How we collect, use, and protect your information. Last updated: April 2026.
1. Information We Collect
When you use the Lustify platform, we collect the following types of information:
Account Information — Username, password (hashed), Telegram user ID, phone number, and optional Telegram username provided during signup.
Activity Data — Messages sent and received, content uploads, payment transactions, login timestamps, IP addresses, user agent strings, and administrative actions performed on your account.
Device Information — Browser type, operating system, device fingerprint (for fraud prevention), and screen resolution.
Payment Information — Payment processor IDs, card fingerprints (not full card numbers), transaction amounts, and payout records. Full payment card details are handled exclusively by our third-party payment processor and are never stored on our servers.
Communications — Support messages and any communications you send through the Platform.
2. How We Use Your Information
Platform Operation — To provide, maintain, and improve the Platform's features and services.
Security & Compliance — To detect fraud, prevent abuse, enforce our Terms of Service and Content Policy, and comply with legal obligations.
Identity Verification (KYC) — Identity verification is processed through our third-party verification partner, Sumsub. When you complete KYC, Sumsub collects and processes your government-issued identification documents and biometric data (facial recognition) to verify your identity. Sumsub's processing is governed by their own privacy policy. Lustify receives only the verification result (approved/rejected) and basic identity data, not the raw biometric data.
Activity Monitoring — To log and monitor account activity for compliance, safety, and operational purposes as described in our Terms of Service.
Analytics — To generate aggregated, anonymized insights about Platform usage to improve our services.
Communication — To send you service-related notifications, security alerts, and support responses.
Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:
Contractual necessity (Art. 6(1)(b) GDPR) — Processing required to provide the Platform and fulfill our agreement with you: account creation, payment processing, content hosting and distribution, and support communications.
Legal obligation (Art. 6(1)(c) GDPR) — Processing required by law: CSAM detection and reporting, 2257 record-keeping, tax and financial record retention, and response to lawful government requests.
Legitimate interest (Art. 6(1)(f) GDPR) — Processing necessary for our legitimate business interests where those interests are not overridden by your rights: fraud prevention, platform security, activity monitoring for policy compliance, and anonymized analytics.
Consent (Art. 6(1)(a) GDPR) — Where none of the above bases apply, we will ask for your explicit consent before processing. You may withdraw consent at any time.
3. Data Retention
We retain your account information and activity logs for as long as your account is active and for a reasonable period thereafter for legal, compliance, and dispute resolution purposes.
Some data is retained even after account deletion because the law requires it. Specifically: payment and financial records are retained per applicable tax and financial regulations, CSAM-related reports and associated logs are retained permanently as required by federal law, and records required under 18 U.S.C. § 2257 are retained for a minimum of seven years. All other account data and activity logs are deleted or anonymized within 90 days of account closure upon request.
Payment records are retained in accordance with applicable financial regulations and tax requirements.
4. Data Sharing
We do not sell your personal information. We may share your information in the following circumstances:
Payment Processors — Transaction data is shared with our payment processor (Stripe) to facilitate payments and payouts.
Law Enforcement — We will disclose information when required by law, subpoena, court order, or when we believe in good faith that disclosure is necessary to protect the safety of any person or to prevent illegal activity. CSAM-related content is always reported to the National Center for Missing and Exploited Children (NCMEC) and relevant law enforcement.
Identity Verification — KYC data is shared with our verification partner, Sumsub, for the purpose of identity verification. Sumsub processes your government-issued ID and biometric data under their own data processing agreement with Lustify.
Service Providers — We may share data with trusted service providers who assist in operating the Platform (e.g., hosting, monitoring), subject to confidentiality obligations.
International Data Transfers
Your data may be processed in the United States and other countries where our service providers operate. If you are located in the EEA or UK, we ensure that international transfers of your personal data are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms. By using the Platform, you acknowledge that your data may be transferred to and processed in jurisdictions that may not provide the same level of data protection as your home country.
5. Data Security
We implement industry-standard security measures to protect your data, including encrypted connections (TLS), hashed passwords, access controls, and regular security reviews. However, no system is perfectly secure, and we cannot guarantee absolute security of your information.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
Access the personal information we hold about you
Correction of inaccurate information
Deletion of your account and associated data — we will delete or anonymize all data not subject to the legal retention requirements described in Section 3 above within 90 days of your request
Object to certain processing of your data
Portability — request a copy of your data in a structured, machine-readable format
To exercise any of these rights, contact us at @lustifydevadmin on Telegram. We will respond to all requests within 30 days. If we need to retain certain data for legal compliance (such as financial records or CSAM reports), we will explain exactly what is retained and why.
If you are located in the EEA or UK and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.
7. Cookies & Tracking
We use a minimal set of cookies necessary to operate the Platform:
Session cookie (strictly necessary) — Maintains your authenticated login state. Expires when your session ends or after the configured session timeout. This cookie is essential for the Platform to function and cannot be disabled.
Device fingerprint (strictly necessary) — A server-side fingerprint derived from your browser and device characteristics, used solely for fraud prevention and abuse detection. No fingerprint data is shared with third parties.
We do not use third-party advertising cookies, marketing trackers, or analytics cookies. All analytics data is collected and processed server-side and is not shared with third-party analytics providers. Because we only use strictly necessary cookies, we do not require cookie consent banners under GDPR/ePrivacy regulations.
8. Children's Privacy
The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we discover that a minor has created an account, the account will be immediately terminated.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform. Your continued use of the Platform after changes constitutes acceptance of the updated policy.