ONLYFANS MERCHANDISE STORE PRIVACY POLICY

Last updated: November 2026

---

BY USING OUR STORE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THE INFORMATION IN THIS POLICY.

PLEASE REVIEW THIS POLICY TO UNDERSTAND HOW YOUR PERSONAL DATA IS PROCESSED IN CONNECTION WITH YOUR USE OF OUR STORE AND THE SERVICES.

1. INTRODUCTION
2. WHAT IS PERSONAL DATA?
3. INFORMING US OF CHANGES
4. APPLICABILITY OF THIS POLICY AND VIDEO SUBMISSION GUIDELINES
5. THIRD-PARTY LINKS
6. IF YOU DO NOT WISH TO PROVIDE PERSONAL DATA
7. UPDATES TO THIS POLICY
8. CATEGORIES OF PERSONAL DATA
9. HOW / WHY YOUR PERSONAL DATA IS USED AND LAWFUL BASES FOR PROCESSING
10. OBTAINING YOUR PERSONAL DATA
11. SHARING YOUR PERSONAL DATA
12. INTERNATIONAL DATA TRANSFERS
13. YOUR RIGHTS REGARDING PERSONAL DATA
14. EXERCISING YOUR RIGHTS
15. CHOICES AND CONTROL OVER YOUR PERSONAL DATA
16. RETENTION OF PERSONAL DATA
17. ADDITIONAL U.S. STATE PRIVACY DISCLOSURES
18. ASSISTANCE AND CONTACT INFORMATION

1. INTRODUCTION

OF World LLC (“OF World,” “we,” “our,” or “us”) is the owner of the OnlyFans online merchandise store available at https://store.onlyfans.com/ (the “Store”). OF World is a company formed under the laws of Delaware, with its registered address at 501 Silverside Road, Suite 87AXK, Wilmington, Delaware 19809. OF World is a subsidiary of Fenix International Limited, which owns and operates www.onlyfans.com (“OnlyFans”).

This privacy policy (“Policy”) explains our practices with respect to the Personal Data we process when you access and use the Store and for the provision of the services that we offer from time to time via the Store (the “Services”). We are a “data controller” of the Personal Data that we process in connection with the Services. This means that we decide the reasons why we process Personal Data about you and how we do so. If you have any questions about this Policy or our processing of your Personal Data, please see Section 18 (assistance and contact information) for information about how to contact us.

2. WHAT IS PERSONAL DATA?

“Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could be linked, directly or indirectly, with a particular person or household.

In addition, we may deidentify, aggregate or anonymise your Personal Data, such that it is not capable of identifying you or is otherwise not associated or linked with you. We may also collect data that is, deidentified, aggregated or anonymised information. This type of data is not Personal Data and our use of such data is not subject to this Policy.

3. INFORMING US OF CHANGES

It is important that the Personal Data we hold about you is accurate and current. If you have an account with us, you can make certain updates or corrections through your account settings, otherwise you can make changes by emailing us at support@ofmerch.com. 

4. APPLICABILITY OF THIS POLICY

This Policy is provided in addition to the OnlyFans Merchandise Store Terms and Conditions that govern your use of the Store and the Services. OnlyFans has a separate Terms of Service and Privacy Policy.

Our Services are strictly intended for individuals 18 years of age or older. Anyone under 18 years of age is not permitted to use the Store. By using the Services, you represent that you are 18 years of age or older.

5. THIRD-PARTY LINKS

The Store may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share Personal Data about you. We are not responsible for, and this Policy does not apply to, the content, security or privacy practices of those other websites, plug-ins or applications. We encourage you to view the privacy and cookie policies / notices of those third parties to find out how your Personal Data may be used.

6. IF YOU DO NOT WISH TO PROVIDE PERSONAL DATA

We need to collect certain Personal Data from you in order to provide you with access to the Services or specific features and functionalities of the Services in accordance with our contract with you (i.e. the OnlyFans Merchandise Store Terms and Conditions). We are also required to process certain Personal Data in accordance with applicable laws. Please note that if you do not wish to provide Personal Data where requested, we may not be able to provide you with access to the Services or specific features and functionalities of the Services.

7. UPDATES TO THIS POLICY

We may update this Policy from time to time, and any updates will be effective upon our posting of the revised Policy on the Store. We will use reasonable efforts to notify you in the event that material updates are made to this Policy.

