Privacy Policy

We collect the following categories of personal data:

• Account data: name, email address, display name, and authentication details.
• Creator business data: sessions, rituals, notes, brand deal applications, content drafts, manually-entered or CSV-imported earnings records, and other information you enter into the Service.
• Connected-platform data: where you authorise a connection, data such as messages, fan/subscriber records, engagement, and revenue figures from the platforms you connect (which may include social, messaging, monetisation, and adult-content platforms). Some of this data is personal data about your fans or subscribers, not about you — see Section 3 for how we handle it.
• Payment data: billing details are collected and processed by our payment processor, Stripe; we do not store full card numbers ourselves.
• Usage data: device, log, and analytics information generated by your use of the Service.
• Communications: support requests, feature requests, and bug reports you send us.

Under UK GDPR (and, for creators in the EEA, EU GDPR — see Section 8), we rely on the following legal bases to process your personal data:

• Performance of a contract — to provide the Service, including account access, feature functionality, billing, the Creator Health Score, the Deal Readiness score, and Burnout Radar (activity/safety/revenue/engagement business metrics — session load, message volume, ritual consistency, and income stability — not a health assessment).
• Legitimate interests — to maintain and improve the Service, monitor for abuse or security issues, and provide most AI-generated recommendations, provided this does not override your rights and interests.
• Explicit consent — Wellbeing Insights (AI-inferred sleep-pattern and message-sentiment/toxicity-exposure signals, distinct from Burnout Radar's business metrics above) touches on your physical or mental wellbeing, which UK/EU GDPR treats as a special category of data requiring a stronger legal basis than legitimate interests. This feature is off by default; we only calculate or show it to you once you explicitly turn it on from Settings, and you can turn it off again at any time, which stops the processing immediately.
• Consent — for optional marketing communications, which you can withdraw at any time.
• Legal obligation — where we must retain or disclose data to comply with the law.

When you connect a third-party platform, we access the data that platform makes available under the permissions you grant, and use it solely to display it within the Service and power related features (such as the unified inbox, earnings tracking, and AI suggestions). We do not sell this data. Disconnecting a platform stops future data collection from it, though previously imported data may remain in your account until you delete it.

Some of this data — such as a fan's username, messages, or spend — is personal data about a third party (your fan or subscriber), not about you. For that data, you are the data controller and NoMoreManagers acts as your data processor, processing it only on your instructions to provide the Service. You are responsible for having your own lawful basis for that data and for meeting your own obligations to your audience under applicable law. A Data Processing Addendum describing this arrangement is available at /dpa.

Certain features send relevant data (such as message content, session notes, opportunity details, or contract text you paste into the Contract Safety scanner) to our AI provider (Anthropic) to generate suggestions, summaries, risk flags, or scores. This data is processed to generate your requested output and is subject to our AI provider's own data-handling terms, which restrict use of your data to providing the service to us. See Section 11 (Sub-processors) for our full list of service providers.

Subscription payments are handled by Stripe, Inc., which acts as an independent data controller for payment data it processes. Please refer to Stripe's own privacy policy for details of how it handles your payment information.

We use cookies that are strictly necessary for authentication and core functionality (for example, your sign-in session and two-factor verification status). We also use Vercel Analytics and Speed Insights to understand overall Service usage and performance. We do not use advertising cookies or cross-site tracking for behavioural marketing. If that changes, we will update this section and seek your consent first where required by law (in the UK, under PECR; in the EEA, under the ePrivacy rules). You can control cookies through your browser settings or our cookie preferences banner, and disabling essential cookies may prevent the Service from working correctly. A dedicated Cookie Policy explains the categories we use.

Where personal data is transferred outside the UK (for example, to service providers located in the United States — see Section 11), we rely on appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Addendum or an adequacy decision, to ensure your data continues to receive an appropriate level of protection. The same applies for data we receive from creators located in the EEA or elsewhere: it is transferred to and processed in the UK and by the sub-processors listed in Section 11, under equivalent safeguards.

Where you are located in the EEA, EU GDPR applies to our processing of your personal data in addition to UK GDPR, and you have the same set of rights described in Section 12 under EU GDPR.

EU & UK GDPR Representative

In accordance with Article 27 of the UK and EU General Data Protection Regulation, Lustra Digital LTD has appointed Euverify Ltd as its GDPR representative in both the United Kingdom and the European Union.

