Privacy policy

The controller of your personal data is MiMa IT FZ-LLC, S18421S, New Shed No. 18, Al Hulaila Industrial Free Zone, Ras Al Khaimah, United Arab Emirates (licence no. 47006187). For any privacy question or request, write to message@olga-ferbey.com.

• Account: your name, email address, password (stored only as a one-way hash), whether you confirmed your email, and the date you confirmed you are 18 or older and accepted the terms.
• Membership and payments: your membership status, renewal date and payment history. Card details are entered on Stripe’s secure checkout and stay with Stripe; we never receive your full card number.
• Gifts: the amount, the name and note you add, and the time you sent it.
• Messages and enquiries: the name, email address and message you send through the contact, store, wishlist or gift forms, and anything you write to us by email.
• Livestreams: chat messages and reactions you send during a stream, and moderation records if a message is removed or an account is suspended.
• Technical data: your IP address, browser type and the pages you request, recorded in server logs for security and to keep the site working.

• To provide the site and your membership (running the contract with you): creating your account, charging and renewing your membership, opening members-only content, running livestreams, delivering gifts and replying to messages.
• To send service emails (contract): email confirmation, password resets, and emails about your membership such as a failed payment, a cancellation or a price change. We do not send marketing emails.
• To keep the site and payments safe (our legitimate interests): preventing fraud, abuse, account sharing and unauthorised copying of content, and moderating the chat.
• To meet legal duties (legal obligation): keeping payment and tax records and answering lawful requests from authorities.

We use only cookies the site needs to work: a session cookie that keeps you logged in, and a security cookie that protects forms against cross-site request forgery. We do not use advertising or tracking cookies. Any traffic measurement we use sets no cookies and does not identify you. Stripe sets its own cookies on its checkout pages to prevent fraud.

We use these service providers, each bound to handle data only on our instructions or under their own privacy terms:

• Stripe: payment processing, fraud prevention and tax calculation.
• Hostinger: the servers the site and its database run on, and our email inbox.
• Cloudflare: domain name service, storage and delivery of photos and films, and livestream video delivery.
• Brevo: sending the site’s service emails.

Olga Ferbey sees gift names and notes, messages you send, and chat during livestreams. We share data with authorities only when the law requires it.

We are based in the United Arab Emirates, and our providers operate in several countries, including the European Union and the United States. When personal data of people in the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, we rely on the European Commission’s standard contractual clauses or an equivalent safeguard offered by the provider.

• Account data: while your account exists, then deleted within 30 days of closing it.
• Payment, gift and tax records: for as long as tax and accounting law requires, currently up to 10 years.
• Messages and enquiries: up to 24 months after the conversation ends.
• Chat messages: up to 12 months after the stream, or until you close your account.
• Server logs: up to 30 days, unless needed to investigate a security incident.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Write to message@olga-ferbey.com from the email address on your account. We reply within one month.

If you live in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority. In the United Arab Emirates, the UAE Data Office oversees personal data protection.

The site is for adults. We do not knowingly collect data from anyone under 18, and we close any account we find belongs to someone under 18.

The whole site runs over HTTPS. Passwords are hashed, members-only media is stored privately and served only through short-lived signed links, and payments are handled by Stripe, which is certified to PCI DSS Level 1.

If we change this policy in a way that affects you, we will email members before it takes effect. The date at the top of this page shows when it last changed.