Privacy Notice

Introduction

Rhodit Media LLC ("Rhodit," "we," "us," or "our") operates rhodit.com and related services for adult content creators, including OnlyFans account management, messaging operations, analytics, banking coordination, and compliance support. We are the controller of personal information collected or provided through our website and our operating services, except where we act as a processor on a creator's documented instructions.

Please read this Privacy Notice carefully. Your access to and use of our website and services signifies that you have read and understand the terms within this notice. If you have questions about our privacy practices, see Contact Information below.

Data controller: Rhodit Media LLC, 8 The Green, STE B, Dover, DE 19901, United States. Email: privacy@rhodit.com.

1. Scope

For the purposes of this Privacy Notice, "process," "processed," or "processing" means any operation performed on personal data, whether by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, alignment, combination, restriction, erasure, or destruction.

This Privacy Notice applies to information we process:

• on rhodit.com and related application forms;
• in communications with Rhodit via email, messaging platforms, phone, or other channels;
• in the course of onboarding, managing, and operating creator accounts on third-party platforms such as OnlyFans; and
• in our internal dashboards, analytics, and back-office systems used to deliver creator operations.

This notice does not apply to third-party platforms' own privacy practices (including OnlyFans, payment processors, or social networks). Those services are governed by their own policies.

2. Our Policy Towards Minors

Our services are directed exclusively to individuals who are at least eighteen (18) years of age, or the applicable age of majority in the jurisdiction from which our services are accessed, whichever is higher. We do not knowingly collect personal information from minors.

Where required for onboarding or platform compliance, we may collect and verify age and identity documentation to confirm eligibility. If you are the parent or legal guardian of a minor who has provided us with personal information, contact us at privacy@rhodit.com and we will take steps to delete that information.

3. The Data We Process About You

"Personal Data" or "Personal Information" means any information relating to an individual that can be used to identify that person, either directly or indirectly. This does not include data that has been anonymized or aggregated so that the individual is no longer identifiable.

We may process different categories of personal data depending on how you interact with us.

Website visitors and enquirers

Individuals who visit rhodit.com without entering a management relationship with us. We may process:

• Contact data: name, email address, telephone number, country, and other details you submit through our introduction or application forms.
• Communication data: content of emails, messages, and support requests.
• Activity data: pages visited, referring URLs, browser and device information, operating system, time zone, and IP address.
• Preference data: marketing and communication preferences where you opt in.

Prospective creators

Individuals applying to work with Rhodit. In addition to the categories above, we may process:

• date of birth and demographic information submitted during application;
• platform handles, revenue ranges, content category, and business intent;
• referrer or introduction details;
• social media profile information you choose to provide; and
• records of calls, meetings, and diligence conducted before onboarding.

Managed creators

Creators under an active operating agreement with Rhodit. In addition to the categories above, we may process:

• Account and identity data: legal name, stage or display name, postal address, government-issued identification where required for verification, tax identification numbers, and banking or payout details necessary to process revenue.
• Platform access data: credentials, session tokens, or API connection data needed to operate your account on your behalf. We treat this information under strict access controls and do not use it for purposes unrelated to the services you have engaged us to perform.
• Content and performance metadata: post schedules, pricing, vault organization, analytics, subscriber counts, and operational notes — not for public redistribution, but to run your account.
• Messaging data: fan conversation content, templates, and operator notes where you authorize us to manage messaging on your behalf.
• Financial data: earnings reports, payout records, invoices, and revenue-share calculations.
• Sensitive data: depending on how you use our services and what you submit, we may process special categories of personal information, including information concerning your sex life or sexual orientation, only where necessary to provide the services you have requested and subject to appropriate safeguards.

Fans and third parties

Where we manage messaging or operations on a creator's behalf, we may process limited personal information about fans or subscribers (such as usernames, message content, purchase history visible within the platform, and interaction timestamps) solely to perform services for that creator. Creators remain responsible for their relationship with fans under platform terms; we process fan data as a processor or service provider on the creator's instructions where applicable.

4. The Sources from Which We Process Personal Information

We process personal information from the following sources:

• Directly from you: application forms, contracts, email, calls, and dashboard settings.
• Automated technologies: cookies and similar technologies when you use our website (see Section 8).
• Third-party platforms: OnlyFans and other creator platforms, payment processors, analytics providers, identity verification vendors, and communication tools you connect or authorize.
• Referrers and introductions: where you are introduced to Rhodit by a third party who provides contact details with appropriate consent.

5. Purposes for Which We Process Your Personal Information

We process personal information for the purposes described below.

