Skip to content
SEPX

Privacy Policy

Effective: October 25, 2026

This Privacy Policy describes how SEPX LIMITED (“we,” “us,” or “our”) collects, uses, and shares information about you when you use our platform, applications, and related services (the “Services”). SEPX is an adult platform for people aged 18 and over, so this Policy also explains how we handle age checks, adult content, and the automated moderation that runs on what you send.

1. Introduction

This Policy is designed to be specific about what data we collect, why we are allowed to collect it, how long we keep it, and what rights you have over it. If you have questions, contact our Data Protection Contact at support@sepx.cc.

Who Is Responsible for Your Data

  • SEPX LIMITED — company no. 17367346, 20 Wenlock Road, London N1 7GU, United Kingdom. Registered with the UK Information Commissioner's Office (ICO) under registration number ZC212736 (opens our registration certificate on the ICO register, as a PDF). This is the company you contract with, the data controller for the personal data described in this Policy under the UK GDPR and the EU GDPR, and the merchant of record for every payment you make. Section 7 of the Terms sets out the descriptor your bank statement actually shows, which is the processor's and not ours.
  • SEPX LLC — company no. 10611201, 131 Continental Dr, Ste 305, Newark, DE 19713, United States. This is an independent entity, not a parent, holding company or group member of SEPX LIMITED. It acts solely as an independent third-party provider of support and customer-service functions for SEPX.CC. It is not a party to your contract with us, it does not operate SEPX.CC, and it is not the controller of your personal data.

Where this Policy says "we", it means SEPX LIMITED.

2. Data We Collect

Information You Provide

  • Account data — username, email address, password (stored as a secure hash), and optional display name or avatar.
  • Age-assurance data — the date of birth you declare at registration, which we store so we can show that the 18+ check was carried out and so we can act if it turns out to be false. If you sign up through an OAuth provider, your declared date of birth is carried through the sign-up flow in a short-lived cookie.
  • Profile information — bio, status, profile picture, banner, and any other information you choose to add to your public profile.
  • Content you create — messages, direct messages, files, images, videos, reactions, and any other content you submit. Uploaded files are fingerprinted (SHA-256) so that paid content can be protected against unauthorised resharing.
  • Payment information— order records, amounts, currency, the provider's transaction reference, and subscription status. Card details are entered directly into our payment providers' hosted fields; we never receive or store full card numbers. If you pay in cryptocurrency we process the wallet address and on-chain transaction data for that payment.
  • Creator and payout data — if you earn on the platform, the payout details and records needed to pay you and to meet our accounting obligations.
  • Communications with us — support requests, appeals, feedback, and reports you submit.
  • Rights and removal requests — if you send us a content-removal request, a copyright notice, or a request as a person depicted in content, we process the name, contact details, description of the content, statement of your relationship to it, and any evidence you provide.

Information Collected Automatically

  • Usage data — pages visited, features used, actions taken, and timestamps.
  • Device and browser data — IP address, browser type and version, operating system, device identifiers, and screen resolution.
  • Network and connection data — approximate geographic location derived from IP address (city/country level), ASN (autonomous system number), and connection quality metrics.
  • Log data — server-side logs including request timestamps, HTTP status codes, and error traces used for debugging and security.
  • Moderation and safety records — reports made by or about you, warnings, automated moderation events and the signals that produced them, an internal risk score for your account, and any suspension or ban record. Section 6 explains how these are generated.
  • Push subscription data — if you enable push notifications, the endpoint and keys your browser or device issues for that purpose.

Information from Third Parties

  • If you connect a third-party OAuth provider (Google or GitHub) to sign in, we receive basic profile information from that provider as permitted by your settings and their privacy policy.
  • Our payment providers tell us whether a payment succeeded, was refunded, was disputed or was flagged as fraudulent, along with limited identifiers for that transaction.
  • Our anti-bot provider tells us whether a sign-in, registration or password-reset attempt passed its challenge.

