Privacy Policy and Data Protection (GDPR)

Last update date: 02.10.2026

§ 1 Preliminary Provisions

  1. Wink3r.com is a social-dating platform intended exclusively for adults (18+).

    It enables the creation of profiles, making contacts and communication between users with similar preferences and interests.

  2. This Privacy Policy sets out the rules for the processing of users' personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: "GDPR").

  3. The controller of your personal data is: MSLang Mateusz Sójka, NIP: 9571188929, REGON: 541911040, registered office: ul. Wały Piastowskie 1/1508, 80-855 Gdańsk, Poland.

§ 2 Contact Details

  1. For all matters related to the processing of personal data and the exercise of your rights, you may contact us:

    • e-mail: [email protected]
    • by post: MSLang Mateusz Sójka, ul. WaÅ‚y Piastowskie 1/1508, 80-855 GdaÅ„sk, with the note "RODO"

  2. We have not appointed a Data Protection Officer (DPO) because it is not required by GDPR in our situation.

§ 3 What Personal Data We Collect and Process

  1. We collect and process only personal data that is necessary to achieve the purposes described in this Privacy Policy, in particular: creating and maintaining an account, building and displaying a profile, enabling communication, interaction and publication of content, as well as ensuring security, moderation and the proper functioning of the service. We do not collect or process data beyond these purposes.

  2. Data provided voluntarily by the user during registration, profile creation and completion, and use of the service.

    Basic account data (provided during registration):

    • e-mail address
    • username (pseudonym / login)
    • password (stored only in encrypted / hashed form)
    • date of birth
    • approximate location (current or nearest city)
    • users gender and, in the case of transgender persons, an additional descriptor (sub-gender)
    • information about the account type (individual or for couples)

    Personal and profile data:

    • first name
    • height, weight, body type
    • ethnicity, education, industry, languages
    • relationship status, attitude to substances
    • profile description
    • partner preferences (age, gender)
    • relationship goals while using the service (e.g. relationship, casual acquaintance)
    • specific consents for data processing

    Optional nearby-people email alert (only with consent, e.g. when deleting or deactivating the account):

    • e-mail address
    • city
    • genders you want to be notified about when more such people appear nearby

    Content and materials published by user:

    • posts
    • galleries
    • private messages
    • swingers club chat messages (room chat on the map)
    • photos, videos in galleries, posts and private messages
    • descriptions of photos and videos
    • comments
    • likes

    Data concerning interactions between users:

    • lists of friends, followers and blocked users
    • information about profile views (who viewed your profile and when)
    • Winks balance and transaction logs (grants for watching advertisements, spends on optional features, related session identifiers and timestamps)

  3. Data concerning sexual orientation and sexual life

    We process this data exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR), given separately and voluntarily while completing your profile. This consent is voluntary; you may withdraw it at any time without affecting your ability to use the basic functions of the service (except for the visibility of this information in your profile).

    The processed data includes in particular:

    Sexual preferences and data (stored e.g. in the "sexualities" table and JSONB fields):

    • sexual orientation
    • readiness for sex (e.g. immediately or after several meetings)
    • sexual role
    • penis length (in the case of men and other persons who may have a penis)
    • date atmosphere / preferred vibe
    • level of experience
    • attitude to recording multimedia
    • attitude to group sex

    Sexual preferences and fetishes, among others:

    • kissing
    • massage
    • foot fetish
    • masturbation
    • oral sex
    • vaginal penetration
    • anal penetration

    Preferred erotic objects, among others:

    • anal plug
    • dildo
    • electrostimulators
    • blindfolds
    • costumes and outfits
    • sports socks
    • sexy lingerie

  4. Technical and log data:

    • two-factor authentication (2FA) tokens
    • age-verification status and related technical identifiers (we do not store face or identity-document images)
    • registration time, last login, current online status
    • activity logs (pseudonymised using profile ID)
    • analytical data on the use of the service (e.g. visited pages, time spent on the page, clicks, traffic source, device, browser, approximate location)
    • cookies and similar technologies (details in the dedicated section "Cookies and similar technologies")

