Privacy Policy.

Account Registration Data. When you register for an account, we collect your first and last name, email address, password, date of birth (to verify you are at least 18 years old), and phone number.

Profile Information. You may choose to provide a profile picture, biography, display name, website URL, and links to your other social media profiles. For Creators, this information is displayed publicly on your Fanvault storefront.

Payment and Financial Information. We collect financial information necessary to process transactions and payouts.

We do not store your full payment card number on our servers. Payment card data is handled by our PCI-DSS-compliant third-party payment processor (e.g., Stripe).

Communications and Content. We collect the content of your communications on the Platform. This includes the text, images, and audio/video files sent in paid Direct Messages (DMs), comments, reviews, wish list requests, and correspondence with our customer support team, including messages submitted as part of a complaint under our Complaints Policy.

Identity Verification Data. For Creators, we utilize third-party identity verification services to ensure platform safety and compliance. This process may require you to provide a government-issued photo ID (including name, date of birth, and ID number) and a live selfie. Our verification partners may process biometric data (such as facial geometry) solely for the purpose of verifying your identity and confirming you are at least 18 years of age.

Device and Usage Data. When you access the Platform, we automatically collect information about your device and your interactions with our Services. This includes your IP address, browser type and version, operating system, device identifiers (including unique device IDs), pages visited, time spent on pages, navigation paths, clickstream data, and referring URLs.

Cookies and Tracking Technologies. We use cookies, web beacons, pixels, tags, and similar technologies to analyze trends, administer the website, track users' movements around the site, remember your preferences, and gather demographic information. For more information on our use of cookies, please see our Cookie Policy.

Fanvault AI Interactions. Fanvault offers Fanvault AI, accessible via our web application and via Telegram. When you interact with Fanvault AI, whether to manage your profile, set up your storefront, draft product descriptions, or ask questions, we collect the text of your queries, commands, and the resulting actions taken by the AI on your behalf. We may also collect session metadata such as the time, duration, and frequency of your AI interactions. This interaction data is used to execute your requests and may be analyzed in an aggregated, anonymized format to improve the AI's performance and accuracy. Please refer to Section 7 (Data Retention) for more details on how long we retain AI interaction logs.

Paid DM Content and AI Assistance. Creators may enable optional AI tools for their paid direct messages (see Section 6.2 of our Terms of Service). Where a Creator has enabled them, the content of messages in that conversation, including messages you send as a Fan, together with the Creator's configured persona and instructions, is transmitted to our AI and content-moderation service providers so a reply can be drafted and screened before it is sent. We store a record of each AI-assisted reply, including a marker identifying it as AI-generated, the settings in force at the time, and the outcome of the moderation check. Messages in conversations where no AI tools are enabled are not sent to AI providers for this purpose, though all messages remain subject to the content screening described above.

Writing-Style Training Data. A Creator may choose to have our AI learn their writing style. When they do, we collect the text of posts from the accounts they select (their own connected Instagram or TikTok, a social account they have listed on their profile, or web pages they provide) and store a capped sample of that text together with a derived description of their writing style (tone, register, and words and phrases they characteristically use, some quoted verbatim from those posts). This is collected only when a Creator starts training, only from accounts and pages they identify as their own, and it describes how they write rather than facts about them. Creators can see exactly what was read, and from where, on their Paid DMs page. Disconnecting a social account, or requesting deletion of that platform's data, deletes the text we collected from it and the style description derived from it.

Session Replay and Analytics. We may use session replay software and analytics tools that record your interactions with the Platform, including clicks, mouse movements, scrolling, and form fills, to help us understand how users interact with our Services and to improve the user experience.

Data Collection via Scraping (Creators Only). To streamline the onboarding process, verify Creator identity, and assist in setting up storefronts and wishlists, Fanvault may collect publicly available data from Creators' public social media profiles (such as Instagram, TikTok, Twitter/X, YouTube, etc.) using automated means (e.g., web scraping). This may include public profile information, follower counts, engagement metrics, and public content. By registering as a Creator and linking or providing your social media handles, you authorize us to collect this public data for these purposes.

Storefront Previews (Before You Have an Account). If you enter an Instagram or TikTok handle on our website to build a storefront preview before creating an account, we collect the public profile information for that handle (name, photo, bio, follower count and recent public posts) through our processor Apify to build the preview, and we store it together with the email address you provide so we can send you the preview link and one reminder. Entering a handle authorizes us to collect that public data for this purpose. If you do not claim the preview, we delete this data within ninety (90) days, and you can unsubscribe from the reminder at any time using the link in the email.

