Конфиденциальность

Обновлено 19 октября 2026.

Who we are

MyFanQ is operated by Rubani Cars ENK, org. no. 825786112, Utstranda 665, 3531 Krokkleiva, Norway. Contact: [email protected].

MyFanQ (myfanq.com) is a worldwide marketplace. The English version of this policy prevails. We collect your account email, a date of birth used to decide an age band, profile details a creator enters, order text, optional files attached to a question, and payout identity handled by Stripe.

Minors

We do not knowingly let anyone under 13 order, and we do not create a profile for them.

For fans aged 13–17 we store the date of birth and the age band 13–17 on the fan profile and on the order, plus the country they select. That country is used only to look up the digital-consent age. GDPR allows that age to be set between 13 and 16 by country. Where the fan is under that age, we collect a parent or guardian email and send one confirmation link. The guardian does not pay. The answer is not delivered until they confirm.

We do not show a minor's email or phone number to the creator. Phone numbers, email addresses, social handles, links, and “add me on” phrases are removed from the stored question and answer before a creator can read them. We do not sell minor data.

Moderation

Questions and answers are checked by an automatic filter. Flagged text is kept for an admin review queue and is not delivered until it is approved. See Youth safety and Rules.

A license or credential file is collected only when a category requires it, and it is reviewed by an admin. For a creator request we store the name and, if you give it, your email to tell you when they join.

Subprocessors

The application runs as a Node service on a cloud server (Hetzner Cloud) rented from Hetzner Online GmbH (Germany). That server is physically located in Singapore. Accounts, orders, and creator requests are stored in a SQLite database on that server.

Traffic to the application is routed through Cloudflare (Cloudflare Tunnel).

Card payments are processed by:

• Stripe Payments Europe Ltd
• Stripe Technology Europe Ltd

Resend sends transactional email and stores that mail in the United States. Resend is certified under the EU-US Data Privacy Framework, and its data processing agreement includes standard contractual clauses. Those messages do not include question text, answers, dates of birth, phone numbers, or the recipient's postal address. Every outgoing message names the operator and the operator's postal address.

Business email is handled by Zoho (EU).

Transfers

Singapore is outside the EEA. Personal data stored on the server in Singapore is transferred under the EU Standard Contractual Clauses with Hetzner (Hetzner's DPA).

Cookies

Essential cookies keep you signed in, remember the language, and store the consent choice. Optional storage waits until you allow it. There is no marketing cookie. The list is on the cookies page.

Outreach

Who is responsible. Rubani Cars ENK (trading as MyFanQ), org. no. 825786112, Utstranda 665, 3531 Krokkleiva, Norway, is the controller for these emails. Contact: [email protected].

What this covers. We sometimes email content creators and talent agencies to invite them to join MyFanQ as creators or partners. This section explains that outreach. It applies whether you are in the EEA, the UK, the US, Canada, or elsewhere.

Where we got your details. Only from public business contact information that you, your company, or your agency published, such as:

• the About page of a YouTube channel
• the contact page of your own website
• an agency roster page

We record the page address and the date we found it, and we keep an archived copy of that page. We do not buy lists, guess addresses, use private profiles or messages, or add data from private sources.

What we process.

• Your name or channel name
• A business email address
• A public channel or profile address, country, topic, and approximate follower count
• The source page and the date we found it
• Whether you represent a company and, if so, its public registry number
• Notes we need to follow the law: who you are (creator or agency), that we believe you are 18 or over, whether we may email you, and whether you unsubscribed
• For an agency: your name and business email, and the public profile details of creators you represent when we mention them

Why, and the legal basis. We use this to send one invitation and, at most, one follow-up. The basis is our legitimate interest in inviting creators to a new platform (GDPR art. 6(1)(f)). Our written assessment is available on request. We email only where the marketing rules of your country allow a message without prior consent. In Canada, we email only where the address was published conspicuously and the message relates to your business role (implied consent). In other countries that require consent, we do not email you without it.

Who receives it. Resend sends these messages for us and stores them in the United States. Resend is certified under the EU-US Data Privacy Framework. Standard contractual clauses are in the DPA. We do not sell your data, and we do not share it for anyone else's marketing.

How long we keep it.

• No reply. We delete the details 90 days after the last email, including from backups.
• You reply and want to join. We move the details into onboarding. The creator terms and the rest of this privacy policy then apply.
• You say no, or you unsubscribe. We keep only the email address, or a hash of it, and the date, on a do-not-contact list. We keep that list so we do not email you again (GDPR art. 6(1)(c), art. 6(1)(f), and art. 17(3)).

Your rights. You can object at any time (GDPR art. 21). For direct marketing, that right is absolute. Use the unsubscribe link in the email, reply STOP, or write to [email protected]. We stop immediately, and in any case within 10 business days.

You can also ask for access, correction, deletion, or restriction (art. 15–18). We reply within one month.

You can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no), or to the authority where you live. Examples are the ICO in the UK, IMY in Sweden, the Data Protection Ombudsman (tietosuojavaltuutettu) in Finland, Autoriteit Persoonsgegevens in the Netherlands, and the Data Protection Commission in Ireland.

Minors. We do not knowingly contact anyone under 18. If we learn that a person we contacted is under 18, we delete their details and add the address to the do-not-contact list.

No tracking. Outreach emails have no tracking pixels and no open tracking.

Questions? [email protected]