Privacy and Cookie Policy
Effective date: 2 November 2026
By using Heduno, you acknowledge that you have read and understand this Policy.
1. Who we are and where you will see us
1.1 Heduno is operated by Wick Entertainment Limited (company no. 13853762, registered office C/O Alexander & Co, Centurion House, 129 Deansgate, Manchester, England, M3 3WR), trading as "Heduno" ("we", "us", "our"). We are the data controller of the Personal Data we process in connection with Heduno and the services we provide through it (the "Services").
1.2 Who controls your data on different sites. You may use Heduno on heduno.com, on a Creator's own domain, or on a Partner Site: a branded site run by one of our Partners on Heduno. You have a single Heduno Account across all of them.
-
On heduno.com and Creator domains, Wick Entertainment Limited (trading as Heduno) is the controller of your Personal Data.
-
If you sign up on a Partner Site, that Partner and we are joint controllers of your Personal Data. The Partner's name is shown when you sign up. While the Partner works with us, we hold and manage all your data, handle your requests and are your point of contact. The Partner sees only limited information about activity on its site (see clause 10.1). If the Partner stops working with us, we give it the data described in clause 10.1, and from then on the Partner is responsible for it.
1.3 You can contact us about this Policy or your Personal Data at privacy@heduno.com.
2. Scope and age
2.1 This Policy applies to Personal Data we process about Fans, Creators, individuals who feature in a Creator's Content ("Content Collaborators"), Partners (and the individuals who act for them), and our business contacts. It is provided alongside, but does not form part of, the Terms of Service.
2.2 Heduno is strictly for individuals aged 18 or over. By using the Services you confirm you are 18 or over.
3. What is Personal Data
3.1 "Personal Data" means information that identifies or could reasonably be linked to a particular person. Anonymised or aggregated data that cannot be linked to you is not Personal Data and is not covered by this Policy.
4. The Personal Data we process
We process the following categories of Personal Data about Users and Content Collaborators:
| Category | What it includes |
|---|---|
| User Data | Creators / Content Collaborators: full name, alias, date of birth, nationality, gender, address, country of residence, email, phone, how you heard about Heduno (if you tell us), a copy of the government ID document provided to our verification provider (which, for Creators and Content Collaborators, we access and hold as Records Custodian — see clause 6.3), a selfie/short clip used for verification, social/website handles, and signatures on release forms where you feature in Content. Fans: email, phone. |
| Verification Data | Data generated by our verification provider during age and identity checks: the result (pass/fail and reason) and process metadata (e.g. start/finish time). See clause 6. |
| Account Data | Profile name, password, avatars/banners, your Subscriptions, followers and referrals, posts, comments, chat messages, and support queries. |
| Financial Data | Payment-card details (tokenised — see note below), billing address, Wallet balance and top-ups, and (for Creators) payout details, tax identifiers and any tax forms. |
| Transaction Data | Payments, Wallet debits and credits, Creator earnings, payout requests and failed payments. |
| Custom Request Data | The free-text briefs and any details you include when you commission a Custom Request, which may contain information you choose to provide. |
| Technical Data | IP address (and country code) and user-agent. |
| Usage Data | How you use the Services. Our servers record key events, such as signing up, purchases (amounts and the country of your card, but not card details) and age-check results. If you agree to analytics cookies (see clause 8), we also record the pages you view, what you click, the Creators you open or follow, your device, browser and screen size, and the website, campaign or link that brought you to us. It may also include session recordings of your visits. In these recordings, text you see or type is masked, images are hidden, and payment, verification and sign-in pages are never recorded. Usage Data is linked to your Account by an identifier, not by your name or email address. |
| Partner Data | Business and contact details, ownership and verification information, bank, tax and VAT details, and Partner Dashboard activity. |
| Face Recognition Data | Used by our verification provider during age/identity checks. It is collected by and remains with the provider; we do not receive, hold or have access to it. |
Tokenisation note: card Payments are securely processed by our payment processor. We do not receive your full card number, expiry or security code.
5. How we collect your Personal Data
5.1 We collect it: directly from you (when you register, transact or contact us); automatically through your use of the Services (Transaction, Technical and cookie data); and from our service providers (for example, the verification result we receive from our age/identity provider).
