LBB

Legal

Privacy Policy

Version 1.0Updated 2026-07-17

title: Privacy Policy version: 1.0 last_updated: 2025-11-13

Privacy Policy

[IMPORTANT LEGAL NOTICE] This document is a structural template prepared in good faith but has not yet been reviewed by a qualified lawyer. It must be reviewed and approved by counsel familiar with the New Zealand Privacy Act 2020, the Australian Privacy Act 1988, the UK and EU GDPR, the Canadian PIPEDA, and US state privacy laws (including the CCPA/CPRA) before production deployment. Items flagged [REVIEW] require legal sign-off prior to launch.

Effective Date: August 17, 2026

Last Updated: November 13, 2025

1. Introduction

This Privacy Policy explains how LBB Holdings Limited ("LittleBlackBook", "we", "us", "our") collects, uses, discloses, and protects personal information when you use our advertising-directory platform at littleblackbook.nz and related sub-domains (the "Platform").

This Policy is supplemented by our Terms of Service and Content Guidelines. Capitalised terms not defined here have the meaning given in the Terms of Service.

We take privacy seriously. Because our Platform deals with adult content, much of the information we hold is sensitive, and we apply heightened safeguards described in Clause 8.

2. Who We Are and How to Contact Us

Data Controller: LBB Holdings Limited, a company incorporated in New Zealand (NZBN [REVIEW]).

Registered office: [REVIEW: insert registered office address]

Privacy enquiries: privacy@littleblackbook.nz

Privacy Officer / Data Protection Officer: [REVIEW: insert name and email of designated Privacy Officer for NZ Privacy Act 2020 s 23 compliance, and, if a DPO appointment is required under GDPR Art 37 once we serve EU/UK users, the DPO's name, contact details, and country of establishment.]

EU/UK Representative (Art 27 GDPR): [REVIEW: appointment required prior to offering services to EU or UK data subjects if we have no EU/UK establishment.]

3. Scope

This Policy applies to:

  1. Visitors to the Platform;
  2. Registered Clients;
  3. Registered Providers, including individual Providers and Provider Agencies;
  4. Authorised representatives of agencies; and
  5. Anyone who contacts us through the Platform, by email, or via our support channels.

It does not apply to third-party services we link to (which have their own privacy policies), to communications that take place off-Platform between Providers and Clients, or to information you choose to share publicly on your profile.

4. Information We Collect

4.1 Information You Provide

When you register and use the Platform, we may collect:

  • Account credentials: name, email address, password (stored only as a salted hash), Account type.
  • Profile information (Providers): display name, biography, services offered, rates, working hours, languages, age (verified separately), gender, body details, location (city / suburb / region), tour locations, contact preferences, links to external services.
  • Media: photographs, videos, and any other media you upload.
  • Verification information: government-issued identification documents and, where applicable, biometric data processed by our verification provider (Yoti). This information is used solely to confirm age and identity and is stored in our Compliance Database (see Clause 8).
  • Payment information: billing name, address, and payment-method tokens. Full card data is captured directly by our payment processor (Windcave) and is not transmitted to or stored by us.
  • Communications: the content of messages you send through the Platform, support tickets, abuse reports, and survey responses.

4.2 Information We Collect Automatically

When you use the Platform, we automatically collect:

  • Device and connection data: IP address, device identifiers, browser type and version, operating system, screen size, language, time zone.
  • Usage data: pages viewed, searches run, filters applied, profiles viewed, time spent, click paths, referring URLs.
  • Security and abuse signals: sign-in events, two-factor challenges, rate-limit and anomaly events, failed payment attempts.

4.3 Information from Third Parties

We may receive information about you from:

  • Yoti, in the form of verification results (pass/fail, age band, document type) when you opt in to instant Verification;
  • Windcave, in the form of payment outcomes, fraud signals, and chargeback notifications;
  • Microsoft PhotoDNA and AWS Rekognition, in the form of content-classification results for media you upload (e.g., CSAM hash match, NSFW score); and
  • Public sources and abuse-reporting partners, where relevant to a trust-and-safety investigation.

4.4 Sensitive Information

Because of the nature of the Platform, information about you may reveal or imply data that is "sensitive", "special category", or otherwise subject to heightened protection under applicable law — including information about your sex life or sexual orientation, your physical characteristics, and (in verification documents) your race or national origin. By using the Platform you provide your explicit consent to our processing of that information for the purposes set out in Clause 5.

