Privacy

IThe short version

LotusMake, referred to as we, runs this site and is responsible for the records on this page. Reading needs no account and loads no trackers. Signing in creates an account at our own sign-in service and a small record in this site's database. Paying hands your card to Stripe; we never see it. We send only the email an account needs. Everything we hold about you exports in one click and is erased on request. The table under Retention says how long each record lives.

IIReading

You do not need an account to read public posts. The pages load no analytics scripts, no advertising pixels, no third-party fonts and no trackers.

Like every web server, ours keeps an access log: the address a request came from, the page it asked for, the time and the browser's user-agent string. Cookies and sign-in tokens are stripped from the log before it is written. We use the log to keep the site running and to block abuse, keep it for seven days and share it with no one. Traffic reaches us through Cloudflare, which provides encryption and attack protection and sees your address for that purpose.

The lotus badge on other sites is a plain picture: loading or clicking it is not counted.

The site sets only cookies it needs to work. A theme cookie (ff_theme) remembers a light or dark choice and identifies nothing else. There is no cookie for your age: the age band belongs to an account, and a person without an account sees content rated G and PG. The session cookie (ff_session) and a short-lived sign-in cookie (ff_flow) exist while you sign in or stay signed in. While you fill in a creator application, a draft cookie (ff_apply_draft) holds the text you typed so a failed submit does not lose it. A maker who writes on more than one page has a cookie (ff_studio_page) that remembers which page the Studio writes as. The sign-in service sets its own session cookies on its own address. None of these is used for tracking, so there is no cookie banner.

A post may carry a video, a track, a sketch or another item from a platform such as YouTube or Spotify. The page shows the title and a picture we saved ahead of time, and nothing from the provider loads until you click. When you click, your browser asks that provider for the item, and the provider sees your address and sets whatever cookies it sets under its own policy. A post by a maker who has linked a GitHub project shows a saved card; when you click Load the latest from GitHub, your browser fetches it from GitHub, which then sees your address.

Search queries are not stored: the search field sends nothing until you submit it, and what you search for is removed from the access log before the entry is written, as sign-in tokens are. Results are worked out for that request and kept nowhere.

IIISigning in

Accounts live at our own sign-in service, which we run. You can sign in with Google, GitHub, GitLab or Hugging Face, or with an email address and a password. The service stores what an account needs: your email address, the name you give it, a password stored hashed if you set one or a link to the provider account you chose, and whether the address has been verified. If you sign in with a provider, that provider tells the service your email address and name and whether it has verified the address. We never see your password at that provider. You may add a passkey or a second factor from the account settings page.

The sign-in screens for sign-up and password reset may load a challenge from Cloudflare Turnstile (challenges.cloudflare.com) to stop automated abuse; Cloudflare sees your address and browser details for that purpose. After sign-in the site sets one session cookie so it knows who you are. The cookie is encrypted, sent only over HTTPS, unreadable by scripts, and expires after thirty days or when you sign out.

We treat an email address as unverified until the provider or our verification mail says otherwise. A creator application needs a verified address.

IVAccounts

The site keeps a database so that posts, support and the Studio can work. For every account it stores:

• an account record: the sign-in service's opaque user id, your email address and name as the service reports them, whether the address is verified, when the account was created and when you last visited;
• your age band, teen or adult, and the date you gave it at sign-up or later from your Forge page. You are asked whether you are 18 or older, 13 to 17 or under 13; we store the band and never a birthdate, and a person who says under 13 gets no account. The band decides which ratings the site shows you, and an adult's choice to show 18+ content is kept with it;
• the fields you pick as interests, up to eight, and, if you linked GitHub, your GitHub login. We use the interests, with the work you have supported, to order the For you blocks on the makers and projects pages; they are never shared or sold;
• your support: which monthly tiers you hold with their status and renewal dates, the GPU hours you have bought, and the Stripe identifiers that name those payments and your customer record at Stripe;
• the choices you made at checkout, such as whether to share your contact details with a creator;
• an audit log of actions taken with your account, such as starting a checkout or creating an API key, with the originating address, kept for one hundred and eighty days;
• a hash of your private feed link, if you create one. The link itself is shown once and not stored;
• the reports you file under the rules, and any action taken on your account.