8. CATEGORIES OF PERSONAL DATA

We process, our group of companies or third-party providers process on our behalf, limited Personal Data:

9. HOW / WHY YOUR PERSONAL DATA IS USED AND LAWFUL BASES FOR PROCESSING

We process Personal Data for one or more of the following legal bases, where required by applicable law:

• Performance of a contract: By using the Services, you have contracted with us through the OnlyFans Merchandise Store Terms and Conditions, and we will process Personal Data to perform that contract and to enforce the terms of that contract.

• Legitimate interests: We may process Personal Data if it is in our, or a third-party’s, legitimate interests (as detailed in the table below). This may include, for example, investigating and responding to an intellectual property rights claim.

• Compliance with legal obligations: We may be required to process Personal Data to comply with applicable laws, rules and regulations in the locations where we operate.

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose or otherwise permitted under applicable laws.

Depending on your jurisdiction and where required by applicable law, the table below indicates the purposes for which your Personal Data is processed and the legal justification for the processing. Some of the above grounds for processing will overlap and where multiple grounds are listed the grounds relied upon may be dependent on the specific circumstances of the relevant processing and the types of Personal Data processed:

10. OBTAINING YOUR PERSONAL DATA

We collect your Personal Data from the following categories of sources:

• Directly from you: For example, when you provide it to us directly to open an account and use the Store, when you update your Personal Data in your account, or by corresponding with us (e.g. User Data).

• Automatically or indirectly from you: For example, Cookies through and as a result of your use of the Services.

• From our service providers: For example, we may receive Technical Data through your interaction with the Store.

• From our group companies: For the centralised coordination and management of our business, in accordance with the purposes set out at Section 8 (categories of Personal Data).

11. SHARING YOUR PERSONAL DATA

We may need to share Personal Data with the following categories of third parties:

• Our third-party service providers: Such as our IT and payment processing service providers. The lawful basis we rely on for sharing Personal Data with these recipients is that it is necessary for our legitimate interests (namely the receipt of services to support business functionality).

• Our professional advisers: Such as our legal advisors, bankers, auditors, accountants, consultants, and insurers. Our professional advisors will process Personal Data as necessary to provide their services to us. The lawful basis we rely on for sharing Personal Data with these recipients is that it is necessary for our legitimate interests (namely the receipt of professional services).

• Corporate: Relevant third parties in the event of a possible sale, merger, acquisition, business reorganisation or group restructuring exercise. The lawful basis we rely on for sharing Personal Data with these recipients is that it is necessary for our and the relevant third parties’ legitimate interests (namely assessing and putting into effect potential transactions).

• Our group companies: For the centralised coordination and management of our business, in accordance with the purposes set out at Section 8 (categories of Personal Data). These recipients will process Personal Data in the same way as set out in this Policy. The lawful basis we rely on for sharing Personal Data with these recipients is that it is necessary for our legitimate interests (namely coordinating the global operations of our business).

12. INTERNATIONAL DATA TRANSFERS

We share your Personal Data within our group companies and to our third parties, as set out at Section 11 (sharing your Personal Data).

In some circumstances, this will involve transferring your data outside the UK, the EEA and Switzerland. We make those transfers: (i) to countries that have been deemed to provide an adequate level of protection for Personal Data; (ii) using appropriate safeguards; or (iii) where otherwise authorised by applicable law.

Please contact us using the contact details set out at Section 18 (assistance and contact information) if you would like further information on the specific mechanism used by us when transferring your Personal Data outside the UK, the EEA and Switzerland.

13. YOUR RIGHTS REGARDING PERSONAL DATA

Depending on your jurisdiction, you may have certain rights regarding the collection and processing of Personal Data. You may exercise these rights by contacting us using the contact details set out at Section 18 (assistance and contact information).

Under certain circumstances and subject to certain exemptions, you have the right to:

• Withdraw your consent where we rely on such consent for the processing of your Personal Data: Please note that withdrawing your consent will not affect the lawfulness of any processing carried out before you withdraw your consent.

• Request to know or access to your Personal Data: You may request to: (a) receive a copy of the Personal Data we hold about you  and to check that we are lawfully processing it; (b) to know (i) categories of Personal Data we have collected about you, (ii) the categories of sources from which the Personal Data is collected, (iii) the business or commercial purpose for collecting your Personal Data, and (iv) the categories of third parties to whom we have disclosed your Personal Data; and (c) and to confirm whether we are processing Personal Data about you.

