Privacy Policy

This page explains which personal data we process when you use OnlyWAM, what for, who receives it, how long we keep it and what rights you have.

Controller

Remotion Digital Ltd., Clifton House, Suite 33, Fitzwilliam Street Lower, Dublin, D02 XT91, Ireland. For data protection questions write to privacy@onlywam.com or use the contact form.

What we process and why

Visiting the website

When you visit, our servers process your IP address, the time, the address requested, your browser and device to deliver the pages, fend off attacks and find errors. The legal basis is Art. 6(1)(f) GDPR (a secure, working service).

Account and age

For your account we process your name, username, email address, password (encrypted), date of birth, country and your profile details. If you sign in with Google or X, we receive your email address and an identifier from them. We use your date of birth to check whether you may see 18+ content. The legal basis is Art. 6(1)(b) GDPR (contract) and, for the age check, Art. 6(1)(f) (protecting minors).

Verification of creators and models

Full creators verify themselves with an ID and a selfie and give their address, city and postcode; creators in the USA also provide Form W-9. Our team checks this by hand to establish age and identity, pay out to the right person and prevent fraud. If a creator gives us the ID or consent of a model, we process it to prove age and consent. The legal basis is Art. 6(1)(b) and (f) GDPR.

Content, messages and moderation

We store what you publish and send, such as posts, stories, comments, likes and messages. Other users see public content and your profile. We review content and messages for moderation, for example after a report. The legal basis is Art. 6(1)(b) and (f) GDPR.

Upload log

When you upload a video for a post as a creator, your browser reports technical events to us, such as start, completion, cancellation, the app moving to the background and back, the network becoming available again, resuming or an unreadable trailer file. It also sends a short error code, the number of parts uploaded, how often the app was in the background and whether your device was online. We store this with your account, the media item concerned, the time and your browser identifier (user agent, shortened). We do not store your IP address or the content of the file for this. This lets us find and fix upload errors and help you when an upload gets stuck. The log is kept in our database at Supabase (see Recipients). Only our team can read it; we do not pass it on to anyone else. The legal basis is Art. 6(1)(f) GDPR (reliable uploads and support). We delete each entry automatically after 90 days. If you delete your account, we remove the entries earlier, together with your other account data.

Purchases, wallet and payouts

For purchases, subscriptions and top-ups we process the amount, time, content, creator and payment method. You enter card details directly with Mollie; we do not receive them. If you top up by bank transfer, you upload a receipt that we match against our bank statements. If you order a physical item, we pass your delivery address and phone number to the creator who ships it. For payouts to creators we process the payout account, the account holder and, where needed, a proof. For self-billing we store when you accepted which version and your browser identifier. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(c) (retention duties).

WAM Points, reviews and recommendations

For WAM Points we store when you did what and check for abuse. We publish reviews with username, stars and text after checking the purchase automatically. The creators we recommend depend on the interests you choose. You can switch recommendations off in your settings. We count views of content and sponsored profiles on our server, for guests with a check value that changes daily. We do not store the IP address for this. The legal basis is Art. 6(1)(b) and (f) GDPR.

Referral links

If you arrive via a creator's referral link and register, we store who referred you. We take the code from the address of the link. You see it when you register and can remove it. The legal basis is Art. 6(1)(b) and (f) GDPR.

Emails

We send you emails your account needs, for example for confirmation, passwords, purchases and payouts (Art. 6(1)(b) GDPR). If you bought from us and your last purchase was no more than 12 months ago, we email you about similar offers on OnlyWAM (Art. 6(1)(f) GDPR). You can object at any time via the unsubscribe link or in your settings. Others only receive such emails with their consent (Art. 6(1)(a) GDPR).

Push notifications

We only send push notifications if you turn them on in the app or in your settings and give your browser permission. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: turn push off under Settings → Notifications or remove the permission in your browser.

For this we store with your account the address your browser creates for delivery (endpoint) and two keys. We use them to encrypt every notification before it leaves our server. Only your device can read it. What appears on your lock screen is set on your device. We delete the endpoint and keys as soon as you turn push off, as soon as the push service tells us they no longer exist (for example because you removed the permission or the app), and when you delete your account.

Notifications are delivered through your browser's push service: Apple (Safari and web apps on iPhone and iPad), Google (Chrome and most Android browsers), Mozilla (Firefox) or Microsoft (Edge). Your browser decides which service it is, not us, and its provider is responsible for it. From us it only receives the endpoint, the encrypted notification and technical delivery details, not your name and not the readable content.