We do not knowingly collect health information, political opinions, religious beliefs, trade-union membership, or genetic data, and you should not upload such information.

5. How and Why We Use Information

We use your information to:

  1. Provide the Platform — create and maintain your Account, display Provider profiles, run search and matching, deliver messaging, process Subscriptions, send transactional emails.
  2. Verify identity and age — confirm that Providers are at least 18, that profile photographs depict the Provider, and that Accounts are not duplicated or impersonated.
  3. Moderate content — scan media for CSAM (via Microsoft PhotoDNA), classify media for NSFW gating and prohibited content (via AWS Rekognition), and conduct human review where flagged.
  4. Protect the Platform — detect and prevent fraud, abuse, harassment, scraping, and other prohibited activity; investigate violations of the Terms and Content Guidelines; enforce account suspensions and bans.
  5. Process payments — bill Subscription fees, process refunds, resolve chargebacks, prevent payment fraud.
  6. Communicate with you — respond to support requests, send service announcements, send marketing communications where you have opted in (see Clause 5.1).
  7. Improve the Platform — analyse usage, troubleshoot bugs, run A/B tests, develop new features.
  8. Comply with legal obligations — respond to lawful requests from regulators, courts, and law-enforcement authorities; meet reporting obligations in respect of CSAM; keep records for tax and accounting purposes.

5.1 Marketing

We will only send marketing communications where you have opted in or where applicable law permits an opt-out approach. You can withdraw consent at any time via the unsubscribe link in any marketing email or via your Account preferences. Transactional and service-related emails (billing, security, account changes) are not marketing and you cannot opt out of those while your Account is active.

5.2 Automated Decision-Making

We use automated tools to flag content for moderation, score sign-in events for fraud, and rank search results. Where an automated decision has a significant effect on you (e.g., automatic removal of Content, suspension of an Account), we provide a route for human review. We do not engage in automated decision-making that produces legal effects within the meaning of GDPR Article 22.

6. Legal Bases (GDPR / UK GDPR)

If you are in the EU or UK, our legal bases for processing your personal data are:

  • Performance of a contract (Art 6(1)(b)) — to provide the Platform and Subscription services you have requested.
  • Consent (Art 6(1)(a); Art 9(2)(a) for special-category data) — for cookies that are not strictly necessary, for marketing communications, and for processing of sensitive information relating to your sex life.
  • Legal obligation (Art 6(1)(c)) — for record-keeping, tax, CSAM reporting, and responses to lawful requests.
  • Legitimate interests (Art 6(1)(f)) — for fraud prevention, Platform security, abuse moderation, service improvement, and limited direct-marketing of our own services to existing customers, balanced against your rights and interests.
  • Substantial public interest (Art 9(2)(g)) — where specific national derogations apply, for example to permit the safeguarding work involved in CSAM detection. [REVIEW: confirm reliance on UK Sch 1 substantial-public-interest conditions or EU member-state derogations applicable to operations.]

You can request more information about the legal basis applicable to a specific processing activity by contacting privacy@littleblackbook.nz.

7. Cookies and Similar Technologies

We use the following categories of cookies and similar storage:

  • Strictly necessary — session cookies, CSRF tokens, load balancing, fraud prevention. Cannot be disabled.
  • Functional — remembers preferences (language, age-gate acknowledgement, NSFW reveal state).
  • Analytics — measures usage so we can improve the Platform. Set only with your consent in jurisdictions that require it.
  • Performance / abuse-prevention — used by our security partners to detect bots and abuse.

You can manage cookies through your browser settings and, where applicable, through our cookie banner. Disabling strictly-necessary cookies will prevent the Platform from working.

[REVIEW: insert a complete cookie table — provider, name, purpose, duration — once the marketing/analytics stack is final. Required for ePrivacy / PECR compliance.]

8. How We Store and Protect Information

8.1 Split Database Architecture

We separate our data stores into:

  • Content Database — profiles, search data, public Content, usage analytics. Hosted in [REVIEW: region].
  • Compliance Database — sensitive personal information (verification documents, security events, audit logs, abuse reports). Hosted in a separate region [REVIEW: region], with stricter access controls and more frequent audit review.

