Last updated: February 24, 2026. This policy explains how we collect, use, store, and protect your personal data.
SuperModelsX ("we", "us", "our") is the data controller responsible for your personal data. We are located at Rua Actor Mário Viegas, nº 54, 4435-076 Rio Tinto, Gondomar, Portugal, and operate under the General Data Protection Regulation (GDPR) and applicable Portuguese data protection laws. For any data protection inquiries, contact us at: contact@supermodelsx.com.
We collect the following categories of personal data: (a) Account data: email address, password (encrypted), display name; (b) Profile data: name, age, location, physical attributes, description, contact details, photos, and videos uploaded by advertisers; (c) Verification data: government-issued identification documents and selfie photographs, used to verify advertiser identity and age; (d) Payment data: subscription plan, payment status, and transaction identifiers (payment card details are processed directly by our payment provider and are never stored on our servers); (e) Technical data: IP address, browser type, device information, and cookies; (f) Usage data: pages visited, features used, and interaction patterns.
We process your personal data on the following legal bases under GDPR Article 6: (a) Contract performance — to provide the services you signed up for, including account management, profile hosting, and subscription processing; (b) Legitimate interest — to maintain platform security, prevent fraud, moderate content, and improve our services; (c) Legal obligation — to comply with applicable laws, including age verification and record-keeping requirements; (d) Consent — for optional processing such as marketing communications and analytics cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
We use your personal data to: (a) create and manage your account; (b) publish and display advertiser profiles; (c) verify advertiser identity and age through our moderation process; (d) process payments and manage subscriptions; (e) communicate with you about your account, including service updates and support; (f) enforce our Terms of Service and moderate content; (g) detect and prevent fraud, abuse, and security threats; (h) analyze platform usage to improve our services; (i) comply with legal obligations.
For advertiser identity verification, we collect and store copies of government-issued identification documents and selfie photographs. This data is: (a) used exclusively for verifying advertiser identity and age (18+); (b) reviewed by authorized moderation staff only; (c) stored securely with restricted access; (d) retained for the duration of the advertiser's account and for a period of up to 12 months after account deletion, as required for compliance and legal purposes; (e) managed by our designated Custodian of Records. We do not use verification documents for any purpose other than identity and age verification.
We use cookies and similar technologies for: (a) Essential cookies: authentication, session management, and security (strictly necessary, no consent required); (b) Functional cookies: language preferences and user settings; (c) Analytics cookies: understanding how the platform is used to improve our services. We do not use third-party advertising cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the platform from functioning correctly.
We do not sell your personal data. We share data with the following categories of third parties only as necessary: (a) Payment processors — to process subscription payments (they receive only the data necessary to complete transactions); (b) Cloud hosting and database providers — to host and operate the platform infrastructure; (c) Transactional email providers — to send emails such as account confirmations; (d) Law enforcement — when required by law, court order, or to protect the safety of our users. All third-party service providers are contractually obligated to protect your data and process it only on our instructions.
Some of our service providers operate outside the European Economic Area (EEA). When your data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or reliance on adequacy decisions. You may request details of the safeguards in place by contacting us.
We retain your data for the following periods: (a) Account data: for the duration of your account, deleted within 30 days of account closure; (b) Profile data: deleted when the profile is removed or account is closed; (c) Verification documents: retained during active account and up to 12 months after account deletion for compliance purposes; (d) Payment records: retained for up to 7 years as required by tax and financial regulations; (e) Technical and usage data: retained for up to 12 months for analytics and security purposes; (f) Moderation logs: retained for up to 24 months for audit and compliance purposes.
We implement appropriate technical and organizational measures to protect your personal data, including: (a) encryption of data in transit (TLS/HTTPS) and at rest; (b) secure password hashing; (c) role-based access control for staff; (d) restricted access to verification documents; (e) regular security reviews; (f) secure hosting infrastructure with industry-standard protections. While we take all reasonable precautions, no system is completely secure. In the event of a data breach, we will notify affected users and the relevant supervisory authority as required by GDPR.
Under the GDPR, you have the following rights: (a) Right of access — request a copy of your personal data; (b) Right to rectification — request correction of inaccurate data; (c) Right to erasure — request deletion of your data (subject to legal retention requirements); (d) Right to restriction — request limited processing of your data; (e) Right to data portability — receive your data in a structured, machine-readable format; (f) Right to object — object to processing based on legitimate interest; (g) Right to withdraw consent — withdraw consent at any time for consent-based processing. To exercise any of these rights, contact us at contact@supermodelsx.com. We will respond within 30 days.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. For Portugal, the relevant authority is: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1200-651 Lisboa, Portugal — www.cnpd.pt.
The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete that data immediately and terminate the associated account.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Platform. Continued use of the Platform after changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically.
This Privacy Policy is governed by the laws of Portugal and the European Union, including the General Data Protection Regulation (GDPR). Any disputes related to data protection shall be resolved in the courts of Portugal, without prejudice to the right of users within the EU to lodge complaints with their local supervisory authority.
For questions, data protection requests, or concerns regarding this Privacy Policy, contact us at: contact@supermodelsx.com. SuperModelsX, Rua Actor Mário Viegas, nº 54, 4435-076 Rio Tinto, Gondomar, Portugal.