We do not sell or share your personal information, and nothing here is rented or used for advertising.

VSupporting a creator

Payments are processed by Stripe. When you buy GPU hours or join a monthly tier, Stripe's hosted checkout collects your card or wallet details and Stripe stores them; this site never sees or stores a card number. LotusMake is the merchant of record, so the charge appears under our name with the creator's handle beside it. Stripe acts as our payment processor and, for its own obligations such as fraud prevention and financial regulation, as an independent controller under its privacy policy at stripe.com/privacy.

Stripe tells us the outcome of each payment, the status of each tier and the dates it renews or ends. We keep those facts and the Stripe identifiers so that we can show you what you support, unlock the posts your tier includes and pay the creator. Stripe sends its own receipts.

What the creator learns about you. By default a creator sees a stable pseudonymous id, the tier or the number of GPU hours, the date and the amount, and nothing else. At checkout for a monthly tier you may choose to share your name and email address with that creator so they can reach you if they leave the platform. The default is off, and the choice is recorded with its date. A note you attach to GPU hours is shown to the creator alone and is never published. GPU hours bought without an account carry no note; Stripe collects an email address for the receipt, and we store no account for you.

VIBeing a creator

Applying. Your application holds the handle, display name, tags, statement, links and country you entered, and the decision with its reason. An approved application becomes your public page. A declined application is erased ninety days after the decision unless you appeal it, and the handle you asked for is released. We count applications per account and per network address to limit abuse.

Your page. Your handle, display name, statement, links, tags, the number of posts and the month you joined are public. Posts you publish are public or limited to the readers you choose. Every saved version of a post is kept so you can go back to it. Images are re-encoded on upload and the original bytes are not kept. API keys are stored as hashes; the secret is shown once.

Payouts. Payouts go through a Stripe account connected to ours under Stripe's Connected Account Agreement. Stripe collects the identity, tax and bank details that payouts require and stores them; we never see your bank account or your identity documents. We store the id of your Stripe account, its country, and the status Stripe reports: what is complete, what is still due and whether payouts are enabled. When Stripe pauses or closes a payment account we record the reason Stripe gives, pass it to you the same day and count it on the transparency page without your handle.

Signing key. At approval we generate a signing key pair for you. It signs your export so that you can prove where your work came from. The private key is stored encrypted and can be downloaded once.

Your supporters. You see each supporter as a pseudonymous id with tier, start date and amount. You see a supporter's name and email address only where that supporter chose to share them at checkout. A supporter's note on GPU hours is visible to you alone. Nothing about your supporters is published.

Teams. A page can have people who write on it, as owners, editors or contributors. For each person we keep the account, the role, who added them, when, and when they were removed. A team page lists the maker pages on it in public; the people who write on it are listed only in its Studio. A post written on a team page carries a byline with the name of the author's own maker page, never the name of the account, and an author with no page of their own is not named. An invite link is shown once to the owner who makes it; we keep only a hash of it, with the role, the optional maker handle and the note the owner chose.

VIIEmail

We send email through Resend, a mail service that processes the address and the message for us. We send only these messages: a link to confirm your email address, when you ask for one; the outcome of your application; a notice when an API key is created; notices, reminders and decisions under the rules, including the outcome of an appeal; a notice to a maker when the share the platform keeps changes; one message to a maker when a project of theirs reaches a goal; one message to an inviter when a maker they invited is terminated under the rules and their invites are frozen; an invitation to write on a team page, sent to the maker an owner names, and one message to the principal or the owners of a page when someone joins it; one message to supporters when a creator they support is suspended or leaves; and one message to a reporter when a case is reviewed. We send no newsletter and no digest.

These messages are part of running your account and cannot be turned off while the account exists. Our sign-in service sends its own verification and recovery mail, and Stripe sends receipts and payment notices. None of it is marketing.

We log each message we send for one year, so that we never send the same notice twice: a hash of the address, the template, the subject line, the date and, for a message to an account, the account id.

VIIIModeration records

Anonymous reports. Copyright notices, intimate-image requests and reports under rule A1 may be filed without an account. For these we keep what you type, including the reply address and postal details you give, and a keyed hash of your network address (with an IPv6 address reduced to its /64) that only limits abuse and cannot be turned back into the address without our server key. They are kept like any other report, below.