  5. Anonymised statistics:

    • post views
    • clicks on post elements:
      • username (go to profile)
      • comment sections (open and close separately)
      • user avatar (enlarge avatar and access message/invitation buttons)
    • total number of profile views

  6. Data from content reports:

    • the case number, the reason, and the text of the report, the appeal or the complaint
    • images attached to the report and automatic screenshot of the reported content
    • who reported and whom the report concerns (an account or, for a person without an account, an e-mail address)
    • the text of the decision notices
    • a copy of content removed because of the report (a post, a comment, a gallery item, a profile photo, a profile description, or a first name) and the data needed to restore it, including the comments and reactions to it

    A report about a chat message does not delete that message. The decision in that case can block the account or apply another sanction set out in the Terms of Service.

§ 4 Purposes and Legal Bases for Processing Personal Data

We process your personal data only for the purposes described below. Each purpose has an indicated appropriate legal basis.

  1. Provision of Wink3r.com platform services, including:

    • creation and maintenance of a user account
    • registration and login
    • creation, editing and display of a profile
    • display of other users profiles
    • operation of the Winks internal points system (crediting for watching advertisements, spending on optional extra features, handling related complaints and preventing abuse)

    Legal basis: Art. 6(1)(b) GDPR - processing is necessary for the performance of the contract (Wink3r.com Terms of Service) to which you are a party.

  2. Enabling communication between users (private 1:1 chat, swingers club chat)

    Legal basis: Art. 6(1)(b) GDPR - performance of the contract. Swingers club chat messages are also stored on the server for 30 days (a copy that other players cannot see after 10 minutes) for moderation and to fulfil legal duties, in particular the DSA and requests from competent authorities (legal basis: Art. 6(1)(c) and (f) GDPR).

  3. Processing of special category data concerning sexual life (sexual orientation, sexual preferences and other aspects of sexual life).

    Legal basis: Art. 9(2)(a) GDPR - your explicit consent.

    Consent is voluntary. You may withdraw it at any time (withdrawal does not affect the lawfulness of processing carried out before the withdrawal) by deleting or hiding this information in your profile settings or by contacting us ([email protected]).

  4. Ensuring the security of the platform and protection of users, including:

    • content and behaviour moderation
    • detection of spam, abuse and fraud
    • counteracting violations of the Terms of Service

    Legal basis: Art. 6(1)(f) GDPR - legitimate interest of the controller consisting in protecting the platform, its users and ensuring compliance with the Terms of Service.

  5. Analysis of service usage and its improvement, including:

    • creation of internal statistics and reports
    • testing new features
    • detection and correction of technical errors

    Legal basis: Art. 6(1)(f) GDPR - legitimate interest of the controller consisting in the development and improvement of the quality of services provided.

  6. Analysis of traffic and how the platform is used via Google Analytics 4 (GA4), in order to better understand how users use the service, optimize UX/UI and improve the quality of services.

    Legal basis: Art. 6(1)(a) GDPR - your consent, given in the cookie banner (Marketing category). You may withdraw this consent at any time in the cookie settings.

  7. Displaying advertisements in the Service via the ExoClick advertising network.

    Legal basis: Art. 6(1)(a) GDPR - your consent, given in the cookie banner (Marketing category). You may withdraw this consent at any time in the cookie settings.

    We do not share special category data from your profile (sexual orientation, sexual preferences, sex life) with advertising networks and we do not target ads on that basis.

    If you are age-verified, you may store up to three advertising category keys on your account (for example latina or BDSM). We use those keys only to choose which ExoClick ad zone to load. We send the ad network the zone identifier and whether you are age-verified (ex_av). We do not send questionnaire sexuality fields or free-text keywords.

  8. Sending technical, administrative and security information (e.g. notifications of changes to the Terms of Service / Privacy Policy, session reminders, account security alerts).

    Legal basis: Art. 6(1)(f) GDPR - legitimate interest of the controller consisting in properly informing users about important matters related to the use of the service.

