Legal
Privacy Policy
Last updated: 11 September 2026
This notice explains what personal data NSFWBots processes, on what legal basis, and how you can exercise your rights. It is written to comply with Regulation (EU) 2016/679 (GDPR) and the data protection law of Cyprus.
1. Who is responsible
The data controller is Snavitho LTD, Kypranos 13, Nicosia 1101, Cyprus. Contact: snavitho@gmail.com or the contact form.
Given the scale and nature of the processing described below, no Data Protection Officer has been appointed. Requests are handled directly by the publisher.
2. The short version
There are no accounts for visitors, no advertising networks, no third-party analytics scripts, no social media pixels and no cross-site tracking. Your IP address is never written to the database in a readable form. What is collected is a minimal, privacy-preserving measure of which pages and listings people look at.
3. What is collected
3.1 Audience measurement
When you view a page, or click through to a listed third-party service, the following is recorded:
| Data | Detail |
|---|---|
| Page path | Which page of this site was viewed |
| Listing / category | Which entry or category the view or click related to |
| Visitor hash | An irreversible SHA-256 hash of a secret salt, your IP address and your browser user-agent, truncated. Used only to estimate unique visitors |
| Country | Two-letter country code, derived from the network edge (clicks only) |
| Device type | "mobile" or "desktop" only (clicks only) |
| Referrer | The page that sent you to the outbound link, if any (clicks only) |
Your raw IP address is not stored. It is used in memory to compute the hash and then discarded. The hash is pseudonymous rather than fully anonymous: while the salt exists, an identical IP and browser produce an identical hash. It cannot be reversed to recover your IP, and it is not linked to any name, email or account.
3.2 Contact form
If you use the contact form, the name, email address and message you submit are transmitted to the publisher's inbox and retained there. The form is processed by Netlify Forms; submissions are also visible in the site's Netlify dashboard. Provide only what you are comfortable sending, and do not include sensitive personal information.
3.3 Server logs
The host generates standard technical logs (IP address, timestamp, requested URL, user-agent, response status) for security, abuse prevention and troubleshooting. These are managed by the host under its own retention rules and are not used for analytics or profiling.
3.4 What is never collected
- No names, emails or phone numbers except those you type into the contact form
- No payment data; this site sells nothing and takes no payments
- No advertising identifiers or cross-site profiles
- No record linking an individual to specific sexual interests, preferences or listings. The visitor hash is not used to build a profile, and no data is sold or shared for marketing
4. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Measuring audience and which listings are useful | Legitimate interest (Art. 6(1)(f)): running and improving the directory, using the least identifying method available |
| Attributing referrals to partner services | Legitimate interest (Art. 6(1)(f)): verifying commission owed |
| Answering your message | Legitimate interest (Art. 6(1)(f)): responding to a request you initiated |
| Confirming you are of legal age | Legal obligation (Art. 6(1)(c)): protection of minors |
| Security, abuse prevention, log keeping | Legitimate interest and legal obligation |
5. How long it is kept
- Audience and click data: 25 months from collection, the period European supervisory authorities treat as proportionate for audience measurement, then deleted or aggregated into non-identifying counts.
- Contact messages: up to 12 months after the exchange ends, or longer where needed to establish or defend a legal claim.
- Server logs: per the host's retention policy, typically under 12 months.
- Age confirmation: stored in your own browser only, never transmitted. See the Cookie Policy.
6. Who else processes it
No personal data is sold, rented or shared for anyone else's marketing. It is processed on the publisher's behalf by:
| Provider | Role |
|---|---|
| Netlify, Inc. | Hosting, CDN, server logs, contact form processing |
| Supabase | Database storing the catalogue and the audience data above |
Each acts as a processor under a data processing agreement. Some are established outside the European Economic Area; those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
Data may also be disclosed where legally required, in response to a valid order from a competent authority.
6.1 Outbound links
Clicking through to a listed service takes you to a third party operating under its own privacy policy, which this notice does not cover. The referral link may pass an affiliate identifier so the partner can attribute the visit. Read the destination's own policy before creating an account or entering personal data there.
7. Your rights
Under the GDPR you may request access to your data, its correction or erasure, a restriction of processing, portability, and you may object to processing based on legitimate interest. You may also give instructions on the fate of your data after death.
An important practical limit: the audience data is pseudonymous and holds nothing that identifies you. Without additional information, the publisher genuinely cannot single out your records, and under Article 11 GDPR is not required to acquire more data purely to do so. Requests about the contact form can be fulfilled normally.
To exercise a right, use the contact form or write to snavitho@gmail.com. A response follows within one month. If you are not satisfied you may lodge a complaint with the Office of the Commissioner for Personal Data Protection (Cyprus) (dataprotection.gov.cy), which is the lead authority for the publisher, or with the supervisory authority of the EU member state where you live or work.
8. Minors
This site is strictly for adults. It is not directed at anyone under 18 and no data is knowingly collected from minors. If you believe a minor has submitted personal data through the contact form, tell us and it will be deleted immediately.
9. Security
The site is served over HTTPS. Administrative access is restricted, authenticated and limited to the publisher. Database access is governed by row-level security policies. No system is perfectly secure, but the data held is deliberately minimal precisely to limit the consequences of any breach.
10. Changes
This notice may be updated as the site evolves. The revision date at the top always reflects the current version; material changes will be signposted on the site.
11. Contact
For anything relating to privacy or your personal data, use the contact form or write to snavitho@gmail.com.