PRIVACY POLICY

1. INTRODUCTION

EProducts Empire operates LuxCreator Suite, a business management platform for content creators. This Privacy Policy applies to all users of the Platform, including visitors, registered users, and subscribers. By using the Platform, you consent to the data practices described in this policy.

We act as a Data Controller for the personal information collected through the Platform. We determine the purposes and means of processing your personal data.

2. NO AFFILIATION WITH THIRD-PARTY PLATFORMS

3. INFORMATION WE COLLECT

3.1 Information You Provide Directly

• Account Registration Data: Full name, email address, and encrypted password. This information is required to create and maintain your account.
• Profile Information: Creator/stage name, content niche, platform preferences, revenue goals, and any other information you voluntarily add in your Settings page.
• Business Data: All data you manually enter into the Platform, including but not limited to:
  • Content posts, captions, hooks, and scheduling information
  • Fan profiles, usernames, tags, notes, and interaction history
  • Income entries, amounts, sources, and dates
  • PPV offers, pricing, descriptions, and performance metrics
  • Custom order details, fan requests, and fulfillment tracking
  • Message templates and fan communication records
  • Social media promotion analytics and post metrics
  • Business boundary rules and safety settings
  • Tasks, workflows, and operational notes
  • Content vault files and associated metadata

3.2 Information from Connected Integrations

If you explicitly authorize and connect third-party integrations through the Platform's OAuth flow:

• Instagram: Follower counts, post metrics, engagement data (likes, comments). We do NOT access your direct messages, private content, or account credentials.
• TikTok: Follower counts, video metrics, view counts. We do NOT access your direct messages or account credentials.
• Google Calendar: Calendar events for synchronization with task reminders. We do NOT access your email, contacts, or other Google services.

You may revoke any integration at any time. When revoked, we cease data collection from that platform and delete stored data from that integration.

3.3 Automatically Collected Information

• Usage Data: Anonymous analytics about how you navigate and interact with the Platform, including pages visited, features used, time spent, and click patterns. This data is aggregated and does not identify you personally.
• Device Information: Browser type, operating system, device type, screen resolution, IP address (anonymized), and approximate geographic region derived from IP.
• Log Data: Server logs including timestamps, request types, error logs, and performance metrics. IP addresses in logs are anonymized or truncated.
• Cookies and Similar Technologies: As detailed in Section 10 below.

3.4 Payment Information

All payment processing is handled by Stripe, our third-party payment processor. We do NOT collect, store, or have access to your full credit card numbers, CVV codes, or bank account details. Stripe may share with us the last four digits of your card, card brand, and expiration date for account management purposes. Stripe's use of your payment information is governed by Stripe's Privacy Policy.

4. WHAT WE DO NOT COLLECT

We want to be explicitly clear about what we do NOT collect, access, or process:

• OnlyFans/Fansly Data: We do NOT access, collect, scrape, sync, or store any data from your OnlyFans, Fansly, or any fan subscription platform accounts. No exceptions.
• Private Messages: We do NOT access your DMs, private messages, chat logs, or any private communications on any platform (OnlyFans, Instagram, TikTok, etc.).
• Payment Methods: We do NOT store full credit card numbers, bank account details, or other financial account credentials.
• Social Media Credentials: We do NOT store your passwords for Instagram, TikTok, or any third-party platform. OAuth integrations use revocable access tokens.
• Biometric Data: We do NOT collect fingerprints, facial recognition data, voiceprints, or any biometric identifiers.
• Precise Location Data: We do NOT collect GPS coordinates or precise geolocation data. We only infer approximate region from anonymized IP addresses.
• Data for Third-Party Sale: We do NOT sell, rent, trade, or share your personal information with third parties for their marketing purposes.
• AI Training on Your Data: Your business data is NOT used to train, fine-tune, or improve any artificial intelligence or machine learning models.

5. HOW WE USE YOUR INFORMATION

Your information is used exclusively for the following purposes:

• Service Delivery: To provide, maintain, and operate the Platform, including displaying your business data within your private dashboard.
• Account Management: To manage your account, process subscription payments, and communicate about account-related matters.
• Platform Improvement: To analyze aggregated, anonymized usage patterns to improve features, fix bugs, and enhance user experience.
• Security: To detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service.
• Communications: To send service-related emails (account updates, security alerts, billing notices, feature announcements) and optional marketing communications you've consented to receive.
• Integration Services: To facilitate data retrieval from third-party platforms you have explicitly connected.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable government requests.

