Privacy Policy
This policy explains what Talissa AI collects, why, and what you can do about it. It is written for two audiences: the creators and agencies who use the Service (our customers), and the fans whose messages the Service processes on a creator's behalf.
1. Controller
Strava Ltd (HE 453118), 11 Zinonos Sozou Street, Office 303, 1075 Nicosia, Cyprus, is the controller for customer account data. For fan data, the creator (or their agency) is the controller and we are the processor acting on their instructions. Contact for anything in this policy: contact@talissa.ai.
2. What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Account: name, email, password (hashed), role, agency; if you turn on two-step sign-in, its secret key (encrypted) and your recovery codes (hashed) | Sign-in, invitations, security notices | Contract | Life of the account + 30 days |
| Persona: tone, languages, limits, blocked words | Drafting replies in the creator's voice | Contract | Life of the account |
| Catalogue: titles, tags, prices, references to media in Platform vaults | Suggesting and preparing paid messages | Contract | Life of the account |
| Fan messages, drafts, sent replies, who or which rule approved them, and the creator's own messages seen in the conversation on the Platform | Drafting, human review, audit trail of sends | Processing on the creator's instructions | Deleted automatically once older than 180 days; earlier on the creator's request |
| Fan profile: display name, language, purchases, tier | Tailoring replies and offers per fan | Processing on the creator's instructions | Deleted after 180 days without any message or purchase; earlier on request |
| The creator's OnlyFans lists: each list's name and size, the meaning she gives it, and the platform identifiers of the fans in it (read once a day in her server browser) | Showing the list on a fan's card; not offering content to a fan she put in a "no sale" list; treating her "big spender" lists as VIP; ignoring the fans of a list she chose to ignore | Processing on the creator's instructions | Replaced at each daily read; deleted when the list disappears from OnlyFans, when the fan's data is erased, or when the creator leaves |
| The subscription of each fan of the creator's OnlyFans page, as OnlyFans shows it to her: subscription start and end, whether it renews, the price paid, and the fan's net spending on her page by type (subscriptions, tips, messages, posts, streams), with the date of his last activity (read once a day in her server browser, with her list of fans) | Showing on the fan's card whether his subscription renews, ends or has ended, and what he has spent on her page; suggesting a message, checked by a person, when a paid subscription ends soon with renewal off or has just ended (she can turn this off) | Processing on the creator's instructions | Replaced at each daily read; deleted when the fan's data is erased or when the creator leaves |
| Photos and videos in an OnlyFans conversation: which media, its type, who sent it and when (kept); the thumbnail itself is fetched from OnlyFans through the creator's server browser only when someone opens the conversation in the console, and is never stored on our servers | Letting the team see what a fan sent, in the console | Processing on the creator's instructions | The record of the media: until the fan's data is erased or the creator leaves; the thumbnail: not kept |
| Team notes about a fan: the text a creator, her agency or a chatter writes on the fan's card, who wrote it and when | Sharing what the team knows about a fan; the latest notes are given to the AI as private context for drafts, never quoted | Processing on the creator's instructions | Until removed by their author, the creator or her agency; deleted when the fan's data is erased or when the creator leaves |
| Fans the creator chose to ignore or always handle herself: the fan's platform identifier, the choice, who made it and when | Not processing an ignored fan's messages at all; never sending automatically to a fan handled by a person | Processing on the creator's instructions | Until the creator changes it or leaves; kept when the fan's data is erased, so the instruction keeps applying |
| Payments reported by a Platform (amount, date, message id) | Revenue statistics, fan tiers | Processing on the creator's instructions; legal obligation for accounting | Kept for accounting, detached from the fan once the fan is erased |
| OnlyFans session of the server browser (cookies, browser profile) | Reading the inbox and sending approved messages on OnlyFans | Contract | Until the creator disconnects or leaves; encrypted when the browser is closed |
| Dedicated IP credentials | Connecting the creator's server browser through their own IP address | Contract | Until the IP is released; stored encrypted |
| Media uploaded to build a paid bundle | Importing them into the creator's own Platform vault | Contract | Deleted as soon as the import ends, at most 2 hours if it is abandoned |
| Messages stopped by the message guard: when, from where (draft, console, this site, mass message), who tried to send it, why, and the word involved — never the message itself or the fan; a phone number or an e-mail address is kept masked | Protecting the creator's account from wording and contact details that get accounts restricted; letting the creator and her agency see what was stopped | Legitimate interest (protecting the account) | 90 days |
| Autonomy settings: situations, limits, who switched them on and when | Sending on the creator's behalf only where they chose to | Contract | Life of the account |
| Platform tokens (Fanvue OAuth) | Reading and sending messages through the Platform's official API | Contract | Until disconnected |
| Technical logs: IP address, user agent, timestamps, errors | Security, rate limiting, debugging | Legitimate interest | 90 days |
| Subscription and invoices | Billing | Contract, legal obligation | 10 years (accounting) |
We do not keep photos or videos. Files uploaded for a bundle only pass through our servers on their way to the creator's own Platform vault; afterwards the Service keeps only references (identifiers, folder names) to media stored in the Platforms' libraries.
