Master Privacy Policy
Effective Date: August 2026 • Last Updated: October 6, 2026
This Privacy Policy outlines how DiscreetPanties collects, uses, encrypts, processes, and protects your personal data in compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA), and applicable global privacy statutes.
1. Information We Collect
DiscreetPanties collects only the information necessary to provide a secure, authenticated, and legally compliant marketplace. Categories of collected data include:
Email address, username, display name, profile avatar, and securely hashed and salted passwords (Bcrypt).
Government-issued photo identification, date of birth, real legal name, and tax identification (retained strictly for 18 U.S.C. § 2257 compliance).
Purchase logs, tipping records, and point-of-sale Lightning settlement logs.
IP addresses, browser type, operating system, timestamp logs, and essential authentication cookies for session security.
2. Payment Privacy & Cash App / Lightning Payments
ZERO CREDIT CARD OR BANKING DATA STORAGE:
DiscreetPanties strictly prohibits and never processes, accepts, or stores credit cards, debit cards, bank routing numbers, or traditional fiat merchant accounts. Every purchase is a one-time US Dollar checkout paid with Cash App or another Lightning-enabled mobile payment app. We hold no account balances, stored value, or prepaid credit for anyone.
Buyers enjoy complete financial privacy without card billing statements, bank holds, or third-party merchant processor tracking. Models store one payout handle (a Cash App $cashtag or Lightning handle), and payouts go to it the moment a buyer pays, with no platform custody. We never ask for, store, or see shipping addresses: buyers share a delivery destination with the model directly in private chat.
3. How We Use Your Information (Lawful Basis)
We process your personal data under the following legal bases pursuant to GDPR Article 6:
- Contractual Performance: To authenticate your account, process purchases, deliver model media, and facilitate direct messaging.
- Legal & Regulatory Compliance: To satisfy mandatory adult age verification, federal record-keeping (18 U.S.C. § 2257), anti-money laundering (AML), and tax reporting obligations.
- Platform Security & Fraud Prevention: To prevent unauthorized logins, automated bot scraping, payment fraud, and unlawful content distribution.
- Legitimate Interests: To optimize marketplace usability, provide customer support, and promote public listings across marketing channels.
4. Third-Party Service Providers & Data Disclosure
We do not sell, rent, or trade your personal information to third-party data brokers. We share data only with trusted infrastructure providers under strict Data Processing Agreements (DPAs):
- Cloud Hosting & Server Infrastructure: Enterprise secure cloud server hosting with encrypted storage volumes.
- Transactional Email Delivery: Secure email infrastructure (Resend) for password resets, order notifications, and support alerts.
- Sister Site, Only When You Ask: DiscreetPanties and TootsieTrader have the same owner. If a model chooses to open a shop on TootsieTrader with their account carried over, we copy their profile, login, payout handle and (if they tick the box) their ID verification files to TootsieTrader. Nothing is shared unless the model starts it and confirms it.
- Legal & Law Enforcement Compliance: We may disclose user data if required by a valid judicial subpoena, court order, or to protect the safety of individuals and report child sexual abuse material (CSAM) to federal authorities.
5. Your Legal Privacy Rights (GDPR & California CCPA/CPRA)
Depending on your jurisdiction, you possess specific statutory privacy rights:
To submit a verified privacy request, email our compliance team at [email protected]. We respond to all verified requests within thirty (30) days without discrimination.
6. Data Retention & Security Safeguards
We retain personal data for as long as your account remains active and as required by applicable tax, commercial, and federal compliance laws (such as statutory 18 U.S.C. § 2257 record-retention requirements). We utilize industry-standard TLS/SSL encryption in transit, AES-256 encryption at rest, role-based database access controls, and automated rate-limiting defenses against brute-force attacks.
7. Data Protection Officer & Privacy Inquiries
For any inquiries, data deletion requests, or questions regarding this Privacy Policy, contact our Data Protection Officer: