Data Retention Policy

Definitions

For clarity, here are key definitions related to this document.

• Personal Data means information that identifies or can reasonably identify a person

• Retention Period means the length of time a category of data is kept for a stated purpose

• Deletion means secure removal of data so it can no longer be retrieved from active systems

• Anonymisation means altering data so it cannot identify a person

• Backup means a copy stored for resilience that is rotated and expired on a schedule

• Compliance Hold means a requirement to keep data for legal, tax, or regulatory reasons

• Transaction Records means payment and billing records kept for statutory periods

• Verification Record means proof that an age or identity check passed, without storing raw ID images

Fantra values user privacy and adheres to the principle of data minimisation. This Data Retention Policy describes what data we retain, for how long, and why. Our goal is to retain personal data only for as long as necessary to provide the service and meet legal or compliance obligations. When data is no longer needed, we delete or anonymise it in a secure manner. Below is a summary of our retention practices for various categories of data:

• Account Information: Basic account data such as your username, email address, and account preferences are retained for as long as your account remains active. This information is necessary for us to maintain your account and provide the service. If you choose to delete your account (or if it is terminated), we will delete or anonymise this information within a reasonable period after account closure, except for any data we are required to keep by law .

• Age Verification Records: We retain proof that you passed age verification (e.g. a verified-18+ status flag and date) for as long as your account is active. We do not keep ID images or biometric data after verification is done. For Fans who only self-attest age, we record the attestation and date. For Creators who provided ID, we keep a record of the verification result and date. These minimal records are kept demonstrating compliance (e.g. to regulators) and to avoid re-verifying you unnecessarily. If you delete your account, the verification status record is deleted as well, unless law requires us to retain it.”

• User-Generated Content: Content you create on Fantra (AI-generated images, text, etc.) and related metadata (prompts, generation logs) are stored in your account until you decide to delete them, or until you delete your account. We may provide tools for you to download or delete your generated content at any time. We may retain some logs of generation activity (e.g. that a generation occurred, which model was used, timestamp) for service integrity and abuse monitoring, but these logs are generally tied to your account and will be deleted or anonymised upon account deletion. Note that we reserve the right to remove or purge content that violates our Terms of Service or Acceptable Use Policy at any time. In the event content is removed for policy violations, we may retain copies as necessary to cooperate with law enforcement or to evidence the violation, consistent with our legal obligations.

• Payment and Transaction Records: If you make purchases on Fantra (such as subscription payments or token purchases), we retain transactional records and associated billing information for a period required by finance and tax regulations. Typically, financial records are kept for at least 5 to 7 years (depending on the jurisdiction) to comply with accounting laws, tax audit requirements, and anti-fraud regulations. This includes data like payment dates, amounts, the payment method (e.g., which card or payment provider, though not full card numbers), and your billing address or ZIP code. We do not store full credit card numbers on our servers; our payment processor handles that. We retain enough information to provide customer support (e.g. refunds, invoice lookups) and to meet legal record-keeping rules.

• Logs and Device Information: Like most online services, Fantra may keep application logs (such as IP addresses, login timestamps, device type) to ensure security, troubleshoot issues, and analyse usage. These logs are generally retained for a limited period (for example, server logs may be kept for a few weeks to months) unless a specific log is needed for an investigation of abuse or security incidents, in which case it may be retained until resolved. We anonymise or delete routine logs on a rolling basis.

• Legal Compliance Records: If we are required by law to retain certain data, we will do so. For example, if we receive a lawful preservation order or subpoena, we will preserve the specified data for the required time. Additionally, our obligation to report and retain information about illegal content or activities (such as reports of child exploitation material generation attempts) means we might keep certain data related to those reports and the users involved and share it with law enforcement as legally mandated. These compliance records are kept only as long as necessary and in line with legal requirements.

After Account Deletion: When you delete your Fantra account (or it is closed by us), we undertake to delete or anonymise your personal data. Following account deletion, we generally will: remove personal identifiers from remaining data, or aggregate data so it’s no longer linked to you. However, we may retain certain information as required or permitted by law. For example, we may keep:

• Transaction records for completed purchases (for the duration required by financial regulations/tax law).

• Verification logs or a certificate of proof that your age was verified (if needed to demonstrate past compliance to regulators, and only for the duration required).

• Support correspondence or records of user agreements, which might be kept to defend against legal claims or to document that you agreed to our terms at a given time.

• System backups: Some of your data might persist temporarily in routine server backups even after deletion. These backups are securely stored and rotated, and any residual data is expunged in the normal backup cycle. During that interim, your data is not active in our systems.

In all cases, retained data remains subject to our Privacy Policy and strict security measures. We will not use retained data for any new purposes beyond those for which it was retained (e.g., legal, accounting, security). When the retention period expires, we will delete or irreversibly anonymise the data.

Data Minimisation: We regularly review the data we hold and the applicable retention periods. Our aim is to minimise retention. Where feasible, we adopt shorter retention for sensitive data. For instance, raw age verification documents are not stored on our servers at all after verification; they are immediately purged by the verification provider. Similarly, detailed usage logs are pruned when no longer needed. We strive to anonymise data rather than delete it outright when appropriate – for example, we might keep aggregate usage statistics that contain no personal identifiers, even after personal data is deleted, in order to understand platform performance.

This Data Retention Policy is intended to give you clarity on how long your data is kept. It is aligned with our Privacy Policy, which provides additional details. If you have any questions about our data retention practices, or if you need a specific piece of your data deleted or exported, please contact us at admin@fantra.com and we will be happy to assist consistent with your rights and our obligations.