6. Age assurance — how it works and what we process
6.1 Account creation does not require age assurance. When you register as a Fan, we collect only your User Data; you can browse non-adult (SFW) areas without an age check.
6.2 Age assurance is triggered at your first purchase or Subscription. Depending on your country, we use one or more of the following methods:
(a) Payment-card check. We check the payment card you use, ourselves and through our payment processor. We do not receive your full card number, expiry or security code (see the tokenisation note in clause 4).
(b) Email-based age estimation. Our verification provider uses your email address to estimate your age, by checking it against information from other organisations the address has been used with.
(c) Facial age estimation. Our verification provider estimates your age from a selfie or short video.
(d) Government ID verification. Our verification provider checks a government ID document. This route includes human review.
Methods (b) to (d) are carried out by our specialist verification provider, acting as our processor.
6.3 What we receive, and what we do not. Apart from the payment-card check, our verification provider carries out the age and identity checks. We distinguish between three kinds of data:
(a) Biometric / Face Recognition Data (used in facial age estimation and liveness checks): this is collected and processed by our provider only. It stays with the provider, and we do not receive, hold or have access to it.
(b) Government ID documents of Creators and Content Collaborators: because Heduno is the Records Custodian for age and identity verification (see the Creator Terms and the USC 2257 Statement), we access and hold these identity records for Creators and for individuals appearing in Collaborative Content. This is necessary for our custodian, payout and legal-compliance obligations.
(c) Age assurance of Fans (verifying that a Fan is over 18 to access adult Content): where our verification provider carries out the check, we receive only the verification result and process metadata — a pass/fail outcome and information such as the method used and the time of the check. We do not receive or store the underlying ID document or biometric data of Fans verified for age assurance.
If you are in a US state with a biometric-privacy law (including Illinois, Texas and Washington), before any facial-recognition processing takes place we will tell you that biometric identifiers are being collected, the purpose and the retention period, and we will obtain your consent; the data is used only for age/identity assurance, is not sold or disclosed except to the provider for that purpose, and is retained and destroyed in line with our and the provider's biometric retention schedule.
6.4 Re-authentication. We may ask you to re-authenticate periodically. Where you have consented, the provider may retain your Face Recognition Data so you do not need to resubmit your ID. You can withdraw that consent at any time by emailing privacy@heduno.com; doing so does not stop you re-authenticating, but you may need to provide your ID again.
6.5 Audit-trail data. Separately from any identity data held by our verification provider, and separately from the Creator identity records we hold as Records Custodian, we keep a minimal audit record of each age-assurance check: a verification reference or token, the method used, the date and time, and the result. This audit record allows us to demonstrate that a valid check took place, and to apply any periodic re-verification required in your jurisdiction. It does not itself contain identity documents or biometric data.
6.6 Attempts by under-18s. Heduno is strictly for adults. If our age-assurance process indicates that a person attempting to access adult Content is, or may be, under 18, access is refused and the adult Content is not shown. We do not create an account-holder profile for a person we identify as under 18, and we delete data collected during the attempt except where we are required to retain limited records to comply with our legal obligations (for example, to prevent repeat attempts, or where we are required to report). Any suspected attempt to access by a child, and any child sexual abuse material, is handled under our safety processes and reported to the relevant authorities as described in clause 7 of the Terms of Service.