We do NOT use your data for any purpose not listed above without your explicit consent.

6. DATA SHARING AND DISCLOSURE

We do NOT sell, rent, or trade your personal information. We share your information only in the following limited circumstances:

6.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including:

• Cloud Infrastructure: Base44 (application hosting and database services)
• Payment Processing: Stripe, Inc. (subscription billing and payment processing)
• AI Services: OpenAI (LLM processing for AI features when you explicitly use them)
• Email Delivery: Email service providers for transactional and notification emails
• Analytics: Anonymous usage analytics providers

All service providers are contractually bound to process data only on our instructions, maintain confidentiality, and implement appropriate security measures. We do not authorize them to use your data for their own purposes.

6.2 Legal Obligations

We may disclose your information if required to do so by law or in response to valid legal requests by public authorities (courts, law enforcement, regulatory agencies). We will attempt to notify you of such requests unless prohibited by law.

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. You will be notified via email or prominent notice on the Platform of any change in ownership or use of your personal information.

6.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

6.5 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you for analytics, research, or marketing purposes.

7. DATA SECURITY

We implement and maintain commercially reasonable technical, administrative, and physical security measures designed to protect your information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data in transit is encrypted using TLS/HTTPS. Sensitive data at rest is encrypted using AES-256.
• Password Security: Passwords are hashed and salted using industry-standard algorithms (bcrypt). Plaintext passwords are never stored.
• Access Controls: Strict role-based access controls limit data access to authorized personnel only, and access is reviewed regularly.
• Data Isolation: Each user's business data is logically isolated at the database level. No user can access another user's data.
• Monitoring: Automated systems monitor for suspicious activity, unauthorized access attempts, and potential security incidents.
• Regular Audits: We conduct periodic security assessments and updates of our infrastructure and practices.

7.1 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you via email and through the Platform within seventy-two (72) hours of becoming aware of the breach, as required by applicable laws. We will provide details about the nature of the breach, the types of information affected, steps we are taking to address it, and recommendations for protecting yourself.

8. DATA RETENTION

We retain your information as follows:

• Active Accounts: All data is retained for as long as your account remains active.
• Account Deletion: Upon your request for account deletion, all personal data and business data is permanently deleted from our active systems within thirty (30) calendar days. Backups containing your data are purged in accordance with our standard backup rotation cycle (typically within 90 days).
• Terminated Accounts: If we terminate your account for Terms of Service violations, we retain necessary data for legal and security purposes for up to one (1) year.
• Financial Records: Transaction and billing records are retained for the period required by applicable tax and accounting laws (typically 7 years).
• Anonymized Data: Aggregated, anonymized, or de-identified data that cannot identify you may be retained indefinitely.

9. DATA ISOLATION AND YOUR PRIVACY

LuxCreator Suite employs strict data isolation at the infrastructure level:

• Your business data — including content plans, income records, fan profiles, message templates, offers, tasks, vault files, and all other information entered into the Platform — is visible ONLY to you through your authenticated account.
• No other user, creator, or administrator can view, access, or search your business data.
• EProducts Empire staff do not browse, review, or access individual user business data except: (a) when required to investigate and resolve a support ticket you have filed; (b) when required by law or legal process; or (c) when investigating a reported Terms of Service violation.
• Backend analytics are performed on aggregated, anonymized data only — individual user data is never used for aggregate analysis without being fully anonymized first.

10. COOKIES AND TRACKING TECHNOLOGIES

LuxCreator Suite uses only essential cookies and similar technologies:

• Authentication Cookies: Session tokens required to keep you logged in. These are strictly necessary for the Platform to function. They expire when you log out or close your browser session.
• Preference Cookies: Store your UI preferences (such as sidebar collapsed state). These do not track you across websites.
• No Tracking Cookies: We do NOT use third-party tracking cookies, advertising cookies, retargeting pixels, social media tracking buttons, or cross-site tracking technologies.
• No Behavioral Advertising: We do NOT engage in interest-based advertising or behavioral profiling.

