Your browsing belongs to you.

Updated: 27 October 2026

Privacy Policy

1. Who is responsible

Digital Garden s.r.o. is responsible for the Girluo processing described here.
Digital Garden s.r.o.
Registered office: Osuského 3/B, 851 03 Bratislava - mestská časť Petržalka, Slovakia, EU.
Company ID (IČO): 50612948. Tax ID (DIČ): 2120415913.
Commercial Register: Mestský súd Bratislava III (Bratislava III Municipal Court), Section Sro, File No. 116569/B.
Email: info@girluo.com.

Contact info@girluo.com for privacy questions, rights requests or reports. The mailbox is checked daily and is not a continuously monitored emergency service.

This notice describes the data used for the directory, preview images, external referrals, favourites, visitor age declaration and administration. Available provider results depend on the requesting visitor's access context. The age declaration does not verify a person's actual age.

2. Connection information and location

Hosting systems receive connection information such as your IP address, requested page, time and browser request headers. Girluo uses the network address, approximate country or region and browser language information to apply access restrictions and request eligible provider results. Location is resolved with a local GeoIP database, currently DB-IP City Lite. That lookup does not send your IP address to DB-IP and does not use GPS.

Short-lived keyed security identifiers help limit repeated requests and login attempts. They are pseudonymous, not anonymous. Page addresses and query parameters can reveal a profile name or filter choice and may appear in browser history or hosting logs. Hosting traffic statistics and logs are separate from the application catalogue cache.

3. Requests to providers and image hosts

When Chaturbate results are requested, Girluo sends the visitor's real public IP address to Chaturbate with our affiliate identifier and supported request parameters. An encrypted, temporary visitor context can support background collection for that active context. Activity can renew the context, but does not extend the lifetime of an already collected result.

When BongaCams results are requested through BongaCash Models Online V2, Girluo sends the visitor's real public IPv4 address and our campaign identifier to the provider. Results are collected in limited batches for that visitor context. If the address is unsupported, Girluo does not substitute its server address and BongaCams results may be unavailable.

These provider requests disclose the relevant IP address before an outgoing affiliate link is clicked. Results remain tied to the requesting visitor's access context. Stripchat's global feed is requested server-to-server through Stripcash without including the individual visitor's IP address; applicable restrictions are evaluated locally.

An enabled preview loads directly from an external image host, which receives your IP address and browser request headers. Girluo does not maintain a server-side image archive. Hiding the referring page address does not hide your IP address. Following an external link takes you to a separate service with its own data practices.

Provider privacy information:
Chaturbate: https://chaturbate.com/privacy/
Stripchat: https://stripchat.com/privacy
BongaCams: https://bongacams.com/privacy

4. Profile information and editorial mappings

The catalogue processes selected fields received through provider APIs, including identifiers or usernames, profile addresses, category, tags, country, languages, availability indicators, viewer counts, permitted image and referral addresses, access restrictions and collection times. These are provider data, not independent identity checks. We do not retain raw API response archives, birthday fields, iframe code, private messages or payment details in the normalised catalogue.

Chaturbate location and BongaCams hometown text can be held in the temporary encrypted cache for private administration of country rules. Administrators may save an exact text-to-country rule where a usable provider country is missing. Saved rules retain the provider, selected source text and assigned country separately from expiring profile results; they have no automatic expiry in the current implementation. They are editorial mappings, not a history of the people who used that text. Rules remain until an administrator changes or removes them; an expiring profile result does not automatically delete a separate mapping rule. Public results omit the original free-form location text and distinguish assigned countries from provider values.

Selected tag groups combine source tags for navigation. Country counts concern eligible profiles in available data, not unique people. Counts, tags and assigned countries do not verify a person's identity, residence, preferences or quality. Please report inaccurate or inappropriate information.

5. Temporary catalogue data

Chaturbate: selected public profile fields and permitted preview addresses are held in an encrypted visitor-specific cache for up to 24 hours from their last successful collection. A new successful observation can replace the profile and start a new 24-hour period; reading a profile, changing a filter, an unsuccessful request or absence from a later feed does not extend the stored observation. Private administration previews retain their shorter limit of less than 20 minutes. Live availability has a separate, shorter freshness period. A retained profile is not a guarantee that its broadcaster is currently online. Video availability is checked separately when the profile is opened. Expired profile data are excluded immediately on reads and removed by the scheduled cleanup task; an address-continuity record cannot restore them.

BongaCams: results are eligible for use for at most 120 seconds from collection, with page previews expiring sooner. The minute-by-minute cleanup removes expired results and inactive contexts. This is the implementation's limit, not a representation of permission granted by the provider. These profiles are not imported into the persistent profile database and have no stored broadcast history.

The temporary cache is outside the persistent profile database, application sessions and routine application logs. The hosting provider has confirmed exclusion of the designated cache location from backups and system snapshots. New collection from catalogue requests pauses when the cleanup heartbeat is stale. Already collected public profiles remain readable only until their original expiry; a delayed or failed update does not renew them. Physical deletion depends on the hosting service and scheduled task running; a hosting outage can delay removal until service resumes.

