Privacy Policy
Last updated: August 24, 2026
1. Who we are
This Policy explains how Fans Origin LLC ("we", "us", "our") handles personal data in connection with Fansly API (the "Service"), provided through apifansly.com, app.apifansly.com, and docs.apifansly.com.
Fans Origin LLC is a limited liability company formed in Wyoming, United States, with its registered office at 30 N Gould St, Ste N, Sheridan, WY 82801.
Read this alongside our Terms of Service, in particular the data protection terms in Section 14, and our Cookie Policy.
Privacy contact: contact@apifansly.com.
2. We act in two roles
Which role we are in decides who is responsible for what, so it matters more than it might sound.
As controller — for personal data about you, our customer, and the people on your team who use the account. Registration details, billing, support correspondence, and how you use the Service. This Policy governs that data and we decide how it is handled.
As processor — for the personal data the Service retrieves from the Fansly accounts you connect, at your instruction: data about the individuals who interact with those accounts — the people who follow, subscribe to, message, or buy from them. This Policy calls it Connected Account Data. For that data you are the controller, we act only on your instructions, and Section 14 of our Terms of Service sets out the terms. If one of those individuals contacts us about their data, we will point them to you and help you respond.
3. What we process
As controller, about you: name, email address, username, company name, billing and transaction details, IP address, device and browser information, cookie and usage data, support messages, and records of how you use the API.
As processor, on your instructions: Connected Account Data. Depending on the endpoints you call, that can include account identifiers, profile details, message content, media references, purchase and spend history, and engagement data.
4. Special category data
Connecting to an adult platform has a data protection consequence that is easy to overlook, and the obligations it brings fall to you.
Data showing that an identifiable person uses an adult creator platform — and message content exchanged there — can reveal information about that person's sex life or sexual orientation. Under Article 9 of the EU and UK GDPR that is special category data, and it carries stricter conditions than ordinary personal data.
We do not seek out this data for our own purposes, we do not analyse it, and we do not use it for anything beyond passing it between you and Fansly at your request. Where it is processed, we do so only as your processor, on your instructions.
You are responsible for identifying a valid Article 9 condition and a lawful basis under Article 6 before you run this data through the Service.
5. Why we process your data, and on what basis
These bases apply to our controller role.
- Running your account, access, API keys — performance of a contract.
- Taking payment and preventing payment fraud — contract; legal obligation.
- Support and service messages — contract; legitimate interests.
- Security, diagnostics, abuse prevention, product improvement — legitimate interests.
- Marketing emails, where consent is required — consent, which you can withdraw at any time.
- Tax, accounting, and lawful requests — legal obligation.
Where we rely on legitimate interests, we have weighed those interests against your rights, and we will share that assessment on request.
6. What we do not do
We do not sell or rent personal data.
We do not use Connected Account Data — the data you process as a controller — for our own purposes or for advertising.
AI features. Some features may involve an AI or large language model provider — for example analytics built on top of your data. Those features run only when you choose to use them, and the relevant data is shared with the providers required to deliver that feature. Those providers are our sub-processors, and the notice and objection rights in Section 7 apply to them. Where instead you connect the Service to an AI assistant of your own through MCP, that assistant is your arrangement, not ours. In both cases you remain the controller of the underlying Connected Account Data.
Training. Whether or not a feature involves AI, we never use your data to train AI models, and where a provider is involved we use terms that do not permit them to train on it either.
We may create and use aggregated or anonymised data that identifies nobody — for example, total request volumes — to operate and improve the Service.
7. Who we share data with
We share personal data only with the following categories of recipient, and only as far as each needs it:
| Category | Purpose |
|---|---|
| Hosting and infrastructure providers | Running the Service |
| Payment processors | Taking payment and preventing payment fraud |
| Email delivery providers | Transactional, support, and service email |
| Live chat and support providers | Running our chat widget and handling support conversations |
| Website analytics providers | Understanding how the site is used |
| AI and large language model providers | Only where you use a feature that involves them |
| Professional advisers | Legal, accounting, and audit |
| Authorities | Where a valid legal request requires it |
| Fansly | The platform you connect to, at your instruction |
We also share data in connection with a merger, acquisition, or sale of assets, in which case we will tell you before your data becomes subject to a different policy.