This separation reduces the blast radius of any compromise and supports data-residency obligations across jurisdictions.

8.2 Security Measures

We employ administrative, technical, and physical safeguards including:

  • TLS 1.2+ for all data in transit;
  • Encryption at rest for the Compliance Database and for stored media;
  • Role-based access control with least-privilege defaults;
  • Mandatory two-factor authentication for administrative Accounts;
  • Logging and alerting for sensitive access;
  • Routine vulnerability scanning and periodic third-party penetration testing;
  • Vendor due-diligence and contractual data-protection terms for all processors;
  • Documented incident-response and breach-notification procedures.

No system is perfectly secure. While we work to protect your information, we cannot guarantee its absolute security.

8.3 Breach Notification

In the event of a personal-information breach that is likely to cause serious harm (NZ Privacy Act 2020) or a high risk to rights and freedoms (GDPR), we will notify the Office of the Privacy Commissioner (or applicable supervisory authority) and affected individuals as required by law, generally within 72 hours of becoming aware.

9. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We share information only as described below.

9.1 Service Providers

We share information with the following categories of processor, under written data-protection terms:

  • Payment processing — Windcave Limited (NZ) — billing name, address, payment-method tokens, transaction amounts.
  • Identity verification — Yoti (UK) — identification document, biometric template, verification result. Applies only where you opt in.
  • Content moderation — Microsoft PhotoDNA (USA) — image hashes of uploaded media for CSAM matching.
  • Content classification — AWS Rekognition (Amazon Web Services, region [REVIEW]) — uploaded media for NSFW and prohibited-content classification.
  • Media storage and delivery — BunnyCDN (SI/EU) — uploaded media and edge-cached copies.
  • Email delivery — [REVIEW: e.g., Postmark / SendGrid / SES] — your email address and the body of transactional emails.
  • Error monitoring — [REVIEW: e.g., Sentry] — limited request metadata and stack traces.
  • Hosting / infrastructure — [REVIEW: e.g., Hetzner / AWS / DigitalOcean] — all data while in transit through application servers.

Each processor is contractually limited to processing your information only as instructed by us and is required to apply appropriate security measures.

We may disclose information where we believe in good faith that disclosure is necessary to:

  • Comply with applicable law, regulation, court order, search warrant, or government request;
  • Enforce the Terms of Service or investigate suspected violations;
  • Detect, prevent, or address fraud, security, or technical issues;
  • Protect the rights, property, or safety of LittleBlackBook, our Users, or the public; or
  • Report apparent CSAM to relevant authorities, including the New Zealand Department of Internal Affairs and the National Center for Missing & Exploited Children (NCMEC).

9.3 Corporate Transactions

If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will use reasonable efforts to require the recipient to honour this Policy or to notify you of any material change.

9.4 Other Users

Information you choose to publish on your profile is visible to other Users and to the public, subject to NSFW gating. Aggregated and anonymised data may be published in service updates or research reports; we will take reasonable steps to ensure such information cannot identify you.

10. International Transfers

We are based in New Zealand. Some of our service providers are located in jurisdictions outside your country of residence, including the United States, the United Kingdom, the European Union, and Australia.

Where we transfer personal data out of the EU/UK, we rely on:

  • the Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum) for transfers to countries without an adequacy decision; and
  • an adequacy decision of the European Commission or UK Government, where one is in force in respect of the recipient country.

Where we transfer personal information out of New Zealand, we comply with Information Privacy Principle 12 (Privacy Act 2020) by ensuring the recipient is in a comparable jurisdiction or is bound by contractual safeguards.

You can request a copy of the transfer mechanism applicable to a specific transfer by contacting privacy@littleblackbook.nz.

11. How Long We Keep Information

We retain personal information only as long as necessary for the purposes set out in this Policy, and then either delete it or anonymise it. Our default retention periods are:

  • Active Accounts — for the life of the Account, plus 30 days after closure.
  • Cancelled Subscriptions — profile hidden immediately; underlying data retained for 30 days to allow reactivation, then deleted unless retained under another category.
  • Verification documents — retained for as long as the Provider's Account is active and for 12 months after closure, to defend against age-verification claims. [REVIEW: confirm consistent with NZ Department of Internal Affairs and applicable AML record-keeping expectations.]
  • Payment and tax records — retained for seven (7) years from the end of the relevant financial year, as required by NZ tax law (Tax Administration Act 1994).
  • Trust-and-safety records (abuse reports, suspensions, CSAM detections) — retained for seven (7) years from the date of the event, to support investigations and to defend against complaints.
  • Server and access logs — retained for 90 days, then deleted.
  • Backups — retained for 35 days on a rolling basis.
  • Anonymised analytics — retained indefinitely.

