Privacy Policy

The controller of your personal data is Simon Gracies EI, Entrepreneur individuel (sole proprietor) registered in France, 33B rue Copernic, 75116 Paris, France, who runs Bodyslots. Contact: contact@bodyslots.com. We have not appointed a data protection officer: write to this address for any privacy question or request.

Account

Your email address, your role (Body or Sponsor), your date of birth if you sell as a Body (to confirm you are 18 or older; other users never see it), and sign-in records kept by our sign-in provider.

If you choose Continue with Google, we ask Google for your email address only. Google sends it with an identifier of your Google account, whether Google verified the address, and for a work account its domain. We use them to find or create your account; they are kept with your sign-in records. Google learns that you signed in to Bodyslots, under its own privacy policy. Nothing is loaded from Google before you tap the button.

Body profile and listings

Display name, handle, profile photo, bio, niche and content style, US state, your social networks (username, followers), your audience as you declare it (top locations, main age range, women and men split), your events (type, name, dates, city, link, level, and whether a logo is allowed during the event), zone photos, portfolio items, and your zones with their prices and options, including your prices at events.

Your numbers (Bodies)

For each network, the views of your last 12 Reels or videos and, if you give them, the reach of your last 6 photos, with a screenshot of your Reels tab. We compute the medians from them (the views expected for one video and one photo), which are public on your page, and record whether our team verified them against your public profile. The numbers you type and the screenshot are seen only by you and our team.

Sponsor profile

Whether you sponsor as a person or a business, your public name (for a person, by default the first name given at payment, never the full name), and for a business: company name, category, website, logo and, for betting, trading or crypto, your certification that the promotion is lawful. If you turn on a public page (off by default), it also has a handle and the description you write.

Body photos and 3D body

The 4 photos you take for your 3D body, the cutouts made from them, the 3D model (raw and web versions), its preview image, the position of each zone on it, the result of the automatic checks (photo quality, a description of the outfit, and whether nudity or a possible minor was detected), our team’s review decisions, and your consent record. See the 3D body notice.

Orders, offers and messages

Offers and counter-offers, orders and their activity log, what the Sponsor gives at payment to show on the zone (a logo or a name, and a tag for the caption), post links, screenshots of the posts, raw files, results of our automatic post link checks (with a snapshot of the public post), the stats a Body sends for each post (views, reach and a screenshot), disputes, ratings and comments, and the messages you exchange with the other side.

Shipping address (Bodies)

We print the logo or name of every order as temporary tattoos and ship them to you. For that you give a name and a US shipping address on your profile (needed before your zones go live), or on an order page with the dates you are at that address. Only you, our team and our printer see it: the printer gets it by email with each order, only to print and ship your stickers. Sponsors never see it.

Payments

Stripe collects your card or bank details, name and email at payment, and the identity and bank details of Bodies for payouts. We do not receive full card numbers or identity documents. We receive from Stripe the payment status, amounts, Stripe account and customer identifiers, the email and name of buyers without an account, and whether a Body’s account is verified (including whether the Body is 18 or older) and can receive payouts.

Usage and security data

Technical data of each request handled by our host (IP address, browser, time), a keyed hash of your IP address to limit abuse of payments without an account (we do not store the IP address itself for this), the browser type recorded when your 3D body is prepared, records of payment and email events, and cookies (section 10).

What you send us

Emails you send to contact@bodyslots.com and reports you make.

• To run the marketplace (accounts, pages, listings and their suggested prices, offers, checkout, orders, the printing and shipping of the stickers, post stats, payouts, messages, and the emails about them): to perform our contract with you.
• To build and show your 3D body from your photos: your consent, given with the checkbox before the photos are sent. See the 3D body notice.
• To keep Bodyslots safe and fair (outfit, nudity and possible minor checks on photos, contact detail masking before payment, abuse limits, post link checks, checking the numbers Bodies give against their public profile, fraud prevention, moderation, disputes, security logs): our legitimate interest in a safe, lawful marketplace that both sides can trust.
• To meet legal duties (accounting, tax, age requirements, answering lawful requests from authorities): legal obligation.

We do not send marketing emails, we do not sell your data, and we do not use it for advertising. Some decisions are automatic: an offer under a Body’s hidden lowest offer is declined, a photo set that fails the checks is refused before any generation, the suggested price of a zone and the prices a Body can choose come from the numbers they give, and late orders are refunded by timers. You can always ask for a person to review a decision at contact@bodyslots.com.