  9. Fulfilment of legal obligations incumbent on the controller, including:

    • keeping accounting and tax documentation
    • handling complaints and claims
    • responding to requests from authorised public authorities

    Legal basis: Art. 6(1)(c) GDPR - compliance with a legal obligation to which the controller is subject.

  10. We do not carry out automated decision-making, including profiling, that could produce legal effects concerning you or similarly significantly affect you.

  11. Optional e-mail notification when more people of the selected genders appear in your area (subscription when deleting or deactivating the account).

    Legal basis: Art. 6(1)(a) GDPR - your explicit consent. You may withdraw consent by writing to [email protected]. This consent does not cover sexuality-questionnaire data.

  12. Operating the content-reporting system: receiving a report, the decision, notice to the parties, a free appeal and a complaint about the decision within 6 months, and keeping the case file and the copy of content removed because of the report for 6 months from the decision. § 7 point 7 sets out the period. § 5 of the Terms of Service sets out the reporting rules.

    Legal basis: Art. 6(1)(c) GDPR - a legal duty under the Digital Services Act (DSA) - and Art. 6(1)(f) GDPR - legitimate interest in protecting users and in being able to show the decision. Where a report includes content concerning sexual life, we also process it for this purpose under Art. 9(2)(f) GDPR (establishment, exercise or defense of legal claims).

§ 5 To Whom We Share Your Personal Data

We share your personal data only to the extent necessary and only when it is required to achieve the purposes described in this Privacy Policy. We do not sell your personal data. Sharing with advertising partners takes place solely in order to display ads in the Service and only on the basis of your consent given in the cookie banner (Marketing category).

Recipients of your personal data may include the following categories of entities:

  1. Entities processing data on our behalf (processors):

    • Google Ireland Limited - cloud services, hosting, Google Analytics 4 (GA4) and other Google services (Google Cloud Platform). In connection with GA4 and Google Tag Manager, data may be further transferred to Google LLC in the USA (details in § 6)
    • International Business Machines Corporation (IBM), including DataStax, Inc. - database services (Astra DB)
    • Mailgun Technologies, Inc. - mailing services
    • CloudFlare Inc. - hosting, CDN, DDoS protection, server security
    • Upstash Inc. - Redis database services (database hosted exclusively in the EU)
    • Usercentrics A/S - consent management platform (CMP / cookie banner)
    • Vercel Inc. - frontend application hosting (Vercel platform)
    • Ageefy - age verification (hosted selfie with liveness and/or identity document). Ageefy is a third party. We do not store face or ID images; we store only the verification result and related technical identifiers.
    • AgeVerif (PlanetSeason - Unipessoal Lda, Rua Encosta dos Piornais nº 4, 9000-683 Funchal, Portugal, commercial registry no. 518 490 831; privacy policy) - age verification. AgeVerif / PlanetSeason is a third party and processes the data you submit during the check under its own privacy policy. We do not receive or store face images, ID images, card numbers, payment credentials or document contents. We store only that you completed a technical age check and related technical identifiers (for example provider name and attempt reference). Your Wink3r account stays anonymous: even if you verify with a document at AgeVerif or a partner they use, we do not obtain your legal identity from that check.

    All the above entities act on the basis of data processing agreements (DPA) and provide an adequate level of protection (European Commission adequacy decision, EU-U.S. Data Privacy Framework or Standard Contractual Clauses).

  2. Advertising partners (joint controllers):

    ExoClick acts as a joint controller for advertising purposes, only after you give consent in the cookie banner (Marketing category).

  3. Other users of the Wink3r.com platform

    • public profile elements (pseudonym, photos, videos, description, age, sexual orientation and preferences - if provided and visibility has not been restricted) - visible to all users who are not on your blocked list
    • content visible only to "winkers" (friends) i.e. private posts, photos, videos - visible exclusively to people you have accepted as winkers (friends)
    • content of private messages (chat) - visible exclusively to the sender and recipient
    • swingers club chat content - visible to age-verified participants in that room for 10 minutes
    • notices in a content-report case - visible on that case's page to the person the notice concerns

  4. Service administrators:

    • the swingers club chat copy (admin panel, maximum 30 days), only for moderation and to fulfil legal duties
    • the report file and the copy of content removed because of the report, for the period in § 7 point 7

