1. Controller
The controller for data processing on bluq is: [COMPANY NAME / OPERATOR] [STREET NO.], [POSTCODE CITY], Germany Email: [EMAIL ADDRESS]
Data protection officer (if appointed): [NAME / CONTACT OR "not appointed, not legally required"]
2. Overview
We process personal data only where necessary to operate the platform, perform contracts, meet legal obligations, or based on your consent. We do not sell data and do not profile you for advertising without consent.
3. Legal bases
- Art. 6(1)(a) GDPR – consent (e.g. optional cookies)
- Art. 6(1)(b) GDPR – contract and pre-contractual steps (account, memberships, purchases, chat)
- Art. 6(1)(c) GDPR – legal obligations (tax and commercial law, youth protection)
- Art. 6(1)(f) GDPR – legitimate interests (security, abuse prevention, functionality)
- § 25(1) and (2) TDDDG – storing information on your device
4. Hosting and infrastructure
The website and database are hosted by a cloud provider ([HOSTING PROVIDER, LOCATION]). When you visit, technically necessary data is processed: IP address, date and time, page requested, browser and operating system, referrer. These server logs serve security and debugging and are deleted after 30 days at the latest. Uploaded images and videos (avatars, posts, originals, chat media) are stored with Cloudflare R2 (Cloudflare Inc., USA; EU location where possible). Private files are only accessible via time-limited links. Data processing agreements (Art. 28 GDPR) are in place with all providers. Transfers to third countries rely on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
5. User account
Registration
For registration we collect your email address, password (stored only as a hash) and optionally a display name and profile picture. Legal basis: Art. 6(1)(b) GDPR.
Approval
New accounts are approved manually by us. We review the account details and store the status (pending, approved, blocked).
Sessions
After signing in, a session token is stored in your browser (local storage). In account settings you can sign out of other devices or everywhere, and see device, browser and last sign-in time.
Deletion
You can request deletion of your account at any time at [EMAIL ADDRESS]. Data subject to statutory retention (e.g. invoices, 10 years under § 147 AO) is restricted until the period ends and then deleted.
6. Memberships, purchases and payments
For memberships, single purchases, unlockable posts and paid chat media we store type, amount, time, term and status. Payment details (card numbers, bank data) are processed solely by the payment provider and never stored by us.
Payment provider: [NAME, LOCATION, LINK TO PRIVACY POLICY]. Legal basis: Art. 6(1)(b) and (c) GDPR.
7. Content, likes, comments and favourites
When you like, comment on or save posts, we store the link to your account. Comments are visible to other entitled members with your display name. You can delete your comments at any time.
The "For you" feed is ordered by recency, popularity and creators you follow. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place.
8. Messages (chat)
Messages between members and creators are stored to provide the chat (Art. 6(1)(b) GDPR), including text, time, read status and images or videos sent. Media is kept in private storage and delivered only via time-limited links to authorised people. A creator's online status is derived from the time of their last reply.
Deleted messages and media are removed for both sides. To prevent abuse and enforce our guidelines, administrators may view chats where there is a specific reason (Art. 6(1)(f) GDPR).
9. Contact form and email
If you contact us, we store name, email and message to handle your request, and delete them once it is resolved and no retention duties apply.
System emails (welcome, account status, password reset, purchases) are sent via Resend (Resend Inc., USA). Email address, subject and content are transferred under a data processing agreement and Standard Contractual Clauses.
10. Cookies and local storage
See our Cookie Policy. In short: necessary storage (sign-in, consent, language) is used without consent (§ 25(2) TDDDG). Preference, analytics and marketing cookies only with your consent, which you can withdraw at any time via "Cookie settings" in the footer. If you are signed in, we also store your choice as proof (Art. 7(1) GDPR).
11. Language and region
To show you the right language, we determine your country from your IP address at the network edge (no storage) and your browser's time zone. Visitors from Germany, Austria and Switzerland see German, everyone else English. You can change the language at any time.
12. External links
Creator profiles may link to Instagram, TikTok or other services. Data is only transferred when you click such a link; the provider's privacy policy then applies.
13. Age verification
Use is only permitted from age 18. For adult-only content an age check via a specialised provider may be required ([PROVIDER NAME]). The provider processes ID or biometric data; we only receive the result.
14. Retention
- Account data: until account deletion
- Invoice and payment data: 10 years (§ 147 AO, § 257 HGB)
- Server logs: 30 days
- Consent records: 3 years after withdrawal or expiry
- Contact requests: until resolved, at most 2 years
15. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
- Complaint to a supervisory authority (Art. 77 GDPR), e.g. in your country of residence or [COMPETENT AUTHORITY]
Please send requests to [EMAIL ADDRESS].
16. Security
All traffic is encrypted (TLS). Access to data is restricted by database-level rules; originals are kept in private storage. Passwords are stored only as hashes. Keys for third-party services are used server-side only.
17. Changes
We update this policy when features or the law change. For material changes we ask for cookie consent again or inform signed-in members.