3. How We Use Your Data

We use the information we collect to:

  • Provide, operate, and improve the Services
  • Authenticate your identity and maintain the security of your account
  • Deliver messages and content you send through the Services
  • Process payments, manage subscriptions, and pay creators
  • Check that you meet the 18+ age requirement and keep minors off the platform
  • Detect, investigate, and prevent abuse, fraud, and violations of our Terms of Service and Acceptable Use Policy
  • Handle reports, removal requests, and appeals
  • Respond to your support requests and communications
  • Send you service-related notifications (security alerts, policy updates)
  • Comply with applicable legal obligations and respond to lawful requests

We do not use your message content, your purchases, or your browsing of the platform to build advertising profiles or to serve targeted advertising, and we do not sell personal data.

5. Special Category Data (Article 9)

We do not ask you for your sexual orientation, sex life, health, religion, politics, race or biometrics, and none of these is a required field anywhere on the platform. But SEPX permits adult content, and we have to be honest about what follows from that: the content you post, the servers you join, the creators you subscribe to and the things you buy can reveal information about your sex life or sexual orientation. Where it does, that information is special category data under Article 9 of the UK/EU GDPR and needs an Article 9 condition on top of the Article 6 basis in Section 4.

The conditions we rely on are:

  • Article 9(2)(a) — explicit consent. When you choose to post adult content, describe your interests, or buy or subscribe to adult content, you are explicitly consenting to us storing and processing that data in order to run the service you asked for. You can withdraw that consent by deleting the content or closing your account; the practical effect is that we can no longer provide those features to you.
  • Article 9(2)(e) — data manifestly made public by you. Anything you publish on a public profile or in a public server has been made public by your own choice.
  • Article 9(2)(f) — legal claims. For moderation, dispute and evidence records that we need to establish, exercise or defend legal claims.
  • Article 9(2)(g) — substantial public interest, relying on the conditions in Schedule 1 Part 2 of the UK Data Protection Act 2018 for preventing or detecting unlawful acts (paragraph 10) and safeguarding of children and of individuals at risk (paragraph 18). This covers detecting and reporting illegal content, non-consensual material, and content involving minors.

We never use special category data for advertising, marketing, profiling or scoring outside the safety purposes described in Section 6, and we never share it with anyone other than the recipients listed in Section 7.

6. Automated Moderation and Decisions

Some decisions on SEPX are made by software with no person involved at the time. Under Article 22 of the UK/EU GDPR you are entitled to know about this, and to ask a human to look again.

What is checked automatically

Every message you send — in a channel and in a direct message — is passed through our automated moderation engine before it is stored. It scores the text for:

  • Spam signals — message velocity, duplicate content, and mention spam
  • Mass direct messaging to many recipients in a short period
  • Phishing links and known scam patterns
  • Hostile, abusive or threatening language, including doxxing and swatting threats
  • Text indicating child sexual abuse material or the sexualisation of minors — this is the one content category that is always treated as critical
  • Formatting abuse — zalgo text, invisible characters, and flooding

Separately, when you attach a file we compare its SHA-256 fingerprint against paid content already on the platform, to stop other people's pay-to-view material being leaked or resold. This check covers direct messages by default. It looks at file fingerprints and who uploaded them, not at the contents of your conversation.

What can happen as a result

  • Your message is refused and never delivered. You see an error saying it was blocked.
  • An event is recorded against your account and moderators are notified.
  • Your account is flagged for moderator review, and an internal risk score is updated.
  • Your account is automatically suspended for 24 hours when a rule of critical severity fires. No moderator approves this before it takes effect.
  • For paid-content matches: the message is blocked, you may receive a warning, the account may be flagged, and the creator whose content matched is notified.

We do not notify you every time an automated rule fires — most of the time the record is only visible to moderators. You can ask us whether any automated decision has been made about your account, and we will tell you.

Your right to human review

For any automated decision that affects your access to the Services — a block, a flag or a suspension — you have the right to obtain human intervention, to express your point of view, and to contest the decision. Email support@sepx.cc with your username and roughly when it happened. A person, not the system, will review it and reply within 14 days. Removals we are legally required to make (for example illegal content) cannot be reinstated on appeal.

7. Data Sharing and Processors

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We share it with the following categories of recipient, and no others.

Processors acting on our instructions

  • Segpay — card payments, subscription billing, refunds and cardholder billing support. Receives your email address, billing details and order data. Card details go to them directly, not through us. They take the card on their own hosted pages, so none of their code runs on this site. They operate a cardholder self-service portal at https://cs.segpay.com/ where you can look up a charge, contact billing support and cancel a subscription.
  • PrivateAV or iDenfy — our age and identity verification providers. We use one of them at a time, selected by our operations team; the active provider acts as our processor under our agreement with it. There are two different checks, and what is processed differs between them, so they are described separately.

