Privacy Policy

This policy covers the personal data VIPpass handles when you visit our website, join the waitlist, pay at a checkout page, manage your memberships, use the creator app, talk to the VIPpass bot or get a message from us.

VIPpass is responsible for your data (the "controller"). Telegram, WhatsApp, Snapchat and payment providers handle your data under their own privacy policies when you use their services.

A leak of this kind of data could expose creators and fans to blackmail or harm. That is why this policy is built on collecting less, showing less and deleting early.

Everyone who visits the site

Standard server logs: your IP address, browser type and the pages you asked for, with the time. We use them to keep the site secure and keep them for a short time. Our website uses no advertising or analytics cookies.

Waitlist

Your email address, country, the platforms you use, the size of your community, your handle if you give it, and your confirmation that you are 18 or older.

Fans

• Consent record: that you confirmed you are 18 or older, which versions of the Fan Policy and this Privacy Policy you accepted, the time, a device ID and a scrambled (hashed) form of your IP address.
• Phone number: for receipts, renewal reminders and login codes.
• Platform identity: your Telegram user ID, WhatsApp number or Snapchat username, so you can be let in. We store it encrypted.
• Memberships: which space and plan you bought, when it started and ends, and whether it renews.
• Payments: amount, fee, payment method, the provider's reference and status. Your payment provider handles your card or mobile money details. We do not store full card numbers or mobile money PINs.
• Support and reports: messages you send us and reports you make.

Creators

• Account: phone number, email, handle, display name, country and language.
• Identity verification: images of your government ID, a live selfie, and a short video of you holding your ID and reading a code. From these we keep your date of birth, the document's country, a scrambled (hashed) document number and face template used to detect duplicate or banned accounts, the verification checks' results and the reviewer's decision.
• People in your content: the same verification data and a signed consent for every co-performer you declare.
• Payout account: provider, account number (encrypted), account name and whether it matches your ID.
• Spaces: names, descriptions, cover images, plans, preview links and Telegram chat IDs.
• Money: earnings, fees, payouts, plan payments and monthly statements.
• Fraud signals: device identifiers and links to other accounts, such as a shared phone, device or payout account.

What we never collect

The content of creators' groups, channels or stories, or the messages and media in them. The VIPpass bot only sees membership events, such as join requests and members joining or leaving, and the commands you send it.

Data protection laws require a lawful reason for each use of your data. These are ours:

Membership of an adult space can reveal sensitive information about you. We treat all membership data as sensitive: we store fan identities encrypted, and only the people who need it can see it.

We only send fans messages about their memberships: receipts, access links and renewal reminders. Our messages and receipts use a neutral merchant name and never describe a creator's content.

• Creators see who is in their space, each member's plan and expiry date, and the identity they need to let a member in: a Snapchat username, or a WhatsApp number while the add task is open (it is hidden again afterwards). Creators never see fans' payment details or login phone numbers. When a fan messages a creator through “Problem with access?”, their contact details are not shared.
• Fans see a creator's display name, handle and space details, never the creator's legal name or ID.
• VIPpass staff see only what their role needs. Support staff see masked data. Only the reviewer assigned to a verification case can see ID images and videos, which are watermarked with the reviewer's name and cannot be downloaded or exported. Every staff action is logged.
• Service providers who work for us under contract: payment providers, hosting, SMS and messaging, email, and identity verification tools. They may only use your data to provide their service to us.
• Telegram processes the join requests and removals our bot makes for you.
• Authorities, only as described below.
• A buyer of our business, if VIPpass is sold or merged, under the same protections as this policy.

We never sell personal data, and never share it for advertising.

Requests from law enforcement

We disclose data to the police or other authorities only when a request is valid under the law that applies, and we disclose only what the request requires. We record every request, what we decided and what we disclosed. Where the law allows, and where it would not put a child or anyone else at risk, we tell the person concerned. We report suspected child sexual abuse material to the police and to recognised hotlines without waiting to be asked.

We keep daily backups for disaster recovery. Deleted data can remain in a backup until that backup expires.

• All traffic is encrypted. Databases and backups are encrypted at rest, and payout account numbers, fan platform identities and phone numbers shown to creators are encrypted again on their own.
• Identity verification data lives in a separate store on a private network, apart from the main database.
• Staff sign in with single sign-on and two-factor authentication, from approved networks only.
• An outside security firm tests VIPpass before launch and every year after.

If a breach affects your data, we will tell you and the regulator as the law requires.

Depending on where you live, you can ask us to:

• Tell you what data we hold about you and give you a copy.
• Correct data that is wrong.
• Delete your data.
• Stop or limit a use of your data, or object to it.
• Withdraw a consent you gave us.

Email [email protected] from the address on your account, or tell us the phone number you use with VIPpass. We may send a login code to confirm it is you. We answer within 30 days. We cannot delete records the law requires us to keep, such as payment and audit records, or records we need to keep banned people out.

You can also complain to your data protection authority, such as the Nigeria Data Protection Commission, the Data Protection Commission of Ghana, the Office of the Data Protection Commissioner in Kenya or the Information Regulator in South Africa.

We choose where to host VIPpass so that it meets the data protection laws of the countries we operate in. If your data is moved to another country, we use the safeguards those laws require.

Our website does not use advertising or analytics cookies. Checkout and the apps store a few things on your device that they need to work: that you passed the 18+ entry gate (remembered for 30 days, or until our policies change), your login session, and a device ID used for consent records and fraud checks. If we ever add analytics, we will update this policy first.

VIPpass is for adults only. We do not knowingly collect data from anyone under 18. If we find that we have, we delete it, except where we must keep it to report a crime or protect a child. If you think a minor is using VIPpass or appears in a space, report it straight away.

Each version of this policy has a number and a date at the top of this page. When we change it, the checkout entry gate asks fans to accept the new version, and we tell creators in the app or by email.

Questions about your data go to [email protected]. To report a space, use the report option on the checkout page, your membership page or the bot's /report command, which reaches our safety team fastest.