Privacy Policy

1. Scope of this policy

This Privacy Policy explains how BigFan (“BigFan”, “we”, “us”) handles personal information when you visit bigfan.lol, view a creator’s public fan page, make a support payment, or run a creator account. It applies to the BigFan website and the services offered through it (together, the “Service”).

BigFan is a platform. Creators are independent of BigFan and are responsible for their own pages and their own relationships with their audiences. Where a creator handles your information outside the Service, that creator — not BigFan — is responsible for it.

By using the Service you agree to this policy. If you do not agree with it, please do not use the Service.

2. Information we collect

Information you give us as a fan

You do not need an account to support a creator. When you make a support payment we collect the display name you choose (or a record that you chose to appear anonymously), the creator and fan page you supported, the amount and currency, and the status of the payment.

Information you give us as a creator

When you create a creator account we collect your email address, your name, and any profile image supplied by the sign-in method you use. When you publish a page we collect your chosen page address, display name, and biography. If you connect a social account, we receive the handle, profile URL, display name, and avatar for that account from the provider so we can show it on your page.

If you verify Instagram by messaging BigFan, Instagram sends us a signed event containing the one-time verification reference and your Instagram-scoped account ID. We use that ID to retrieve your username and display name. We do not retain the message text, and the verification reference expires after fifteen minutes.

Payment information

Payments are processed by Stripe. Card numbers and other payment credentials are entered on Stripe-hosted pages and are never received or stored by BigFan. We receive confirmations and references from Stripe — such as payment identifiers, amounts, currency, payment status, refunds, and disputes — so we can keep fan boards and creator payouts accurate.

Reports and messages

If you report a page or email us, we collect the content of your report or message, the page it concerns, and any contact address you choose to provide.

Community-goal reward claims

If you join a community-goal campaign, we record the campaign, the version of campaign terms you accepted, and your eligibility against the same browser fan identity. After verified payment we issue a one-time recovery code and store only its secure hash. If a reward unlocks and you claim it, we collect only the delivery email you separately provide and consent to. We encrypt it at rest, verify it by an expiring link, restrict and audit creator access, and delete it on the displayed retention schedule. We never use the email supplied to Stripe as campaign contact without separate consent.

Technical information

Like most websites, our servers and infrastructure providers record technical information automatically, including IP address, browser and device details, requested pages, referring pages, and timestamps. We also record limited operational events (for example, that a payment webhook was processed) so that we can run the Service reliably and investigate problems.

Usage measurement

If — and only if — you accept optional cookies, we measure how the Service is used. That measurement records the pages you view, how you arrived, the approximate region your visit came from, and general device and browser details, against a random identifier stored in your browser. It is not linked to your name, your email address, or your payments, and we read it as aggregate statistics.

The measurement service is present on every page, but until you accept it is instructed to store nothing. In that state your browser still fetches it from Google and still signals that a page was viewed, which — like any request to any server — reveals your IP address, the page address, and your browser details. What it may not do is keep anything: no cookie is stored, you are given no identifier, and you cannot be recognised from one page or one visit to the next, so those signals only ever count towards aggregate estimates. Accepting is what allows it to store an identifier and measure your visit as your visit. See Cookies and similar technologies for what is set then, and how to change your answer.

3. How we use information

We use personal information to:

• provide the Service, including fan pages, support payments, and leaderboards;
• process payments, refunds, disputes, and payouts to creators;
• create and maintain creator accounts and verify connected social profiles;
• keep the Service secure, prevent fraud and abuse, and enforce our terms;
• respond to reports, support requests, and other messages;
• understand how the Service is used in aggregate — and, where you have accepted optional cookies, measure that use — so we can fix problems and improve it; and
• comply with legal, accounting, and tax obligations.

We do not sell personal information, and we do not use it for third-party advertising or profiling.

4. Legal bases for processing

Where data protection law requires a legal basis (for example, in the United Kingdom and the European Economic Area), we rely on the following:

• Performance of a contract — to provide the Service you asked for, including processing a support payment and running a creator account.
• Legitimate interests — to keep the Service secure and reliable, prevent fraud and abuse, and improve what we offer, balanced against your rights.
• Legal obligation — to meet accounting, tax, and other legal requirements.
• Consent — where we ask for it, for example before setting optional cookies or sending optional emails. You can withdraw consent at any time, and doing so is as easy as giving it; withdrawal does not affect processing carried out beforehand.

5. What is public

BigFan is built around public fan boards, so some information is visible to anyone who visits a creator’s page:

• the display name you chose, or no name at all if you chose to appear anonymously;
• your net supported amount and your position on the weekly, monthly, and all-time boards; and
• for creators: the page address, display name, biography, connected social handle, and avatar.

Your email address, payment details, IP address, and other account information are never published on a fan page. Do not use a display name that contains personal information you would not want to be public — display names are shown exactly as entered, and search engines may index them.

6. Cookies and similar technologies

We use cookies for two purposes: to make the Service work, and — only with your agreement — to measure how it is used. The first time you visit, a notice asks whether you accept the optional cookies. No optional cookie is stored before you accept, declining costs you no part of the Service, and we do not use advertising cookies.

