Privacy
Last updated 14 November 2026 · version 2026-11-14
Draft. A lawyer hasn't reviewed this text yet.
What personal data Devota handles, why, on what legal basis, who else receives it, how long we keep it, and what your rights are. It covers fans, creators, and anyone who visits a page or reports one.
The short version
- Payments are public. Every tribute is on the Solana blockchain forever, where anyone can see which wallet paid which creator through Devota. Use a wallet just for Devota.
- Fans need no account. We know your wallet address, not who you are, unless you tell the creator in your name or message.
- We treat tributes as sensitive. Because of the kind of creators on Devota, a tribute can say something about your sex life, and we handle it with that in mind.
- We never see a creator's ID. Didit checks it. We only learn whether the check passed and whether the creator is 18 or older.
- We don't sell or share personal data, show ads, use analytics cookies or trackers, or train AI on what you write.
1. Who is responsible
The controller is the operator of Devota, established in Belgium. Questions and requests about your data: our contact address (published here before launch). A person answers. We haven't appointed a data protection officer, because the law doesn't require one for a service of our size.
Devota is not open to the public yet. The operator's legal name, address, enterprise number and VAT number will be published here before launch.
We're also responsible for the transactions we prepare for the blockchain. Your wallet app and Didit are responsible for what they do under their own policies, except where Didit works for us (section 5).
2. What the blockchain shows
A tribute is a Solana transaction, and Solana is public. Anyone, forever, can see:
- the wallet the tribute came from, the creator's wallet, the amount and the time;
- that the same transaction paid Devota's fee wallet and was signed by Devota as fee payer. So anyone can list every wallet that has sent a tribute through Devota, and which creator wallet each one paid;
- everything else those wallets have ever done on Solana, which can point to their owners, for example through an exchange.
We put nothing else on the blockchain: no names, no messages, no email addresses. Each transaction carries a random code that lets us find it again. It means nothing to anyone else.
Nobody can delete what's on the blockchain: not you, not us. So use a wallet just for Devota, as a fan and as a creator, that isn't linked to your name or to the rest of your money. The payment screen says this too, before you sign.
We use a public blockchain because it's the only way for a fan to pay a creator directly, without anyone holding the money in between. We keep everything else off it.
3. What we handle, why, and on what basis
Fans
| Data | Why | Legal basis |
|---|---|---|
| Your wallet address, the creator, the amount, our fee, the transaction and when it happened | To prepare your payment, confirm it, show it to the creator, and keep the record of our fee income | Our contract with you (GDPR art. 6(1)(b)) and your explicit consent (art. 9(2)(a)), see section 4. The fee record we must keep: our tax and accounting obligations (art. 6(1)(c)) and legal claims (art. 9(2)(f)) |
| Your name and message, if you add them | To pass them to the creator, on their dashboard and in the email we send them about your tribute | Your explicit consent, which you give with its own tick box before you pay (arts. 6(1)(a) and 9(2)(a)) |
| What you agreed to: the versions of the Terms and of this notice, and the time | Showing what you agreed to, if it's ever disputed | Our legal obligation to prove it (art. 6(1)(c)) |
| The sanctions check of your wallet | Making sure we don't help a payment from a sanctioned wallet | Our obligations under sanctions law (art. 6(1)(c)), and our legitimate interest in not breaking it (art. 6(1)(f)) |
Creators
| Data | Why | Legal basis |
|---|---|---|
| Your sign-in: email address and how you sign in, kept by Clerk | Your account, and the emails about your tributes, your page and your receiving wallet | Contract (art. 6(1)(b)). Because your account links you to an adult-friendly page, also your explicit consent (art. 9(2)(a)) |
| Your page: handle, display name, picture and bio | Showing your page to everyone, and our review of it | Contract; you make the page public yourself (art. 9(2)(e)) |
| Your identity check: the session at Didit, its status, whether you're 18 or older, and whether we can't accept it because of where it's from | Making sure a real adult is behind every page (section 5) | Your explicit consent for the face scan (art. 9(2)(a)); our legitimate interest in an adults-only service for the outcome (art. 6(1)(f)) |
| Your receiving wallet, the wallets it replaced, the messages you signed to prove you own them, their sanctions checks, and any change of wallet with its emails and face check | Paying you, and protecting your page from someone who takes over your account | Contract; sanctions law (art. 6(1)(c)); legitimate interest in security (art. 6(1)(f)) |
| Tributes you received, with the fan's name and message | Your dashboard, your emails and your download | Contract |
| The version of the Terms you accepted, and when | Showing what you agreed to | Legal obligation (art. 6(1)(c)); legitimate interest |
| Our reviews of your page, reports about it, our decisions and what we told you | Keeping Devota within the law and the Terms, and being able to show why we decided what we did | Legal obligations under the Digital Services Act (art. 6(1)(c)); legitimate interest (art. 6(1)(f)); legal claims (art. 9(2)(f)) |
Everyone
| Data | Why | Legal basis |
|---|---|---|
| Your IP address | Limiting how often requests can be made, against abuse; and reading the country it's in to block the regions we don't serve. We don't keep the country. | Legitimate interest in security (art. 6(1)(f)); sanctions law (art. 6(1)(c)) |
| A report: the reason and the details you give | Handling the report. We don't ask who you are. If you email us, we also have your address and what you wrote | Digital Services Act (art. 6(1)(c)); legitimate interest |
| Technical logs at our hosts | Running the service and fixing errors | Legitimate interest |
You don't have to give us any of this. Without a wallet address we can't prepare a payment, and without an identity check a page can't go live.
