Not So Vanilla
Terms of ServicePrivacy Policy

Privacy Policy

Last updated: July 3, 2026

1. Who We Are

Not So Vanilla ("we," "us," "our") operates the Platform at notsovanilla.app and creator subdomains. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

2. Information We Collect

We collect the following categories of information:

  • Account information: Email address and display name when you register. If you sign in with Google, we receive your email and profile name from Google.
  • Purchase information: Items purchased, order totals, and the CashApp note you provide for payment reconciliation. We do not store payment card numbers or full financial account details.
  • Usage data: Pages visited, link clicks on creator pages, and general interaction data to help creators understand their audience. This data is associated with your session, not your identity.
  • Age verification: When you confirm you are 18 or older via the age gate, we store that acknowledgment in your browser session storage only. We do not collect or store government ID information.
  • Uploaded content: Creators upload photos and videos which are stored in our secure cloud storage. Buyers receive time-limited access to purchased content via expiring signed URLs.

3. How We Use Your Information

  • To provide, operate, and improve the Platform.
  • To process and fulfill orders and deliver digital content.
  • To authenticate your account and maintain session security.
  • To provide creators with anonymized analytics about their page traffic.
  • To send transactional emails (order confirmation, account notices). We do not send marketing email without your consent.
  • To comply with legal obligations and enforce our Terms of Service.

4. Third-Party Services

We use the following third-party services that may process your data:

  • Supabase — database, authentication, and file storage (US-based).
  • Vercel — hosting and edge delivery.
  • Cloudflare — DNS and DDoS protection.
  • Google — optional OAuth sign-in only; we do not use Google Analytics.

We do not sell, rent, or share your personal information with advertisers or data brokers. We do not use third-party AI services to process your personal data or content.

5. Content and Storage

Digital content purchased by buyers is stored in private cloud storage. Access is controlled by server-side signed URLs that expire after one hour. We do not encrypt files at the client level; security is enforced through access control policies and authenticated sessions.

Creator-uploaded profile and hero photos are stored in a public-read bucket for display on their public pages. Paid content is stored in a private bucket accessible only to verified purchasers and administrators.

6. Data Retention

  • Account data is retained for as long as your account is active.
  • Order and library records are retained indefinitely to preserve your access to purchased content.
  • If you delete your account, we will remove your personal data within 30 days, except where retention is required by law or to resolve disputes.
  • Creator content is removed within 30 days of account termination.

7. Cookies and Local Storage

We use browser session storage to remember your age verification within a session. We use cookies only for authentication (Supabase session cookie). We do not use tracking cookies or third-party advertising cookies.

8. Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and personal data.
  • Object to or restrict certain processing of your data.

To exercise any of these rights, contact us at support@notsovanilla.app. We will respond within 30 days.

9. Children's Privacy

This Platform is strictly for adults 18 years of age or older. We do not knowingly collect any personal information from individuals under 18. If we become aware that a minor has provided personal information, we will delete it immediately and terminate their access.

10. Security

We implement industry-standard security measures including HTTPS, row-level security on our database, time-limited signed URLs for content delivery, and restricted admin access. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but take reasonable precautions to protect your data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page. Continued use of the Platform after changes constitutes acceptance of the revised Policy.

12. GDPR / International Users

If you are located in the European Union, European Economic Area, or United Kingdom, the following applies to you under the General Data Protection Regulation (GDPR) and applicable UK data protection law.

  • Lawful basis for processing: We process your data on the following bases: (a) contract performance — to deliver purchases and operate your account; (b) legitimate interest — to prevent fraud, enforce our Terms, and maintain platform security; and (c) consent — for marketing or promotional email, which you may withdraw at any time.
  • Article 20 — Data portability: You may request a copy of the personal data we hold about you in a structured, commonly used, machine-readable format. To make such a request, email privacy@notsovanilla.app.
  • Article 77 — Right to lodge a complaint: You have the right to lodge a complaint with your local EU or UK supervisory authority if you believe we have processed your personal data in violation of applicable law.
  • International data transfers: Your personal data is stored in the United States via Supabase and Vercel. These transfers are made under the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards. By using the Platform, you acknowledge that your data may be transferred to and processed in the United States.

13. Contact

For privacy questions or to exercise your data rights, contact us at privacy@notsovanilla.app. We will respond within 30 days.