GDPR Notice

1. Scope

This GDPR Notice supplements our Privacy Policy and applies to residents of the European Economic Area (EEA), the United Kingdom (UK), and Switzerland whose personal data is processed by OnlyFunds in connection with the OnlyFunds website, the OnlyFunds Command Center web application, the Fully Managed, Self Managed and Agency service tiers, and any related software, applications, or APIs (collectively, the "Services").

For these residents, references in this Notice to the "GDPR" mean: (a) Regulation (EU) 2016/679 (the General Data Protection Regulation) for individuals in the EEA; (b) the UK General Data Protection Regulation, tailored by the Data Protection Act 2018, for individuals in the United Kingdom; and (c) the Swiss Federal Act on Data Protection (FADP) for individuals in Switzerland, each as amended.

2. Controller

The controller of your personal data is Foxxx Fitzwell Entertainment LLC (DBA OnlyFunds), 6717 Vista Del Lago Ave, Land O' Lakes, FL 34637, United States. You can contact our data-protection point of contact at [email protected].

3. Categories of Personal Data We Process

• Identification & account data — billing email, license key, and the creator handle on each connected platform (OnlyFans, ManyVids, LoyalFans) bound to the subscription.
• Payment data — handled by our third-party payment processor(s); for card payments OnlyFunds receives a tokenized reference, last four digits of the card, expiry, brand, country, and billing postal code. Cryptocurrency payments, where offered, are processed by our digital-asset payment processor.
• Application & onboarding data (Fully Managed) — name, jurisdiction, content focus, account access details, and any information you submit during onboarding.
• Communications — emails, support messages, and other correspondence with us.
• Technical & usage data — IP address, browser and application version, OS, device identifiers, log timestamps, feature-usage events, and error reports.
• Proxy data — the host, port, username and password of the proxy you supply for each connected page, which page it is bound to, its egress IP address as recorded in our operational logs, and the last connection error recorded for it. Proxy data is addressed in Section 3.1 below.
• Earnings figure — each connected page's net earnings for the applicable period, used to calculate the fee for that period (Self Managed and Agency: a percentage of the last thirty days' net earnings per page, charged band by band with a monthly minimum, and for Agency less a volume discount; Fully Managed: a percentage of the prior calendar month's net earnings, billed on the 1st). The current bands are published on our pricing page. No other vault or message data is read for fee purposes.
• Operational data — actions taken on your bound pages by you, by our team, or by the Automated System, and aggregate performance metrics.
• Cookies & analytics signals — see Section 9 of the Privacy Policy.

The OnlyFunds Command Center does not scan, index, or scrape fan messages or platform vault contents for any purpose other than carrying out the actions the customer has configured or requested; it selects content to schedule using the library items and links the customer expressly associates with their account. Messaging with fans under the Fully Managed Service is carried out by human personnel using semi-automated, human-in-the-loop features, and is not performed by autonomous software. Features referred to as "auto," "auto-send," "auto-reply," or "quick reply" require a human to review and send each interactive message.

3.1 Proxy data

Every connected page is operated through a proxy, so that the page presents a stable egress IP address to the platform. Except during a free trial, you purchase that proxy yourself from a provider of your choosing and remain that provider's customer; OnlyFunds does not resell proxies and takes no margin on one. We treat the proxy's credentials and its egress IP as personal data, because together they identify a network connection attributable to you.

• Legal basis — performance of a contract (Art. 6(1)(b)). A page cannot be operated at all without a working proxy, so processing these credentials is necessary to deliver the Services rather than optional. Our legitimate interest (Art. 6(1)(f)) additionally covers recording connection failures so a fault can be diagnosed.
• Purpose limitation — the credentials are used only to open connections to the platform on behalf of the page they are bound to, and to tell you when a proxy has stopped working. They are not used for any other page, any other customer, or any other purpose.
• Storage — proxy records are held in our database on access-controlled infrastructure in the United States, reachable only by the application and by personnel whose role requires it. The Command Center displays only the host and port and whether a proxy is set; a proxy password is never returned to the browser once submitted.
• Retention — for as long as the page is connected. A record is deleted on your request (Art. 17) and when the proxy is withdrawn from our records.
• Trial proxies — a proxy OnlyFunds supplies for a free trial belongs to OnlyFunds or its provider. Its credentials are not disclosed to you, it is not your personal data to port under Art. 20, and it is withdrawn and re-assigned when the trial ends.
• Rejected proxies — a proxy we cannot read or cannot connect through is rejected when you submit it and is not stored for use, so no record of it is created.
• Your proxy provider — is an independent controller, not our processor. It relays your page's traffic, sees that traffic, and keeps its own records under its own privacy notice. Exercise your rights against those records with that provider; we cannot do it for you.
• Transfers — a proxy you buy may route traffic through a country of your choosing. You select the provider and the location, so that routing is your decision and not a transfer carried out by OnlyFunds on your behalf.

4. Purposes & Legal Bases

We rely on the following legal bases under Article 6(1) GDPR (and, for any special-category data we may incidentally encounter, Article 9):

• Performance of a contract (Art. 6(1)(b)) — to deliver the Services you have subscribed to, including license validation, billing, support, and Fully Managed engagement work.
• Legitimate interests (Art. 6(1)(f)) — to secure the Services, prevent fraud and abuse, monitor system health, develop and improve the Services, and conduct internal analytics. We have weighed these interests against your rights and believe the processing is proportionate.
• Compliance with a legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, anti-money-laundering, sanctions, and similar legal obligations.
• Establishment, exercise, or defense of legal claims (Art. 9(2)(f), where applicable) — for any data necessary to defend ourselves in legal proceedings.