Named list. If we act as your processor, you are entitled to the identity of every sub-processor handling data we process for you. Email contact@apifansly.com and we will provide the current list. Before we add or replace one of those sub-processors, we will give you notice so you can object on reasonable data protection grounds, as Section 14.5 of our Terms sets out.
8. International transfers
We are based in the United States, so personal data you send us is processed there and by the recipients described in Section 7, some of whom are also outside the EEA and the UK.
Where personal data moves out of the EEA or the UK, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with supplementary measures where they are warranted. You can ask us for details of the mechanism covering a particular transfer.
9. How long we keep things
| Data | Retention |
|---|---|
| Account details | For the life of your account, then deleted or anonymised within 90 days of closure |
| API request and response logs | 3 days, then deleted automatically. Kept so that you and our support team can debug failed calls and trace errors — they are not used for any other purpose |
| Billing and transaction records | 7 years, for tax and accounting |
| Support correspondence | 12 months |
| Security and authentication logs | 90 days |
| Connected Account Data, which we process for you | Only while needed to provide the Service, then deleted or returned on termination, as Section 14 of our Terms provides |
We may retain information for longer where reasonably necessary to establish, exercise, or defend legal claims, investigate security incidents, prevent abuse, or comply with legal obligations.
10. Security
We use appropriate technical and organisational measures, including encryption in transit and at rest, access controls, and regular review of who can reach what. No system is completely secure, and we do not claim otherwise.
If a personal data breach occurs, what we do depends on our role. Where we act as controller, we will notify the relevant supervisory authority and affected individuals where required by law. Where we act as processor, we will notify you without undue delay so that you can meet your own notification obligations.
11. Your rights in the EEA and the UK
You may ask us to give you access to your data, correct it, erase it, restrict how we use it, or provide it in a portable form. You may object to processing we base on legitimate interests, and withdraw consent at any time without affecting what we did before you withdrew it.
Email contact@apifansly.com. We respond within one month, and will tell you if a complex request needs up to two months more.
For data we hold as processor, the customer who connected the account is the controller — contact them, and we will assist them in responding.
You can complain to your national supervisory authority. In the UK that is the Information Commissioner's Office.
12. Your rights in the United States
Depending on where you live, you may have the right to know what personal information we collect, to have it deleted or corrected, to receive a copy, and not to be discriminated against for exercising those rights. Email contact@apifansly.com to make a request. You may use an authorised agent.
We do not sell personal information, and we do not use it for cross-context behavioural advertising — we run no advertising pixels. We do use Google Analytics to understand how the site is used, and depending on how the term is applied that may count as "sharing" under California law. Section 13 sets out the cookies involved and how to opt out.
13. Cookies
We use cookies and similar technologies on our website, in three kinds:
- Strictly necessary — these keep you signed in, keep the site secure, and remember basic preferences. The site does not work properly without them.
- Analytics — we use Google Analytics to understand how the site is used, which pages people reach, and where they arrive from. It sets the _ga and _ga_* cookies, which last up to 13 months.
- Support chat — we use Crisp to run our chat widget. It stores a session identifier so a conversation can continue as you move between pages.
We run no advertising pixels, and we do not use cookies for advertising or for cross-context behavioural advertising.
The analytics and chat cookies are set when you visit the site. You can block or delete cookies at any time through your browser settings, and you can opt out of Google Analytics on every site you visit using Google's browser add-on at tools.google.com/dlpage/gaoptout. Our Cookie Policy lists the current cookies in full.
14. Age
The Service is for adults. You must be 18 or over to hold an account, and you must not use the Service to process the personal data of anyone under 18. We do not knowingly collect data about children, and we delete it if we find it.
15. Automated decisions
We do not make decisions about individuals by automated means alone that produce legal or similarly significant effects. If you use the Service to score, rank, or segment fans, you are the controller of that processing and responsible for how those decisions are made and disclosed.
16. Changes
We may update this Policy. Where a change is material, we will tell you by email or in the dashboard before it takes effect. The date at the top always shows the current version.
17. Contact
Fans Origin LLC
30 N Gould St, Ste N, Sheridan, WY 82801, United States
Email: contact@apifansly.com
Fansly API is an independent service with no affiliation to Fansly.com, Select Media LLC.