4. What a tribute can say about you
Many creators on Devota are adult creators. So a record that a wallet sent one of them a tribute, and whatever a fan writes in a message, can say something about a person's sex life, even when that isn't true of a particular tribute. The GDPR treats that as especially sensitive, and so do we:
- Fans: we handle your tribute, and your name and message if you add them, only with your explicit consent, which you give with its own tick box before you pay. The box starts unticked.
- Creators: you make your page public yourself. For the private link between your account and your page, we rely on your explicit consent, which you give with a tick box when you make your page.
- Withdrawing consent: email us. We then delete your name and message, and stop using the tribute for anything but the fee record the law makes us keep and the defence of legal claims. We can't take back what the creator already saw or downloaded, or what's on the blockchain.
- Only the creator and Devota's admins see names and messages, and admins only when they handle a report or a request. We never use any of this to profile you, to advertise, or for anything other than what this notice says.
5. Identity checks and face scans
Before a page goes live, the creator takes a photo of an ID document and a short selfie at Didit, our verification provider. Didit checks that the document is real, that the face matches it and that the creator is 18 or older. A creator who lost their receiving wallet does a face check, which compares a new selfie with the face from their identity check.
- Before every scan you give us your explicit consent with a tick box, and Didit asks for it again before it scans your face. Didit handles the document, the selfie and the face scan for us, under a contract with us.
- Didit's answer to us includes what it read from your document. We use only your date of birth, the country that issued the document and, for a US document, its state, and the country and state the check was made from. We keep only the outcome: the session's ID, its status, whether you're 18 or older, and whether the document or the check is from Russia, Belarus or New York State, where we can't accept creators (Terms, section 6). Never the document, the photos, your name or your date of birth.
- Face scans are used only to check identity and age, never sold or shared for anything else, and destroyed by Didit once the check is done and any dispute about it is settled, and at the latest three years after your last check. This is our written retention policy for biometric data, including under the Illinois Biometric Information Privacy Act and similar US state laws.
6. Decisions made by software
- The identity check is largely automated at Didit, and a page can only go live once it has passed. It also refuses, automatically, a document issued by Russia, Belarus or New York State, or a check made from there. If Didit later withdraws a check it had approved, the page goes offline automatically, and we email its creator what happened and what they can do.
- The sanctions check is automated. We look a wallet up in our own copy of the sanctions list that the US Treasury publishes, and ask Didit whether the wallet is on a sanctions list. When it is, we refuse the tribute or the receiving wallet. The law requires it.
- Rate limits refuse requests that come too often.
If one of these decisions affects you, email us. A person looks at it, you can give your side, and you can contest the result.
7. Who else receives your data
These services handle personal data for us, under data processing agreements:
| Service | What for | Where |
|---|---|---|
| Clerk, Inc. | Creators' sign-in: email address, sign-in method and session | United States |
| Convex, Inc. | Our database and server: everything in the tables above | Data stored in the EU (Ireland); a US company |
| Vercel, Inc. | Hosting of the website. Reads the country of your IP address to block the regions we don't serve | United States, served from data centres near you |
| Didit Identity Spain, S.L. | Creators' identity checks and face checks. Also the sanctions check of wallets: for that it receives the wallet address, nothing else, and asks Merkle Science, a company that analyses blockchains | Spain. For Merkle Science: to be added |
| Resend, Inc. | Sending email to creators and to us | United States |
| A Solana node provider (chosen before launch) | Reading the blockchain and sending transactions: sees wallet addresses and transactions | To be added |
When a service is outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the service is certified under it, and otherwise on the European Commission's standard contractual clauses. Ask us for a copy.
