1. Data we collect
- Account data: email address, password (stored hashed by Supabase Auth), optional full name, avatar and country, and the Google account identifier if you sign in with Google.
- Protection profile: the stage names, usernames and keyword variants you ask us to monitor, and the list of domains you whitelist. If you connect an OnlyFans account, we read only the public username and display name needed to build your keywords.
- Free search: the email address and stage name you enter, a one-time verification code, and your IP address (used for rate limiting and abuse prevention).
- Billing: subscription plan, status, billing cycle and invoices. Card data is entered on Stripe and never reaches our servers; we store the Stripe customer and subscription identifiers.
- Search results: the URLs, page titles, thumbnails (small previews, never full media), match scores and timestamps of the content our crawlers find for your keywords.
- Takedown records: the notices we send on your behalf (recipient, timestamp, listed URLs, the statements included in the notice) and their status.
- Support: the tickets and messages you send us.
- Usage data: pages viewed on the website, approximate location derived from the IP address, device and browser type. Google Analytics is loaded only after you accept analytics cookies.
2. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating and operating your account, running scans, showing results in the dashboard | Performance of a contract (art. 6.1.b) |
| Sending DMCA / takedown notices and Google de-indexing requests on your instruction | Performance of a contract (art. 6.1.b); the notice itself relies on your declaration of ownership |
| Billing, invoicing, accounting records | Contract (art. 6.1.b) and legal obligation (art. 6.1.c) |
| Free search verification, rate limiting, fraud and abuse prevention, security logs | Legitimate interest (art. 6.1.f) |
| Transactional emails (verification codes, welcome, takedown updates, password reset) | Contract (art. 6.1.b) |
| Newsletter and product updates | Consent (art. 6.1.a), withdrawable at any time |
| Analytics cookies | Consent (art. 6.1.a) |
3. Who processes data for us
We use the following providers as processors under written data-processing terms. Where a provider is outside the EU/EEA, transfers rely on the EU Standard Contractual Clauses or an adequacy decision.
- Supabase (database, authentication, file storage) — primary database hosted in the EU.
- Vercel (website hosting and delivery) and Railway (API and crawler hosting).
- DigitalOcean (Telegram monitoring service).
- Stripe (payments and invoicing).
- SendGrid / Twilio (transactional email, including takedown notices).
- Firecrawl (web page retrieval for scans).
- Google (OAuth sign-in and, with your consent, Google Analytics).
Takedown notices are, by their nature, disclosed to the recipient website, hosting provider or search engine. A notice contains the name or stage name you ask us to use and a contact address, as required for the notice to be valid.
4. How long we keep data
- Account and profile data: for as long as the account exists, then deleted within 30 days of an erasure request (backups expire within a further 30 days).
- Search results and takedown records: kept while the account exists because they document the notices sent on your behalf; deleted with the account.
- Free search data: results are available for a limited time via the report link; the email and IP address are kept for abuse prevention and then deleted.
- Invoices and accounting records: 10 years, as required by Italian tax law.
- Technical logs: up to 90 days.
5. Your rights
You can ask for access to your data, rectification, erasure, restriction, portability, and you can object to processing based on legitimate interest or withdraw consent at any time. Write to privacy@guarvian.com; we answer within one month. You can also lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali).
6. Security
All traffic is encrypted in transit (TLS), data is encrypted at rest by our hosting providers, passwords are hashed, access to production systems is restricted to authorised staff with two-factor authentication, and database row-level security prevents access from the public API keys.
7. Age requirement
Guarvian is a service for adult content creators and professionals. You must be at least 18 years old to create an account.
8. Changes
We will publish any material change on this page and, for account holders, notify it by email before it takes effect.