What we make. From your 4 photos (front, back, left, right) we make a 3D model of your body with its surface texture, a preview image, and the position of each zone. The model shows your body shape and, unless your face is out of the photos, your face and its shape.

How. Your photos are stored in private storage. Before anything is generated, fal.ai removes the background and two Google Gemini vision models (reached through OpenRouter, via fal.ai) describe the outfit and check for nudity or a possible minor. If the photos pass, fal.ai generates the 3D model. Providers get the photos through links that expire (after 24 hours at most). Then your own browser prepares the model for the web and places the zones: this step runs on your device, with a pose detection model downloaded from Google’s servers and a face detector that only tells which way the model faces.

What it is for, and only that. Showing your 3D body on your Bodyslots page, placing sponsors’ logos and names on your zones, letting Sponsors preview their logo before paying, and checking that the photos follow our rules. We never use your photos or 3D model to identify you or to recognize your face, we never sell or rent them, we do not use them to train AI models, and we do not use them for any advertising other than your own listing.

Who sees what. The web version of the model and its preview image are public on your page: anyone can view them, and like any image on the web, someone could save a copy. Your photos, the cutouts and the raw model stay private. Our team accesses them only when needed for a review, support or safety. The providers listed in section 5 process them for us only.

Your consent. We ask for it with a checkbox before your photos are uploaded, and record the date and the version of this notice with each generation. You can withdraw it at any time by writing to contact@bodyslots.com: we then delete your photos and 3D files, and your page shows a sample body instead. Withdrawing does not affect what was done before.

How long we keep them. Your photos, cutouts, 3D models (including earlier scans you replaced) and preview images are kept while your account is open. We delete them within 30 days after you ask us to delete your 3D body or your account. If our team blocked new generations after a review, we keep the record of that decision (not the photos) as long as it is needed to enforce it.

Some US states have laws on biometric data. We do not use your photos or 3D body to identify you, but we apply this notice and ask for your consent in every case.

We use these service providers. They process personal data on our behalf and under our instructions:

• Supabase: Database, sign-in and file storage.
  Data: Account, profile, listings, orders, messages, photos, 3D files, logs. Where: United States (AWS us-east-2, Ohio).
• Stripe: Payments, refunds, payouts to Bodies (Stripe Connect) and identity checks of Bodies (KYC).
  Data: Name, email, payment details, identity and bank details of Bodies, transaction history. Where: United States and other countries where Stripe operates.
• Resend: Email delivery (order, offer, account and sign-in emails).
  Data: Email address, email content. Where: United States.
• fal.ai: 3D body generation (Hunyuan3D model) and image processing (background removal, person segmentation).
  Data: The 4 body photos and the files made from them. Where: United States.
• OpenRouter, with Google Gemini models: Outfit and safety check of the 4 photos, requested through fal.ai.
  Data: The 4 body photos. Where: United States.
• Our partner printer: Printing the logo or name of every order as temporary tattoos and shipping them to the Body with tracking, ordered by email.
  Data: The Body's name and shipping address, the Sponsor's logo or the name to print, the order number and the day it is worn. Where: United States.
• Cloudflare: Hosting, content delivery, security, and routing of email sent to our address.
  Data: Technical data of every request (IP address, browser), emails sent to us. Where: United States and Cloudflare's global network.

Stripe also processes some data for its own purposes, such as fraud prevention and legal compliance, under its own privacy policy.

We also share data with:

• The other side of a deal: a Sponsor sees the Body’s public page, the order and the stats the Body sends for each post; a Body sees the Sponsor’s public name, the logo or name to show, and messages. Email addresses and phone numbers stay hidden in messages until an order between you is paid, and a Body’s shipping address is never shown to a Sponsor.
• The public: Body pages (including the 3D body and the median views computed from the Body’s numbers), the sponsor shown on a zone, portfolio items and ratings, and the public page of a sponsor that turned one on (its name, logo, website, description and the finished deals the Bodies show).
• Social networks: to check a post, we send its public link to the network’s public embed service (TikTok, YouTube, X, Instagram).
• Authorities, when the law requires it, and professional advisers, or a buyer of the business under the same protections.

Our database and files are hosted in the United States (Supabase, AWS region us-east-2, Ohio), and our providers operate mainly in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred outside it. For these transfers we rely on the safeguards offered by each provider: the European Commission’s standard contractual clauses in their data processing terms, or their certification under the EU-U.S. Data Privacy Framework. You can ask us for details at contact@bodyslots.com.