Browser Do Not Track Signals: The Platform does not respond to browser "Do Not Track" signals because we do not track users across third-party websites in the first place.

11. AI FEATURES AND DATA PROCESSING

When you use the Platform's AI features:

• Your prompts and the AI-generated responses are processed through OpenAI's API using an application-level API key.
• The prompts you submit are transient and not stored by OpenAI for training purposes when using our API integration (subject to OpenAI's API data usage policies).
• Your business data from the Platform is NOT automatically sent to the AI. Only the specific prompt you write is transmitted.
• You control what information to include in AI prompts. Do not include sensitive personal data in AI prompts unless necessary.
• AI responses are generated by third-party systems. We do not control or guarantee the accuracy, appropriateness, or safety of AI-generated content.

12. CHILDREN'S PRIVACY

13. INTERNATIONAL DATA TRANSFERS

EProducts Empire is based in the United States, and your data is stored and processed on servers located in the United States. If you access the Platform from outside the United States:

• You consent to the transfer of your information to the United States, which may have data protection laws different from those in your country of residence.
• We take appropriate safeguards to ensure your data receives an adequate level of protection in accordance with applicable data protection laws.
• For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms as approved by relevant authorities.

14. YOUR RIGHTS AND CHOICES

14.1 General Rights

Regardless of your jurisdiction, you have the following rights regarding your data:

• Access: You may access all data stored in your account at any time through the Platform.
• Correction: You may update or correct inaccurate information through your account Settings.
• Export: You may request a complete export of your data. Contact support@luxcreatorsuite.com.
• Deletion: You may delete your account and all associated data at any time through your Settings or by contacting us.
• Integration Revocation: You may disconnect any third-party integration at any time.
• Communication Preferences: You may opt out of non-essential communications while still receiving critical service notices.

14.2 California Residents (CCPA/CPRA Rights)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information as defined by the CCPA, so there is nothing to opt out of.
• Right to Limit Use of Sensitive Information: We do not use or disclose sensitive personal information for purposes beyond those permitted by the CPRA.

To exercise any CCPA/CPRA rights, email legal@luxcreatorsuite.com with "CCPA Request" in the subject line. We will verify your identity before processing your request, typically within 45 days as required by law.

Categories of personal information collected in the past 12 months: identifiers (name, email), commercial information (subscription records), internet activity (usage data), and inferences drawn from the above. We do not sell this information.

14.3 EEA, UK, and Swiss Residents (GDPR Rights)

If you are located in the European Economic Area, United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) grants you the following rights:

• Right of Access: Confirmation of whether we process your personal data, and access to that data.
• Right to Rectification: Correction of inaccurate or incomplete personal data.
• Right to Erasure: Deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Right to Restrict Processing: Limitation of how we process your data in certain circumstances.
• Right to Data Portability: Receipt of your data in a structured, commonly used, machine-readable format.
• Right to Object: Objection to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Withdrawal of previously given consent at any time.

Legal basis for processing: We process your data based on (a) contractual necessity (service delivery), (b) legitimate interests (security, improvement), (c) consent (marketing communications, integration connections), and (d) legal obligations (tax, regulatory compliance).

You have the right to lodge a complaint with your local data protection supervisory authority.

To exercise GDPR rights, email legal@luxcreatorsuite.com with "GDPR Request" in the subject line.

15. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites, integrations, or services not owned or controlled by EProducts Empire. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices, content, or security of any third-party service. We encourage you to review the privacy policies of any third-party service before providing your information or connecting your accounts.

16. SUBPROCESSORS

We use the following subprocessors to deliver the Platform. By using LuxCreator Suite, you authorize the engagement of these subprocessors:

We will update this list if we add or change subprocessors. Material changes to subprocessors will be communicated to active users.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes:

• We will update the "Last Updated" date at the top of this page.
• For material changes, we will notify you via email and/or through the Platform at least fourteen (14) days before the changes become effective.
• Your continued use of the Platform after the effective date constitutes acceptance of the updated Privacy Policy.
• If you do not agree with the changes, you must discontinue use of the Platform and may request deletion of your account and data.

18. CONTACT US

EProducts Empire is the data controller for the personal information processed through LuxCreator Suite. If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:

We aim to respond to all privacy-related inquiries within thirty (30) days. For urgent matters, please include "URGENT" in your email subject line.