  5. Public authorities and institutions authorised to receive data under the law:

    • law enforcement agencies, courts, public administration bodies, Personal Data Protection Office - in the event of a legal obligation or justified request (e.g. in criminal, civil or GDPR complaint proceedings)

§ 6 Transfer of Data Outside the European Economic Area (EEA)

  1. Personal data is in principle stored and processed within the territory of the European Economic Area (EEA).

  2. Exceptions are the following entities outside the EEA:

    • Upstash Inc. with its registered office in California, USA.
      Redis database data is stored exclusively in the Belgium (EU) region.

    • CloudFlare Inc. with its registered office in San Francisco, USA.

      • photos, videos and thumbnails are stored in R2 Object Storage and processed exclusively within the territory of the European Union thanks to the "Jurisdictional Restrictions" setting.
      • CDN, proxy, DDoS protection, WAF, Bot Management (anti-bot), DNS and other domain security mechanisms contain internet traffic metadata (including IP addresses, HTTP headers, security logs, anti-bot decisions). They are transferred and processed on CloudFlare infrastructure located outside the EEA, including in the United States.

    • Mailgun Technologies, Inc. with its registered office in San Antonio, Texas, USA.
      Mailing services. Message data (emails, logs, suppressions, etc.) is processed and stored in the EU region. Account data may be replicated globally.

    • Vercel Inc. with its registered office in Covina, California, USA.
      Frontend application hosting. Under the Vercel DPA, primary processing takes place in the United States. Data that may be processed includes IP addresses, HTTP request data, device and system configuration information, and technical logs.

    • Google LLC with its registered office in Mountain View, California, USA.
      Onward transfer within the Google group. The contracting party is Google Ireland Limited (Ireland, EEA), but in connection with Google Analytics 4 and Google Tag Manager, analytics data (including cookie identifiers, approximate location, device information and service-usage data) may be transferred to and processed by Google LLC in the United States. Google confirms such transfers and relies on the EU-U.S. Data Privacy Framework.

  3. In the case of the above entities, a formal transfer of personal data outside the EEA takes place. This transfer is secured on the basis of:

  4. In the event that any other service providers outside the EEA are introduced in the future, we will immediately inform you about it in an update to this Privacy Policy and will provide appropriate safeguards in accordance with GDPR (Standard Contractual Clauses or other adequate mechanisms).

§ 7 How Long We Store Your Personal Data

We store your personal data only for the period necessary to achieve the purposes for which it was collected, or for the period required by law. After these periods expire, the data is permanently deleted or anonymised in a way that prevents identification of the person.

Storage periods for individual categories of data:

  1. Data linked to the user account (e-mail address, pseudonym, date of birth, profile description, photos, videos, sexual preferences, sexual orientation, content of private 1:1 messages, activity history, etc.)

    • For the entire period of having an active account.
    • After deletion of the account by the user or by the Service (in the case of violation of the Terms of Service), all personal data is permanently deleted within 30 days (this period includes deletion from production databases and gradual deletion of backups and system logs), subject to the rules set out in points 3, 4, 5, 6 and 7 below.

  2. Technical and security log data (information about the device and browser, login logs, time and date of activity, detected abuse attempts)

    • while the account is active: maximum 12 months from the date of the last activity on the account (for the purpose of ensuring platform security, fraud detection and defence against claims)
    • after account deletion: in accordance with point 1 (deletion within 30 days)

  3. Special rules after account deletion (in accordance with the Wink3r.com Terms of Service):

    • The history of private messages with the deleted account remains visible to the other participants of the conversation - instead of the pseudonym and profile photo, the information "Deleted account" is displayed. It is not possible to send new messages to the deleted account.
    • Photos and videos attached in conversations (private messages) are permanently deleted together with the account and do not remain visible to any user.

