Privacy Policy
Your privacy matters. This Policy explains how we collect, use, share, and protect your personal data, and what rights you have under UK GDPR, EU GDPR, and the Digital Services Act.
Introduction
Thanks for choosing BentBox. This Privacy Policy explains how Haas & Reed B.V. ("BentBox", "we", "us", "our") collects, uses, shares, retains, and protects personal data in connection with the BentBox service, including the website at bentbox.co, its subdomains, mobile clients, APIs, and any associated services (together, the "BentBox Service").
This Policy is written to comply with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), and the EU Digital Services Act (Regulation (EU) 2022/2065, "DSA"). It also references our obligations under United States record-keeping laws relevant to certain content categories (notably 18 U.S.C. § 2257).
Our Privacy Commitments
- Minimal collection: We collect only the personal data we need to operate the BentBox Service and meet our legal obligations.
- Clear legal basis: Every processing activity is tied to a lawful basis under Article 6 (and, where applicable, Article 9) UK GDPR.
- No third-party tracking: We do not collect information about your activity on other sites.
- No marketing cookies: We do not process cookies for advertising or behavioural marketing purposes.
- No data sales: We do not sell personal data, and we do not share it for third-party marketing.
- Secure payments: We never receive or store card numbers — payments are handled by regulated payment processors.
- Identity protection: Identity verification data is stored separately from public profiles and is never published.
If anything in this Policy is unclear, please contact us at privacy@bentbox.co.
Who We Are
The data controller for personal data processed in connection with the BentBox Service is:
Data Controller
Haas & Reed B.V.
Mantelmeeuwhof 15
3582 DN, Utrecht
The Netherlands
Email: privacy@bentbox.co
Haas & Reed B.V. is established in the Netherlands and is subject to the supervision of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, "AP") for EU GDPR matters. For UK GDPR matters, the UK Information Commissioner's Office ("ICO") is the relevant supervisory authority for users in the United Kingdom.
The BentBox Service includes a number of features and surfaces operated by Haas & Reed B.V., including BentBox Folio, BentBox Black, BentPlay (AI chat and image generation), BentBox Messenger, and Clubs. Personal data processed through these features is governed by this Policy.
BentBox also relies on ProntoID — an independent identity and age verification provider operated by a separate company — for creator identity verification, age verification, and model release compliance. ProntoID acts as a separate data controller for the identity records it holds and publishes its own privacy notice. The way BentBox works with ProntoID is described in the Identity and Age Verification section below.
What Personal Data We Collect
We collect personal data in three ways: data you provide to us directly, data we collect automatically when you use the BentBox Service, and data we receive from third parties (for example, payment processors or identity verification providers).
Data You Provide to Us
| Category | Description |
|---|---|
| Account Data | Email address, username, password (stored as a salted hash), display name, profile photo, country, language preferences, and any optional profile information you provide. |
| Creator & Sales Data | For creators: payout details (bank, Paxum, Yoursafe, gift card, or PayPal account identifiers — depending on your chosen payout method), tax information where required, pricing decisions for your Boxes, and content you upload. |
| Identity & Age Verification Data | Government-issued ID, selfie or liveness capture, date of birth, and where applicable model release forms and 2257 records. Processed through our verification service ProntoID. See the Identity Verification section below. |
| Communications | Messages you send through BentBox Messenger or our chat features, communications with our support team, content of complaints or notices you submit, and any documents you attach. |
| Content | Photos, videos, and other content you upload, including embedded metadata (EXIF data, where present), titles, descriptions, and tags. |
Data We Collect Automatically
| Category | Description |
|---|---|
| Usage Data | Pages you visit, Boxes and videos you view or purchase, search queries, collections you create, follows and interactions, timestamps of activity, and referrers (where applicable). |
| Technical Data | IP address, approximate location derived from IP (country/region/state — used for compliance with regional age verification laws), browser type and version, operating system, device type, screen size, language, and crash diagnostic information. |
| Cookies & Similar Technologies | Strictly necessary cookies for authentication, session management, and security. We do not use advertising or marketing cookies. See our Cookies Policy for details. |
| Age Verification Records | For users in jurisdictions that require it (including certain U.S. states and the United Kingdom), we record the fact, method, and timestamp of age verification — not the underlying ID document, which is handled through ProntoID. |
Data We Receive from Third Parties
| Source | Description |
|---|---|
| Payment Processors | Transaction status, fraud signals, chargeback information, and partial card identifiers (BIN ranges, last four digits). We never receive full card numbers, CVVs, or expiration dates. |
| Identity Verification | Verification outcome and audit metadata from ProntoID. Underlying documents are stored within ProntoID, not on the BentBox publishing systems. |
| Partner Services | If you connect a third-party service (e.g. a partner platform via our Partner API), we receive only the data necessary to operate that integration. |
How We Use Your Data and on What Lawful Basis
Under Article 6 UK GDPR (and Article 6 EU GDPR), we may process personal data only when one of the listed lawful bases applies. The table below sets out our processing activities, the lawful basis we rely on, and the data categories involved.
