Privacy Policy

1. Introduction

This Privacy Policy describes how [Your Creative Writing Archive Name] ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our online creative writing archive and related services (the "Service"). We are committed to protecting your privacy and handling your data in an open and transparent manner. Our practices are designed to comply with applicable data protection laws, including:

• The European Union's General Data Protection Regulation (GDPR)
• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws.
• Relevant United States privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), and other similar state laws.

By using the Service, you consent to the practices described in this policy.

2. Data Controller

Adult FanFiction
For questions about this policy or your data, please contact:
tos_team@adult-fanfiction.org

3. Information We Collect

We collect minimal personal information necessary for operating the Service:

• Real Name      
• Account administration, verification, and essential communication. Lawful Basis (GDPR): Contractual necessity.           
• Never publicly visible. Access restricted to administrators.
• Pen Name       
• Public attribution of your creative works. Lawful Basis (GDPR): Contractual necessity and your consent.
• Publicly visible on your published works and profile (if applicable).
• Email Address              
• Account creation, authentication, service communications, password resets, and (if opted-in) newsletters. Lawful Basis (GDPR): Contractual necessity and (for marketing) consent.           
• Never publicly visible. Access restricted to administrators.
• Birthdate          
• Solely to verify you are 18 years of age or older to use the Service, as required by our Terms of Service. We do not use this for marketing, profiling, or any other purpose. Lawful Basis (GDPR): Legal obligation and legitimate interest (preventing access by minors).               
• Never publicly visible. Access restricted to administrators.
• Account Password    
• Securely hashed and stored for authentication.   
• Never accessible to anyone, including administrators.
• User-Generated Content       
• The creative writing you choose to publish on the platform.          
• Publicly visible according to your publishing choices.

We do not collect sensitive personal data (e.g., racial, political, religious, health information) as defined under GDPR, CPRA, or other applicable laws.

4. How We Use Your Information

We use your personal information solely for the following purposes:

• To create, manage, and secure your user account.
• To provide, maintain, and improve the core functionality of the writing archive.
• To verify you are 18 years of age or older.
• To communicate with you regarding your account, technical updates, or changes to our policies.
• To respond to your inquiries and provide user support.
• To send you notification emails only if you have explicitly opted in to receive them. You can unsubscribe at any time.

5. How We Share Your Information

We do not and will not sell, rent, or trade your personal information to any third parties. Under the CCPA/CPRA, "sell" is broadly defined. We do not engage in any activity that meets this definition.
We may share your information only in the following limited circumstances:

• Service Providers: With trusted third-party vendors who perform services on our behalf (e.g., web hosting, email delivery, database management). These providers are contractually bound to protect your data, use it only for the services we request, and are prohibited from "selling" or using it for their own purposes.
• Legal Obligation: If required to do so by law, or in response to a valid legal request (e.g., court order, subpoena).
• Protection of Rights: To protect the rights, property, or safety of [Your Archive Name], our users, or the public, as required or permitted by law.

6. International Data Transfers

If we transfer your personal data outside the European Economic Area (EEA), the United Kingdom, or Canada, we will ensure appropriate safeguards are in place, such as standard contractual clauses approved by relevant authorities, to ensure a level of protection equivalent to GDPR, PIPEDA, and other applicable laws.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained for the lifetime of your active account. You may request deletion at any time (see Section 8).
• Records of Underage Access: If we discover or are notified that a user is under 18, we will immediately delete their account and all associated personal data. A secure, anonymized log entry recording the action taken (account deletion/ban) and the basis (age violation) will be retained as proof of our due diligence in enforcing our age policy. This log does not contain the user's personal information.
• Backup Data: May be retained in secure backups for a limited period necessary for operational recovery, even after account deletion.

8. Your Rights

Depending on your location, you have the following rights regarding your personal data:
Under GDPR (EEA/UK):

• Access, Correction, Deletion (Erasure), Restriction of Processing, Data Portability, Objection, and to Withdraw Consent.
• To lodge a complaint with a supervisory authority.

Under PIPEDA (Canada):

• Access to your information and the ability to challenge its accuracy and completeness.

Under U.S. Laws (e.g., CA, VA, CO, CT, UT):

• Know/Access & Data Portability: To request a copy of the specific personal information we have collected about you.
• Deletion: To request deletion of your personal information, subject to legal exceptions.
• Correction: To request correction of inaccurate personal information.
• Opt-Out of Sale/Sharing: We do not sell or share your personal information as defined under these laws. If our practices change, we will provide a clear "Do Not Sell or Share My Personal Information" link.
• Limit Use of Sensitive Information: We do not collect or use sensitive personal information for inferring characteristics, so this right is not applicable.
• Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your privacy rights.

To exercise any of these rights, please contact us using the information in Section 2. We will respond within the timeframes required by the law applicable to you (e.g., 30-45 days for most US state laws). We may need to verify your identity before processing your request.
Note on Age Verification: Exercising certain rights (like access) will require us to reconfirm your age (that you are 18 or older) as part of our identity verification process, to prevent unauthorized access by minors.

9. Additional Disclosures for U.S. Residents

Categories of Personal Information Collected: Identifiers (name, email, pen name), and protected classification characteristics (age/birthdate for verification only) as listed in Section 3.
Business/Commercial Purpose for Collection: As detailed in Section 4.
Categories of Sources: Directly from you.
Categories of Third Parties with Whom We Share: Service Providers, as defined in Section 5.

10. Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption, secure servers, and access controls. However, no internet transmission is 100% secure, and we cannot guarantee absolute security.

11. Age Restriction & Enforcement

Our Service is strictly limited to users who are 18 years of age or older. By creating an account, you represent and warrant that you are at least 18 years old.
We use the birthdate you provided to verify your age during registration. If we have reasonable grounds to suspect a user is under 18, or if such a violation is reported to us, we will:

1. Immediately suspend and then permanently delete the account in question.
2. Delete all associated personal data collected from that user.
3. Create and retain an internal, secure, and anonymized administrative log of the event. This log will document the action taken (account deletion/ban) and the reason (age policy violation) to demonstrate our due diligence in enforcing this rule. This log is for compliance purposes only and does not contain the user's personal information.

We do not knowingly collect any personal information from individuals under 18. If you believe a user is under 18, please contact us immediately at [Email Address for Reporting].

12. User Responsibility

You are responsible for the personal information you choose to include in the creative writing you publish on the platform (e.g., embedding real details about yourself or others in stories). We are not responsible for such user-disclosed information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and updating the "Last Updated" date. Your continued use of the Service after such changes constitutes your acceptance of the new policy.