• Account, profile, listings: while your account is open. After you ask us to delete your account, we delete or anonymize them within 30 days.
• Photos and 3D files: see the 3D body notice.
• Orders, payments, refunds, payouts, disputes and their activity log: up to 10 years after the order, as French accounting law requires, and for legal claims.
• Messages, logos given with orders, order files and post stats: with the offer or order they belong to, for as long as needed to handle disputes and legal claims, and at most 5 years after the order ends.
• Shipping address: the one on your profile until you remove it or close your account. The copy kept with an order is erased 30 days after the parcel ships (in case it gets lost), and at once when nothing ships.
• Your numbers and the screenshots of your Reels tab: while your account is open. New numbers for a network replace the previous ones.
• Emails you send us: as long as needed to answer, and at most 3 years.
• Cookies: see section 10.

Today, deletion is done by our team on request: there is no delete button in the app yet. Write to contact@bodyslots.com and we will confirm when it is done.

Wherever you live, you can ask us to:

• give you a copy of your data (access), in a portable format for what you gave us (portability);
• correct it (most of it you can edit yourself in your profile);
• delete it, or delete your 3D body only;
• restrict or object to a use based on our legitimate interest;
• withdraw a consent you gave, such as for the 3D body, at any time.

Write to contact@bodyslots.com from the email of your account. We answer within one month (this can be extended by two months for complex requests, and we will tell you). We may ask you to confirm the request from your account email. Some data must be kept for legal reasons even after a deletion request (section 7).

If you are in the EEA or the UK, you can also complain to your data protection authority. In France, it is the CNIL (cnil.fr). Under French law, you can also give instructions about what happens to your data after your death.

Some US state laws, such as the California Consumer Privacy Act as amended by the CPRA, give residents specific rights. We give these rights to all our users:

• Right to know the categories and specific pieces of personal information we collect, where they come from, why we use them and who we disclose them to (this policy, and a copy on request).
• Right to delete and right to correct your personal information.
• No sale, no sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising, and have not done so in the past 12 months. We have no actual knowledge of selling or sharing data of anyone under 16.
• Sensitive personal information (such as the photos and 3D model of your body) is used only to provide the service you asked for and to keep it safe, never to infer characteristics about you.
• No discrimination for using your rights.

Categories we collect: identifiers (name, email, handle), customer records, commercial information (listings, offers, orders), internet activity on Bodyslots, approximate location (US state), the shipping address of Bodies, audio and visual information (photos, 3D model, posts, screenshots), and professional information for businesses. Sources and purposes are in sections 2 and 3, recipients in section 5, and retention in section 7.

To use these rights, write to contact@bodyslots.com. We verify requests by asking you to confirm from the email of your account, and answer within 45 days. An authorized agent can act for you with your signed permission.

Bodyslots uses only cookies that are strictly necessary for the site to work. There is no analytics, no advertising and no tracking pixel, so we do not show a cookie banner.

• Sign-in cookies (names starting with “sb-”): keep you signed in. Set by our sign-in provider, Supabase.
• __Host-bs_google: only while you sign in with Google, so that Google’s answer is matched to the sign-in you started here. 10 minutes at most, removed when you are back.
• bs_guest: after a payment without an account, lets this browser show your order confirmation. 30 days.
• bs_cart: the cart of a visitor without an account (zones and options, no prices, no personal details). 30 days.

The payment page is hosted by Stripe on its own domain, with Stripe’s cookies and privacy policy. If we ever add optional cookies, we will ask for your consent first.

We use access rules in the database so each person reads only what they are allowed to, private storage for photos and order files, links that expire for providers, sign-in links that work once, and encrypted connections (HTTPS). No system is perfectly secure: if a breach affects your data in a way that puts you at risk, we will tell you and the authorities as the law requires.

Bodyslots is for people 18 and older. We do not knowingly collect data from anyone under 18. Photos that suggest a possible minor are refused and reviewed by our team. If we learn that a user is under 18, we close the account and delete their photos and 3D files. If you think a minor uses Bodyslots, write to contact@bodyslots.com.

We may update this policy. The date at the top shows the latest version. For an important change, we tell you by email or on the site before it applies, and we ask for your consent again when the law requires it.

contact@bodyslots.com. Simon Gracies EI, Entrepreneur individuel (sole proprietor) registered in France, 33B rue Copernic, 75116 Paris, France. See also our Terms and legal notice.