| Purpose | Lawful Basis | Data Categories |
|---|---|---|
| Providing the core BentBox Service: account creation, login, browsing, purchasing, uploading, payouts, and customer support. | Performance of a contract (Art. 6(1)(b)) | Account Data, Usage Data, Technical Data, Creator & Sales Data, Communications |
| Identity and age verification for creators and (where required) buyers. | Compliance with a legal obligation (Art. 6(1)(c)); for special category data, explicit consent (Art. 9(2)(a)) | Identity & Age Verification Data |
| Processing payments and detecting or preventing fraud, chargebacks, and abuse. | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) | Account Data, Creator & Sales Data, partial payment metadata |
| Security, abuse prevention, and integrity of the BentBox Service (rate limiting, anomaly detection, incident investigation). | Legitimate interests (Art. 6(1)(f)) | Usage Data, Technical Data, Communications |
| Service communications: account notifications, security alerts, changes to the Policy or Terms, payout statements. | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | Account Data, Communications |
| Marketing communications (newsletters, product announcements, optional surveys). | Consent (Art. 6(1)(a)) | Account Data |
| Complying with legal requests, court orders, and obligations under the DSA, UK GDPR, EU GDPR, and applicable record-keeping laws. | Legal obligation (Art. 6(1)(c)) | As required by the request or obligation |
| Establishing, exercising, or defending legal claims. | Legitimate interests (Art. 6(1)(f)); for special category data, Art. 9(2)(f) | As relevant to the claim |
Where we rely on legitimate interests, we conduct a balancing assessment to ensure that our interests are not overridden by your rights and freedoms. You can ask for further information about that assessment by contacting us.
Sensitive Personal Data
BentBox is a curated content marketplace that hosts artistic, glamour, boudoir, and adult-oriented photography and video. Some content may reveal information about a person's sex life or sexual orientation, which is "special category data" under Article 9 UK GDPR.
We process special category data only where one of the conditions in Article 9(2) applies. In practice, the relevant conditions for BentBox are:
- Explicit consent (Art. 9(2)(a)) — for content published with the data subject's explicit consent, typically evidenced by signed model release forms held by the photographer and verified by BentBox through ProntoID prior to publication.
- Manifestly made public (Art. 9(2)(e)) — for content the data subject has chosen to publish themselves (for example, creators who publish their own content).
- Legal claims (Art. 9(2)(f)) — where processing is necessary to establish, exercise, or defend legal claims.
We take particular care with this category of data:
- All content involving identifiable individuals must be supported by a valid model release before publication. Where the person depicted is not the uploader, BentBox manually verifies the model release and likeness match prior to publication, supplemented by automated screening using AWS Rekognition.
- A data subject may withdraw consent at any time (Article 7(3) UK GDPR). Where consent is withdrawn, we will remove the affected content from public view, subject only to retention required for legal compliance or the defence of legal claims.
