Privacy Policy

Depending on the data, we act in one of two roles:

• As controller for the data of the people who use the Service — agency owners and team members: account details, billing, security and usage data.
• As processor on behalf of the agency for the data the agency brings into the Service through its connected OnlyFans accounts: creator account data, fan profiles, conversations and media. For that data the agency is the controller: it decides why and how it is processed, and it is responsible for having a legal basis and for informing creators and fans.

The Service is intended for businesses and professionals aged 18 or over. It is not directed at consumers or minors.

2.1 Account information

• Email address, agency name and the role of each team member (owner, chatter or viewer).
• Your password, which is stored only as a secure hash by our authentication provider. We never see or store it in plain text.

2.2 OnlyFans account and platform data

When you connect an OnlyFans creator account, we process the following data on behalf of your agency to provide the Service:

• Conversations and messages — fan messages and replies, their status, and attached media metadata.
• Fan profiles — identifiers, username, spending history, subscription status, conversation stage, notes your team adds and facts the AI remembers about the conversation.
• Media vault — metadata of your vault content and cached copies of the files needed to display and send them.
• Earnings and statistics — daily earnings, transactions and subscription metrics.
• Connection status — account identifiers and synchronisation state.

We never see your OnlyFans password. Credentials are entered in the secure connection flow of our integration provider, OnlyFansAPI.com, which keeps the authorised session. We only store the identifier of the connected account.

2.3 Billing information

Payments are processed by Stripe. We do not receive or store card numbers or security codes. We keep your Stripe customer and subscription identifiers, the number of accounts purchased, the billing interval and a log of billing events (type, amount, date).

2.4 Technical and usage data

• Request and security logs — IP address, browser and timestamps, used to run the Service, limit abuse (rate limiting) and investigate incidents.
• Error reports — technical details of errors (stack traces, browser and device data) so we can fix them.
• Product analytics — page views measured without cookies, only if you accept analytics.
• Session replay — recordings of how the interface is used, with all text masked and media blocked, only if you accept analytics.
• AI usage records — which AI tasks ran, with which model, how long they took and their outcome, to measure quality, cost and commission.

• Provide the Service: sync, dashboards, messaging, automations and scripts

  Legal basis

  Performance of the contract

• AI features: suggestions, automated replies, translations, classification

  Legal basis

  Performance of the contract (and the agency's instructions, as processor)

• Billing, invoicing and payment management

  Legal basis

  Performance of the contract and legal obligation

• Service emails and the notifications you configure

  Legal basis

  Performance of the contract

• Security, abuse prevention and error diagnosis

  Legal basis

  Legitimate interest in keeping the Service secure and working

• Product analytics and session replay

  Legal basis

  Your consent, which you can withdraw at any time

• Compliance with legal obligations and requests from authorities

  Legal basis

  Legal obligation

We do not sell personal data and we do not use it for advertising.

To write replies and suggestions, the Service sends the AI providers the conversation context and the fan information each request needs — recent messages, relevant profile data and the persona and instructions your agency configures. We send only what the task requires.

• xAI writes replies, suggestions, script messages and translations, and analyses vault images to tag them by content.
• OpenAI reviews reply quality, extracts conversation memory and generates search embeddings.
• Anthropic classifies intent and purchase intent, writes media captions and helps select content.

We use these providers through their business APIs. The AI does not take decisions with legal or similarly significant effects on you: your agency decides how much autonomy it has (suggestions only, approval before sending, or automatic sending) and can change it at any time.

We rely on the following providers to operate the Service. Each one processes data only to perform its function and under a contract with confidentiality and security obligations.