• Request correction of the Personal Data that we hold about you: You may correct any incomplete or inaccurate Personal Data we hold about you.

• Request deletion / erasure of your Personal Data: Subject to certain exceptions, you may ask us to delete or remove Personal Data where there is no legitimate reason for us continuing to process it. You also may ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below). Please note that we may not always be able to comply with your request of deletion / erasure for specific legal reasons. Please see Section 16 (retention of Personal Data) for further information.

• Request the restriction of processing of your Personal Data: You may ask us to suspend the processing of Personal Data about you, for example if you want us to establish its accuracy or the reason for processing it.

• Request the transfer of some sections of your Personal Data to another party and, subject to certain limitations and exceptions, a portable and readily usable copy of the Personal Data we have collected about you.

• Opt-out of “sales” and/or “sharing” for “cross-context behavioural advertising” or “targeted advertising” purposes, as such terms are defined in applicable law.

You also have the right to object to processing of your Personal Data where we are relying on a legitimate interest for the processing and there is something about your particular situation which makes you want to object to processing on this ground.

We do not process Personal Data that is subject to solely automated decision-making, where that decision-making is likely to have a legal or similarly significant effect on you.

You also have the right:

• To lodge a complaint with us and your data protection regulator. For example, in the UK, this is the Information Commissioner’s Office (ICO) and in Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). If you are resident in the EEA, you may wish to contact your local country or state-specific data protection regulator.

• Depending on your state of residency in the U.S., to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights, or appeal a decision we have made in connection with your privacy rights request. Further information on appeals is set out at Section 17 (additional U.S. State Privacy Disclosures).

14. EXERCISING YOUR RIGHTS

If you would like to exercise your rights set out at Section 13 (your rights regarding Personal Data), you may do so by contacting us using the contact details set out at Section 18 (assistance and contact information).

If you submit the request yourself, please ensure that your request contains sufficient information to allow us to confirm your identity and properly understand, evaluate, and respond to it.

In order to verify your identity, we may at times need to request additional Personal Data from you, taking into consideration our relationship with you and the sensitivity of your request. At a minimum, we will request your name and email address. In certain circumstances, we may decline a privacy rights request, particularly where we are unable to verify your identity.

If your request is made by a third-party authorised by you, we will also require proof that the third-party has permission to submit the request on your behalf (such as a signed document evidencing that the third-party has authority to make the request).

15. CHOICES AND CONTROL OF YOUR PERSONAL DATA

Modifying and deleting your Personal Data: If you have an account with us, you may update your account settings. Please note that changes to your settings may require some time to take effect.

Access to device information: You may control the Services’ access to your Technical Data through your “Settings” app on your device. For instance, you can withdraw permission for the Services to access your network devices and IP address.

Email notifications: If you have provided your email address to receive our newsletter, you may unsubscribe at any time via the unsubscribe link in the emails that we send, or contacting us using the contact details set out at Section 18 (assistance and contact information). We may also send email notifications which are related to the Store (e.g. updates to the OnlyFans Merchandise Store Terms and Conditions or this Policy). Please note that you cannot opt-out of email notifications that are necessary to provide the Services or are otherwise required in accordance with applicable law.

16. RETENTION OF PERSONAL DATA

We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes for which it was collected, as set out in this Policy, or as permitted by applicable laws. The Personal Data that we retain and the length of time for which it is retained will be determined on a case-by-case basis, depending on the particular circumstances.

We determine the periods for which we normally retain Personal Data as follows:

• Providing our Services: Where we need to use Personal Data to provide you with our Services, or specific parts of our Services, we will retain your Personal Data for the lifetime of your account or as long as necessary to provide you with the relevant feature or functionality of our Services.

• Compliance with applicable laws and regulatory obligations: For example, financial / tax reporting requirements. We will delete your Personal Data sooner where a shorter retention period is required by applicable law.

• Legal claims: Personal Data will be retained in accordance with applicable statutory limitation periods. In certain circumstances we may need to retain this longer, for example, to defend ourselves in litigation about a claim or complaint related to you.