If you are a data subject or a supervisory authority and wish to contact our representative regarding matters covered by the GDPR, you can reach them at:

UK Representative
Euverify Ltd
3rd Floor, 86-90 Paul Street
London, EC2A 4NE
United Kingdom

EU Representative
Euverify Ltd
Unit 3D North Point House
North Point Business Park, New Mallow Road
Cork, T23 AT2P
Ireland

Email: gdpr@euverify.com
Verification: https://gdpr.euverify.com/verify/b513809d-d660-4f36-bba7-4a7afd3e8e50

Depending on your state of residence, you may have rights under state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and similar laws in states including Virginia, Colorado, Connecticut, and Utah. In plain terms:

• We do not sell or share your personal information for cross-context behavioural advertising, and we have not done so in the preceding 12 months.
• You can still submit a "do not sell or share" request from Settings at any time, or use the dedicated Do Not Sell or Share page.
• You have the right to know, access, correct, and delete your personal information, and not to be discriminated against for exercising these rights — the same self-service tools in Section 12 cover all of these.

If you are located somewhere not specifically addressed above, we still process your personal data in line with the principles in this policy — lawful basis for processing, data minimisation, security, and your ability to access, correct, or delete your data — and nothing in this policy limits any rights you have that cannot be waived under the law of your own country.

We use the following categories of sub-processor to provide the Service. We do not sell your data to any of them.

• Supabase — database, authentication, and file storage.
• Stripe — payment processing (see Section 5).
• Anthropic — AI-generated suggestions, summaries, and scores (see Section 4).
• Resend — transactional and account-related email delivery.
• Sentry — error monitoring, to help us find and fix bugs.
• Vercel — application hosting, and analytics/performance monitoring (see below).
• Inngest — scheduling background jobs (such as reminders and the deletion process in Section 13).
• OFAuth — where you connect OnlyFans message history, used solely to retrieve that history into your unified inbox.
• Chaturbate — where you connect your own Chaturbate Events API token, used solely to retrieve chat and private-message events into your unified inbox.
• Platform-specific processors — where you choose to connect a platform (for example Discord, X, or Telegram), we process data through that platform's own API under the permissions you grant.

You have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request erasure of your data, subject to the process and limited legal-retention exceptions in Section 13;
• Request that we restrict or object to certain processing;
• Receive your data in a portable format;
• Withdraw consent at any time where processing is based on consent (including turning off Wellbeing Insights, or opting out of marketing);
• If you are in the US, confirm that we do not sell or share your personal information (see Section 9);
• Complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in the EEA, your local data protection authority.

The fastest way to exercise most of these rights is the self-service "Data & Privacy Requests" panel in Settings, which lets you submit an access, portability, correction, restriction, objection, or do-not-sell request directly, and account deletion is available from the same page. You can also contact us at hello@nomoremanagers.com.

We retain personal data for as long as your account is active. When you delete your account (from Settings, or by request), deletion happens in two stages:

• Grace period: your account is deactivated and your data is hidden immediately, but kept recoverable in case the deletion was a mistake or is disputed.
• Permanent erasure: after the grace period, your personal data — messages, fan/subscriber records, session notes, and the other categories in Section 1 — is permanently deleted.

A narrow set of fields tied to your account record (not your personal identifying details, which are removed) are kept afterwards where we have a legal obligation to retain them — for example, billing references kept for the period required by UK accounting law (currently six years) so we can meet our own tax and audit obligations. Security and fraud-prevention logs may also be kept for a limited period after account closure for the same reason logs exist in the first place: to detect and respond to abuse.

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and optional two-factor authentication, to protect your personal data. No system is completely secure, and we cannot guarantee absolute security.

The Service calculates scores such as churn risk and the Creator Health Score, and — where you've turned it on — Wellbeing Insights, using automated processing of your data. These are provided to help you make your own decisions and do not produce legal or similarly significant effects on their own — no automated decision is made that affects your account status or access to the Service without human involvement.

The Service is not directed at, and must not be used by, anyone under the age of 18. We ask every creator to affirmatively confirm they are 18 or older before they can use the Service. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you before they take effect. The "Last updated" date at the top of this page shows when it was last revised.

For any questions about this Privacy Policy or how we handle your data, contact us at hello@nomoremanagers.com or our registered office address above.