If you file a report with an account, we keep it with your account id, the rule you picked, your text and a snapshot of what you reported, and we tell you once how your report was resolved. If a report concerns you, we keep the case: the evidence snapshot, the notice we sent, your reply, the action taken and the outcome of any appeal. These records are kept for three years after the action or the end of any appeal or dispute, whichever is later, and every time a person reads the evidence that read is logged. Material preserved under rule A1 is sealed, kept for one year and reported as the law requires. If an account is terminated we keep a hash of its sign-in identifier so that the same account cannot return. The transparency page publishes counts from these records and never a handle or a name.

IXRetention

XYour rights

Export. Two exports exist. Both are one click, free, and usually take minutes. The account export, from your Forge page, holds your account record, your tiers and GPU hours, your consents, the mail we sent you, your audit log, your reports and any action that targeted you, with a README that says what Stripe and the sign-in service hold and how to get it. The creator export, from the Studio, holds every post and revision, your images, tiers, supporters (by name only where they consented), tips, payments, goals, project wallets (totals and whether a view key is stored, never the key), invites (first four characters of each code), API key names and key limits, moderation records and your application, signed with your key. Each export is available once per account per day, and the download link works once and for seventy-two hours. We answer any request about your data within one month. A terminated creator can still take the export for ninety days.

Correction. You can change the details the sign-in service holds from its account settings page, and the details of your page from the Studio.

Erasure. You may ask us to erase your account by writing to support@lotusmake.com from the address on the account; the export page points there as its next step. Within thirty days we erase the database records above, ask the sign-in service to delete the account and ask Stripe to delete your customer record. Project wallet addresses and view keys are removed and replaced by a tombstone. Stripe keeps the transaction records the law requires it to keep. Some identifiers survive erasure because the system needs them: the sign-in service's opaque user id, the dates the account was created and last seen, a creator's handle (it stays reserved), and the mail-log rows described above (account id, subject line and a hash of the address, for one year). Stripe webhook payloads, which can hold your email address and name, are cleared on their own 90-day schedule rather than at erasure, and database backups hold an erased record until they expire. Posts and images go with a creator account unless a legal hold applies. Erasure is paused while a legal hold applies to your account, for example during a copyright dispute, a court order or a preservation duty, and you are told when the hold lifts. A hold for a copyright dispute is placed by an admin. A hash kept to enforce a ban also survives erasure.

Where you are. If you are in the European Union or the United Kingdom, the export and erasure rights above are how we meet the GDPR and the UK GDPR. Whether we must also appoint a representative there is an open question. Counsel is settling it before launch, and this page will name the representative if one is appointed.

XILegal bases, transfers and your other rights

If you are in the European Union or the United Kingdom, these are the bases we rely on. To run your account, sign you in, take and honour payments and pay creators, the basis is the contract with you. To keep records the law requires, such as payment records and copyright notices, it is a legal obligation. To keep the site secure, limit abuse, enforce the numbered rules and keep the public record, it is our legitimate interest, which we weigh against your rights. Mail beyond what the account needs would need your consent, and we send none. Giving us an email address is required to hold an account; everything else you give is optional or comes from a choice you make.

Our processors are Stripe (payments), Resend (mail), Cloudflare (transport, attack protection and sign-in challenges), the sign-in providers you choose, and the host of our encrypted off-site database backup. Several are in the United States. Where personal data leaves the European Union or the United Kingdom, it moves under the processor's standard contractual clauses or its Data Privacy Framework certification.

In addition to export, correction and erasure you may object to processing based on our legitimate interest, ask us to restrict processing, and complain to your data protection authority. If you live in a US state with a privacy law, you may ask us to confirm, correct, delete or give you a copy of your personal information, and we will not treat you differently for asking. We do not sell or share personal information and we do not profile you. What orders a list for you is the fields you chose and the work you have supported, and the page says so.

XIIChanges

The date at the top of this page is the date it last changed. If the practice changes, this page changes first.

XIIIContact

Write to support@lotusmake.com. Court orders and law-enforcement process go to legal@lotusmake.com. Copyright notices go to dmca@lotusmake.com.