3. Where the data goes
- Our servers, hosted in France by Ikoula (Reims, EU). The language models run on these servers: no message is sent to a third-party AI provider.
- Platforms the creator connects: today OnlyFans and Fanvue. Fanvue through its official API; OnlyFans through the creator's own browser running on our servers (section 4). They receive the messages that are approved to be sent.
- Dedicated IP provider: IPRoyal Services FZE LLC (United Arab Emirates) supplies the IP address each creator's server browser uses to reach OnlyFans. The traffic passes through its servers inside an encrypted HTTPS connection: IPRoyal sees that a connection to OnlyFans exists, not its content.
- Email delivery for account notices, from our own mail server in the EU.
- Payment processor: Stripe Payments Europe, Ltd. (Ireland) processes subscriptions. It receives your billing details when you subscribe; we never see your full card number.
- Operational alerts to our team through Telegram. They name the creator account concerned (for example "their IP is not answering") and never contain messages or fan data.
No data is sold, and none is used to train models for other customers. The fonts and images of talissa.ai are served from our own servers: visiting the site sends nothing to Google or any other third party.
4. The server browser and the chatter console
Server browser (OnlyFans). Each creator who connects OnlyFans gets their own browser on our servers, on an IP address that is theirs alone. They sign in themselves, typing their password and code into OnlyFans' own page: nobody at Talissa AI or in their agency sees them, and we do not store them. OnlyFans then keeps a session in that browser, which reads their inbox and sends what was approved, inside their active hours. When the browser is closed, its profile (and with it the session) is encrypted at rest (AES-256-GCM). The creator can end it at any time by signing out from OnlyFans or asking us to disconnect it.
Chatter console (desktop app for macOS and Windows, signed by Strava Ltd). Your team signs in with their Talissa AI accounts. It shows the queue and sends decisions to our servers; it keeps only display preferences (skin, text size, sound) on the computer, and updates itself from talissa.ai.
5. Cookies
talissa.ai uses one cookie, velvet_session, strictly necessary to keep you signed in (30 days, or until you sign out). No analytics, advertising or third-party cookies. Your theme choice is stored in your browser's local storage. No consent banner is needed for these, and none is shown.
6. Security
Passwords are stored as salted scrypt hashes; sign-in and password-reset links, and two-step recovery codes, are stored as fingerprints only; the two-step secret key is encrypted. OnlyFans sessions and dedicated IP credentials are encrypted at rest. Every request is scoped to the creators you are allowed to see. Connections are encrypted in transit. A message can only be marked as sent with an approval on record: a named person, or an autonomy rule that a named person switched on, with its limits. This rule is enforced in the database itself.
7. Transfers outside the European Union
Our servers and the language models are in the EU. Two providers are outside it: IPRoyal (United Arab Emirates), which only relays encrypted OnlyFans traffic it cannot read, and Telegram, which carries internal alerts without messages or fan data. Stripe may process billing data outside the EU under its own safeguards (EU Standard Contractual Clauses).
8. Your rights
Under the GDPR and similar laws you can ask for access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interest. Customers exercise these rights from their account or by writing to contact@talissa.ai; we answer within 30 days. Fans should address the creator they wrote to, who is the controller for their data; they can export or erase everything about a fan in two clicks, and we help them respond. You can also complain to your data protection authority: in Cyprus, the Office of the Commissioner for Personal Data Protection; in France, the CNIL.
9. Retention and deletion
Fan messages and drafts are deleted automatically once they are older than 180 days, and a fan profile without any message or purchase for 180 days is deleted too. When an account is closed, its data is deleted within 30 days, its dedicated IP is released and its server browser removed, except invoices and security logs kept for the periods above. A creator can ask their agency, or us, to delete their conversations and fan data at any time.
10. Children
The Service is for adults only. We do not knowingly process data of anyone under 18; if you believe we do, write to us and we will delete it.
11. Changes
We will email account holders about material changes to this policy at least 15 days before they take effect.