Privacy Policy

1. Information We Collect

When you register and use TuttiChat, we collect personal information necessary to deliver our services, process payments, and verify legal adult age:

• Account Data: Email address, username, display name, password hash, and profile details.
• Performer Verification Data: Government photo ID images, a selfie holding the ID, proof of address, legal name, date of birth, nationality, address, tax identification numbers, tax certifications, any additional documents a performer uploads, and the result of our automated face comparison and age estimate (see section 2a).
• Payment & Financial Information: Billing zip code, transaction history, Stripe Connect account IDs, and cryptocurrency wallet or bank wire details. (Raw credit card numbers are stored securely with PCI-DSS Level 1 compliant processors and never touch our servers).
• Usage & Device Information: IP address, device fingerprints, browser version, and session identifiers for fraud prevention and DRM anti-piracy protection.

2. How We Protect & Use Your Data

We process your information for the following specific purposes:

• To operate live broadcasts, room chat, tips, paid shows and fan clubs.
• To verify identity, age compliance, and maintain federal record-keeping standards.
• To detect, prevent, and prosecute credit card chargeback fraud and unauthorized access.
• To mark broadcasts with our logo and prevent them being copied to other sites.

2a. How We Verify Performers (Automated Check + Human Review)

Before a performer can go live or be paid, we verify their identity in two stages:

• Automated check: our own verification system (TuttiAgeVerify), running on our servers, compares the face on the ID document with the selfie and estimates the person's age. It produces a similarity score and an age estimate; it does not keep a separate biometric template.
• Human review: a member of our verification team reviews every document and the automated result and makes the decision. The automated system never approves or rejects anyone on its own.
• Consent and security: performers give explicit consent to this processing before submitting. Documents and personal data are encrypted at rest, only our verification team can open them, and every access is logged.
• Retention: verification records are kept for as long as the performer account is active and afterwards only for the period required by law (for example tax and anti-money-laundering record-keeping).

3. Data Sharing & Disclosures

We do NOT sell, rent, or trade your personal data to third-party data brokers or advertisers. Data is shared strictly with:

• Payment Processors: To execute fan payments, fraud checks, and performer earnings disbursements.
• Legal & Law Enforcement Authorities: Solely upon valid subpoena, court order, or mandatory statutory reporting (such as reporting CSAM to NCMEC).

4. Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you have the right to request access to your personal data, request correction of errors, or request deletion of your account. Note that certain tax records and 18 U.S.C. § 2257 age verification records must be retained for statutory limitation periods required by federal law.

For privacy inquiries or deletion requests, contact our Data Protection Officer at privacy@tuttichat.com.