Privacy Policy
This Privacy Policy explains what personal data DripFlicks collects, why we collect it, how long we keep it, and what rights you have. We minimise data collection: our only first-party processing is two aggregate-measurement analytics tools — Google Analytics 4 and Umami (the latter is cookieless and anonymised). We do, however, serve advertising on listing pages (the homepage and category, pornstar, and search pages) through the ExoClick network (a single "Recommendation Widget" ad slot below the video grid), which sets its own advertising cookies and receives device/browser Client Hints for ad targeting — see Section 6 and the Cookie Policy. We do not host or play any video content; clicking a video opens the Source Platform's own website (currently xHamster or NuVid) in a new tab. The data on our own infrastructure is limited to web-server access logs, two functional first-party cookies, the standard Google Analytics cookies described below, and event pings sent to Umami (no cookies set in your browser). The video links across the Service are xHamster or NuVid partner/affiliate links: when you click a video and follow it through to xHamster or NuVid, we may earn a commission, and the click is shared with the respective source platform for affiliate attribution. Separately, the /featured/ section of the Service contains affiliate-linked content from the FapCash network (see /affiliate-disclosure).
1. Scope
This Policy applies to personal data we process when you access the Service. It does not apply to third-party Source Platforms whose websites you visit after following an outbound video link from the Service; those platforms operate under their own privacy policies, which you should consult separately.
2. Data controller
DripFlicks is the controller of personal data processed in connection with the Service. Contact: peterdgarrido@proton.me. The full corporate registered address is provided in the Imprint and on request.
3. Categories of personal data we collect
(a) Server access logs — IP address (as forwarded by Cloudflare in the CF-Connecting-IP header), timestamp, requested URL, response status, user-agent string, referrer. (b) Cookies — see Cookie Policy. (c) Communications — content of any email you send us. (d) Google Analytics 4 measurement data — IP address (truncated by Google before storage), pseudonymous client identifier (in the _ga cookie), page URL, referrer, user-agent, device class, country/region, and aggregate event data (pageviews, session duration, scroll depth). Google Analytics is processed by Google LLC; we do not link GA data to any other identifier on our side. (e) Umami analytics measurement data — page URL, referrer, user-agent string (anonymised), and inferred country/region from a hashed and rotated IP-derived identifier. Umami does NOT set cookies, does NOT store IP addresses, and does NOT use cross-session tracking. Processed by Umami Software Inc. (f) ExoClick advertising data — when a listing page (the homepage or a category, pornstar, or search page) loads the sponsored Recommendation Widget, the ExoClick ad server (a.magsrv.com / s.magsrv.com) receives your IP address, user-agent, the User-Agent Client Hints delegated via the Delegate-CH header (browser platform, version, model, architecture, bitness), page URL, and referrer, and may set or read advertising cookies/identifiers. ExoClick uses this for ad selection, frequency capping, conversion measurement, and may use it for behavioural/retargeted advertising as an independent controller. We ourselves collect NO accounts, NO passwords, NO payment data, NO precise geolocation, and NO biometric data, and we do not build behavioural advertising profiles on our own side — but note that ExoClick (entry (f)) does process data for advertising purposes.
4. Purposes of processing
(i) Operating and securing the Service (logs); (ii) remembering your age confirmation and audience preference (cookies); (iii) responding to your communications; (iv) detecting and preventing abuse, fraud, and security incidents (logs); (v) aggregate traffic measurement — understanding how many visitors use the Service, which pages perform, and which sources refer them, so we can improve the experience (Google Analytics + Umami).
5. Legal bases — GDPR Article 6
Server logs: legitimate interest in operating, securing, and improving the Service (Art. 6(1)(f)). Functional cookies: necessary for the service requested by you (Art. 6(1)(b) and Recital 30 / ePrivacy strict-necessity exemption). Communications: necessary for pre-contractual / contractual measures and our legitimate interest in responding (Art. 6(1)(b) / 6(1)(f)). For the age-confirmation cookie we additionally rely on your consent acknowledged when you pass the age-gate (Art. 6(1)(a)). Google Analytics: legitimate interest in measuring aggregate traffic and improving the Service (Art. 6(1)(f)). Where local law requires affirmative consent for analytics cookies (in particular, ePrivacy / GDPR jurisdictions), and where consent has not been provided, we will not load Google Analytics; if you are accessing from such a jurisdiction and wish to opt out, see Section 7 below. Umami: legitimate interest in measuring aggregate traffic (Art. 6(1)(f)); because Umami is cookieless and does not store IP addresses, it qualifies under the ePrivacy strictly-necessary exemption for measurement in most EU implementations and does not require additional consent under most national frameworks.
6. Cookies and local storage
See our Cookie Policy at /cookie-policy for a per-cookie disclosure. Browser localStorage is used to persist one optional engagement feature: a favourites list. It is stored in your browser only and never transmitted to our servers.
