Privacy Policy

The controller of your personal data is Simon Gracies, Entrepreneur individuel (sole proprietor) registered in France, Being updated. Write to contact@bodyslots.com in the meantime., who runs Bodyslots. Contact: contact@bodyslots.com. We have not appointed a data protection officer: write to this address for any privacy question or request.

Account

Your email address, your role (Body or Sponsor), your date of birth if we ask for it to confirm you are 18 or older, and sign-in records kept by our sign-in provider. If you sign in with Google, Google shares your name and email with us.

Body profile and listings

Display name, handle, profile photo, bio, niche and content style, US state, your social networks with the figures you declare (username, followers, average views, engagement), your audience as you declare it (top locations, main age range, women and men split), your events (type, name, dates, city, link), zone photos, portfolio items, and your zones with their prices and options.

Sponsor profile

Whether you sponsor as a person or a business, your public name (for a person, by default the first name given at payment, never the full name), and for a business: company name, category, website, logo and, for betting, trading or crypto, your certification that the promotion is lawful.

Body photos and 3D body

The 4 photos you take for your 3D body, the cutouts made from them, the 3D model (raw and web versions), its preview image, the position of each zone on it, the result of the automatic checks (photo quality, a description of the outfit, and whether nudity or a possible minor was detected), our team’s review decisions, and your consent record. See the 3D body notice.

Orders, offers and messages

Offers and counter-offers, orders and their activity log, briefs (logo, message, link, promo code, mentions), previews, post links, proofs, raw files, results of our automatic post link checks (with a snapshot of the public post), disputes, ratings and comments, and the messages you exchange with the other side.

Payments

Stripe collects your card or bank details, name and email at payment, and the identity and bank details of Bodies for payouts. We do not receive full card numbers or identity documents. We receive from Stripe the payment status, amounts, Stripe account and customer identifiers, the email and name of buyers without an account, and whether a Body’s account is verified (including whether the Body is 18 or older) and can receive payouts.

Usage and security data

Technical data of each request handled by our host (IP address, browser, time), a keyed hash of your IP address to limit abuse of payments without an account (we do not store the IP address itself for this), the browser type recorded when your 3D body is prepared, records of payment and email events, and cookies (section 10).

What you send us

Emails you send to contact@bodyslots.com and reports you make.

• To run the marketplace (accounts, pages, listings, offers, checkout, orders, payouts, messages, and the emails about them): to perform our contract with you.
• To build and show your 3D body from your photos: your consent, given with the checkbox before the photos are sent. See the 3D body notice.
• To keep Bodyslots safe and fair (outfit, nudity and possible minor checks on photos, contact detail masking before payment, abuse limits, post link checks, fraud prevention, moderation, disputes, security logs): our legitimate interest in a safe, lawful marketplace that both sides can trust.
• To meet legal duties (accounting, tax, age requirements, answering lawful requests from authorities): legal obligation.

We do not send marketing emails, we do not sell your data, and we do not use it for advertising. Some decisions are automatic: an offer under a Body’s hidden lowest offer is declined, a photo set that fails the checks is refused before any generation, and late orders are refunded by timers. You can always ask for a person to review a decision at contact@bodyslots.com.

What we make. From your 4 photos (front, back, left, right) we make a 3D model of your body with its surface texture, a preview image, and the position of each zone. The model shows your body shape and, unless your face is out of the photos, your face and its shape.

How. Your photos are stored in private storage. Before anything is generated, fal.ai removes the background and two Google Gemini vision models (reached through OpenRouter, via fal.ai) describe the outfit and check for nudity or a possible minor. If the photos pass, fal.ai generates the 3D model. Providers get the photos through links that expire (after 24 hours at most). Then your own browser prepares the model for the web and places the zones: this step runs on your device, with a pose detection model downloaded from Google’s servers and a face detector that only tells which way the model faces.

What it is for, and only that. Showing your 3D body on your Bodyslots page, placing sponsors’ logos and names on your zones, letting Sponsors preview their logo before paying, and checking that the photos follow our rules. We never use your photos or 3D model to identify you or to recognize your face, we never sell or rent them, we do not use them to train AI models, and we do not use them for any advertising other than your own listing.

Who sees what. The web version of the model and its preview image are public on your page: anyone can view them, and like any image on the web, someone could save a copy. Your photos, the cutouts and the raw model stay private. Our team accesses them only when needed for a review, support or safety. The providers listed in section 5 process them for us only.

Your consent. We ask for it with a checkbox before your photos are uploaded, and record the date and the version of this notice with each generation. You can withdraw it at any time by writing to contact@bodyslots.com: we then delete your photos and 3D files, and your page shows a sample body instead. Withdrawing does not affect what was done before.

How long we keep them. Your photos, cutouts, 3D models (including earlier scans you replaced) and preview images are kept while your account is open. We delete them within 30 days after you ask us to delete your 3D body or your account. If our team blocked new generations after a review, we keep the record of that decision (not the photos) as long as it is needed to enforce it.

Some US states have laws on biometric data. We do not use your photos or 3D body to identify you, but we apply this notice and ask for your consent in every case.