  4. Winks transaction logs (balance, grants, spends, related sessions):

    • while the account is active: for the life of the account, in order to operate the points system, review complaints and prevent abuse
    • after account deletion: in accordance with point 1 (deletion within 30 days), unless a complaint or legal claim is pending, in which case the logs needed for that matter are kept until it is concluded and then deleted

  5. Swingers club chat (map chat):

    • In the room, a message is visible to age-verified participants for 10 minutes, then it leaves the chat.
    • We keep a server copy of each stored message for 30 days, only for administration, moderation, and legal duties (including the DSA and law-enforcement requests). Only administrators can access it. Other users cannot recover that history.
    • After 30 days the copy is deleted automatically. Deleting the account does not shorten that 30-day period if the copy is still needed for the purposes above.

  6. Optional nearby-people alert (e-mail address, city, selected genders):

    • only if you consent when deleting or deactivating the account
    • until you withdraw consent or request erasure of this data ([email protected])
    • this consent does not keep the account, profile, photos or messages - those are deleted under point 1

  7. Content reports and the copy of content removed because of a report:

    • an undecided case is kept until the decision
    • from the decision we keep the report file and the copy of content removed because of that report for 6 months, so that an appeal or a complaint can be reviewed and so that the decision can be shown
    • if an appeal or a complaint is still under review at the end of those 6 months, we keep those data until that review ends and then delete them
    • deleting the account does not shorten this period
    • only administrators see the full file; the parties see their own notices; images in a case concerning child sexual abuse are not shown to the parties
    • after the copy is deleted we do not restore that content
    • this point does not extend storage of content the user deleted, or the 30-day swingers club chat copy (point 5)

  8. After the indicated periods expire, the data is permanently deleted or anonymised in a way that prevents identification of the person.

  9. Account deletion is irreversible. We do not offer the possibility of recovering the account, profile, photos, messages or any other data. A nearby-people alert subscription, if switched on, continues independently of account deletion until consent is withdrawn (point 6). The report file and the copy of content removed because of a report remain for the period in point 7.

§ 8 Your Rights

  1. In accordance with GDPR, you have the following rights in relation to your personal data:

    • Right of access to the data (Art. 15 GDPR)
      You may obtain information about what data we process about you, for what purpose, to whom we disclose it, and receive a copy of this data.
    • Right to rectification of data (Art. 16 GDPR)
      You may request the correction of inaccurate or completion of incomplete data.
    • Right to erasure of data ("right to be forgotten" - Art. 17 GDPR)
      You may request the deletion of all your personal data (including deletion of the account), provided there is no legal obligation to retain it.
    • Right to restriction of processing (Art. 18 GDPR)
      You may request the restriction of processing (e.g. while a complaint or rectification request is being considered).
    • Right to data portability (Art. 20 GDPR)
      You may receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (applies to data processed on the basis of a contract or consent).
    • Right to object (Art. 21 GDPR)
      You may object to processing based on legitimate interest (e.g. moderation, analytics, security) - we will then cease such processing unless we demonstrate compelling legitimate grounds.
    • Right to withdraw consent (Art. 7(3) GDPR)
      Where processing is based on consent (special category data concerning sexual life, Google Analytics 4, advertising) you may withdraw consent at any time - this does not affect the lawfulness of processing carried out before the withdrawal. You may withdraw consent for special category data in your profile settings or by contacting us. You may withdraw cookie consent (Marketing category) in the cookie settings.

  2. We process your requests without undue delay, no later than within 1 month (in exceptional cases - up to 3 months). We do not charge a fee for exercising your rights, unless the requests are manifestly unfounded or excessive (in which case we may charge an administrative fee or refuse to act).

  3. You also have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (UODO): ul. Stawki 2, 00-193 Warsaw, e-mail: [email protected], www.uodo.gov.pl.

§ 9 Data Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, damage or unauthorised modification. Due to the nature of the platform (special category data concerning sexual life), we apply an elevated level of protection.

  1. Main security measures applied:

    • Encryption of data in transit (TLS 1.3 / HTTPS)
    • Encryption of user passwords
      Thanks to this, no one except you (not even the administrator with database access) can read your password.
    • Access control
      Only authorized persons have access to the data and only to the extent necessary.
    • Regular updates of software, libraries and servers
    • Monitoring and logging of suspicious activity
    • Limited access to sensitive data
      Pseudonymisation or anonymisation applied wherever possible.
    • Data backups

  2. Despite the application of high security standards, we cannot guarantee 100% protection against all threats (e.g. new zero-day exploits). In the event of a personal data breach, we will take immediate action and - if required - inform you and the President of the UODO.

