Privacy Policy
Last updated: July 2026
Article 1 - Introduction
This Privacy Policy aims to inform users of the Desirely platform (hereinafter the "Platform") about how their personal data is collected, processed, stored, and protected, in accordance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data ("GDPR"), Act No. 78-17 of January 6, 1978 on Information Technology, Data Files and Civil Liberties ("French Data Protection Act"), and Regulation (EU) 2024/1689 of June 13, 2024 laying down harmonised rules on artificial intelligence ("AI Act").
By using the Platform, the User acknowledges having read this Privacy Policy and accepts its terms.
Article 2 - Identity of the Data Controller
Data Controller: Desirely
Legal form: Simplified joint-stock company (SAS)
Share capital: €1,000.00
RCS: 102 631 108 R.C.S. Paris
Registered office: 59 rue de Ponthieu, Bureau 326, 75008 Paris
Represented by: Mr. Romuald Pouget, President
Email: contact@desirely.co
Phone: +33 6 32 92 10 88
Article 2 bis - Data Protection Contact Point
Desirely has not appointed a Data Protection Officer (DPO) within the meaning of Article 37 of the GDPR. Given the nature of the processing operations carried out, the volume of data processed as of the date of drafting this Policy, and the company's staff size, Desirely considers that appointing a DPO is not required under Article 37.1 of the GDPR.
Desirely regularly reassesses this position based on the development of its activities, processing volumes, and CNIL recommendations. If necessary, a DPO will be designated and their appointment will be published in this Policy.
In the meantime, all requests regarding personal data protection should be sent to: contact@desirely.co
All requests are processed under the direct supervision of the President, in his capacity as the legal representative of the data controller.
Article 3 - Collected Personal Data
As part of the use of the Platform and the provision of services, Desirely collects the following categories of personal data:
3.1 - Account and Identification Data
Collected data: agency or creator name, email address, password (encrypted), login credentials for third-party platforms (authentication tokens). Collection time: account creation and connection to third-party platforms.
3.2 - Technical Data
Collected data: IP address, browser type and version, session and connection data. Collection time: connection to the Platform.
3.3 - Usage Data
Collected data: connected models and AI configuration parameters, history of conversations processed by the AI, Platform usage statistics, configured alerts, and notifications. Collection time: use of services.
3.4 - Billing Data
Collected data: billing and commission-related information, transaction history. Collection time: subscription and use of paid services.
Article 4 - Processing of Sensitive Data
4.1 - Nature of Data Processed by the AI
As part of providing the services, Desirely's artificial intelligence system processes conversations exchanged between Models (content creators) and their subscribers (fans) on adult content platforms.
These conversations may contain data relating to sex life or sexual orientation, falling under Article 9 of the GDPR (special categories of personal data).
4.2 - Legal Basis for Processing
Desirely acts as a data processor on behalf of the User (data controller), as specified in Article 4.3.
The processing carried out by Desirely is based on the performance of the contract between Desirely and the User (Article 6.1.b of the GDPR), as processing the conversations is strictly necessary to provide the conversational automation services ordered by the User.
Regarding data falling under Article 9 of the GDPR (special categories), it is the User's responsibility, as the data controller, to ensure they have a valid legal basis under Article 9.2 of the GDPR regarding the data subjects (fans), in accordance with the obligations specified in Article 4.3 below and Appendix 1 of the T&C (DPA).
4.3 - Allocation of Responsibilities
Desirely acts as a processor within the meaning of Article 28 of the GDPR for the processing of fan data and conversations. The User (agency or creator) remains the data controller for the personal data of the fans they collect and process through the Platform.
As such, the User is solely responsible for compliance with the GDPR and fan rights in connection with the processing of their data, obtaining fans' consent for data processing where applicable, and informing fans about the use of an artificial intelligence system in interactions, in accordance with Article 50 of Regulation (EU) 2024/1689 (AI Act).
Article 5 - Purposes and Legal Bases of Processing
Service provision: account management, AI operation, message processing, response personalization. Legal basis: contract performance (Art. 6.1.b GDPR).
Billing and commissions: subscription management, calculation and collection of commissions, billing. Legal basis: contract performance (Art. 6.1.b GDPR).
Minor detection: automated analysis of conversations to detect the potential presence of minors and disable the AI. Legal basis: legitimate interest (Art. 6.1.f GDPR) - protection of minors.
Moderation and security: content filtering, detection of risky behavior, fraud prevention. Legal basis: legitimate interest (Art. 6.1.f GDPR).
Product communication: sending product updates, service notifications. Legal basis: contract performance (Art. 6.1.b GDPR).
Service improvement: anonymized statistical analysis of Platform usage. Legal basis: legitimate interest (Art. 6.1.f GDPR).
Legal obligations: compliance with tax, accounting, and regulatory obligations. Legal basis: legal obligation (Art. 6.1.c GDPR).
