your purchase.

7.3 Legal Requirements

We may disclose your information when required by law, court order, or governmental authority, when necessary to enforce our Terms of Service, or when necessary to protect the rights, property, or safety of our users or the public.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred to the successor entity. We will provide notice before any such transfer and ensure continued protection of your data.

8. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• Adequacy Decisions: Transfers to countries with EU adequacy decisions (including the United States under the EU-US Data Privacy Framework for certified organizations).
• Standard Contractual Clauses: For transfers to other countries, we use EU-approved Standard Contractual Clauses (SCCs) supplemented by Transfer Impact Assessments.

You may request a copy of the safeguards we use for international transfers by contacting our DPO.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

10. Your Data Protection Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of Access (Article 15): Request a copy of your personal data and information about how we process it.
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Article 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Right to Restriction (Article 18): Request limitation of processing in certain circumstances.
• Right to Data Portability (Article 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to Object (Article 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw your consent at any time (without affecting the lawfulness of prior processing).

To exercise any of these rights, contact us at compliance@reallyyou.com. We will respond within 30 days.

11. Right to Lodge a Complaint

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with a supervisory authority. For Cyprus residents, this is the Commissioner for Personal Data Protection (www.dataprotection.gov.cy). EU residents may also contact their local supervisory authority.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS/SSL) and at rest
• Secure authentication mechanisms
• Regular security assessments and penetration testing
• Access controls limiting data access to authorized personnel
• PCI-DSS compliant payment processing
• Incident response procedures

Despite these measures, no system is completely secure. In the event of a data breach affecting your rights, we will notify you and relevant supervisory authorities within 72 hours as required by GDPR.

13. Minors

This Platform is strictly for adults aged 18 years and older. We do not knowingly collect personal data from anyone under 18. If we discover that a user is under 18, we will immediately terminate their account and delete all associated personal data.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email or prominent notice on the Platform. Continued use after changes constitutes acceptance of the revised policy.

15. Contact Information

For privacy-related inquiries:

• Email: compliance@reallyyou.com
• Data Protection Officer: compliance@reallyyou.com
• Mail: VERSONA DIGITAL LTD, Attn: Privacy Officer, Souliou 1, Mezzanine, Strovolos 2018, Nicosia, Cyprus