1. Who is responsible
The controller of personal data processed through PornVerdict is the operator of PornVerdict ("we", "us"). Privacy questions and requests, including from people in the EU, EEA and UK: [email protected].
2. Summary
- You can use PornVerdict without an account and without telling us who you are.
- Our servers keep short lived technical logs needed to deliver and protect the site.
- Google Analytics is on by default; by using the site you agree to it. You can turn it off at any time through "Cookie settings" in the footer, and it stays off automatically if your browser sends Global Privacy Control.
- If you email us, we use your message to answer it.
- We do not sell your personal information and we do not share it for cross context behavioural advertising.
3. What we collect and why
3.1 Server and security logs
Every time a browser loads a page, our web server and hosting providers automatically record technical data: IP address, date and time, requested URL, referring URL, HTTP status, amount of data transferred, browser user agent and operating system. We use it to deliver pages, detect and block abuse, attacks, scraping and mirroring of the site, fix errors and count aggregate traffic, including how often outbound "Visit" links are used.
3.2 Analytics (on by default, can be turned off)
We use Google Analytics 4 (provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA) to understand which pages are visited, how visitors arrive, which device types and countries they use and how they navigate. Google Analytics 4 does not log or store full IP addresses for EU users. Google Signals and advertising personalisation are disabled on our property. Data is reported to us in aggregated form. If you turn analytics off in "Cookie settings" (or your browser sends Global Privacy Control), the Google script is not loaded at all. Instructions are in the Cookie Policy.
3.3 Preferences stored on your device
We store whether you turned analytics off and whether you dismissed the 18+ notice in your browser's local storage, so we do not ask again. This data stays on your device and is not sent to us. See the Cookie Policy.
3.4 Communications
When you email us (for example a correction request, DMCA notice, removal request or partnership enquiry), we process your email address, name if provided, the content of your message and any attachments, to handle the request, keep a record of it and, where needed, defend legal claims. DMCA notices may be forwarded to the affected party or to third party transparency databases as described in our DMCA Policy.
3.5 Site search
Searching on PornVerdict runs entirely in your browser against a downloaded index. We do not receive or store what you type into the search box.
4. What we do not collect
We do not offer user accounts, comments, payments, newsletters or uploads. We do not ask for your name, date of birth, ID documents or payment card details, we do not use fingerprinting, and we do not knowingly collect special category data (see section 12). When you click to a reviewed website, that website may collect data about you under its own privacy policy, not ours.
5. Legal bases (GDPR and UK GDPR)
- Server and security logs: our legitimate interests in providing a secure, working website and preventing abuse, Article 6(1)(f) GDPR. Storage and access needed to deliver the service you request is strictly necessary and exempt from consent under Article 5(3) of the ePrivacy Directive.
- Analytics: your agreement given by using the site after being informed by this policy and the Cookie Policy, Article 6(1)(a) GDPR, together with our legitimate interest in understanding how the site is used in aggregated form, Article 6(1)(f). You may withdraw at any time with effect for the future by turning analytics off in "Cookie settings".
- Preferences on your device: strictly necessary to remember the choice you made, and our legitimate interest, Article 6(1)(f).
- Communications: our legitimate interest in answering and documenting requests, Article 6(1)(f); compliance with legal obligations such as copyright notice and counter notice procedures or requests from authorities, Article 6(1)(c); and the establishment, exercise or defence of legal claims.
We do not use automated decision making or profiling that produces legal or similarly significant effects (Article 22 GDPR).
6. Who we share data with
- Hosting and infrastructure providers (servers, content delivery, DDoS protection, email), acting as processors under Article 28 GDPR agreements.
- Google for analytics, unless you turn it off.
- Professional advisers such as lawyers and accountants, under confidentiality.
- Authorities, courts or rights holders where the law requires it or where it is necessary to protect our rights, safety or the rights of others, for example in response to a valid court order or a report of child sexual abuse material.
- A successor if the site is sold or transferred, under this policy.
We do not sell personal data and we do not share it with partner websites or advertisers.