17. ADDITIONAL US STATE PRIVACY DISCLOSURES

Where required by law, these additional U.S. State Privacy Disclosures ("U.S. Disclosures") supplement the information contained in the Policy by providing additional information about our Personal Data processing practices relating to individual residents of certain U.S. States. Unless otherwise expressly stated, all terms defined in this Policy retain the same meaning in these U.S. Disclosures.

For the purposes of these U.S. Disclosures, Personal Data does not include publicly available information or deidentified, aggregated or anonymised information that is maintained in a form that is not capable of being associated with or linked to you.

Sales and Sharing of Personal Data

While we do not “sell” Personal Data in a traditional sense (i.e. for money), some of the cookies we use may be considered a “sale” and/or “sharing” for “cross-context behavioural advertising” or “targeted advertising” purposes, as such terms are defined in applicable laws.

Sensitive information        

Although sensitive information may be disclosed for a business purpose as described below, we do not sell or share sensitive information for the purpose of targeted advertising.

The following Personal Data elements we, or our service providers, collect may be classified as “sensitive” under certain privacy laws ("sensitive information") including:

• username and password; and

• payment card information and the name registered with your payment card.

We use this sensitive information for the purposes set out at Section 9 (how / why your Personal Data is used and lawful bases for processing). We do not use sensitive personal information for purposes other than those permitted under the California Consumer Privacy Act (“CCPA”).

Deidentified information

We may at times receive, or process Personal Data, to create deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by applicable law.

U.S. state privacy rights

Depending on your state of residency, you may have certain rights regarding your Personal Data. See Section 13 (Your rights regarding Personal Data) for details and Section 14 (Exercising your rights) for how to submit a request.

Appeals

If you are a resident of certain U.S. States, you have the right to appeal decisions regarding your privacy requests. All appeal requests should be submitted using the contact details set out at Section 18 (assistance and contact information). If your appeal is denied, you may contact your local Attorney General.

Minors

Our Services are strictly intended for individuals 18 years of age or older. Anyone under 18 years of age is not permitted to use the Store. By using the Services, you represent that you are 18 years of age or older.

CALIFORNIA SPECIFIC DISCLOSURES

The following disclosures only apply to residents of the State of California:

Personal Data collection

California law requires that we provide disclosures to you about what Personal Data we collect by reference to the categories of Personal Data set forth within California law. To address this obligation, we have identified the relevant California Personal Data category for the Personal Data set out in more detail at Section 8 (categories of Personal Data):

• Identifiers: Such as your name, address, phone number and email address.

• Customer Records: Such as your partial payment card information or other payment or financial information.

• Commercial Information: Such as details about purchases / orders made by you.

• Internet / Network Information: Such as device information.

• Other Personal Data: Such as communication history, Personal Data an individual permits us to see when interacting with us through social media, Personal Data an individual provides us in relation to a question or request, and messages you send us through our Services or make available to us on social media.

Disclosure of Personal Data

As set out at Section 11 (sharing your Personal Data), we may disclose the categories of Personal Data identified above to the following categories of third parties for various business purposes as set out in Section 9 (how / why your Personal Data is used and lawful bases for processing): our group and affiliated companies, service providers and our professional advisers as needed to provide our Services, and certain third parties for the purposes set out at Section 11 (sharing your Personal Data).

Sources of Personal Data

We collect Personal Data directly from you, from your browser or device when you interact with our Services, from our group and affiliated companies, and other service providers. For more information, please see Section 10 (obtaining your Personal Data).

Purpose for collection

We collect Personal Data about you for the purposes set out at Section 9 (how / why your Personal Data is used and lawful bases for processing).

NEVADA SPECIFIC DISCLOSURES

Nevada law requires operators of online services to provide a way for Nevada residents to request to opt-out of the sale of Personal Data. Although we do not sell Personal Data, Nevada residents can still submit this type of opt-out request by contacting us using the details set out at Section 18 (assistance and contact information).

OREGON, MARYLAND AND MINNESOTA SPECIFIC DISCLOSURES

Residents of Oregon, Maryland and Minnesota can request a list of nonaffiliated third parties (excluding our service providers and contractors) to whom we have disclosed Personal Data.

CONNECTICUT SPECIFIC DISCLOSURES

We do not collect, use, or sell the Personal Data of Connecticut residents to train large language models (LLMs).

18. ASSISTANCE AND CONTACT INFORMATION

If you have questions about this Policy, or how we process your Personal Data, please email us at support@ofmerch.com.