    Viewing adult content, and buying: you present a live capture of your face to the active provider, which estimates your age from it and deletes the capture afterwards. It is never transmitted to us, and there is nothing for us to view: we receive only whether the check passed, which method established it, and an opaque reference. Where the estimate does not establish that you are 18 or over, the provider asks you for a government-issued identity document instead — that document is likewise handled by the provider and not by us. Most people complete this check without submitting any document at all.

    Publishing adult content: a publishing account is verified on the stricter path in every case — a government-issued identity document together with a selfie, submitted directly to the active provider. Those files are not transmitted to, processed by or stored on our own systems: the provider holds them as our processor, under the retention configured for our account, and our own systems keep only the result and an opaque reference. Because the provider processes that evidence on our behalf, SEPX LIMITED — not the provider — is the controller of it, and the document is visible to us in the provider’s dashboard. We limit that access strictly; see §9 for who may look and when.

    Our lawful basis for asking is compliance with our legal obligations as an adult service and with the rules of the card schemes we accept payment under.
  • Cloudflare — the Turnstile anti-bot challenge shown on sign-in, registration, password-reset and guest-ticket forms. Receives your IP address and browser signals to decide whether you are a bot. (Our software also supports hCaptcha and Google reCAPTCHA as alternatives; if we switch providers we will update this Policy.)
  • Our email delivery provider — sends transactional email (verification, password resets, payment receipts, security and moderation notices, and any digest you have enabled). Receives your email address and the content of those messages.
  • Our hosting and object-storage providers — run the servers, database, and the storage buckets holding uploads and encrypted backups. They do not access the data for their own purposes.

Each of these is bound by a written data-processing agreement, may only act on our instructions, and may not use your data for its own purposes.

Independent recipients

  • OAuth providers (Google, GitHub) — if you sign in with one, that provider is a separate controller for what happens on its side.
  • Browser and device push services — if you enable push notifications, your operating system or browser vendor delivers them.
  • Blockchain networks — if you pay in cryptocurrency, the transaction is recorded on a public ledger. That record is public and permanent, and we cannot delete or amend it.
  • Law enforcement, regulators and courts — where we are legally required to disclose, or where we believe in good faith that disclosure is necessary to prevent serious harm.
  • Child-protection and law-enforcement authorities — where we find child sexual abuse material we preserve it and refer it, with the account identifiers, IP addresses and content hashes needed to action the referral, to the authority competent for the jurisdictions involved, wherever we are legally required to report it or where reporting is necessary to protect a child.
  • Professional advisers — lawyers, accountants and auditors, under duties of confidentiality.
  • Business transfers — if SEPX is involved in a merger, acquisition, or asset sale, user data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

In any other circumstance we share your data only with your consent.

8. Cookies and Similar Technologies

We use no analytics cookies, no advertising cookies, and no cross-site tracking of any kind. We set only strictly necessary cookies:

  • token — your authentication session. Without it you cannot stay signed in.
  • oauth_state_* — a short-lived value that protects the sign-in-with-Google/GitHub flow against cross-site request forgery.
  • oauth_dob_* — carries the date of birth you declared through an OAuth sign-up so the 18+ check can complete. Discarded once the account is created.

These are exempt from the consent requirement in the Privacy and Electronic Communications Regulations because they are strictly necessary to provide a service you have asked for. Your interface preferences, such as theme and language, are kept in your browser's local storage rather than in cookies.

A small number of third-party components set their own storage when they load, and only on the pages that need them:

  • Cloudflare Turnstile — on sign-in, registration and password-reset pages, to run the anti-bot challenge.
  • PrivateAV or iDenfy — only when you start an identity check, whether that is for adult content or before completing a purchase, to run the verification flow in your browser.

Because we set no non-essential cookies, there is no cookie banner and nothing for you to opt out of. If we ever introduce analytics or any other non-essential storage we will ask for your consent before setting it — we will not treat your browser settings as consent. Full details are in our Cookie Policy.

9. Data Retention

We keep each category of data for the period below, then delete or anonymise it. Where two periods apply to the same record, the longer one governs.

