Privacy Policy

Last updated 3 August 2026 · XSTARME

This policy explains exactly what XSTARME collects, why, who else sees it, and the choices you have. We deliberately collect very little: we do not run advertising or analytics trackers, we do not keep a record of which scenes you watch, and we never sell your personal information.

1. Who is responsible for your data

20 Minute Production LLC, of [set COMPANY_ADDRESS in config.php], is the controller of the personal data described here. For privacy questions or to exercise your rights, contact privacy@xstarme.com.

Because we handle sexually explicit material, we treat the fact that you use this Site as sensitive information and limit who can see it accordingly.

2. What we collect

2.1 Information you give us

2.2 Information created when you subscribe

Payments are taken by Paddle, our merchant of record (section 4). Your card number, billing address, and payment details go to Paddle, not to us — we never see or store them. What we do store is:

• a Paddle customer reference and subscription reference;
• which performer you subscribed to, the billing interval (weekly or monthly), the subscription status, and the date the current paid period ends;
• a transaction record for each payment: transaction reference, currency, amount paid, the fee and tax retained by Paddle, and the net amount — which we need for accounting and to pay the performer their share.

2.3 Information collected automatically

• Server logs. Like every web server, ours records the IP address, date and time, page or file requested, referrer, and browser user-agent for each request. These logs are kept by our hosting provider for security, abuse investigation, and diagnosing faults.
• Session cookie. A strictly necessary cookie (PHPSESSID) that keeps you signed in during your visit. It is HttpOnly and SameSite=Lax and expires when you close the browser.
• Age confirmation. When you confirm you are 18+, your browser stores a single flag (xstarme_age_ok) in local storage so you are not asked again. It stays on your device and is never sent to us.

Details are in our Cookie Policy.

2.4 What we deliberately do not collect

• No viewing history tied to you. Each scene has a simple total view counter that increments when the page is opened. It is a single number per video and is not linked to your account, your IP, or any identifier — we cannot reconstruct what any individual watched.
• No advertising or analytics. There is no Google Analytics, no advertising pixel, no session recorder, and no third-party tracker of any kind on this Site.
• No profiling. We do not build behavioural profiles and we make no automated decisions that produce legal or similarly significant effects about you.
• No selling or sharing. We do not sell your personal information, and we do not share it for cross-context behavioural advertising, for money or otherwise.

3. Why we use it, and our legal bases

Where we rely on legitimate interests, we have considered your rights and interests and limited what we collect accordingly. You may object at any time (section 7).

4. Who we share it with

We share personal data only with the following categories of recipient, and only as far as needed:

• Paddle (Paddle.com Market Ltd and affiliates) — our payment processor and merchant of record. Paddle receives your email address and payment details, is the seller of record for your purchase, handles billing and tax, and sends your receipts and renewal notices. Paddle is an independent controller for that processing and has its own privacy notice, shown at checkout.
• Our hosting provider — stores the Site, the database, and the server logs on our behalf, under a data-processing agreement.
• Google Fonts — the Site loads the “Inter” typeface from Google’s font servers, so your IP address and browser details are disclosed to Google when a page loads. No cookie is set by this request.
• Performers, managers, and our administrators — a performer (and their manager, where one is assigned) can see earnings and subscriber counts for their own page in aggregate, and our administrators can see account records where needed to run the service and provide support.
• Professional advisers, and authorities — lawyers, accountants, or auditors under confidentiality, and law enforcement or regulators where we are legally required to disclose or must defend legal claims.
• A buyer — if the business is sold or reorganised, data may transfer as part of that transaction; you would be told beforehand.

We do not give your data to advertisers, data brokers, or list vendors. Ever.

5. International transfers

We are based in the United States and our service providers may process data in the United States, the United Kingdom, the European Union, and elsewhere. Where data covered by UK or EU law is transferred outside those regions, the transfer is protected by an appropriate safeguard — typically the European Commission’s Standard Contractual Clauses (with the UK Addendum), or an adequacy decision. You can ask us for a copy of the relevant safeguard at privacy@xstarme.com.

6. How long we keep it

7. Your rights

7.1 Everyone

Whatever country you are in, you can ask us to give you a copy of your data, correct it, or delete your account. Email privacy@xstarme.com from the address on your account and we will respond within 30 days. We may need to verify your identity first — for sensitive requests we will not simply take an email address at face value.

7.2 UK and EU (UK GDPR / GDPR)

You have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. You also have the right to complain to your national supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

7.3 California (CCPA/CPRA)

California residents have the right to know what personal information we collect and disclose, to delete it, to correct it, and to limit the use of sensitive personal information. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of; we honour Global Privacy Control signals as a matter of course. We will not discriminate against you for exercising your rights. You may use an authorised agent, with proof of authorisation.

7.4 Other US states

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana) have equivalent rights of access, correction, deletion, portability, and opt-out, and a right to appeal a refused request. To appeal, reply to our decision email and write “appeal” in the subject line.

8. Deleting your account

Email privacy@xstarme.com from your account address and ask us to delete it. We will cancel any active subscriptions, remove your email address, display name, and password hash, and disconnect your transaction records from your identity. We must keep the financial totals themselves for the tax period described in section 6 — those are retained without your contact details. Deleting your account does not automatically refund a period you have already paid for; see the refund policy.

9. Security

We protect your data with measures appropriate to its sensitivity: HTTPS for all traffic, passwords stored only as bcrypt hashes, prepared statements throughout the database layer, session cookies marked HttpOnly and SameSite=Lax with the session ID regenerated on sign-in, access controls limiting staff to what their role requires, and video delivered as an encrypted stream rather than downloadable files. No system is perfectly secure; if a breach affects your data and creates a risk to you, we will notify you and the relevant regulator as the law requires.

10. Children

This Site is strictly for adults. It is not directed at anyone under 18 and we do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we will close it and delete the data immediately. If you believe a minor has created an account, tell us at privacy@xstarme.com.

11. Changes to this policy

If we change this policy we will update the “last updated” date above. For material changes — new categories of data, new recipients, or a new purpose — we will give notice by email or a prominent notice on the Site before the change takes effect.

12. Contact

Privacy enquiries and rights requests: privacy@xstarme.com
General and billing support: support@xstarme.com
Postal: 20 Minute Production LLC, [set COMPANY_ADDRESS in config.php]