Encrypted visitor contexts expire after inactivity. The catalogue limits do not describe retention of hosting logs, browser records, separate editorial rules or technical identifiers.

6. Other retention

Stripchat: when import is enabled, current normalised profiles and the latest observation can be stored in the database. Inactive profile content is subject to an inactivity limit no longer than 30 days, with daily cleanup. Provider deletions or removal decisions can cause earlier removal. Optional availability history requires separate permission and a configured retention window.

Profile address continuity: when enabled, separate keyed hashes of route and source identifiers, the provider and observation times can support a neutral unavailable page. These records do not contain a plain-text username, image, viewer count or profile tags. They are pseudonymous metadata with a separate configured retention window, rather than part of the expiring profile-content cache. Their separate retention setting determines how long an unavailable route can be recognised. The route does not restore expired profile content.

Removal suppression: keyed identifiers, provider, reason code and timestamp can prevent a removed profile being reimported. These records have no automatic expiry; keeping the suppression in place prevents an ordinary feed refresh from restoring a removed listing. Contact us to request a review of a restriction or the associated personal data.

Scheduled maintenance removes import summaries older than 30 days, administrator audit entries older than 90 days and daily aggregate click counts older than 400 days. Expired rate-limit records become eligible for removal after an additional day. These records are not copies of the full provider feed. Deletion depends on successful maintenance.

Hosting logs, server traffic statistics, mailbox correspondence, session files and ordinary backups have separate retention and access arrangements. They are not covered by the temporary catalogue limits above, and this notice does not assert a verified maximum period for all such systems. Contact us for information about a particular record or to make a privacy request.

7. Browser storage and cookies

The optional favourites feature stores up to 50 technical profile identifiers in your browser under girluo:favorites. An identifier can contain a provider username. Images are not stored in that list. It has no automatic application expiry: remove individual favourites, choose Clear favourites or clear this site's browser storage. Other people using the same browser profile may be able to see it. The list is sent to Girluo when you request the favourites view to retrieve eligible current results.

Visitor age confirmation also uses the necessary girluo_session browser-session cookie and form-security token. After you select 'I am 18 or older', the server stores the time of that declaration in the session. It is accepted for this browsing session, for no more than 24 hours, and can end sooner if the session expires. This is self-declaration only: we do not request a date of birth, identity document, selfie or biometric age check. Choosing 'I am under 18' clears the declaration and does not grant access. This choice is not consent to optional analytics or advertising.

Administrative access uses the necessary girluo_session browser-session cookie for login and form security, with additional idle and maximum-session limits. Cookie expiry does not establish when every server-side session file is deleted. There are no visitor registration accounts. Google Analytics and advertising pixels are not installed. Any future optional analytics will need its own review, information and consent controls where required; acceptance of Terms or an age notice is not that consent.

8. Reports and correspondence

Messages to info@girluo.com are received in our Hostwinds-hosted mailbox. We process the sender's address, message and necessary supporting information to respond, handle rights requests and investigate concerns. Send page addresses and brief explanations rather than explicit media or unnecessary identity documents. Necessary information may be shared with an involved provider, adviser or competent authority. We use this correspondence to handle the report or request and any related follow-up. This notice does not specify a fixed deletion period for mailbox correspondence; contact us about a particular message or a request for erasure.

9. Purposes, lawful basis and international processing

The purposes are operating and securing Girluo, applying access restrictions, supplying requested features, handling reports and measuring aggregate referrals. Legitimate interests is the proposed basis for ordinary service, security and correspondence processing, subject to the required balancing assessment; legal duties may apply to rights requests. Public-profile processing, potentially sensitive data, transparency to people in provider feeds and any required additional legal condition remain subject to a separate legal assessment. This notice does not represent that assessment as completed. API access or public availability alone is not treated as unrestricted permission to process personal data.

Recipients can include Hostwinds and relevant hosting or mail suppliers, enabled providers and image hosts, and advisers or authorities where necessary. Our hosting account is identified as being in Amsterdam; this does not establish that every supplier, support activity, backup or onward transfer stays within the EEA. The complete supplier and transfer assessment has not been verified for this notice; it should not be read as confirmation that all processing stays in the EEA or that every transfer safeguard has been assessed.

10. Your rights and adult access

Depending on applicable law and the circumstances, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent for consent-based processing. Contact info@girluo.com. Where the GDPR applies, requests are normally answered within one month and lawful extensions will be explained. You may complain to a competent supervisory authority, including Slovakia's Office for Personal Data Protection at https://dataprotection.gov.sk/.

The adult directory is intended for people aged at least 18 who meet any higher applicable local age requirement. The current site does not collect identity documents or biometric data for an integrated age check. If an age-assurance service is introduced, this notice and the relevant data flows will be updated before use. Report a suspected minor's profile or a safety concern using the Contact page.