- Withdrawal of GDPR-based consent for data processing is independent of any underlying contractual arrangement between a model and a photographer. The contractual consequences of withdrawing consent are a matter between those parties and not for BentBox to adjudicate.
Identity and Age Verification
BentBox uses ProntoID — an independent identity and age verification provider operated by a separate company — to verify:
- Creators: identity, age (18+), and where applicable model release documentation (via ProntoRelease) and consent management (via ProntoTag), in compliance with 18 U.S.C. § 2257 and equivalent record-keeping requirements.
- Buyers: where required by law (for example, under the UK Online Safety Act and certain U.S. state laws including Tennessee SB 1792 and Ohio's adult content provisions), age verification before access to age-restricted content.
ProntoID runs on systems that are technically and organisationally separated from the BentBox publishing systems. Identity documents and verification records held by ProntoID are not accessible from BentBox public profiles or search, and are not shared with other BentBox users. ProntoID acts as a separate data controller for the underlying identity records and applies its own retention schedule based on the legal obligations that require those records to be kept. BentBox receives only the verification outcome and audit metadata necessary to confirm that the relevant compliance checks have been completed. ProntoID's own privacy notice is available on the ProntoID website.
For users in U.S. states with re-verification requirements (for example, Tennessee's 60-minute re-verification rule), we record the timestamp, method, and applicable jurisdiction of each verification to enforce the relevant re-verification interval.
How We Share Your Data
We share personal data only as described in this section. We do not sell personal data, and we do not share it for third-party marketing.
Publicly Available Information
If you create an account, the following information is visible on the public BentBox Service:
- Your username and display name
- Your profile picture, where you have uploaded one
- Your public Boxes, videos, and collections
- Who you follow and who follows you, unless you have made this private in your settings
You can adjust the visibility of much of this information in your account settings. Content shared in private communities (Clubs) is visible only to members of that community.
Recipients of Personal Data
| Recipient Category | Purpose |
|---|---|
| Payment processors | We use Verotel and EMerchantPay to process payments. They act as independent controllers for payment data they collect directly from you, in accordance with their own privacy policies. |
| Payout providers | Where you receive payouts, we share the minimum information required with your chosen payout provider (bank, Paxum, Yoursafe, gift-card provider, or PayPal where available). |
| Hosting and infrastructure | Amazon Web Services (AWS) hosts the BentBox Service in the United States (us-east-1 region) and provides storage, compute, content delivery (CloudFront), search (OpenSearch), and image-recognition services (Rekognition). |
| Identity verification | ProntoID, an independent identity and age verification provider operated by a separate company, for creator identity verification, age verification, and model release compliance. ProntoID acts as a separate data controller for the underlying identity records. |
| Analytics | Google Analytics 4, configured to collect aggregated and pseudonymised usage information only. IP addresses are not stored in identifiable form. |
| Email delivery | Transactional and service email is delivered through AWS Simple Email Service (SES). |
| Partner platforms | Where you authorise integration with a partner platform via our Partner API, we share the data you have agreed to share with that partner. |
| Law enforcement and authorities | We share personal data when required by law, valid legal process (court order, search warrant, subpoena), or to protect the safety of any person or the integrity of the BentBox Service. |
| Professional advisors | Our legal, accounting, and audit advisors, bound by professional duties of confidentiality. |
| Successors in a corporate transaction | In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the successor entity, subject to continuing protection consistent with this Policy. |
International Data Transfers
BentBox is operated from the Netherlands, and our core infrastructure is hosted by AWS in the United States. Personal data may also be processed by service providers in other jurisdictions. For users located in the United Kingdom or the European Economic Area, transfers of personal data outside the UK / EEA are subject to UK GDPR Chapter V and EU GDPR Chapter V respectively.
Where we transfer personal data outside the UK or EEA, we rely on one or more of the following safeguards:
- An adequacy decision in force at the time of transfer (for example, the EU–U.S. Data Privacy Framework and the UK Extension to the Data Privacy Framework, where the recipient is certified).
- Standard Contractual Clauses approved by the European Commission and, where applicable, the UK International Data Transfer Addendum.
