Privacy Policy

Last updated: 2025-04-01

1. Introduction

Brillith’s Mansion ("SEM Sàrl", "we", "us", "our"), based in Geneva, Switzerland, operates the platform accessible at brillithsmansion.com (the "Platform"). We are committed to protecting the privacy and personal data of our users, members, and models. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you use our Platform. It applies to all visitors, registered members, VIP subscribers and models.

We process your data in compliance with the Swiss Federal Act on Data Protection (nFADP/nLPD, in force since 1 September 2023), the EU General Data Protection Regulation (GDPR) where applicable, and any other applicable data protection legislation.

2. Data Controller

The data controller responsible for processing your personal data is:

SEM Sàrl Geneva, Switzerland Email: privacy@brillithsmansion.com

If you have any questions about how we process your data, or if you wish to exercise your rights, please contact us using the details above.

3. Data We Collect

We collect different categories of personal data depending on how you interact with our Platform:

Account data

When you register, we collect your name, email address, phone number, password (hashed), language and currency preferences, and country of residence.

Profile data (models)

Models provide additional information such as biography, physical characteristics, photos, videos, availability, rates, spoken languages, and location details.

Technical data

We automatically collect your IP address, browser type and version, operating system, device type, referral source, pages visited, session duration, and interaction data (clicks, scrolls).

Booking data

When you submit a booking request, we collect the requested dates, location, message, and contact preferences.

Payment data

If you subscribe to a VIP plan, payment transactions are handled by our third-party payment processor. We do not store your full credit card number. We receive and store transaction IDs, subscription status, billing currency, and payment confirmation details.

Communication data

When you contact us, we collect the content of your messages, your email address, and any attachments you send.

4. How We Collect Data

We collect data through the following means:

Directly from you — when you create an account, fill in your profile, make a booking, subscribe, or contact us.
Automatically — through cookies, server logs, and analytics tools when you browse the Platform.
From third parties — if you sign in via Google OAuth, we receive your name, email and profile picture from Google. We may also receive verification data from SMS providers (Twilio).

5. Legal Basis for Processing

We process your personal data on the following legal grounds:

Performance of a contract

Processing necessary to provide our services: account management, booking requests, VIP subscriptions, and model profile hosting.

Consent

Where you have given explicit consent: marketing communications, analytics cookies, and newsletter subscriptions. You may withdraw consent at any time.

Legitimate interests

Processing necessary for our legitimate business interests: Platform security, fraud prevention, service improvement, and abuse detection — provided these interests do not override your fundamental rights.

Legal obligations

Processing required to comply with Swiss and EU law: tax records, anti-fraud measures, and responding to lawful requests from authorities.

6. How We Use Your Data

We use your personal data for the following purposes:

To create and manage your account, authenticate your identity, and provide access to the Platform's features.
To process and facilitate booking requests between members and models.
To manage VIP subscriptions, process payments, and grant access to premium content.
To send transactional notifications (booking confirmations, account updates, security alerts) via email or SMS.
To protect the Platform against fraud, abuse, and unauthorised access through rate limiting, audit logging, and anomaly detection.
To analyse Platform usage through privacy-respecting analytics (Plausible) in order to improve our services and user experience.
To comply with legal obligations, respond to lawful requests, and enforce our Terms and Conditions.
To send you marketing communications about our services, only with your explicit consent. You may unsubscribe at any time.

7. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We share your data only in the following limited circumstances:

Service providers

We use trusted third-party providers to operate the Platform. These providers process data on our behalf under strict contractual obligations:

Payment processor

VIP subscription payments are processed by our payment provider. Only necessary transaction data is shared. We never have access to your full card details.

Legal and regulatory

We may disclose your data if required by law, regulation, court order, or governmental request, or to protect our rights, safety, or property.

Models (booking context)

When you submit a booking request, the relevant model receives your name, booking details, and contact preferences to respond to your request.

We never sell your personal data to advertisers, data brokers, or any other third party.

