Privacy policy

This policy describes how MaxGirls, the operator of maxgirls.com, handles personal data. MaxGirls is the data controller for the processing described here. There is one contact address for every question and every request in this policy: support@maxgirls.com.

01What we collect

If you only browse or search. A session cookie so the site works, and standard server logs containing your IP address, the pages requested and your browser's user agent string. Logs are kept for thirty days and used to keep the service up and to investigate abuse. If you confirm your age on an 18+ photo, a cookie records that choice for thirty days in that browser. Nothing about that choice is attached to a person.

If you sign up. Your email address, the confirmation code we send you, whether and when you confirmed it, which page the signup came from, any UTM parameters on that page, your IP address and your user agent at the moment of signup. The last two exist to detect automated abuse of the signup.

If you publish a model profile. Everything you choose to put in it: display name, biography, photographs, categories, city, date of birth, height, day-rate range, availability and any social handle you add. This is a public directory, so the whole of an approved profile is intended to be visible to anyone, once it has passed the review step. That is the point of publishing it, and it is worth being deliberate about what goes in.

If you contact us. The email you sent and our replies to it, kept as long as needed to resolve the matter and then for the period any legal claim could arise from it.

02Photographs, EXIF and the 18+ files

• Location and camera metadata is stripped from every uploaded image automatically. A photo taken at home does not publish where home is.
• Original files are stored on a private disk that is not reachable from the web and is never symlinked into a public directory. Images are streamed through a controller, so the URL shape gives nothing away about what is behind it.
• For a photo you mark 18+, a second, deliberately degraded file is generated: the image is reduced to roughly thirty pixels on its long edge, blurred, then scaled back up. Public pages reference only that file. The detail is gone from the pixels themselves rather than hidden with a CSS filter.
• The original of a marked photo is released only to a viewer who has confirmed, on that photo, that they are 18 or older. The control is described in full on the FAQ. That confirmation is a cookie in their browser and is not linked to an identity.

03Why we are allowed to process it

• Contract. Running your account, publishing your profile and letting brands contact you is the service you asked for.
• Legitimate interests. Keeping the service secure, preventing abuse of the signup and the search, and reviewing profiles before publication. We think a directory that reviews is in the interests of everyone listed in it.
• Consent. Marketing email, where we ask for it. You can withdraw consent at any time and it does not affect anything processed before you did.
• Legal obligation. Where the law requires us to keep or produce something.

04Who else sees it

Approved profiles are public by design. Beyond that, personal data is shared only with the suppliers that make the service run: hosting, the mail server that sends confirmation codes and notifications, and error logging. They act on our instructions and may not use your data for anything of their own. We do not sell personal data, we do not run advertising networks on this site, and we do not share your address with other members. A brand who wants to contact you emails the address on your profile, or through the contact reveal on a Booker seat, which shows them what you published and nothing else.

05How long it is kept

• Server logs: thirty days.
• Signup records: until you ask us to delete them, or three years after the last activity.
• Profiles and photographs: until you unpublish or delete them. Deleting removes the originals and every derivative, including the blurred previews, from our storage. Backups roll off within thirty days.
• Correspondence: as long as needed to deal with it, then as long as a claim could arise from it.

06Your rights

Under the GDPR and RODO you can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to processing based on legitimate interests, ask for processing to be restricted, and ask for your data in a portable format. Email support@maxgirls.com from the address on the account and we will answer within one month, usually within one business day. If you think we have handled your data badly you can complain to your national data protection authority; in Poland that is the President of the Personal Data Protection Office.

07Cookies

Three, and none of them are advertising cookies. A session cookie so the site works and forms cannot be forged. A thirty day cookie recording an age confirmation on 18+ photos. A cookie remembering that you are signed in, once accounts exist for you. We do not use third-party tracking cookies to follow you around other websites.

08Children

MaxGirls is not for anyone under 18, and trust and safety sets out what else we screen for. Accounts and profiles require you to be 18 or over, and a profile whose date of birth or photographs suggest otherwise is rejected at review and the account is closed.

09Changes

If this policy changes materially we will say so on this page and date it. The date at the top is the last time anything here was edited.