Privacy policy

This statement describes which personal data we process when you use FemFame, for what purpose, and on what legal basis.

Controller

Data we process

On registration: e-mail, name, role (client or influencer). For influencers additionally: profile details (age, city, topics, tags, channels), portfolio photos, insights (proof as images, optionally as video), status and availability data. For bookings: briefing, time frame, proposed fee, acceptance status. For messages: content and timestamp. On every sign-in: date and time (through our auth provider).

Purposes

Providing platform features (profile, booking, communication), performing the user agreement (Art. 6 (1) lit. b GDPR), verifying clients to prevent abuse (legitimate interest, Art. 6 (1) lit. f GDPR), statutory retention of booking and invoice data (Art. 6 (1) lit. c GDPR, §§ 257 HGB, 147 AO).

Processors

We use a cloud service provider (data centre in the EU, region Frankfurt) for database, authentication, file storage and server-side functions, under a Data Processing Agreement per Art. 28 GDPR. All data is processed in the EU. Web fonts (Big Shoulders Display, Raleway) are self-hosted on our server; no requests go to Google Fonts. The site runs with a hosting provider in Germany and is delivered through the network of Cloudflare (Cloudflare, Inc., USA). Cloudflare acts as a processor and handles the technically necessary access data (IP address, time, requested address); transfers to the USA are based on the EU-US Data Privacy Framework. Account emails (address confirmation, password reset, security notices) are sent through Brevo (Sendinblue SAS, Paris, France) as our processor; for this purpose Brevo processes your email address and the content of the message within the EU. Brevo records whether an email was opened and whether a link in it was clicked: for this the emails contain a tracking pixel, and links pass through an address of Brevo; time, IP address and type of mail program are recorded. We use this information only to follow up on delivery. Emails with a link also give it as plain text; no click is recorded through that one.

Browser storage

We set technically necessary localStorage entries: language preference, theme choice (light/dark), login session token, wishlist. No tracking or analytics cookies, no transfer to third parties.

Retention & deletion

Profile and photo data are deleted when you delete your account in the dashboard (complete removal from database and storage). Booking and communication history are kept in anonymized form (Art. 17 (3) lit. b and e GDPR) for statutory retention (invoices 10 years under § 147 AO) and legal defense. The original link to the person is irreversible after deletion.

Your rights

You have the right to information (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) at any time. You can run the data export (ZIP) and account deletion directly in the dashboard under "Account & Privacy". You may lodge a complaint with a supervisory authority (Art. 77 GDPR).

Security

Data transmission is encrypted via HTTPS. Database access is gated by Row Level Security: every query is checked server-side for permission, regardless of the frontend code. Insights (proof for clients) are kept in private storage and are delivered to verified clients only through short-lived signed links. Public portfolio photos carry the FemFame mark as a watermark.

Contact

Privacy enquiries: mail@femfame.com