• Provision of services: to evaluate applications, onboard creators, operate accounts, manage messaging, run analytics, coordinate banking and payouts, and deliver the creator operations described in our agreements.
• Customer management: to administer your relationship with Rhodit, provide support, send service notices, and communicate about changes to our services.
• Identity and eligibility verification: to confirm age, identity, and eligibility for adult-platform services where required by law, platform policy, or our internal standards.
• Communications: to respond to enquiries, resolve requests, and handle complaints.
• Analytics and improvement: to understand how our website and services are used, improve performance, and develop internal tools.
• Marketing: where permitted, to send information about Rhodit services. We rely on consent or legitimate interest as applicable, and you may opt out at any time.
• Security and fraud prevention: to detect, prevent, and respond to unauthorized access, fraud, abuse, or activity that violates our terms or applicable law.
• Compliance: to comply with legal obligations, tax and accounting requirements, platform policies, law-enforcement requests where lawfully required, and to enforce our Terms of Use.
• Business continuity: in connection with a merger, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality protections.

6. Our Legal Bases Under GDPR and Similar Laws

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data only when one of the following legal bases applies:

• Consent (Art. 6(1)(a) GDPR): where you have given explicit consent, for example when subscribing to marketing communications or accepting non-essential cookies.
• Contractual necessity (Art. 6(1)(b) GDPR): processing necessary to perform a contract with you or to take steps at your request before entering a contract.
• Legal obligation (Art. 6(1)(c) GDPR): processing necessary to comply with applicable law, including tax, accounting, and regulatory requirements.
• Legitimate interests (Art. 6(1)(f) GDPR): processing necessary for our legitimate business interests — such as improving services, securing our systems, and preventing fraud — provided those interests are not overridden by your rights.

Where we process special categories of personal data under GDPR, we do so only where a valid condition under Art. 9 GDPR applies, such as your explicit consent or processing necessary for the establishment, exercise, or defense of legal claims, and always with appropriate safeguards.

Depending on the circumstances, we may rely on different legal bases when processing the same information for different purposes. If you reside outside the EEA, UK, or Switzerland, the legal bases on which we rely may differ from those listed above.

7. Disclosure of Your Personal Information

We disclose personal information when necessary to perform our services or for the other purposes set out in this notice. Recipients may include:

• Service providers and processors: hosting providers, cloud infrastructure, analytics tools, payment processors, identity verification vendors, communication platforms, and professional advisers who process data on our instructions and under contractual confidentiality and security obligations.
• Platform operators: OnlyFans and other third-party platforms where disclosure is necessary to operate your account as authorized by you.
• Authorized personnel: employees and contractors who require access on a need-to-know basis and are bound by confidentiality obligations.
• Business successors: a buyer or successor in the event of a merger, acquisition, or sale of assets, subject to appropriate protections.
• Regulators and authorities: where we reasonably believe disclosure is required to comply with law, court order, legal process, or governmental request; to enforce our terms; to detect or prevent fraud or illegal activity; or to protect the rights, property, or safety of Rhodit, our clients, or others.

We do not sell your personal information for money. We do not share personal information with third parties for their own independent marketing without your consent.

To request a list of categories of service providers we use, contact privacy@rhodit.com.

8. Cookies and Automatic Data Collection Technologies

As you navigate rhodit.com, we and our service providers may use cookies, pixels, and similar technologies to collect website activity data. These technologies help our site function, remember preferences, measure traffic, and — where you consent — support analytics and marketing.

We use only cookies that are strictly necessary for the Site to function, plus limited analytics cookies where permitted. You can manage non-essential cookies through your browser settings. We do not operate a separate cookie policy page.

9. Your Choices About How We Collect, Use, and Disclose Your Personal Information

We strive to provide you with meaningful choices regarding your personal information.

• You may choose not to provide certain information, but that may limit your ability to apply for services, onboard as a creator, or use particular features.
• You may manage non-essential cookies through your browser settings.
• You may opt out of marketing emails using the unsubscribe link in any marketing message or by contacting us at privacy@rhodit.com. We may still send transactional or service-related messages.
• Managed creators may request updates to operational data or withdrawal of specific authorizations through their Rhodit contact, subject to contractual and legal requirements.

10. California Rights and Choices

If you are a California resident, the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act of 2020 ("CPRA"), may provide you with certain rights regarding your personal information, including the right to:

• know what personal information we collect, use, disclose, and sell or share;
• request deletion of personal information we collected from you, subject to exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information;
• limit use of sensitive personal information in certain circumstances; and
• not receive discriminatory treatment for exercising your privacy rights.

Rhodit does not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising in a manner that constitutes a "sale" or "share" under the CCPA/CPRA without offering an opt-out where required.

