Privacy Policy

MADOX SRL ("Madox", "we", "us") respects your privacy. This policy explains what personal data we collect through madoxagency.com, why we collect it, where it is stored and what rights you have under the General Data Protection Regulation (GDPR).

1. Who we are

The data controller is MADOX SRL, CUI/VAT RO18350750, Str. Paltinului 6, 040735 București, Romania. Contact for anything related to your data: hello@madoxagency.com.

2. What we collect

• Application data (only if you submit the form): name, age, email, phone, location, social handles, OnlyFans link, earnings range, experience, your message and up to five photos you choose to upload.
• Technical data with your application: the IP address and browser type used when the form was sent. We keep these alongside the application to detect spam and abuse.
• Where you came from (with your application only): if you reached us through an advertisement or a link, the click identifier (for example Google's gclid) and campaign parameters from that link, plus the referring site. We store these with your application so we know which channel it came from.
• Analytics and advertising-measurement data (only if you accept in the banner): see section 5.
• Correspondence: anything you send us by email or Telegram.

We do not collect any data about visitors who only browse the site and decline the banner, beyond the short-lived server logs our hosting provider keeps for security. Your country, derived from your IP address by our hosting provider, is used only to show you the site in the right language; it is not stored.

3. Why we process it and on what legal basis

• Reviewing your application and contacting you — steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)).
• Your photos — your explicit consent, given when you tick the consent box on the form (Art. 6(1)(a)). You can withdraw it at any time; we will then delete the photos.
• IP address and browser type — our legitimate interest in preventing spam, fraud and abuse of the form (Art. 6(1)(f)).
• Analytics and advertising measurement — your consent, given through the banner (Art. 6(1)(a)). You can change your choice at any time via "Cookie & analytics settings" in the footer.
• Click identifiers stored with your application — our legitimate interest in knowing which of our channels applications come from (Art. 6(1)(f)). This involves no cookies and no sharing with third parties.
• Email and Telegram correspondence — pre-contractual steps and our legitimate interest in answering you (Art. 6(1)(b) and (f)).

You must be 18 or older to submit an application. We do not knowingly process data of minors.

4. Photos

Photos are used solely to assess your application. They are stored in encrypted form in our database, are only accessible to our review team through a password-protected admin area, are never published or shared, and are deleted within 90 days if we do not proceed together.

5. Analytics and advertising measurement (Plausible, Google Ads)

We use Plausible Analytics to understand which pages are read and where visitors come from. Plausible is a privacy-first tool: it uses no cookies, does not track you across websites, and does not build a profile of you. It records the page visited, the referring site, browser and operating system family, device type and country. Your IP address is used only to derive the country and is not stored. Plausible is operated by Plausible Insights OÜ (Estonia) and all analytics data is stored on servers in the European Union (Germany).

We also use the Google Ads conversion tag (Google Ireland Ltd.) to measure whether our advertisements lead to applications. When you accept, the tag may set cookies such as _gcl_au and report to Google that a conversion happened on this site. Google may link this to your Google account if you are signed in, under Google's own privacy policy. We use Google's Consent Mode: without your acceptance the tag is not loaded at all and no data is sent to Google. Google may transfer data to the United States; Google LLC is certified under the EU-US Data Privacy Framework.

Both scripts are loaded only after you click "Accept" in the banner. If you decline, nothing is loaded. Your choice is saved in your browser for 12 months and can be changed at any time from the footer.

6. Where your data is stored and who processes it

We keep your data in the European Union and use the following processors, each bound by a data-processing agreement:

• Neon, Inc. — database hosting. Applications and photos are stored in Neon's Frankfurt (Germany) region.
• Vercel Inc. — website hosting and the serverless code that receives your application. That code runs in Vercel's Frankfurt region. Static files (pages, images, fonts) are delivered through Vercel's global content-delivery network. Vercel is certified under the EU-US Data Privacy Framework and uses the EU Standard Contractual Clauses for any transfer.
• Plausible Insights OÜ — analytics, EU-hosted, only if you accept in the banner.
• Google Ireland Ltd. — advertising conversion measurement, only if you accept in the banner (see section 5).

Fonts and scripts on this site are served from our own domain, so no request is made to Google or other third parties simply by opening a page. We do not sell personal data. The only data that reaches an advertising network is the anonymous conversion signal described in section 5, and only with your consent.

7. Retention

Application data is kept for up to 12 months and photos for up to 90 days, unless we enter into an agreement with you (in which case the agreement governs retention) or you ask us to delete it sooner. Analytics data is aggregated and contains no personal data. Your analytics choice is stored in your browser for 12 months.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted ("right to be forgotten");
• restrict or object to our processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email hello@madoxagency.com. We answer within one month. You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), or with the authority in your country of residence.

9. Security

All traffic to the site is encrypted (HTTPS). Application data and photos are stored in an encrypted database and are only reachable through a password-protected admin area used by our review team. Access is limited to the people who need it to review applications.

10. Cookies and local storage

This site sets no cookies unless you accept the banner; after acceptance, the Google Ads tag may set the cookies described in section 5. Strictly necessary storage, which needs no consent: your browser's local storage remembers whether you accepted or declined the banner; a madox_lang cookie (12 months) remembers your language choice if you use the language switcher; and, for the duration of your visit, session storage keeps the click identifier from the link you arrived through so it can be attached to your application. The admin area used by our staff stores a login token in session storage; this never applies to visitors.

11. Automated decision-making

Every application is reviewed by a person. We do not make automated decisions or profile you.

12. Changes

If we change this policy we will update the date at the top of this page. Material changes will be highlighted on the site.