We use these service providers. They process personal data on our behalf and under our instructions:

• Supabase: Database, sign-in and file storage.
  Data: Account, profile, listings, orders, messages, photos, 3D files, logs. Where: United States (AWS us-east-2, Ohio).
• Stripe: Payments, refunds, payouts to Bodies (Stripe Connect) and identity checks of Bodies (KYC).
  Data: Name, email, payment details, identity and bank details of Bodies, transaction history. Where: United States and other countries where Stripe operates.
• Resend: Email delivery (order, offer, account and sign-in emails).
  Data: Email address, email content. Where: United States.
• fal.ai: 3D body generation (Hunyuan3D model) and image processing (background removal, person segmentation).
  Data: The 4 body photos and the files made from them. Where: United States.
• OpenRouter, with Google Gemini models: Outfit and safety check of the 4 photos, requested through fal.ai.
  Data: The 4 body photos. Where: United States.
• Cloudflare: Hosting, content delivery, security, and routing of email sent to our address.
  Data: Technical data of every request (IP address, browser), emails sent to us. Where: United States and Cloudflare's global network.

Stripe also processes some data for its own purposes, such as fraud prevention and legal compliance, under its own privacy policy.

We also share data with:

• The other side of a deal: a Sponsor sees the Body’s public page and the order; a Body sees the Sponsor’s public name, brief and messages. Email addresses and phone numbers stay hidden in messages until an order between you is paid.
• The public: Body pages (including the 3D body), the sponsor shown on a zone, portfolio items and ratings.
• Social networks: to check a post, we send its public link to the network’s public embed service (TikTok, YouTube, X, Instagram).
• Authorities, when the law requires it, and professional advisers, or a buyer of the business under the same protections.

Our database and files are hosted in the United States (Supabase, AWS region us-east-2, Ohio), and our providers operate mainly in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred outside it. For these transfers we rely on the safeguards offered by each provider: the European Commission’s standard contractual clauses in their data processing terms, or their certification under the EU-U.S. Data Privacy Framework. You can ask us for details at contact@bodyslots.com.

• Account, profile, listings: while your account is open. After you ask us to delete your account, we delete or anonymize them within 30 days.
• Photos and 3D files: see the 3D body notice.
• Orders, payments, refunds, payouts, disputes and their activity log: up to 10 years after the order, as French accounting law requires, and for legal claims.
• Messages, briefs and order files: with the offer or order they belong to, for as long as needed to handle disputes and legal claims, and at most 5 years after the order ends.
• Emails you send us: as long as needed to answer, and at most 3 years.
• Cookies: see section 10.

Today, deletion is done by our team on request: there is no delete button in the app yet. Write to contact@bodyslots.com and we will confirm when it is done.

Wherever you live, you can ask us to:

• give you a copy of your data (access), in a portable format for what you gave us (portability);
• correct it (most of it you can edit yourself in your profile);
• delete it, or delete your 3D body only;
• restrict or object to a use based on our legitimate interest;
• withdraw a consent you gave, such as for the 3D body, at any time.

Write to contact@bodyslots.com from the email of your account. We answer within one month (this can be extended by two months for complex requests, and we will tell you). We may ask you to confirm the request from your account email. Some data must be kept for legal reasons even after a deletion request (section 7).

If you are in the EEA or the UK, you can also complain to your data protection authority. In France, it is the CNIL (cnil.fr). Under French law, you can also give instructions about what happens to your data after your death.

Some US state laws, such as the California Consumer Privacy Act as amended by the CPRA, give residents specific rights. We give these rights to all our users:

• Right to know the categories and specific pieces of personal information we collect, where they come from, why we use them and who we disclose them to (this policy, and a copy on request).
• Right to delete and right to correct your personal information.
• No sale, no sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising, and have not done so in the past 12 months. We have no actual knowledge of selling or sharing data of anyone under 16.
• Sensitive personal information (such as the photos and 3D model of your body) is used only to provide the service you asked for and to keep it safe, never to infer characteristics about you.
• No discrimination for using your rights.

Categories we collect: identifiers (name, email, handle), customer records, commercial information (listings, offers, orders), internet activity on Bodyslots, approximate location (US state), audio and visual information (photos, 3D model, posts), and professional information for businesses. Sources and purposes are in sections 2 and 3, recipients in section 5, and retention in section 7.

To use these rights, write to contact@bodyslots.com. We verify requests by asking you to confirm from the email of your account, and answer within 45 days. An authorized agent can act for you with your signed permission.

Bodyslots uses only cookies that are strictly necessary for the site to work. There is no analytics, no advertising and no tracking pixel, so we do not show a cookie banner.

• Sign-in cookies (names starting with “sb-”): keep you signed in. Set by our sign-in provider, Supabase.
• bs_guest: after a payment without an account, lets this browser show your order confirmation. 30 days.
• bs_cart: the cart of a visitor without an account (zones and options, no prices, no personal details). 30 days.

The payment page is hosted by Stripe on its own domain, with Stripe’s cookies and privacy policy. If we ever add optional cookies, we will ask for your consent first.

We use access rules in the database so each person reads only what they are allowed to, private storage for photos and order files, links that expire for providers, sign-in links that work once, and encrypted connections (HTTPS). No system is perfectly secure: if a breach affects your data in a way that puts you at risk, we will tell you and the authorities as the law requires.

Bodyslots is for people 18 and older. We do not knowingly collect data from anyone under 18. Photos that suggest a possible minor are refused and reviewed by our team. If we learn that a user is under 18, we close the account and delete their photos and 3D files. If you think a minor uses Bodyslots, write to contact@bodyslots.com.

We may update this policy. The date at the top shows the latest version. For an important change, we tell you by email or on the site before it applies, and we ask for your consent again when the law requires it.

contact@bodyslots.com. Simon Gracies, Entrepreneur individuel (sole proprietor) registered in France, Being updated. Write to contact@bodyslots.com in the meantime.. See also our Terms and legal notice.