To exercise California privacy rights, email privacy@rhodit.com with the subject line "CCPA Request" and include sufficient information for us to verify your identity. We will respond within the timeframe required by applicable law. You may designate an authorized agent to submit a request on your behalf where permitted by law.

11. Other US State Privacy Laws

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another US state with a comprehensive privacy law, you may have additional rights including the right to access, delete, correct, or obtain a copy of your personal data, and the right to opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects, where applicable.

We do not sell personal data for money. To exercise rights under applicable state law, contact privacy@rhodit.com with the subject line "Privacy Rights Request." We will verify your identity before processing your request and respond within the period required by applicable law.

12. Identity and Age Verification

Because we work with adult content creators and regulated platforms, we may use third-party service providers to verify identity, age, and the authenticity of identification documents you submit during onboarding or as required by platform policy.

Where biometric or facial-comparison technologies are used, they are provided by our verification vendors under their own terms and privacy notices. We receive only the verification outcome and related metadata necessary to confirm eligibility, not ongoing biometric profiles, unless otherwise disclosed at the point of collection.

You may be asked to provide consent for verification processing where required. Withdrawing consent may prevent us from onboarding or continuing to operate your account where verification is a legal or platform requirement.

13. Transfers of Your Personal Information to Other Countries

Rhodit Media LLC is based in the United States. We may process and store personal information in the United States and other countries where we or our service providers operate.

Where personal information is transferred outside the EEA, UK, or Switzerland, we implement appropriate safeguards, which may include Standard Contractual Clauses approved by the European Commission (and equivalent UK mechanisms where appropriate), adequacy decisions, or other lawful transfer mechanisms.

To request more information about transfer safeguards, contact privacy@rhodit.com.

14. Retention of Personal Information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax, or reporting requirements.

Indicative retention periods include:

• Creator and client records: for the duration of the business relationship and up to five (5) years thereafter, unless a longer period is required by law.
• Application and enquiry records: up to three (3) years after the last interaction, unless a longer period applies.
• Website analytics data: up to twenty-six (26) months, where analytics cookies are used with consent.
• Financial and tax records: up to seven (7) years, as required by applicable tax law.
• Security and audit logs: for a period appropriate to investigate incidents and meet compliance obligations.

When personal information is no longer needed, we securely delete or anonymize it. In some circumstances we may anonymize information so it can no longer be associated with you and use that anonymized information indefinitely without further notice.

15. Data Security

We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS/SSL), access controls, least-privilege permissions, contractual requirements for processors, and staff training on data protection.

No method of transmission over the Internet or electronic storage is completely secure. While we work to protect your personal information, we cannot guarantee absolute security.

16. Third-Party Links and Sites

Our website and communications may contain links to third-party websites or services that we do not control, including OnlyFans, social networks, and payment providers. This Privacy Notice does not apply to those third parties. We encourage you to read the privacy policies of every site you visit.

17. Changes to Our Privacy Notice

We review this Privacy Notice periodically and may update it to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will post the updated notice on this page and revise the "Last modified" date above.

Your continued use of our website or services after changes become effective constitutes acceptance of the updated notice, to the extent permitted by law.

18. Your Rights Related to Your Personal Information

Subject to applicable law, you may have the following rights regarding your personal data:

• Right of access: to receive information about the personal data we hold about you and how it is used.
• Right to rectification: to correct inaccurate or incomplete personal data.
• Right to erasure: to request deletion of your personal data in certain circumstances.
• Right to restriction: to request that we limit processing in certain circumstances.
• Right to data portability: to receive personal data you provided in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.
• Right to object: to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, to withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: if you are in the EEA or UK, you may complain to your local data protection authority. US residents may contact their state attorney general where applicable.

Privacy law is nuanced, and these rights are not available in all circumstances. To exercise your rights, email privacy@rhodit.com with the subject line "Privacy Rights Request." We will respond within one (1) month, or the period required by applicable law. We may need to verify your identity before processing a request.

Please note that deleting certain personal information may require ending an active management relationship where that information is necessary to perform our contract with you.

19. Contact Information

If you have questions about this Privacy Notice or our information-handling practices, contact us:

• Email: privacy@rhodit.com (subject line: "Privacy Inquiry")
• General enquiries: team@rhodit.com
• Postal address: Rhodit Media LLC, Attn: Privacy, 8 The Green, STE B, Dover, DE 19901, United States

For data protection inquiries under the GDPR, you may contact us at the same address with the subject line "Data Protection Inquiry."

This Privacy Notice is effective as of June 6, 2026 and applies to personal information collected by Rhodit Media LLC through rhodit.com and our creator operations services.