5. Recipients & Processors

We share personal data only with the categories of recipients described in our Privacy Policy, under written data-processing agreements where required. These include: our third-party payment processor(s); our hosting and database providers; our transactional email provider; error-tracking and observability providers; our professional advisors (such as accountants, auditors, lawyers, insurers, and bankers); and public authorities where disclosure is required by law or lawful process. We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

Two further recipients follow from how the Services work. The platforms you connect (OnlyFans, ManyVids, LoyalFans) receive the requests we make on your page's behalf, including the proxy IP address those requests originate from, and each is an independent controller of what it holds. Your proxy provider relays that traffic and keeps its own logs of doing so; where you bought the proxy, that provider is your counterparty and its own controller, not a processor acting for us, and we send it none of your account or billing data. Where OnlyFunds supplies a proxy for a free trial, the provider is ours and is engaged under a data-processing agreement.

6. International Transfers

OnlyFunds is established in the United States. When we transfer personal data from the EEA, UK, or Switzerland to the United States or another third country, we rely on:

• The European Commission's Standard Contractual Clauses (Module 1, 2, or 4 as applicable);
• The UK International Data Transfer Addendum to the EU SCCs, where the UK GDPR applies;
• Swiss-recognized SCCs, where Swiss law applies;
• Supplementary technical, organizational, and contractual measures (e.g., encryption in transit and at rest, strict access controls, transparency reporting, and challenges to overbroad government requests) following the recommendations of the European Data Protection Board.

A copy of the relevant transfer mechanism is available on request to [email protected].

7. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, plus any additional period required to comply with legal obligations, resolve disputes, or enforce our agreements. Specific retention periods are set out in Section 7 of our Privacy Policy. After the retention period expires, data is deleted or anonymized.

8. Your Rights Under GDPR

Subject to applicable conditions and exceptions, you have the right to:

• Access (Art. 15) — obtain confirmation of whether we process your personal data and a copy of that data.
• Rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Erasure / "right to be forgotten" (Art. 17) — request deletion of your data in certain circumstances.
• Restriction of processing (Art. 18) — request that we limit processing in certain circumstances.
• Data portability (Art. 20) — receive personal data you have provided in a structured, commonly used, and machine-readable format, or have it transmitted to another controller where technically feasible.
• Object to processing (Art. 21) — object to processing based on legitimate interests, including profiling, and to direct-marketing processing at any time.
• Withdraw consent (Art. 7(3)) — for any processing based on consent, without affecting the lawfulness of processing already performed.
• Lodge a complaint with your local supervisory authority (Art. 77).

9. How to Exercise Your Rights

Send a request to [email protected] from the email address associated with your OnlyFunds account, or via post to Foxxx Fitzwell Entertainment LLC (DBA OnlyFunds), 6717 Vista Del Lago Ave, Land O' Lakes, FL 34637, marked "Privacy Request". Include the right(s) you wish to exercise and any details that will help us locate the relevant records.

We respond to verifiable requests within one (1) month, extendable by up to two (2) additional months for complex or numerous requests, in which case we will notify you of the extension and the reasons for it within the first month. Requests are generally provided free of charge; we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive (in particular, repetitive ones).

We may need to verify your identity before responding. We will not use the verification data for any other purpose.

10. Automated Decision-Making & Profiling

We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. The performance-linked rate computed for Fully Managed pricing is a contractual calculation reviewed by our staff before any commercial decision is made. Messaging and "quick reply" features are semi-automated and human-in-the-loop: a human reviews and sends each interactive message, and no autonomous agent composes messages or conducts conversations with fans.

11. Supervisory Authority & Complaints

You have the right to lodge a complaint with your local supervisory authority. Without limiting that right, you may contact:

• European Union — your member-state Data Protection Authority. A directory is maintained at edpb.europa.eu/about-edpb/about-edpb/members_en.
• United Kingdom — the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint/.
• Switzerland — the Federal Data Protection and Information Commissioner (FDPIC), at edoeb.admin.ch/edoeb/en/home.html.

We would, however, appreciate the opportunity to address your concerns first — please contact us before raising the matter with a supervisory authority.

12. Sensitive Data & Adult Content

Because the Services interact with the OnlyFans platform, some processing may incidentally involve information about your sex life or sexual orientation as defined in Article 9 GDPR. We do not collect such data deliberately. Where we process it, we rely on Article 9(2)(e) (data manifestly made public by the data subject) and/or your explicit consent under Article 9(2)(a). You may withdraw any explicit consent at any time.

13. Updates to This Notice

We may revise this Notice from time to time. The "Last updated" date above reflects the most recent revision. Material changes will be communicated through the Services or by email.

Effective date: May 13th 2026
Last updated: October 8th 2026

14. Contact

Foxxx Fitzwell Entertainment LLC (DBA OnlyFunds)
6717 Vista Del Lago Ave
Land O' Lakes, FL 34637, United States
Phone: +1 (813) 857-3335

Support: [email protected]
Billing: [email protected]
Legal: [email protected]
Privacy / GDPR: [email protected]