Judicial cooperation: disclosure of data to authorities in the event of a judicial subpoena. Legal basis: legal obligation (Art. 6.1.c GDPR).
Important note: Desirely never uses User or fan conversation data to train, improve, or develop its own or third-party artificial intelligence models.
Article 6 - Data Recipients
The personal data collected is accessible to Desirely, as data controller, represented by its President Mr. Romuald Pouget and its Managing Director Mr. Célestin Cordos, as well as to the technical processors listed in Article 7 below, within the limits of what is strictly necessary to perform their duties.
Desirely undertakes not to sell, rent, or transfer the personal data of its Users or fans to third parties for commercial, advertising, or profiling purposes.
In the event of a legal request, Desirely reserves the right to transfer any data to the competent authorities (police, courts, CNIL) within the framework of a judicial investigation, legal request, or legal obligation, in accordance with applicable legislation.
Article 7 - Data Processors
Desirely uses the following processors to provide its services:
OpenAI, L.L.C. - AI model provider (generating responses) - United States - Guarantees: EU-US Data Privacy Framework (DPF).
Stripe Payments Europe Limited - Payment processing and subscription management - Ireland (EU) - GDPR directly applicable. Data may be transferred to Stripe Inc. (United States) as part of intra-group transfers, with the guarantees of the EU-US Data Privacy Framework (DPF).
Google LLC (Gemini) - AI model provider (generating responses) - United States - Guarantees: EU-US Data Privacy Framework (DPF).
Vercel Inc. - Web application hosting - United States - Guarantees: EU-US Data Privacy Framework (DPF).
Clerk Inc. - User authentication service - United States - Guarantees: EU-US Data Privacy Framework (DPF).
Framer B.V. - Landing page hosting - Netherlands (EU) - GDPR directly applicable.
Agilitation SAS (Axeptio) - Cookie consent management - France (EU) - GDPR directly applicable.
Google LLC (Analytics) - Landing page audience measurement - United States - Guarantees: EU-US Data Privacy Framework (DPF).
Microsoft Corporation (Clarity) - Landing page behavioral analysis - United States - Guarantees: EU-US Data Privacy Framework (DPF).
Desirely ensures that each processor provides sufficient guarantees regarding personal data protection and is contractually committed to complying with GDPR obligations.
Article 8 - Data Transfers Outside the European Union
In connection with providing the services, personal data is transferred to the United States, in particular via the processors listed in Article 7.
These transfers are governed by the following safeguards, in accordance with Chapter V of the GDPR: the EU-US Data Privacy Framework (DPF) for certified entities, standard contractual clauses (SCCs) approved by the European Commission where applicable, and additional technical measures (encryption, pseudonymization) in accordance with the recommendations of the European Data Protection Board (EDPB).
The User can obtain more information about the safeguards in place by contacting Desirely at contact@desirely.co.
Article 9 - Data Retention Period
Account data (email, name, credentials): duration of subscription + 3 years after account deletion.
Billing and commission data: 10 years (accounting and tax obligation - Art. L.123-22 of the French Commercial Code).
Technical data (IP address): 1 year from collection.
Conversation data processed by AI: duration of subscription - deleted within 30 days after cancellation or account deletion.
Third-party platform authentication tokens: duration of subscription - deleted immediately upon cancellation.
AI configuration and model settings: duration of subscription - deleted within 30 days after cancellation.
Analytical cookies data: maximum of 13 months (CNIL recommendation).
At the end of these periods, the data is irreversibly deleted or anonymized.
Article 10 - Fate of Data Upon Cancellation
10.1 - Transition Period
In the event of subscription cancellation or account deletion, the User has a period of thirty (30) calendar days from the effective date of cancellation to request the export of their data (AI configuration, model settings, usage statistics).
10.2 - Data Deletion
Upon expiration of this 30-day period, conversation data, AI configurations, model settings, and authentication tokens are permanently deleted. Billing data is retained in accordance with accounting obligations (10 years). Account data (email, name) is kept for 3 years to manage potential disputes.
10.3 - Export Request
The User can send their export request by email to contact@desirely.co. Desirely undertakes to provide the data in a structured, commonly used, and machine-readable format within fifteen (15) business days.
Article 11 - Cookies and Trackers
11.1 - Technical Cookies
The Site uses technical session and navigation cookies strictly necessary for the Platform to function correctly. These cookies do not require the prior consent of the User.
11.2 - Analytical Cookies (Subject to Consent)
Subject to User consent, the site uses the following cookies:
Google Analytics 4 (Google LLC): audience measurement. Anonymized data transmitted to Google servers. Learn more: https://policies.google.com/privacy
Microsoft Clarity (Microsoft Corporation): behavioral analysis via session recordings and heat maps. Learn more: https://clarity.microsoft.com/terms
11.3 - Consent Management
On their first visit, the User is invited to express their choices through a consent banner managed by Axeptio (Agilitation SAS). The User can change their preferences at any time via the Axeptio widget accessible on the Site.