8. International Data Transfers

Your data is primarily stored and processed in the European Economic Area (EEA) and Switzerland. Some of our service providers may process data in the United States (e.g., Vercel, Sentry). Where data is transferred outside Switzerland or the EEA, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs) approved by the European Commission • Adequacy decisions by the Swiss Federal Data Protection and Information Commissioner (FDPIC) • Provider certification under recognised frameworks.

You may request information about the specific safeguards applied to international transfers by contacting us.

9. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law:

Account data — retained for the lifetime of your account, then deleted within 30 days of account closure.
IP addresses — retained for 90 days for security purposes, then anonymised or deleted.
Audit logs — retained for 12 months for security and compliance, then permanently deleted.
Analytics data — retained for 26 months (aggregated, no personal identifiers).
Booking records — retained for 12 months after completion, then archived or deleted.
Payment records — retained as required by Swiss tax and accounting law (typically 10 years for transaction records).
Support communications — retained for 24 months, then deleted.

When your data is no longer needed, it is securely deleted or irreversibly anonymised.

10. Data Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

All data in transit is encrypted using TLS 1.2 or higher. Sensitive data at rest is encrypted.
Passwords are hashed using secure algorithms (bcrypt). We never store passwords in plain text.
Access to personal data is restricted to authorised personnel on a need-to-know basis.
Two-factor authentication (2FA) is available for all accounts and mandatory for administrators.
We use automated monitoring and error tracking to detect and respond to security incidents.
EXIF metadata is automatically stripped from uploaded photos to protect location data and device information.
Premium media is served via time-limited signed URLs (30-minute expiry) to prevent unauthorised access.

Despite our best efforts, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to privacy@brillithsmansion.com.

11. Cookies

We use cookies and similar technologies to operate the Platform. For detailed information about the types of cookies we use and how to manage your preferences, please refer to our Cookie Policy.

In summary, we use essential cookies (session, language, currency) that are necessary for the Platform to function, and optional analytics cookies (Plausible Analytics) that help us understand usage patterns in a privacy-respecting way. You can manage your cookie preferences at any time via our cookie consent banner.

12. Your Rights

Under the GDPR and Swiss nFADP (nLPD), you have the following rights regarding your personal data:

Right of access

You have the right to obtain confirmation of whether we process your personal data, and to request a copy of that data.

Right to rectification

You have the right to request correction of inaccurate or incomplete personal data.

Right to erasure ("right to be forgotten")

You have the right to request deletion of your personal data, subject to legal retention obligations.

Right to restriction of processing

You have the right to request that we limit the processing of your data in certain circumstances.

Right to data portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON), and to transmit it to another controller.

Right to object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Right to withdraw consent

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Right not to be subject to automated decisions

You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

You can exercise most of these rights directly from your account dashboard (Settings > Privacy). For data export, use the "Export my data" feature. For account deletion, use "Delete my account". For other requests, contact us at privacy@brillithsmansion.com.

We will respond to your request within 30 days. If your request is complex, we may extend this period by an additional 60 days, with prior notice.

13. Children's Privacy

The Platform is strictly intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18 years of age. If we become aware that we have collected data from a minor, we will take immediate steps to delete that data. If you believe a minor has provided us with personal data, please contact us immediately at privacy@brillithsmansion.com.

14. Third-Party Links

The Platform may contain links to third-party websites or services that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites. We encourage you to review the privacy policy of every site you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via email or a prominent notice on the Platform at least 14 days before they take effect. The "Last updated" date at the top of this page indicates when this policy was last revised.

We encourage you to review this policy periodically. Continued use of the Platform after changes take effect constitutes acceptance of the revised policy.

16. Supervisory Authority

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a supervisory authority:

In Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch
In the EU: the supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement.

We encourage you to contact us first so we can try to resolve your concern directly.

17. Contact

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact us at:

SEM Sàrl Data Protection Contact Geneva, Switzerland Email: privacy@brillithsmansion.com

We will make reasonable efforts to respond to your inquiry within 10 business days.