Cookies that are strictly necessary

These deliver the Service you asked for, so they are set without consent. You can delete them in your browser settings, but parts of the Service will not work correctly without them.

• Fan session cookie (bigfan_fan) — a signed, HTTP-only cookie that links your browser to your place on a fan board so we can recognise repeat support without asking you to create an account. It lasts up to 180 days. Clearing it, or switching browser or device, starts a new fan identity.
• Cookie choice (bigfan_consent) — records whether you accepted or declined the optional cookies so that we honour your answer and do not ask again on every page. It lasts six months, after which we ask again.
• Authentication cookies — set by our authentication provider when a creator signs in, to keep that session secure.
• Payment cookies — set by Stripe on its own checkout pages to process payments and prevent fraud.

Optional cookies

We use Google Analytics, a measurement service provided by Google, to count visits and see which pages are used. It runs on every page, but with its storage switched off until you accept: while the notice is unanswered, and after a refusal, it stores nothing in your browser and cannot recognise you from one page or visit to the next.

Once you accept, it stores a randomly generated identifier for your browser in cookies named _ga and _ga_ followed by a property identifier, which last up to two years. Its advertising and personalisation storage stay switched off whatever you answer, so these cookies are used for measurement only — never to build an advertising profile of you.

Changing your answer

Choose Cookie settings in the footer of any page to reopen the notice and change your answer at any time. Declining after you have accepted stops the optional cookies from being set again and deletes the ones already stored in that browser; it does not undo measurement that already took place.

7. How we share information

We share personal information only as described here. Our service providers may process it on our behalf and under contract:

• Payment processing — Stripe processes payments, refunds, disputes, and creator payouts, and acts as its own controller for that data under its privacy policy.
• Authentication — our sign-in provider handles creator accounts and sessions.
• Hosting, infrastructure, and email — providers that host the Service, store our database, and deliver operational email.
• Measurement — Google Analytics processes usage measurement on our behalf and under contract, and measures a visit only where that visitor has accepted optional cookies. Where you decline or have not answered, your browser still contacts Google and signals that a page was viewed — revealing your IP address, the page address, and your browser details — but nothing is stored and you are not identified.
• Creators — a creator can see the public fan board for their own page and aggregate figures for their earnings. Creators do not receive fan email addresses or payment details from us.
• Legal and safety — we may disclose information where we believe in good faith that it is required by law, or necessary to investigate fraud or abuse, enforce our terms, or protect the rights and safety of any person.
• Business transfers — if the Service or its assets are transferred to another party, information may be transferred as part of that transaction, subject to this policy.

8. International transfers

The Service and our providers may store and process information in countries other than the one you live in, including outside the United Kingdom and the European Economic Area — our payment, authentication, and measurement providers all operate internationally, including in the United States. Where we transfer personal information across borders, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

9. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy.

• Payment and financial records are kept for as long as required by accounting and tax law, typically several years, and cannot be deleted on request before then.
• Fan board entries are kept while the creator’s page is active. Hiding a fan identity removes it from public view without altering financial records.
• Creator accounts are kept while the account is active and for a reasonable period afterwards.
• Connected social data is removed when a creator disconnects the social account. Disconnecting also hides the page and blocks new payments, while financial records remain subject to their separate legal retention periods.
• Reports and support messages are kept for as long as needed to handle them and to keep a record of safety decisions.
• Technical logs are kept for a short period for security and troubleshooting.
• Usage measurement is kept at visit level for no longer than fourteen months, and the cookies behind it expire within two years.

10. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to object to or restrict how we use it, to receive a copy in a portable format, and to withdraw consent where we rely on it. You also have the right to complain to your local data protection authority.

To make a request, email contact@bigfan.lol. We may need to verify your identity before we act, and we will respond within the time required by applicable law. Some information — such as records we must keep for tax or fraud-prevention reasons — cannot be deleted on request.

To have a display name removed from a public board, email us or ask the creator to hide it from their dashboard.

11. Security

We take reasonable technical and organisational measures to protect personal information, including encryption in transit, signed session cookies, hashed fan identifiers, restricted access to production systems, and delegation of card handling to Stripe. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities where the law requires it.

12. Children

The Service is not intended for children. You must be at least 18 years old to make a support payment or run a creator account, as set out in our Terms & Conditions. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact contact@bigfan.lol and we will delete it.

13. Third-party sites

Creator pages and other parts of the Service may link to third-party websites, including social media profiles and Stripe-hosted checkout. We do not control those sites and are not responsible for their content or privacy practices. Please read their privacy policies before providing information to them.

14. Changes to this policy

We may update this policy from time to time. When we do, we will change the “last updated” date at the top of this page, and for significant changes we will provide a more prominent notice. Continuing to use the Service after an update means you accept the revised policy.

15. Contact us

For any question about this policy, or to exercise your rights, email contact@bigfan.lol. We aim to reply to every message within a reasonable time.

To report impersonation, harassment, fraud, or illegal content on a page, use the report form or email the same address.