7. Third-party destinations and analytics
When you click a video, your browser opens the video's page on the Source Platform (currently xHamster, reached via the partner redirect xh.partners, or NuVid, reached via the partner redirect nvdvid.com) in a new tab. On its own website, that platform may set its own cookies, collect IP and user-agent data, and serve its own advertising, and it acts as the controller for any data it collects once you arrive. Their processing is not under our control and is governed by their own policies. We use two analytics services: Google Analytics 4 (Google LLC, USA) and Umami (Umami Software Inc., USA). To opt out of Google Analytics: (a) install Google's official opt-out browser add-on at https://tools.google.com/dlpage/gaoptout; (b) block third-party cookies in your browser settings; or (c) use a browser-level tracker blocker such as uBlock Origin. To opt out of Umami: block requests to cloud.umami.is in your browser or via any tracker blocker (Umami sets no cookies, so cookie-blocking alone does not stop it). These two analytics services are used for aggregate measurement only. Separately, the ExoClick advertising network serves the sponsored Recommendation Widget on listing pages (the homepage and category, pornstar, and search pages) and DOES derive advertising signals: to opt out of ExoClick, use ExoClick's opt-out at https://www.exoclick.com/privacy/, block requests to magsrv.com via a tracker blocker such as uBlock Origin, and/or block third-party advertising cookies in your browser settings.
8. Sharing of personal data
We do not sell or rent your personal data for money. However, because the ExoClick advertising network serves an ad slot on listing pages (the homepage and category, pornstar, and search pages) and may set advertising cookies and receive Client Hints, the loading of that ad slot may constitute "sharing" for "cross-context behavioural advertising" under the California CPRA (and equivalent concepts in other U.S. state laws). California and other eligible residents may opt out of this sharing — see "Your privacy rights" below and the ExoClick opt-out instructions in the Cookie Policy; you can also block magsrv.com with a tracker blocker. Separately, when you follow a video link the click is shared with xHamster (via the partner redirect xh.partners) or NuVid (via the partner redirect nvdvid.com) for affiliate attribution, and when you follow a /featured/ link the click is shared with FapCash/FapHouse — in all cases this lets the partner attribute any resulting commission to us; this is a consequence of you choosing to follow an outbound link rather than a sale of your data. Apart from that ad slot, we do not otherwise disclose personal data to third parties for commercial purposes. We may also disclose personal data: (a) to subprocessors that operate the Service (see /subprocessors); (b) to comply with valid legal process (see /law-enforcement-requests); (c) to protect rights, safety, or property; (d) in connection with a corporate transaction (merger / acquisition), in which case the acquirer will be bound by no-less-protective terms.
9. International transfers
Our infrastructure is operated within the European Union (Cloudflare global edge + an EU-based VPS provider). Google Analytics data is processed by Google LLC in the United States and is transferred under the EU–US Data Privacy Framework (Google LLC is a self-certified participant). Umami analytics data is processed by Umami Software Inc. in the United States; the transfer relies on Umami's published Data Processing Addendum and Standard Contractual Clauses where applicable, and is mitigated by the fact that Umami does not store IP addresses or set cookies. Where other personal data is transferred to a recipient outside the EEA we rely on the European Commission's Standard Contractual Clauses (2021/914) or an adequacy decision.
10. Retention
Server access logs: up to 30 days, then deleted or anonymised. Functional cookies: 12 months from last visit (you can clear earlier in your browser). Google Analytics user data: 14 months from the user's last activity, then deleted by Google (per our configured retention setting in GA4). Umami analytics data: retained by Umami Software Inc. per its standard policy (typically 6-12 months for Umami Cloud) — since no personal identifier is stored, the data is fully anonymised aggregate data. Communications: retained for as long as needed to address the matter and as required by law (typically up to 36 months). Records related to legal claims, takedown notices, transparency reporting, and tax/accounting obligations: as required by the applicable statute of limitations and accounting laws.
11. Your rights
Depending on where you live, you may have the rights to access, rectify, erase, restrict processing, port, object, and withdraw consent. EU/EEA/UK residents: see /gdpr-rights for the detailed Article-by-Article description and supervisory-authority lodging. California residents: see /ccpa-rights for CCPA/CPRA rights.
12. How to exercise your rights
Email peterdgarrido@proton.me with the subject line "Data Request — [right]". We acknowledge within 5 business days and respond substantively within 30 days (extensible to 90 in complex cases, with notice). We may need information sufficient to verify your identity; we will not ask for more than necessary.
13. Security
We use industry-standard technical and organisational measures: TLS for all traffic; Cloudflare WAF; a private origin reachable only from Cloudflare IP ranges; principle of least privilege for operational access; periodic dependency updates and review.
14. Children
The Service is strictly for adults. We do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, contact peterdgarrido@proton.me and we will delete it promptly.
15. Automated decision-making
We do not engage in any solely-automated decision-making that produces legal or similarly significant effects on you.
16. Changes
We may update this Policy from time to time. The effective date will be revised at the top. Material changes will be brought to the visitor's attention via a site-wide banner for at least 14 days after they take effect.
17. Contact
Privacy questions, requests, and DPO matters: peterdgarrido@proton.me.