Privacy Policy

Last updated 2026-07-28 · Version 1.0

This Privacy Policy explains how Lusty ("we", "us", "our") collects, uses, shares, and protects your personal information, and the rights you have over it. We process personal information in line with South Africa's Protection of Personal Information Act, 2013 ("POPIA"). For the purposes of POPIA, Lusty is the responsible party for the information described here. Because Lusty is an adult service, some of the information we process is of a sensitive nature, and we treat it accordingly.

1. Information we collect

1.1 Account information

Your name or display name, username, email address, mobile number, password (stored only as a salted hash), role (Member, Creator, or Manager), city, language, and the preferences and settings you choose.

1.2 Verification information

To confirm age and identity and to operate the marketplace safely, we collect identity-document details, a verification selfie used for a liveness and face match, and, for Creators and Managers, the signed work agreements they complete in-app. Those records include a typed name, a drawn signature, a selfie, a timestamp, a hashed record of the signer's IP address, and a hash of the agreement version signed. See our Work Agreements policy.

1.3 Payment information

Card payments are processed by our third-party payment processor, CCBill. Full card numbers never touch Lusty's systems. We receive and store only payment metadata — for example a transaction reference, the amount and currency, a result code, and a truncated card descriptor — together with your wallet balance and transaction history.

1.4 Device location at payment

As a fraud-prevention and security measure, we capture your device's location at the moment a payment is made. This protects buyers and Creators against account takeover and fraudulent transactions, and helps establish where a payment was authorised. Location is collected for this security purpose only.

1.5 Messages and content

The messages, photos, and other content you send through the Platform. Messages are subject to automated screening that detects and blocks the sharing of contact information before a paid booking is confirmed, in line with our marketplace safeguards. We also process the content you post to your profile or feed.

1.6 Technical and cookie data

Device and browser type, IP address, log and usage data, and information from cookies and similar technologies. See our Cookies & tracking page for the categories of cookies we use and how to manage them.

2. Why we use your information (purposes)

• To create and operate your account and provide the Platform;
• To verify age and identity and to operate the work-agreement signing process;
• To facilitate bookings, the wallet, payouts, and to process payments via CCBill;
• To detect and prevent fraud, abuse, and unauthorised access — including the payment-time location check;
• To operate messaging and the automated contact-information screening that protects users before a paid booking;
• To moderate content and enforce our policies, keeping the community safe;
• To provide support, send service and transactional messages, and, where you have consented, marketing about Lusty;
• To comply with our legal obligations and to establish, exercise, or defend legal claims.

3. Lawful basis for processing

Under POPIA we rely on one or more of the following justifications, depending on the purpose:

• Performance of a contract — to provide the Platform and services you ask for;
• Consent — for example for optional cookies, marketing, and the processing of certain sensitive information you choose to provide (which you may withdraw at any time);
• Compliance with a legal obligation — for example record-keeping and responding to lawful requests;
• Our legitimate interests — for example fraud prevention, security, and protecting users — balanced against your rights.

4. When we share information

We do not sell your personal information. We share it only as follows:

• CCBill, our payment processor, to process card payments and manage chargebacks;
• Hosting and infrastructure providers that store and run the Platform on our behalf, under contract and bound to confidentiality and security obligations as operators;
• Law enforcement, regulators, or other authorities where we are required to by law or in response to a valid, lawful request, or where necessary to protect users or investigate serious harm such as trafficking or non-consensual content;
• Professional advisers and, in the event of a merger or sale, a successor entity, subject to this Policy.

Some service providers may process information outside South Africa. Where that happens we take steps to ensure your information receives a comparable level of protection as required by POPIA.

5. How long we keep information (retention)

We keep personal information only for as long as necessary for the purposes above or as required by law, and then delete or de-identify it. Key retention periods include:

• Verification and signed work-agreement records — 5 years after the account closes or the agreement ends, to evidence age, identity, and consent;
• Payment and payment-location records — 5 years, in line with financial record-keeping and fraud-investigation needs;
• Account and profile data — for the life of your account and a reasonable period afterwards;
• Messages and moderation records — for as long as needed to operate the service, handle disputes, and meet legal obligations.

6. Your rights as a data subject

Subject to POPIA, you have the right to:

• Be told what personal information we hold about you and to access it;
• Request correction of inaccurate or incomplete information;
• Request deletion or destruction of information we are no longer entitled to keep;
• Object to certain processing, and to withdraw consent where we rely on it (without affecting prior lawful processing);
• Not be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review;
• Lodge a complaint with the regulator.

To exercise these rights, use the data tools in Settings or contact us through the Platform. Some rights are subject to limits — for example, we may need to retain verification and payment records for the periods above even after an account is closed.

7. How we protect your information

We maintain appropriate, reasonable technical and organisational measures to safeguard personal information against loss, unauthorised access, and misuse. These include encryption of data in transit, hashing of passwords and sensitive identifiers (such as IP addresses in agreement records), tokenisation of card payments through CCBill so that card numbers never reach us, role-based access controls, and logging. No system is perfectly secure; where a compromise of your information occurs, we will notify you and the Information Regulator where POPIA requires.

8. Children

The Platform is strictly for adults aged 18 and over. We do not knowingly collect information from minors. If we learn that we hold information relating to a minor, we will delete it and take appropriate action, including referral to the authorities where required.

9. Cookies

We use cookies and similar technologies as described on our Cookies & tracking page, where you can review the categories (essential, analytics, personalization, marketing) and manage your choices.

10. Changes to this Policy

We may update this Policy from time to time and will post the updated version with a new "Last updated" date and version. Where changes are material we will take reasonable steps to notify you.