This policy explains, in plain language, what VRStrip.Cam ("we", "us") does with the personal data of everyone who uses the Site - casual visitors, registered viewers, broadcasting Models, and the studios that manage them. We wrote it to satisfy the GDPR, the UK GDPR, the EU Digital Services Act, the California CCPA/CPRA, and equivalent laws in other regions where we operate.

If you cannot agree with how we handle data, don't use the Site.

1. Who's Responsible

The operator of VRStrip.Cam is the data controller for personal data collected through the Site. Send privacy questions, complaints, deletion requests, and rights claims to [email protected]. EEA visitors can also contact their local supervisory authority directly.

2. Where the Data Comes From

We collect data three ways:

• You give it to us: account signup, payment forms, ID verification, support emails, chat messages;
• Your device sends it: IP, user-agent, screen size, headset type when a WebXR session starts, language, referring URL;
• Partners share it: payment processors confirm transactions, age-verification vendors confirm pass/fail, OAuth providers (if you choose to sign in with one) share an email and a unique ID.

3. Categories We Process

Casual visitors (no account):

• IP address (truncated after 30 days), coarse geolocation derived from it, ISP;
• Browser, OS, headset model when applicable;
• Pages viewed, dwell time, click and scroll patterns, search terms used on the Site;
• Cookies and similar storage - see Section 11.

Registered viewers (add to the above):

• Username, password hash, email, optional profile photo and bio;
• Wallet balance, token purchases, tips sent, recordings owned;
• Following lists, favorites, blocked users, chat history;
• Communication preferences, language, time zone.

Models and studios (add to the above):

• Legal name, date of birth, residential address, tax identification, payout method;
• Government ID image, hold-the-ID selfie, optional second proof of identity;
• Stage name, public bio, schedule, tags, kinks list, room rules;
• Stream metadata, snapshots, recordings, viewer counts, tipping totals, payout history.

4. Sensitive Categories

Some of what we process is "special category" data under GDPR - sexual orientation may be inferred from your favorites list, and ethnicity or health may be inferred from a Model's bio. We rely on explicit consent (Article 9(2)(a)) for this and we never sell it. You can withdraw consent at any time, though doing so may force account closure if the data is integral to delivering the service.

5. Why We Process It (Legal Basis)

• Contract performance: creating your account, processing token purchases, paying Models;
• Legitimate interests: fraud prevention, abuse detection, product analytics, evolving the recommendation engine;
• Legal obligation: tax reporting, 18 U.S.C. § 2257 record-keeping, responding to court orders;
• Consent: marketing emails, optional cookies, processing of sensitive categories.

6. Who We Share Data With

• Processors under contract - hosting, CDN, payment, fraud scoring, anti-abuse, email delivery, customer support, analytics;
• Age-verification providers who return a true/false signal and store the underlying document on their own side per local law;
• Law enforcement and regulators when a valid, narrowly scoped legal request is served;
• Acquirers in the event of a merger, restructure, or asset sale - bound by this policy or one with equivalent protection;
• Studios get access to data relating to their own Models and rooms, never to viewers or to unrelated Models.

We do not sell or rent personal data. We do not share data with advertising networks for cross-site behavioral profiling.

7. Payments

Card numbers are entered directly into our PCI-compliant processor's iframe and never touch our servers. We retain only the last four digits and a non-reversible token for repeat purchases you've authorized. Refunds and chargebacks are coordinated through that processor.

8. International Transfers

Some processors are based outside the EEA/UK. When we transfer personal data to them we use the European Commission's Standard Contractual Clauses (2021/914) plus supplementary technical measures (encryption in transit and at rest, key separation, contractual access controls). You can request a copy of the safeguards in place for a specific transfer.

9. How Long We Keep It

• Visitor logs: 30 days, then aggregated;
• Account data: for the life of the account plus 12 months after deletion (for fraud-recurrence detection);
• Financial records: 7 years to satisfy tax and audit law;
• Model verification documents: as long as the Model is active plus 7 years to satisfy record-keeping law;
• Chat history: 90 days for casual rooms, lifetime of the account for direct messages.

10. Your Rights

Depending on where you live you have some combination of:

• Access - get a copy of what we hold on you;
• Rectification - fix incorrect or out-of-date data;
• Erasure - request deletion (subject to legal retention requirements above);
• Restriction - pause processing while a dispute is investigated;
• Portability - receive your data in a structured, machine-readable file;
• Objection - opt out of processing based on legitimate interest;
• Withdrawal of consent - at any time, with no effect on processing already carried out;
• No discrimination for exercising any of the above (a CCPA-specific guarantee).

We respond to verified rights requests within 30 days. To submit one, email [email protected] from the address on file.

11. Cookies and Local Storage

We use strictly necessary cookies to keep you logged in and to protect the checkout flow. We use functional cookies for preferences (language, default category, headset type) and limited analytics cookies to count unique sessions and detect bot traffic. We do not run third-party ad cookies, retargeting pixels, or fingerprinting scripts. EEA, UK, and Brazilian visitors see a granular consent banner; everywhere else strictly-necessary cookies load by default and you can adjust the rest in account settings.

12. How We Secure Your Data

TLS 1.3 for everything in transit; AES-256 at rest; role-based access control with two-factor required for staff; encrypted backups; quarterly third-party penetration testing; bug bounty for responsible disclosure. No system is unbreakable - pick a strong, unique password and keep it inside a password manager.

13. Minors

VRStrip.Cam is for adults only. We block known minor user-agents, enforce age verification at signup, and remove any account where there is reasonable suspicion of underage use. Suspected child sexual abuse material is reported immediately to NCMEC and the relevant national authority.

14. EEA, UK, and DSA-Specific Notes

As a "large online platform" under the EU Digital Services Act we publish a recommender-system explanation in account settings, a transparency report at least once per year, and a single point of contact for authorities and trusted flaggers. You can opt out of personalized recommendations and switch the grid to a recency-only feed.

15. California-Specific Notes

California residents have the rights listed in Section 10 plus the right to limit use of sensitive personal information. We do not sell personal data and we honor "Do Not Sell or Share" / GPC browser signals. To exercise rights, email [email protected] from the address on file or use the in-app form.

16. Outbound Links

Streams, profiles, and blog posts may link to outside sites. We don't control how those sites collect data; review their policies before signing up or paying for anything there.

17. Updates to This Policy

We post material changes at least 15 days before they take effect, by banner on the homepage and by email to verified addresses. Minor edits (typos, contact details) take effect when posted.

18. Talk to Us

Privacy questions, requests, or complaints: [email protected]. General support: [email protected].