  3. We also encourage you to take care of the security of your own account:

    • use a strong, unique password
    • do not share your login details with anyone
    • log out from public devices
    • enable two-factor authentication (2FA)

§ 10 Cookies and Similar Technologies

Wink3r, like almost all internet platforms, uses cookies and similar technologies (e.g. localStorage, sessionStorage).

  1. Cookie Management

    Upon your first visit (or after clearing cookies), we display a cookie settings banner (provided by Usercentrics A/S). You can choose:

    • Accept all
    • Customize preferences (including the Marketing category)
    • Reject all non-essential cookies

    You can change your settings at any time via:

    • the "Cookie Consent" link in the footer
    • clearing cookies in your browser

    Disabling advertising and analytics cookies does not affect the basic functioning of the service, but may result in less personalized ads being displayed.

    A complete, up-to-date list of all cookies with their names, providers, purposes, and storage periods is available in our cookie banner by clicking "Cookie Consent".

  2. Google Analytics 4 (GA4)

    We use Google Analytics 4 to analyze website traffic. GA4 collects data using cookies (including _ga, _ga_*) and other identifiers. The collected information is largely anonymized (IP is masked).

    • Data from GA4 helps us understand which sections of the service are the most popular, how users navigate, and how to improve the platform.
    • You can opt out of tracking by Google Analytics through the cookie settings in our banner (Marketing category).

§ 11 Age Restrictions - Service Exclusively for Adults

Wink3r.com is a platform intended exclusively for persons who have reached the age of 18. We do not provide services to minors and do not knowingly process personal data of children under 18 years of age.

  1. Measures taken to verify age:

    • We require the date of birth to be provided during registration
    • The user must confirm that they are 18 years of age or older
    • The landing age-gate remains a self-declaration and is not regulated proof of age
    • For unblurred access to pornographic content we offer a technical age check with Ageefy and AgeVerif. This is not a payment and not regulated proof of age. Details of each provider are in § 5.
    • AgeVerif methods we offer (AgeVerif only shows methods available in your country; the EU Digital Identity Wallet is not available in Poland): FaceAge (selfie estimate on your device); PayPal (an account already confirmed 18+); a small 3-D Secure card check by AgeVerif's payment partner, not by Wink3r; a ticket where AgeVerif offers it (for example in France); and AnonymAGE or a similar wallet-style proof where offered. Some methods may involve an identity document at AgeVerif or a partner they use.
    • Wink3r does not store any face image, ID image, scan, card number or document data from this check. We only record the result on your account (verified / not verified) and identifiers needed to run the session. Completing age verification, including with a document, does not identify you to Wink3r by legal name or ID number and does not make your Wink3r profile any less anonymous.
    • In the event of suspicion that the account belongs to a minor (user reports, behavior analysis, document verification in exceptional cases) - the account is immediately blocked and then deleted

  2. If we become aware that we have processed data of a person under 18 years of age, we will immediately delete all related personal data.

  3. If you suspect that a child is using the service, please report it immediately to: [email protected]. We will take immediate action, including deletion of the account and data.

§ 12 Changes to the Privacy Policy

  1. We reserve the right to update this Privacy Policy in order to adapt it to changes in law, new technologies, the scope of services provided or the manner of data processing.

  2. We will inform you of material changes in advance by:

    • a notification in the platform
    • and/or an e-mail to the address provided during registration

    Each update is also marked by a change to the content and the "last modified" date in the header of the Privacy Policy.

  3. Continued use of Wink3r.com after the changes come into effect constitutes acceptance of the new version of the policy.

  4. If you do not agree to the changes, you have the right to delete your account at any time (which will result in the deletion of all data in accordance with the section "How long we store your personal data").

  5. This Privacy Policy enters into force on 02.10.2026 and supersedes all previous versions.