7. Why we use your Personal Data and our lawful bases
7.1 We rely on the following UK GDPR lawful bases. Some processing relies on more than one.
| Purpose | Lawful basis |
|---|---|
| Creating and operating your Account; fulfilling transactions between Fans and Creators; processing Creator earnings; providing support and communicating about the Services | Performance of a contract |
| Age assurance (carrying out our age checks and keeping records of them) | Legal obligation (compliance with our duties under the Online Safety Act 2023), supported, for biometric processing, by the substantial-public-interest condition for special-category data |
| Retaining Face Recognition Data for optional re-authentication | Consent |
| Analytics in your browser: understanding how the Services are used, measuring which websites, campaigns and links bring people to us, and finding and fixing problems (including through session recordings) | Consent (given through our cookie banner; you can withdraw it at any time) |
| Analytics of key events recorded by our servers (such as sign-ups, purchases and age-check results), to understand and improve the Services | Legitimate interests. You can object at any time by turning analytics off in your Account settings or by emailing privacy@heduno.com |
| Sending direct-marketing emails | Consent or, where you are an existing customer, our legitimate interests. You can opt out at any time using the link in every marketing email |
| Recognising referrals under the Referral Programme (referral code or link captured at registration; no cookies) | Performance of a contract |
| Moderating Content and messages; removing illegal Content and suspending accounts | Legal obligation and performance of a contract |
| Reporting illegal activity to authorities and relevant organisations | Legal obligation, legitimate interests and public interest |
| Detecting and preventing fraud, protecting security and our and others' rights; maintaining a record of banned users | Legitimate interests (and, for security monitoring, substantial public interest) |
| Tax and financial reporting | Legal obligation |
| Sale, merger or reorganisation of our business | Legitimate interests |
| Giving Partners information about activity on their Partner Sites | Legitimate interests |
| Giving a departing Partner the data of users who joined through its Partner Sites | Legitimate interests |
8. Cookies and similar technologies
8.1 We use cookies and similar storage-and-access technologies. UK rules changed on 5 February 2026 (the Data (Use and Access) Act 2025), and we apply the categories below.
8.2 Strictly necessary (no consent needed): cookies required to run the Service, such as session, login/authentication and security cookies.
8.3 Consent-exempt but with information and opt-out (under the 2026 exceptions): (a) cookies that remember your appearance or functionality preferences; and (b) cookies for emergency assistance. We tell you about these and let you opt out free of charge; we do not use any of them for advertising.
8.4 Non-essential cookies — consent first. We set any non-essential cookies only after you have given consent through our cookie banner. The banner offers "Accept all" and "Reject all" with equal prominence, sets no non-essential cookies before you choose, and lets you change or withdraw consent at any time.
8.4A Analytics. Our analytics cookies and similar technologies are non-essential, so we use them only if you consent. They are run for us by our analytics provider, acting as our processor, and collect the browser-based Usage Data described in clause 4. Key events recorded by our servers are also sent to our analytics provider (see clause 7). Our analytics provider stores this data in the European Union. You can refuse analytics cookies, and you can turn analytics off at any time in your Account settings. Turning analytics off also stops the key events recorded by our servers being linked to you. We may still record anonymised data that cannot be linked to you (see clause 3.1).
8.5 We do not use cross-site tracking, we do not sell your Personal Data, and we do not share it for cross-context behavioural advertising.
9. Automated decision-making
9.1 Our payment-card check and our email and facial age estimation produce an automated pass/fail result. Where you do not pass, you can use another method, including government-ID verification, which includes human review, so there is always a non-automated route. We do not otherwise make decisions that produce legal or similarly significant effects about you solely by automated means.
10. Sharing your Personal Data
10.1 We share Personal Data with:
-
Service providers (processors) acting on our behalf under data-processing agreements — including our payment processor, our identity-verification and age-estimation provider, our automated content-moderation provider, our hosting provider, our email provider, our analytics provider, and the tools we use to handle support requests. A current list of the specific providers we use is available on request at privacy@heduno.com and is maintained in our sub-processor register, which we may update from time to time as our providers change;
-
Authorities and reporting organisations, including UK law enforcement, the National Crime Agency (including CEOP), the Internet Watch Foundation, HMRC, the ICO, and — where relevant — the US National Center for Missing & Exploited Children (NCMEC); and
-
Partners. If you use a Partner Site, the Partner that runs it can see activity on that site. For Fans, that means your username and what you buy on that site. Partners never see your email address, payment details, verification data or messages. For Creators, it means your content, posts, subscriptions, custom requests, sales and earnings on that site. Partners may use this only to run their sites. We may also give Partners anonymised, general statistics about their Partner Sites, which do not identify you.
If a Partner stops working with us. If you signed up on a Partner Site and that Partner stops working with us, we will give the Partner your account details (your name or username, email address, and the Creators you follow or subscribe to on its site). We never pass on payment, verification or message data. The Partner then becomes solely responsible for that data, must give you its own privacy notice, and must honour any marketing opt-out you gave us. We will tell you before this happens, and you can object by emailing privacy@heduno.com.
11. International transfers
11.1 Some of our providers process data outside the UK and the EEA. Where we transfer Personal Data internationally we use a transfer mechanism recognised under the applicable law — an adequacy decision where one applies, or otherwise the UK International Data Transfer Agreement (IDTA) / UK Addendum (for UK data) and the EU Standard Contractual Clauses (for EEA data), in each case with a transfer risk assessment. You can ask us for details at privacy@heduno.com.