• Supabase

  Purpose

  Database, authentication and file storage

  Data involved

  All account and platform data

• Vercel

  Purpose

  Hosting, application execution and cookieless analytics (with consent)

  Data involved

  Request data including IP address; page views

• OnlyFansAPI.com

  Purpose

  Connection to OnlyFans

  Data involved

  Access to the connected accounts; messages, fans, media and earnings

• xAI

  Purpose

  AI text generation and image tagging

  Data involved

  Conversation context and fan data needed for each request; vault images

• OpenAI

  Purpose

  AI quality review, memory and embeddings

  Data involved

  Conversation context and fan data needed for each request

• Anthropic

  Purpose

  AI classification, captions and content selection

  Data involved

  Conversation context and media information needed for each request

• Stripe

  Purpose

  Payments, subscriptions and invoicing

  Data involved

  Billing contact and payment data (card data is handled only by Stripe)

• Cloudflare R2

  Purpose

  Media storage and delivery

  Data involved

  Media files cached from the connected vaults

• ElevenLabs

  Purpose

  Text-to-speech

  Data involved

  The text you choose to convert to audio

• Inngest

  Purpose

  Background job processing

  Data involved

  Identifiers and conversation data needed to generate replies

• Upstash

  Purpose

  Rate limiting

  Data involved

  IP addresses and request counters, kept for minutes

• Resend

  Purpose

  Transactional email

  Data involved

  Email address and message content

• Sentry

  Purpose

  Error monitoring and, with consent, session replay

  Data involved

  Technical error data, browser and device data, masked recordings

• Langfuse

  Purpose

  AI pipeline observability (where enabled)

  Data involved

  Pseudonymised technical metadata: model, timings and outcomes

• Telegram

  Purpose

  Optional notifications

  Data involved

  The notification content you enable

Some providers process data outside the European Economic Area, mainly in the United States. When that happens, the transfer relies on the safeguards required by data protection law, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

7.1 Essential (always active)

• Authentication session (sb-… cookies) — keeps you signed in. Removed when you sign out.
• cookie_consent — remembers your cookie choice. 1 year.
• i18next — remembers the language you chose or that your browser requested. 1 year.
• Device storage (local storage and IndexedDB) — your theme, the last account you opened, which notifications you have seen and a cache of recently loaded data so the app opens faster. Cached entries expire 30 days after their last update. This data stays on your device; you can delete it from your browser settings.

7.2 Analytics (only with your consent)

• Vercel Analytics — counts page views without cookies and without cross-site tracking.
• Sentry Session Replay — records how the interface is used to diagnose errors, with all text masked and media blocked.

We do not use advertising or cross-site tracking cookies. You can change or withdraw your consent at any time; it applies immediately, without reloading the page.

• While your account exists — we keep the data needed to provide the Service. Cancelling a subscription does not delete data: it remains available until the account is deleted.
• Account deletion — you can delete your account from Account Settings. If you are the last member of the workspace, the workspace is deleted together with the connected OnlyFans accounts, their data and stored media, and any active subscription is cancelled. If other members remain, only your user is removed and the workspace data stays with the agency.
• Billing records — kept for the period required by tax and accounting law, even after the account is deleted.
• Backups and provider logs — residual copies are removed as our providers' retention cycles expire.

• Encryption in transit — all connections use TLS (HTTPS).
• Workspace isolation — each agency's data is isolated by access controls in the application and in the database.
• Access control — team members are assigned the owner, chatter or viewer role.
• Credentials — passwords are hashed by our authentication provider, and we never store OnlyFans passwords.

No system is completely secure. If you find a vulnerability, please report it responsibly to privacy@nextsell.ai.

Under the GDPR and similar laws you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data, including by deleting your account from Account Settings.
• Restrict or object to certain processing, including processing based on legitimate interest.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time, without affecting earlier processing.
• Lodge a complaint with your data protection supervisory authority.

To exercise them, write to privacy@nextsell.ai. We reply within one month. If you are a creator or a fan and your data reached us through an agency, contact that agency first: it is the controller of your data, and we will help it respond.

The Service is only for adults (18+). We do not knowingly collect data from minors. If you believe a minor's data has reached us, contact us and we will delete it.

We may update this policy. We will change the “Last updated” date at the top and, for material changes, notify you by email before they take effect.

For any privacy question or request: privacy@nextsell.ai · www.nextsell.ai