Storefront Previews We Build Before Contacting You. We sometimes build a storefront preview for a creator with a public Instagram or TikTok profile before that creator has heard of Fanvault, using the same public profile information described above, and email that creator once, with follow-ups, to offer it. Our legitimate interest is introducing our service to creators it is built for. We may select the creators we contact automatically, from public profile data such as follower counts and engagement supplied by our processor Influencers Club, and we read the public profile page to find a published contact address; the email address comes from the creator's own public profile or from Influencers Club. Every such email carries an unsubscribe link, and an address that opts out, bounces or replies is not contacted again. We may also contact a creator we emailed by Instagram direct message from Fanvault's own account, at most a few short messages, to offer the same preview; replying that you are not interested ends it. If the preview is not claimed, we delete the profile data and the address within ninety (90) days.

Meta/Instagram Connect. Fanvault allows Creators to connect their Instagram accounts to the Platform via the Meta Developer API. This is an optional feature. If you choose to link your Instagram account, you will be asked to authorize Fanvault to access specific data from your Instagram account. This includes the ability to read comments on your Instagram media and respond to them on your behalf, and to read and send Instagram Direct Messages on your behalf, in addition to the profile and media data described below. Comment replies, comment moderation actions, and direct messages are only performed when you initiate the action inside Fanvault.

We collect this data solely to verify your Creator status, display your verified social presence on your Fanvault storefront, provide the core functionality of linking your physical collectibles to your Instagram content, and respond to comments and messages on your behalf when you ask us to. We do not use this data for unauthorized advertising purposes, and we do not sell this data to third parties.

To request deletion of your Instagram data, visit our Data Deletion page or disconnect your account at any time from Settings → Connected Accounts.

TikTok Connect. Fanvault lets Creators optionally connect their TikTok accounts using TikTok's Login Kit. If you choose to connect TikTok, you will be asked on TikTok's consent screen to grant Fanvault specific scopes (at minimum user.info.basic, user.info.profile, user.info.stats, video.list, and video.upload).

We use TikTok data only to: (a) verify your Creator identity, (b) display your verified TikTok handle on your Fanvault profile, (c) give Fanvault AI brand context so it can better personalize your storefront and recommendations, and (d) send draft posts to TikTok when you explicitly request it. We do not sell TikTok data, we do not use it for unrelated advertising, and we do not share it with third parties except the trusted service providers listed in Section 4.

You can disconnect TikTok at any time from Settings → Connected Accounts (or from the AI page / Edit Profile modal). Disconnecting clears the stored TikTok tokens and stops all authenticated TikTok API calls on your behalf. You can also revoke Fanvault's access directly from inside the TikTok app.

Other Third-Party Platforms. If you choose to connect other social media accounts or sign in using a third-party service (e.g., Google), we may collect your name, email address, profile picture, and other information made available by that service in accordance with its privacy policy.

Data from Other Users. Other users may provide information about you when they interact with you on the Platform, such as when a Creator mentions you in a post or when a Fan sends you a gift.

Providing and Maintaining the Services. To operate Fanvault, manage your account, process transactions for memorabilia, paid DMs, tipping, and wish list items, facilitate shipping and fulfillment, and provide customer support.

Powering AI Features. To operate Fanvault AI, allowing it to take actions on your behalf (such as configuring your storefront, drafting product descriptions, or managing your profile) based on your explicit commands. We may also use interaction data in an anonymized, aggregated form to train and improve our AI models.

Identity Verification and Safety. To verify the identity and age of Creators, prevent fraudulent activity, detect and prevent abuse, enforce our Terms of Service, investigate and resolve complaints under our Complaints Policy, and maintain a safe and brand-appropriate environment for all users.

Personalization. To customize your experience, display relevant content and recommendations, and tailor our communications to your interests based on your past interactions with the Platform.

Communication and Marketing. To send you administrative messages, security alerts, transaction confirmations, and customer support responses. With your consent (where required by law), we may also send promotional emails and push notifications about new features, Creator updates, and special offers. You may opt out of marketing communications at any time.

Analytics and Product Improvement. To analyze how users interact with our Platform, measure the effectiveness of our features and marketing campaigns, conduct research and development, and improve the overall user experience.

Legal Compliance. To comply with applicable legal obligations, tax reporting requirements, anti-money laundering laws, and to respond to lawful requests from law enforcement or regulatory authorities.

With Other Users. Certain information is visible to other users as part of the normal operation of the Platform. For Creators, this includes your public profile, storefront listings, and public content. For Fans, your username and profile picture may be visible when you leave a review or interact publicly. When a Fan purchases a paid DM, provides a tip, or fulfills a wish list item, relevant transaction details (excluding full payment card numbers) are shared with the receiving Creator.

Service Providers. We share information with third-party vendors who perform services on our behalf. We name them, rather than describing them by category, so that you can see exactly who processes your data and look up their own privacy practices. Each is bound by contract to use your data only for the purposes we specify. This list is current as of the effective date above; if we add a provider that receives Personal Data, we will update this table.

These service providers are contractually obligated to protect your data and use it only for the purposes we specify.