  • Account data — for as long as your account exists. After you delete your account we remove your profile from public view immediately and delete or anonymise the account record within 30 days, except for the records below.
  • Messages and direct messages— until you delete them, the channel or server is deleted, or a disappearing-message timer expires. Messages you sent to other people remain in their copy of the conversation after you close your account; messages in servers stay visible to that server's members, attributed to a deleted user.
  • Uploads and attachments — for as long as the message they are attached to exists. Uploads that are never attached to a message are removed by routine cleanup. File fingerprints (SHA-256) of paid content are kept for as long as the paid content protection applies to it.
  • Payment, invoice, payout and tax records — 6 years from the end of the accounting period they fall in, as required by UK company and tax law. These survive account deletion and are outside the scope of an erasure request.
  • Moderation, report and appeal records — 2 years from the last related event, so that repeat behaviour and ban evasion can be recognised. Records relating to illegal content, child safety, or an open investigation or legal claim are kept for as long as necessary for that purpose.
  • Automated moderation events and risk scores — 12 months from the event.
  • Age-assurance evidence — your declared date of birth is kept for the life of the account as the record that the check was performed, and for 12 months after closure as evidence that we operated the age gate. Where you complete the age check — which is required both for adult access and before completing any purchase — you present a live capture of your face to our verification provider (PrivateAV or iDenfy, as configured); the provider processes that capture and deletes it afterwards, and it is never transmitted to or stored on our own systems. An identity document is involved only where the estimate from that capture does not establish that you are 18 or over, and only the provider handles it. A publishing account is verified on the document path in every case. Whatever the path, we keep only the result of the check, which method established it, and an opaque reference — for the life of the account and for the statutory retention period after closure.
  • Who can look at your identity document — this applies only where a document was submitted, which means every publishing account and those consumers whose face capture did not establish that they are 18 or over. Where a check completed on the face capture alone, there is no document, and nothing for anyone to look at. Where a document does exist, our verification provider processes it on our behalf and it is visible to us in the provider’s dashboard, which we limit strictly. Access is restricted to our Director alone, through a named account, and is used only where there is a reason to look: an appeal against a failed check, a suspected impersonation or fraudulent document, a lawful request from a regulator or law-enforcement body, or a card-scheme compliance audit. Where a check simply passes or fails, no one opens it. Our moderation staff have no access and see only the result. We never use verification data for marketing or profiling, and we never sell it.
  • Records about people depicted in content — kept for the period set out in our Age & Consent Records policy.
  • Removal and copyright requests — 2 years from the decision, as the record of how the request was handled.
  • Security and access logs — 90 days, extended where they are part of an active investigation.
  • Inactive sessions — deleted after 30 days without activity.
  • Backups — we keep only a limited number of recent encrypted snapshots, which rotate out as new ones are taken. Data you delete can persist in a backup until that snapshot rotates. We do not restore a backup to bring deleted personal data back, except when recovering from a system failure.
  • Aggregated statistics — figures that cannot identify you may be kept indefinitely.

10. Your Rights

Depending on where you live, you may have the following rights regarding your personal data:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — request that we correct inaccurate or incomplete data.
  • Erasure (“right to be forgotten”) — request deletion of your personal data, subject to the retention obligations in Section 9.
  • Portability — receive your data in a structured, machine-readable format.
  • Restriction — request that we restrict how we process your data in certain circumstances.
  • Objection — object to processing based on legitimate interests (Section 4), including direct marketing.
  • Human review of automated decisions — see Section 6.
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
  • Complain to a supervisory authority — lodge a complaint with the data protection authority in your country. The routes are set out at the end of this section.

To exercise any of these rights, email support@sepx.cc. We respond within one month, which we may extend by up to two further months for complex requests — we will tell you if that happens. We may need to verify that the request comes from you before we act on it.

Complaining about how we handle your data

If you think we have handled your personal data wrongly, please tell us first at support@sepx.cc — we will look into it and reply. You do not have to come to us first, and going to us does not take away any other right you have.

You can complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at any time: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. If you live outside the United Kingdom, you may also complain to the supervisory authority where you live or work.

SEPX LIMITED is registered with the Information Commissioner's Office as a data controller under registration number ZC212736 (certificate on the ICO register, PDF).