We may extend a retention period where we are required to do so by law, court order, or regulatory request, or to defend a legal claim.

12. Your Privacy Rights

Subject to local law and to verification of your identity, you have the following rights:

  • Access — request confirmation of whether we hold information about you and a copy of that information;
  • Correction — request correction of inaccurate or incomplete information;
  • Deletion — request deletion of your information, subject to our retention obligations (Clause 11);
  • Portability — receive a copy of information you provided to us in a structured, commonly used, machine-readable format;
  • Restriction / Objection — restrict or object to certain processing, including processing based on our legitimate interests and processing for direct marketing;
  • Withdraw Consent — where processing is based on consent, withdraw that consent at any time (without affecting the lawfulness of processing carried out before the withdrawal); and
  • Complain — lodge a complaint with the supervisory authority in your jurisdiction (see Clause 13).

To exercise a right, please email privacy@littleblackbook.nz. We will respond within 30 days of a verified request (or such shorter period as applicable law requires, e.g., 20 working days in New Zealand under the Privacy Act 2020).

We will not discriminate against you for exercising any privacy right.

13. Jurisdiction-Specific Information

13.1 New Zealand

We comply with the Privacy Act 2020 (NZ) and the Information Privacy Principles. Our Privacy Officer is named in Clause 2. You may complain to the Office of the Privacy Commissioner:

  • Web: privacy.org.nz
  • Email: enquiries@privacy.org.nz
  • Phone: 0800 803 909

13.2 Australia

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where we hold personal information about Australian residents. You may complain to the Office of the Australian Information Commissioner (OAIC):

13.3 United Kingdom and European Union

If you are in the UK or EU, you have the rights set out in Clause 12 under the UK GDPR or EU GDPR. You may complain to:

  • UK — Information Commissioner's Office (ICO), ico.org.uk.
  • EU member states — your national supervisory authority. A list is published at edpb.europa.eu.

13.4 Canada

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. You may complain to the Office of the Privacy Commissioner of Canada:

13.5 California, USA

If you are a California resident, you have the rights set out in the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the rights to know, delete, correct, opt out of "sale" or "sharing", and limit the use of "sensitive personal information". We do not sell or share personal information for cross-context behavioural advertising. To exercise a right, contact privacy@littleblackbook.nz. You may also designate an authorised agent to make a request on your behalf.

13.6 Other US States

Where state-specific privacy laws apply (including Virginia, Colorado, Connecticut, Utah, Texas, and others as the regulatory landscape evolves), we honour the rights conferred by those laws. Contact privacy@littleblackbook.nz to exercise a right. [REVIEW: confirm operational coverage prior to launch in any US state.]

14. Children's Privacy

The Platform is intended for adults only. You must be at least 18 years of age to access or use the Platform. We do not knowingly collect information from any person under 18. If we become aware that we hold information about a person under 18, we will delete it as soon as reasonably practicable and terminate the relevant Account.

If you believe we may hold information about a person under 18, please contact us immediately at trust@littleblackbook.nz.

The Platform may link to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing personal information to them.

16. Changes to This Policy

We may amend this Policy from time to time. Material changes will be notified by email and via an in-Platform notification, and will take effect on the date stated in the notice. Non-material changes (clarifying language, processor substitutions) take effect on posting.

The "Last Updated" date at the top of this Policy reflects the most recent change. Continued use of the Platform after the effective date of an amendment constitutes your acceptance of the amended Policy.

17. Contact

For any privacy-related question or to exercise a right described in Clause 12:

Privacy Officer / DPO LBB Holdings Limited Email: privacy@littleblackbook.nz Registered office: [REVIEW: insert registered office address]

© 2025 LBB Holdings Limited. All rights reserved.

Questions about this document?

If anything here is unclear or you need clarification on how it applies to you, get in touch with our team.

Contact UsRead Terms of Service