Meta/Instagram. When you use the Instagram Connect feature, certain data is exchanged with Meta in accordance with their Platform Terms to facilitate and maintain the connection. The data we send to Meta is limited to what is necessary to authenticate and maintain the API connection.

TikTok. When you use TikTok Connect or the "Post to TikTok" feature, Fanvault exchanges the information described in Section 2.3 with TikTok's Login Kit, Display API, and Content Posting API, in accordance with the TikTok Developer Terms of Service. The data we send to TikTok is limited to what is necessary to authenticate your account, read the scopes you approved, and deliver the draft posts you explicitly initiate.

Business Transfers. If Fanvault Shop Inc. is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of its assets, your Personal Data may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform prior to your Personal Data being transferred and becoming subject to a different privacy policy.

Legal Requirements and Safety. We may disclose your information if required to do so by law, subpoena, or court order, or if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend the rights or property of Fanvault; (c) prevent or investigate possible wrongdoing in connection with the Services; (d) protect the personal safety of users of the Services or the public; or (e) protect against legal liability.

Right to Access and Portability. You can request a copy of the Personal Data we hold about you in a structured, commonly used, and machine-readable format.

Right to Correction. You can update or correct inaccuracies in your profile information directly through your account settings, or by contacting us.

Right to Deletion. You can request that we delete your account and associated Personal Data. Please note that we may retain certain information as required by law (e.g., transaction records for tax purposes) or for legitimate business purposes (e.g., fraud prevention and dispute resolution).

Right to Opt-Out of Marketing. You can unsubscribe from promotional emails by clicking the "unsubscribe" link at the bottom of any marketing email. You can also manage your notification preferences in your account settings.

Right to Restrict Processing. In certain circumstances, you may have the right to request that we restrict the processing of your Personal Data.

Right to Object. You can object to our processing of your Personal Data where we rely on legitimate interests as our lawful basis, including processing for direct marketing. If you object to direct marketing, we will stop.

Right to Withdraw Consent. Where we rely on your consent, you can withdraw it at any time, and withdrawing it is as easy as giving it. Withdrawal does not affect processing carried out before you withdrew.

Right to Complain. You can lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first, but you are not required to contact us before complaining.

How to exercise these rights. Email privacy@fanvaultshop.com. You can delete your account yourself at any time from Settings, which removes your account, your listings, your profile, and the files associated with them. We do not charge for a request, and we do not discriminate against you for making one: exercising a privacy right will never affect your pricing, your payouts, or the features available to you.

Authorized agents. You may use an authorized agent to make a request on your behalf. We will ask the agent for written proof of their authority, and we may ask you to confirm directly that you granted it.

What we collect. Government-issued identification numbers and images of your ID document; facial geometry derived from a verification selfie; your Social Security Number or Employer Identification Number, where required for tax reporting; and financial account information including bank account and routing numbers. We collect these from Creators only, and only where they are necessary to verify identity and age, to pay you, and to meet our tax and anti-fraud obligations.

Biometric data specifically. Facial geometry is processed by our identity verification partner for one purpose: confirming that the person applying is the person on the ID document and is at least 18. We do not use it to identify you elsewhere on the Platform, we do not use it for advertising or model training, and we do not sell or otherwise disclose it. Our verification partner retains it only as long as needed to complete verification and to satisfy record-keeping obligations, and it is destroyed when those obligations end or within three years of your last interaction with us, whichever comes first.

We do not use it to infer anything about you. California gives you the right to limit a business's use of sensitive personal information to what is necessary to provide the service. We already limit ourselves to that: we use these categories only for verification, payment, tax and fraud prevention, and never to infer characteristics about you. Because we do not use sensitive personal information for any other purpose, there is nothing further to opt out of.

Consent. Where the law requires your written consent before we collect a biometric identifier, we ask for it at the point of verification and you can decline. Declining means we cannot verify you as a Creator, but it does not affect a Fan account.

Content screening. Messages, listings and AI-generated replies are screened automatically for prohibited content. A screening hit can block a message from sending or flag content for review. It does not by itself terminate an account: a human reviews flagged content before any account-level action is taken.

Fraud and payment-risk checks. We apply automated velocity and risk checks to payments, which can decline a transaction or place a payout on hold pending review.

Your rights. If a decision was made solely by automated means and it significantly affects you, you can ask for human review, express your point of view, and contest the outcome. Write to privacy@fanvaultshop.com and a person will look at it.

Performance of a contract. Operating your account, processing orders and payments, delivering purchases and messages, and paying Creators.

Legal obligation. Tax and accounting records, identity and age verification, and responding to lawful requests.

Legitimate interests. Securing the Platform, preventing fraud and abuse, screening content, and improving the Services. We balance these against your rights, and you can object at any time.

Consent. Analytics and session-replay cookies, optional social account connections, marketing email, and biometric verification. You can withdraw consent at any time without affecting anything we did beforehand.