7. International transfers
Some providers, including Google, may process data outside the EU, EEA and UK, in particular in the United States. Transfers rely on the EU-U.S. Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795) and the UK Extension to it where the recipient is certified, on other adequacy decisions, or on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) and the UK International Data Transfer Addendum, in line with Articles 44 to 49 GDPR.
8. How long we keep data
- Server logs: up to 30 days, longer only for logs needed to investigate a specific security incident.
- Analytics: event data is retained in Google Analytics for 14 months, then deleted automatically.
- Emails and requests: up to 3 years after the matter is closed, or longer if needed for a pending legal claim or a legal obligation. DMCA notices and counter notices are kept for as long as the related claim may be brought.
- Local storage on your device: until you clear it.
9. Your rights in the EU, EEA and UK
Under Articles 15 to 21 GDPR and the UK GDPR you have the right to access your data, have it rectified, erased or restricted, receive it in a portable format, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time. To exercise a right, email [email protected]. We will answer within one month (extendable by two months for complex requests, Article 12(3)). Because we do not know who our visitors are, we may need information from you, for example the IP address and time of a visit, to find any data relating to you.
You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the EU member state where you live or work. In the UK this is the Information Commissioner's Office (ico.org.uk). A list of EU authorities is available from the European Data Protection Board (edpb.europa.eu).
10. Your rights in the United States
Residents of California and of other states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) may have rights to know what personal information we process, to access, correct and delete it, to obtain a copy, and to opt out of the sale or sharing of personal information, targeted advertising and profiling, where those laws apply to us.
- California (CCPA as amended by the CPRA, Cal. Civ. Code § 1798.100 et seq.). In the last 12 months we collected identifiers (IP address), internet or network activity (pages viewed, referrer, browser data) and approximate location derived from IP, from your browser, for the business purposes of security, debugging, delivering the site and analytics. We disclose them to our service providers only. We have not sold or shared personal information as those terms are defined, and we have no actual knowledge of selling or sharing data of consumers under 16. We do not use sensitive personal information to infer characteristics.
- How to make a request: email [email protected]. You may use an authorised agent. We will verify your request in a way proportionate to the data involved and respond within 45 days (extendable as permitted by law). You may appeal a refusal by replying to our decision; if we deny your appeal, you may contact your state attorney general.
- No discrimination: we will not treat you differently for exercising your rights.
- Shine the Light (Cal. Civ. Code § 1798.83): we do not share personal information with third parties for their direct marketing purposes.
11. Do Not Track and Global Privacy Control
We honour the Global Privacy Control (GPC) signal: if your browser sends it, analytics stays off and we treat it as a valid request to opt out of sale or sharing, as required by California and other state laws. Browsers' older "Do Not Track" setting has no common standard; we do not track you across other websites in any case. This disclosure is made under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575).
12. Sensitive information
We are aware that visiting an adult website can reveal information about a person's sex life or sexual orientation, which is special category data under Article 9 GDPR. We do not attempt to identify visitors, do not create profiles about sexual preferences and do not combine browsing on PornVerdict with other data about you. Our analytics are used only in aggregated form, and you can turn them off at any time. Please do not send us sensitive information by email unless it is needed for your request.
13. Children
PornVerdict is for adults only. We do not knowingly collect personal information from anyone under 18, and the site is not directed at children within the meaning of the U.S. Children's Online Privacy Protection Act (15 U.S.C. §§ 6501 to 6506). If you believe a minor has sent us personal information, contact us and we will delete it.
14. Security
We use HTTPS encryption, access controls, minimal data collection and short retention periods. No system is completely secure; if a breach affecting your rights occurs, we will notify authorities and affected people where the law requires it (Articles 33 and 34 GDPR and applicable U.S. state breach laws).
15. Third party websites
Reviewed websites, advertisers and partners are independent controllers. Their privacy practices, cookies, age verification and billing are governed by their own policies. Review them before you sign up or pay.
16. Changes and contact
We may update this policy when our processing changes. The "last updated" date shows the current version; material changes will be highlighted on this page. Contact: [email protected].