- Other lawful transfer mechanisms permitted under UK GDPR or EU GDPR.
You can request a copy of the safeguards in place for a particular transfer by contacting us at privacy@bentbox.co. We may redact commercially sensitive information from the copy we provide.
How Long We Keep Your Data
We keep personal data only for as long as we need it for the purposes set out in this Policy and as required by law. The table below sets out our typical retention periods. Where a longer period is required by law (for example, tax or content record-keeping obligations), that longer period applies.
| Data Category | Retention |
|---|---|
| Active account data | For as long as your account is active. |
| Closed account data | Up to 90 days after account closure, after which data is deleted or anonymised, except where a longer period is required for legal compliance or the defence of legal claims. |
| Financial and transaction records | Seven years from the date of the transaction, in line with Dutch tax and accounting requirements. |
| 2257 / identity verification records | For the period required by 18 U.S.C. § 2257 and any applicable equivalent record-keeping laws, calculated from the date the relevant content is last published. |
| Removed content metadata | Limited transaction records and audit logs may be retained for up to six years after content removal to enable defence of legal claims, dispute resolution, and compliance. |
| Support and complaint records | Up to three years from resolution. |
| Marketing data | Until you withdraw consent or unsubscribe. |
| Security logs | Up to 12 months, longer if relevant to an active investigation. |
After the retention period, we delete or irreversibly anonymise the data. Limited residual copies may persist in backup systems for a short period before they are overwritten.
Your Rights
If you are in the United Kingdom, the European Economic Area, or otherwise within the territorial scope of UK or EU GDPR, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to legal exceptions.
Right of access Art. 15
You have the right to obtain confirmation as to whether we process your personal data and, if so, to receive a copy of that data along with information about how and why we process it.
Right to rectification Art. 16
You have the right to have inaccurate personal data corrected and incomplete personal data completed.
Right to erasure ("right to be forgotten") Art. 17
You have the right to have your personal data erased in certain circumstances, including where it is no longer needed for the purposes for which it was collected, you withdraw consent, or you object to processing and there is no overriding legitimate ground.
Right to restriction of processing Art. 18
In certain circumstances you may ask us to restrict — rather than delete — the processing of your personal data.
Right to data portability Art. 20
For personal data you have provided to us and that we process by automated means on the basis of consent or contract, you have the right to receive it in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to object Art. 21
You have the right to object to processing based on legitimate interests, and an absolute right to object to processing for direct marketing purposes.
Rights related to automated decision-making Art. 22
We do not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects. If this changes, we will update this Policy and inform you of your rights.
Right to withdraw consent Art. 7(3)
Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Right to lodge a complaint with a supervisory authority Art. 77
You have the right to complain to a data protection supervisory authority. For UK users, this is the Information Commissioner's Office (ico.org.uk). For users in the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the authority in your country of residence or place of work.
How to Exercise Your Rights
To exercise any of the rights set out above, please contact us at privacy@bentbox.co. We will respond within one month of receiving your request, as required by Article 12 UK GDPR. Where a request is complex or where we have received a number of requests from you, we may extend this period by a further two months and will tell you within the initial month if we need to do so.
What we will ask for
- Verification of identity: to protect your data, we will ask you to verify your identity before acting on your request. This typically involves confirming control of the email address on the account, or where the request is made through a legal representative, evidence of authority to act.
- Scope: for access requests, please tell us which categories of data or which time period the request covers. We can respond more accurately and quickly when the scope is clear.
- Format: let us know how you would like to receive the response (secure portal, encrypted email, or another method).
Limits on Your Rights
Data subject rights are not absolute. In particular:
- We may decline manifestly unfounded or excessive requests, or charge a reasonable fee, in line with Article 12(5) UK GDPR.
- Where data we hold about you is mixed with personal data of another person, we may need to redact that other person's data before responding, in line with Article 15(4) UK GDPR and ICO guidance on third-party data in subject access requests.
- We may need to retain certain data — even after you have asked for it to be deleted — where retention is necessary for legal compliance, the establishment, exercise or defence of legal claims, or the conduct of an active investigation.