- Creators see the name, message, amount and time of the tributes they receive, and, like anyone, the paying wallet on the blockchain.
- Everyone sees a live creator's page, and what's on the blockchain (section 2).
- Your wallet app (Phantom, Solflare and others) is a separate company with its own privacy policy. When you open a page in it, it sees the page, your IP address and the transaction you sign.
- Our accountant sees the fee records.
- Authorities receive data when a court or competent authority orders it, when the law requires us to report, including to tax authorities, and when someone's life or safety is at risk.
8. How long we keep it
| Data | Kept |
|---|---|
| A tribute that was started but never paid | Deleted a week after it expired |
| A fan's name and message | 90 days after the tribute, or until consent is withdrawn |
| A paid tribute: wallet, creator, amount, fee, transaction, time, and the Terms version | 10 years after the end of the year it was paid in, the record of our fee income that Belgian tax law requires |
| A creator's page and sign-in | Until the page is closed. Then deleted, apart from what's below |
| Reviews, decisions, wallet changes, the Terms a creator accepted, and the result of the identity check | 5 years after the page is closed, to show what happened if it's ever disputed. Never any ID document data |
| Reports | 12 months after we closed a report without action. 5 years after the page is closed when we acted on it |
| The email address of a page we removed, and scrambled copies of it and of the sign-in | 5 years, so the same person can't simply sign up again |
| Scrambled copies of the email address and the sign-in of a page its creator closed while it was suspended | 5 years, so we know about the earlier page when the same person asks for a new one to go live. They don't stop a new page |
| ID document, selfie and face scan (at Didit) | The shortest period Didit allows us, at most 90 days, unless a dispute about the check needs them longer (section 5) |
| Sanctions checks of a wallet | 30 days. A wallet found on a sanctions list: 5 years |
| IP addresses used for rate limits | At most 24 hours |
| Our copies of emails we sent | 7 days. Resend keeps its own copy for a limited time under its terms |
| What's on the blockchain | Forever. Nobody can delete it |
9. Your rights
You can ask us to show you the data we hold about you, to correct it, delete it or limit what we do with it, to give it to you in a format you can take elsewhere, and to stop using it where we rely on our legitimate interest. Where we rely on your consent, you can withdraw it at any time; that doesn't affect what we did before.
- Email our contact address (published here before launch). We answer within a month.
- Fans have no account, so we ask you to show that a wallet is yours before we hand over or delete data linked to it. This stops someone else from getting your data.
- When we delete, we delete what we hold off the blockchain: names, messages and what's linked to your IP address. We keep only what the law makes us keep, for the periods above, and tell you what we kept and why. We can't delete what's on the blockchain.
- You can complain to the Belgian Data Protection Authority (Drukpersstraat 35, 1000 Brussels, Belgium), or to the authority of the country where you live.
10. Cookies
Devota uses only the cookies that Clerk needs for creators to sign in. Clerk's sign-in runs on every page, so its cookies can be set on any of them. They're strictly necessary, so we don't ask for consent. No analytics, advertising or tracking cookies. Besides those cookies, your browser only remembers how far you scrolled on the pages you visited, so going back lands in the same place; it forgets that when you close the tab. Your wallet app keeps its own data. We don't track you across other sites, so a "Do Not Track" setting changes nothing here.
11. Security
Data is encrypted on its way to us and at our providers. Only Devota's admins can see creators' data and reports. Confirmation links are stored as a hash. The key that signs transactions as fee payer lives only on our server and holds no USDC, and our fee wallet's key is not on any server. If a data breach puts you at risk, we tell you and the Data Protection Authority within 72 hours.
12. For creators: fans' data
When you download your tributes, the file holds fans' names, messages and wallets. From then on you're responsible for that copy under the law where you live. The Terms say what you may and may not do with it.
13. Outside the EU
- United Kingdom: the UK GDPR gives you the same rights. Complain to us first; if we don't resolve it, you can go to the Information Commissioner's Office. Our UK representative will be named here before launch.
- United States: we don't sell or share personal information, or use it for targeted advertising. The categories we collect, why, and who receives them are in sections 3 and 7. You can ask to see, correct or delete your data as described in section 9.
14. Under 18s
Devota is for adults only. We don't knowingly handle data of anyone under 18. If you think a creator or a fan is under 18, report the page or email us.
15. Changes
This notice has a version and a date at the top. When we change it in substance, we email creators, and the new version applies to fans from their next tribute.