If you are in the EU or EEA

You have the same rights under the EU GDPR, and you may complain to the supervisory authority in your own country. SEPX LIMITED has not yet appointed a representative in the EU under Article 27 of the EU GDPR. Until it does, please contact our Data Protection Contact directly at support@sepx.cc, or write to the registered office in Section 15. We will update this section as soon as a representative is appointed.

If you are in California

You have the right to know what personal information we collect and why, to request deletion or correction, to limit the use of sensitive personal information, and not to be discriminated against for exercising those rights. Use the same contact address above.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no “Do Not Sell or Share My Personal Information” link for us to give you. If that ever changes we will publish that link and update this Policy before the change takes effect.

11. Adult Content, Age Assurance and Removal Requests

SEPX is an adult platform. Sexual content between consenting adults is permitted, within the prohibited categories set out in our Terms of Service and Acceptable Use Policy. That creates three data flows worth calling out.

Age assurance

We collect your date of birth once, at registration, and store it as the record that the 18+ check was carried out. Before you can open or access adult content, and before you can complete a purchase of any kind, you also complete a separate age check with our verification provider (PrivateAV or iDenfy, as configured): a live capture of your face, from which your age is estimated, escalating to a government-issued identity document only where that estimate does not establish that you are 18 or over. The purchase check is a regulatory obligation on us as a seller and applies whatever you are buying. Section 7 sets out the provider’s role and section 9 sets out what is kept, for how long, and who may view it. Publishing accounts are verified on the stricter document-based path in every case.

Requests from people depicted in content

If you appear in content on SEPX and you did not consent to it being published, or you have withdrawn that consent, you can ask us to remove it through our Content Removal process. To act on the request we process your name, contact details, a description of the content, and whatever you send to show that you are the person depicted. We use it only to assess and action the request and to keep a record of the decision, we do not add it to any account profile, and we do not pass your identity to the uploader. We acknowledge these requests within 24 hours and resolve them within 5 business days.

Illegal content

Content involving minors, non-consensual material, and other illegal content remain absolutely prohibited. Where we find them we remove the content, terminate the account, and preserve the account identifiers, IP addresses and content hashes, and we report them to law enforcement and to the competent child-protection authority where the law requires it. Neither this Policy nor your rights under it prevent us from doing so.

If you encounter prohibited content on the platform, use the in-app report function or email our Content Removal Agent at support@sepx.cc.

12. Minors

SEPX is an 18+ platform. The Services are not directed to anyone under the age of 18, and we do not knowingly collect personal data from minors. We collect a date of birth during registration and refuse to create an account that does not meet the 18-year minimum set out in our Terms of Service.

If we become aware that we hold personal data belonging to someone under 18, we will suspend the account, delete that data promptly, and report the account where the law requires it. If you believe a minor is using the platform or has provided us with personal data, email support@sepx.cc immediately.

13. International Transfers

We are established in the United Kingdom, and some of the processors named in Section 7 are outside the UK — principally in the United States. Where personal data leaves the UK we rely on one of the following:

  • UK adequacy regulations, where the destination country is covered by them (including the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified under it);
  • the ICO's International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses, together with a transfer risk assessment.

For transfers originating in the EEA we rely on the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguard applied to a particular transfer using the contact details in Section 15.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Effective" date at the top of this page and, where appropriate, by sending you a notification. Where a change requires your consent, we will ask for it before the change applies to you.

15. Contact Us

For anything in this Policy, or to exercise your data rights, contact our Data Protection Contact:

  • Email — support@sepx.cc (first response within 1 business day)
  • Post — Data Protection Contact, SEPX LIMITED, 20 Wenlock Road, London N1 7GU, United Kingdom

Data controller. SEPX LIMITED, company no. 17367346, registered in England and Wales. Registered office: 20 Wenlock Road, London N1 7GU, United Kingdom. ICO registration ZC212736.

Support provider (independent). SEPX LLC, company no. 10611201, 131 Continental Dr, Ste 305, Newark, DE 19713, United States. Not a parent, holding company or group member; not a controller of your personal data and not a party to your contract. It provides third-party support and customer-service functions for SEPX.CC only.

If you are not satisfied with our response you can complain to the ICO at ico.org.uk/make-a-complaint, on 0303 123 1113, or by the other routes at ico.org.uk/global/contact-us — or to the supervisory authority where you live.