12. Your rights
12.1 Subject to the usual conditions, you have the right to: access your Personal Data; have it corrected; have it erased; restrict or object to processing; data portability; and withdraw consent where we rely on it (without affecting earlier processing). You can also complain to the ICO (ico.org.uk), though we would welcome the chance to resolve matters first.
13. Exercising your rights
13.1 To exercise any right, email us at privacy@heduno.com. To protect your data, we may need to verify your identity before responding, and may ask for proof of authority if someone makes a request on your behalf.
13.2 If you signed up on a Partner Site. You can exercise your rights against either joint controller: us or the Partner. While the Partner works with us, we handle all requests, so please email privacy@heduno.com.
14. Your choices and control
14.1 Editing your details. You can update the fields available in your Account settings; for anything not editable in-product, email privacy@heduno.com.
14.2 Notifications. We send account and transactional notifications (for example, a new subscriber or a renewal) and may send direct-marketing emails. You can manage optional notifications in your notification preferences; you cannot opt out of essential transactional, security or legal notices.
15. How long we keep your Personal Data
15.1 We keep Personal Data only as long as necessary for the purpose it was collected, then delete or anonymise it. In practice: account data for the life of your Account; trust-and-safety data for as long as needed to investigate, report and enforce; compliance records (including identity and tax records) for the period the law requires (in some cases up to 7 years); data needed for legal claims for the relevant limitation period; and Usage Data only as long as we need it to understand how the Services are used, except that session recordings are deleted after 30 days.
15.2 Verification data — what is kept, by whom. Retention of age and identity data depends on who you are and why you were checked:
Creators and Content Collaborators: we hold identity and age verification records as Records Custodian for the period required by law (see clause 6.3 and the USC 2257 Statement).
Fans verified for age assurance: we keep only the audit record described in clause 6.5 (a verification reference or token, method, time and result) — not the underlying ID document or biometric data, which we do not receive for this purpose.
Jurisdiction-specific rules. Where the law of your jurisdiction imposes stricter requirements, those apply. For example: in Ohio, verification documents are not retained after the check is complete other than as permitted for account-holders, and account-holders are re-verified periodically as required by law; in France and Italy, age checks are performed on a minimal-data, per-access basis through our provider, and we retain only the audit record needed to evidence that a valid check took place.
16. Data Protection Officer and contact
16.1 You can contact our privacy team, and our Data Protection Officer, at privacy@heduno.com (or by post at our registered office, marked for the DPO).
16A. European Union and EEA data subjects
16A.1 If you are in the European Union or EEA, the EU General Data Protection Regulation applies to our processing of your Personal Data. The lawful bases in clause 7 apply, read against the EU GDPR. You have the same rights set out in clause 12, and you may lodge a complaint with the supervisory authority in your member state.
16A.2 As we are established in the United Kingdom and not in the EU, we are appointing an EU representative under Article 27 GDPR. This Policy will be updated with their contact details once appointed; in the meantime, EU and EEA data subjects can contact us at privacy@heduno.com.
17. US State privacy disclosures
17.1 These disclosures apply where a US state privacy law (such as the California Consumer Privacy Act as amended (CCPA/CPRA), or the privacy laws of Virginia, Colorado, Connecticut, Texas, Utah and other states) applies to our processing of your Personal Data.
17.2 What we do and do not do. We do not sell your Personal Data and we do not share it for cross-context behavioural (targeted) advertising. We do not sell sensitive personal information. We use sensitive personal information (including any biometric data handled by our verification provider) only for the age- and identity-assurance purposes described in this Policy.
17.3 Your rights. Subject to the applicable state law and verification of your identity, you may have the right to: know and access the Personal Data we hold about you; correct it; delete it; obtain a portable copy; opt out of any sale, sharing or targeted advertising and of certain profiling; limit the use of sensitive personal information; and not be discriminated against for exercising these rights. To exercise any right, email privacy@heduno.com. You may use an authorised agent. If we deny your request you may appeal by replying to our decision; if an appeal is denied you may contact your state Attorney General.
18. Changes to this Policy
18.1 We may update this Policy and will post the revised version on Heduno. Where changes are material, we will take reasonable steps to notify you.