These services also run on servers in the USA. Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework. For them the European Commission's adequacy decision of 10 July 2023 applies. Apple Inc. and Mozilla Corporation are not certified there (as of October 2026), so there is no adequacy decision for them. We transfer the data to them because this is necessary to deliver the notifications you turned on (Art. 49(1)(b) GDPR). US authorities may be able to access the delivery data without you having the same legal remedies as in the EU.

AI features

We use AI models from Anthropic: for text suggestions in the Social Planner (title and description of your post), to match bank transfer receipts (image of the receipt, amount, reference) and to identify models in post texts. Our team makes the decisions. The legal basis is Art. 6(1)(b) and (f) GDPR.

Social Planner

If you connect your X or Instagram account as a creator, we store the access keys and send planned texts and images to X or Meta. The legal basis is Art. 6(1)(b) GDPR.

Contact and reports

If you write to us or report content, we process your message, the reported content and, if you provide them, your name and email address. To prevent spam we store a check value of your IP address. The legal basis is Art. 6(1)(b), (c) and (f) GDPR.

Internal analysis

For an internal map we convert postcode, city and country from stored addresses into map points using Nominatim (OpenStreetMap Foundation). For support, our team can open your account in a support view for up to 4 hours. The legal basis is Art. 6(1)(f) GDPR.

Recipients

Service providers working for us are bound under Art. 28 GDPR.

Independent controllers are Mollie where it checks payments itself, Google and X when you sign in with them, X and Meta in the Social Planner, Google (YouTube) when you play an embedded video, and the provider of your crypto wallet if you connect one. Authorities only receive data where we are obliged to share it. You can get a copy of the standard contractual clauses via privacy@onlywam.com.

How long we keep data

• Account and profile: as long as your account exists; after that see "Deleting your account".
• Unconfirmed accounts: until the confirmation period ends.
• Media files of deleted accounts: up to 90 days.
• Statistics: 90 days; read notifications 30 days; requests for confirmation emails 30 days.
• Upload log: 90 days.
• Payments, receipts and payouts: 6 years, as Irish tax law requires.
• IDs and proof of age and consent: after the account is deleted, as long as we need them to defend legal claims and answer requests from authorities.
• Contact requests and reports: up to 3 years after they are closed.
• Server logs: only as long as our hosting providers keep them, usually a few days.

Do you have to provide data

For an account we need your name, username, email address, password and date of birth; for payouts we need verification and a payout account. Everything else is voluntary. We do not make solely automated decisions under Art. 22 GDPR.

Deleting your account

You delete your account in your settings. A balance does not prevent deletion. As a creator you must complete open payouts and orders you still have to deliver first.

• Your profile is hidden straight away. For 30 days you can cancel the deletion; for creators it can take longer, until their fans' paid subscriptions have run out. After that we delete or anonymise your data.
• We refund, on request, any wallet balance you paid in and have not spent. Bonus balance and balance from WAM Points lapse.
• We pay out creators' remaining balance in monthly payments of up to €500, as described in the Creator Terms.
• Messages you sent stay with the other person; you appear as an anonymous sender.

Data we have to keep is blocked for any other use and deleted when the period ends.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw consent at any time with effect for the future. Write to privacy@onlywam.com, ideally from your account's email address.

Right to object (Art. 21 GDPR): Where we process data based on legitimate interests, you can object at any time on grounds relating to your particular situation. You can object at any time, without giving reasons, to the use of your data for marketing emails.

You can lodge a complaint with the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, www.dataprotection.ie, or with the supervisory authority in your country.

Cookies and storage on your device

We set necessary cookies and storage without consent (Regulation 5(5) of S.I. No. 336/2011). External media (YouTube videos) only load with your consent (Regulation 5(3) of S.I. No. 336/2011, Art. 6(1)(a) GDPR); you can load a single video with one click if you want. Google Ireland Limited then receives your IP address and device data; any transfer to Google LLC in the USA relies on the adequacy decision for the EU-US Data Privacy Framework. We do not set advertising or tracking cookies. You can withdraw your consent at any time under “Cookie settings”; this applies from then on (Art. 7(3) GDPR). We keep your choice for six months in the cookie ow_consent. To prove that you consented or refused (Art. 7(1) GDPR), we log a random ID, time, version and chosen categories without your IP address and without any link to your account (Art. 6(1)(c) GDPR) and delete the log after 24 months. Details in the cookie policy.

We take a creator's referral code only from the address, not from a cookie. We do not load any third-party script for push notifications. All details are in the cookie policy. You can delete cookies and storage in your browser settings.

Last updated: November 2026.