Privacy Policy

1. Who is responsible for your data

GetHuffi, based in the United States, decides how and why your data is processed on the Platform, and is the data controller for the purposes of the GDPR and equivalent laws.

For any question about this policy or about your data, write to [email protected].

2. What we collect

Data you give us

• Registration: username, email address, date of birth, and a password, which is stored as a hash and never in readable form
• Profile: anything you choose to add, such as a description, location, avatar or custom field
• Content: listings, images, private messages, ratings and posts
• Correspondence: what you send us by email or through the contact form

You choose your username. We do not ask for your real name, and we recommend that you do not use it.

Data collected automatically

• IP address
• Browser and device information sent by your browser
• Pages viewed and actions taken on the Platform
• Dates and times of access

What we never collect

• Identity documents
• Payment card or bank details — payments for paid features go directly to Tribute, and payments between members happen entirely outside the Platform
• Your real name, unless you volunteer it

3. Why we use it, and on what basis

Running your account	Performance of a contract
Publishing your content	Performance of a contract
Delivering paid features	Performance of a contract
Age confirmation	Legal obligation
Security, fraud and abuse prevention	Legitimate interest
Moderation and handling reports	Legitimate interest and legal obligation
Service emails	Performance of a contract
Audience measurement	Consent

4. Private messages

Messages between members are private in the sense that other members cannot read them.

Connections between your browser and the Platform are protected in transit by TLS.

5. Who sees your data

We do not sell your data. We do not share it with advertisers.

Your username, profile and content are visible to other members according to the settings you choose. Everything else is shared only with the following service providers, who process data on our behalf:

Hosting provider New York, United States	Stores the Platform and its database
Cloudflare, Inc. United States	Content delivery, DDoS protection and traffic filtering. Processes your IP address and request data.
Mailgun Technologies, Inc. United States	Delivers service emails. Processes your email address and the content of those emails.
Google Analytics Google LLC, United States	Audience measurement. Runs only where you have consented.
Tribute	Processes payments for paid features. You deal with Tribute directly and your payment data does not pass through us.

We also disclose data to competent authorities where we are legally required to do so.

6. How long we keep it

• Account data: for as long as your account exists
• Content: until you delete it, or until the account is deleted
• IP addresses: stored alongside the account and the actions they relate to, and deleted when the account is deleted
• Server and security logs: retained on a rolling basis for operational and security purposes
• Records relating to a violation: for as long as necessary to handle the matter and to comply with the law, which may be after the account is deleted
• Backups: deleted data may persist in backups for a limited period before those backups are overwritten

7. Where your data is processed

The Platform is hosted in New York, United States. Cloudflare, Mailgun and Google Analytics also process data in the United States.

If you are in the European Economic Area, the United Kingdom or Switzerland, this means your data is transferred outside your region. Those transfers rely on the Standard Contractual Clauses approved by the European Commission, or on an adequacy decision where one applies to the provider concerned.

You can request further information about these safeguards at [email protected].

8. Your rights

Depending on where you live, you may have the right to:

• Ask what data we hold about you and receive a copy
• Have inaccurate data corrected
• Have your data deleted
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent where processing is based on it
• Complain to your data protection authority

To exercise any of these, write to [email protected] from the email address registered on your account. We respond within one month.

Some data cannot be deleted on request where we must keep it to comply with a legal obligation or to prevent repeat abuse.

9. Cookies

Necessary cookies

These are required for the Platform to work and cannot be switched off:

xf_csrf	A unique token confirming that an action was performed by you and not by a third party on your behalf
xf_session	Identifies your current browsing session
xf_user	Keeps you signed in between visits

We also store your preferences, such as the language and style you selected.

Analytics cookies

Google Analytics sets cookies to measure how the Platform is used. These run only if you consent, and you can withdraw consent at any time using the cookie control in the footer.

You can delete cookies in your browser settings. Removing necessary cookies will sign you out.

10. Children

The Platform is for adults only. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a person under 18, we terminate it and delete the associated data.

If you believe a minor has registered, write to [email protected] immediately.

11. Changes

We may update this policy. Where a change is material, we will give notice on the Platform before it takes effect. The date at the top shows when it was last revised.