Privacy Policy

Last updated 11 October 2026

The short version

We collect only what we need to sell content, keep people safe and meet the law. Buyers can buy without an account. We never see or store full card numbers. For age checks we keep only a pass or fail result, never your face image. Creators' ID and consent records are kept for at least 7 years because the law and card networks require it. We do not use advertising cookies and we do not sell your data. You have rights over your data, and you can complain to the ICO.

1. Who we are

The controller of your personal data is CORE-FBM MANAGEMENT LTD, trading as Teaselock, a company registered in England and Wales, company number 17168590, registered office 82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom.

For anything about your personal data, email privacy@teaselock.com.

This policy explains how we use personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What we collect

Buyers

• Your email address, if you give it at checkout.
• Confirmation of payment from our payment processor, such as the amount, date, a transaction reference and, for cards, typically the card type and last four digits. We never receive or store your full card number.
• Your IP address.
• An age-check result token stored on your device, showing whether you passed.
• Your purchase history.
• The watermark identifier linked to each copy delivered to you.
• Anything you send us, such as a support or refund request.

Creators

• Identity and ID document data, collected through our identity verification provider.
• Your legal name, stage name, email address and account details.
• Payout details, such as your bank account.
• Tax information.
• Your content and its titles, descriptions and tags.
• Consent records for everyone appearing in your content, including signed releases and co-performer ID.
• Your Creator Agreement signature record: typed name, date and time, and IP address.
• Sales, payout, hold and chargeback records.
• If you connect an agency, the agency's details, its revenue share, the permissions you gave it and a log of its actions.

Co-performers

• The details on the Co-performer Release, such as legal name, stage name, date of birth and signature.
• Copies of the front and back of your ID.

People who report content or appeal

• Your contact details and the content of your report, appeal or complaint, including any evidence you send.

Everyone

• Technical and access log data, such as IP address, browser type, pages requested and times.

3. Why we use it and our lawful bases

• To provide what you asked for (contract): processing purchases, giving you access links, emailing your orders on request, running creator accounts, paying creators, handling support and refunds.
• To meet our legal obligations (legal obligation): age checks where the law requires them, keeping performer age and consent records (including for 18 U.S.C. 2257 purposes) and the records card networks require, tax and accounting records, handling reports of illegal content, and responding to lawful requests from authorities.
• For our legitimate interests (legitimate interests): preventing fraud and chargeback abuse, tracing leaks through watermarks, keeping the Sites secure, moderating content, and defending legal claims. We balance these interests against your rights and you can object (see section 8).
• With your consent (consent): sending you marketing emails. This is the only thing we rely on consent for, and you can withdraw it at any time using the unsubscribe link or by emailing us.

Some of the data we handle, such as ID documents and data about sex life, can be special category data. Where we process it, we do so because it is necessary to meet legal obligations, to establish or defend legal claims, or for reasons of substantial public interest such as preventing unlawful acts and protecting people from harm, under the conditions in the Data Protection Act 2018. For creators and co-performers, publication of their content is also based on the explicit consent recorded in the Creator Agreement or Co-performer Release.

4. Who we share it with

We use these service providers, who process data on our behalf under contract:

• Cloudflare: hosting, content storage and delivery, and security.
• Payment processor ([PROCESSOR NAME]): card payments on its own hosted page.
• Crypto payment processor ([CRYPTO PROCESSOR NAME]): cryptocurrency payments, where offered.
• Age and identity verification provider ([VERIFICATION PROVIDER NAME], for example Yoti, VerifyMy or Veriff): buyer age checks and creator ID verification.
• SightEngine: automated content moderation.
• Email provider ([EMAIL PROVIDER NAME]): sending order, account and service emails.

We may also share data:

• with a creator, limited to what is needed to deal with a leak of their content traced to a buyer;
• with an agency a creator has connected, limited to what the creator has allowed;
• with card networks, banks and payment processors, where needed for chargebacks, fraud checks and their compliance requirements;
• with the Internet Watch Foundation, NCMEC, the police and other authorities, where the law requires or to protect people from harm;
• with a neutral third party resolving a consent dispute under our Appeals Policy;
• with our professional advisers, or a buyer of our business if it is sold.

We do not sell your personal data.

5. International transfers

Some of our providers process data outside the UK. Where they do, we make sure the transfer is protected, either because the destination has UK adequacy regulations or by using the UK International Data Transfer Agreement or Addendum, together with any further safeguards needed.

6. How long we keep it

• Performer ID and consent records: for as long as the content is available and for at least 7 years after it is removed (2257 and card-network requirements).
• Order records: 6 years (tax).
• Age checks: we store only the pass or fail result, never face images. The verification provider deletes its data in line with its own policy.
• Complaint records: 3 years.
• Access logs: 12 months.
• Other data: only for as long as we need it for the purpose we collected it, or as long as the law requires.

We may keep data for longer where it is needed for an ongoing investigation, legal claim or request from the authorities.

7. Security

We protect data with access controls, encryption in transit and limited staff access, and we only use providers who meet appropriate security standards. ID documents and consent records are restricted to the staff who need them.

8. Your rights

You have the right to:

• access the personal data we hold about you;
• rectification: have inaccurate data corrected;
• erasure: have your data deleted. This is limited where the law requires us to keep records, for example performer ID and consent records and tax records;
• restriction: ask us to limit how we use your data;
• objection: object to our use of your data based on legitimate interests, and to marketing at any time;
• portability: receive data you gave us in a usable format.

To use any of these rights, email privacy@teaselock.com. We may need to confirm your identity. We will reply within one month. If you bought without an account, please include the email address you used at checkout.

If you appear in content and want it removed, use our Appeals Policy at teaselock.com/appeal. It is the fastest route.

9. Complaining to the regulator

If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies

See our Cookie Policy.

11. Children

Teaselock is only for adults. We do not knowingly collect data from anyone under 18. If we find that we have, we delete it unless we must keep it to report to the authorities.

12. Changes to this policy

We will update this policy when how we use data changes. The date at the top shows when it last changed. If we make a significant change and we hold your email address, we will tell you.