If we decline a request in whole or in part, we will explain why and tell you about your right to complain to a supervisory authority and to seek a judicial remedy.
Children's Data
The BentBox Service is intended exclusively for users aged 18 or over. We do not knowingly collect personal data from anyone under 18. Age is verified at registration and, where required, before access to age-restricted content.
If we become aware that we have collected personal data from a person under 18, we will close the account and delete the data without undue delay, subject to limited retention required for legal compliance. If you believe a minor has provided personal data to us, please contact privacy@bentbox.co immediately.
How We Protect Your Data
We implement technical and organisational measures appropriate to the risk of the processing, taking into account the nature of the data and the state of the art. These measures include:
Security Measures
- Encryption in transit: All connections to the BentBox Service are protected by TLS.
- Encryption at rest: Personal data stored in our databases and object stores is encrypted at rest using industry-standard algorithms.
- Access controls: Access to personal data is restricted to employees and contractors who need it to perform their role, and is logged. All such personnel are subject to written confidentiality obligations.
- Authentication: Account credentials are stored as salted hashes; session tokens are issued as HttpOnly cookies where possible to mitigate exposure to client-side scripts.
- Network controls: Production systems are deployed behind a managed load balancer with rate-limiting and abuse detection; databases and search clusters are isolated within a private virtual network.
- Identity-verification isolation: Identity documents processed through ProntoID are stored separately from public profile data and are not exposed by the BentBox publishing systems.
- Backups and recovery: Encrypted backups are retained for a limited period to support disaster recovery.
- Review and improvement: We review our security practices on an ongoing basis and update them in response to identified risks.
No system can be guaranteed entirely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and we will notify affected users without undue delay where the risk to their rights and freedoms is high, in line with Articles 33 and 34 UK GDPR.
Complaints and Internal Dispute Resolution
If you are unhappy with how we have handled your personal data, a content moderation decision, or any other aspect of the BentBox Service, you can use our internal complaint-handling system, established in accordance with Article 20 of the Digital Services Act.
How to Submit a Complaint
Send your complaint to privacy@bentbox.co with the subject line "Complaint" and include:
- Your account email or username (if applicable)
- A clear description of the issue, including dates and any reference numbers
- The outcome you are seeking
- Any supporting evidence or documents
How We Handle Complaints
- Acknowledgement: We aim to acknowledge complaints within five working days of receipt.
- Investigation: Complaints are reviewed by a member of staff who was not involved in the original decision. We may ask for further information.
- Decision: We aim to provide a substantive response within 30 days. Where a matter is complex, we may take longer and will keep you informed.
- Reversal: Where a complaint is upheld, we will reverse or vary the original decision as appropriate (for example, by reinstating content removed in error or correcting inaccurate data).
External Remedies
Using our internal complaint-handling system does not affect your right to seek external remedies, including:
- Lodging a complaint with a data protection supervisory authority (see the Your Rights section).
- Using an out-of-court dispute settlement body certified under Article 21 of the Digital Services Act.
- Seeking a judicial remedy.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the BentBox Service, or applicable law. When we make a material change, we will update the "Last Updated" date at the top of this Policy and, where the change is significant, we will notify you by email or through a prominent notice on the BentBox Service before the change takes effect.
We encourage you to review this Policy periodically. Continued use of the BentBox Service after a change takes effect indicates that you have read and accepted the updated Policy in respect of future use; it does not affect rights you already have under data protection law.
How to Contact Us
For privacy questions, requests to exercise your rights, or any other matter related to this Policy, please contact us:
Get in Touch
Email: privacy@bentbox.co
Postal address:
Haas & Reed B.V.
Mantelmeeuwhof 15
3582 DN, Utrecht
The Netherlands
We aim to respond to all inquiries promptly. For statutory requests under UK GDPR or EU GDPR, the response timelines set out in the How to Exercise Your Rights section apply.
Last Updated: 29/05/2026 | Version 2.0 | Print This Policy