No non-essential cookies are placed before consent is obtained, in accordance with CNIL recommendations and the GDPR.
11.4 - Cookie Retention Period
Analytical cookies are kept for a maximum of 13 months. The User's consent is kept for 6 months.
Article 12 - Data Processed by Artificial Intelligence
12.1 - Nature of the Processing
Desirely's artificial intelligence system processes conversation data from Models and their fans for the exclusive purpose of generating automated responses in accordance with the settings defined by the User.
12.2 - Safeguards
Conversation data is processed solely for the purpose of providing the services. Desirely does not use conversation data to train, fine-tune, or improve its AI models or those of third parties. Conversation data is not shared with AI providers (OpenAI, Google) beyond what is strictly necessary to process each request in real time. Desirely implements automatic detection mechanisms to identify risky situations, particularly the potential presence of minors in conversations. The User retains the ability to monitor, correct, or disable the AI's operation at any time.
12.3 - Transparency Obligation (AI Act)
Pursuant to Article 50 of Regulation (EU) 2024/1689 (AI Act), people interacting with an AI system must be informed. The User is solely responsible for informing fans about the use of an AI system in exchanges, in accordance with applicable regulations.
Desirely provides the User with the necessary information to comply with this obligation but cannot be held responsible for the User's failure to comply.
Article 13 - Desirely Chrome Extension
13.1 - Purpose of the Extension
The sole purpose of the Desirely Chrome extension is to facilitate the secure link between the User's creator profile on third-party platforms (currently OnlyFans, MYM, Uncove, and Reveal) and their Desirely account.
13.2 - Data Collected by the Extension
The extension only collects and processes the following data: the authentication tokens required to connect with the Clerk service (clerk.desirely.co), stored locally in the browser via chrome.storage and cookies, as well as the creator model IDs present on the pages of third-party platforms visited by the User, transmitted to the Desirely server when the User explicitly requests it.
The extension does not collect any browsing data, history, or personal data other than the elements mentioned above.
13.3 - Token Security
Authentication tokens retrieved by the extension are transmitted securely (HTTPS/TLS protocol) and are only used as part of providing Desirely services. Desirely undertakes not to exploit these tokens to access data or features beyond what is strictly necessary to provide its automated messaging services.
13.4 - Accessible Domains
The extension communicates exclusively with clerk.desirely.co (authentication) and Desirely backend servers (transmission of identifiers). The content script runs only on the pages of compatible third-party platforms.
13.5 - Data Sharing
No data collected by the extension is sold, rented, or shared with third parties.
13.6 - Data Deletion
Uninstalling the extension results in the deletion of all locally stored data. Data transmitted to the Desirely server is subject to the retention periods set out in Article 9.
Article 14 - User Rights
In accordance with the GDPR and the French Data Protection Act, the User has the following rights:
Right of access: obtain confirmation of the processing of their data and receive a copy of it.
Right to rectification: request the correction of inaccurate or incomplete data.
Right to erasure: request the deletion of their data (Art. 17 GDPR).
Right to restriction: request the restriction of processing (Art. 18 GDPR).
Right to portability: receive their data in a structured, commonly used, and machine-readable format.
Right to object: object to the processing of their data for legitimate reasons.
Right to withdraw consent: when processing is based on consent (in particular for analytical cookies), the User can withdraw consent at any time, without affecting the lawfulness of the processing carried out prior to withdrawal.
Post-mortem instructions: define guidelines regarding the fate of their data after death.
To exercise these rights: contact@desirely.co
Desirely undertakes to respond within one (1) month. This period may be extended by two (2) months in cases of complexity.
Complaint to the CNIL: Website: https://www.cnil.fr - Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Article 15 - Data Security
Desirely implements appropriate technical and organizational measures to protect personal data, in accordance with Article 32 of the GDPR:
Encryption of data in transit (HTTPS/TLS protocol). Encryption of authentication tokens at rest. Restricted data access only to authorized personnel. Regular backup procedures. Regular monitoring and updates of security systems. Logging of access to sensitive data.
In the event of a data breach likely to result in a high risk to the rights and freedoms of data subjects, Desirely will notify the CNIL within 72 hours and inform the affected Users as soon as possible, in accordance with Articles 33 and 34 of the GDPR.
Article 16 - Modifications
Desirely reserves the right to modify this Privacy Policy at any time. Any material changes will be communicated to Users by email or notification on the Platform.
The date of the last update is indicated at the top of the document. Continued use of the Platform after publication of changes constitutes acknowledgment of the modified Privacy Policy.
Article 17 - Contact
Email: contact@desirely.co
Phone: +33 6 32 92 10 88
Form: https://www.desirely.co/contact