← Back

Privacy policy

This is a condensed version in English. The German version is complete and authoritative, and it is linked in the footer of this page. If anything here is unclear, write to us and we will explain it in English.

1 · Controller

NaughtyAvocado GmbH
Luhnenstraße 7
30559 Hannover
Germany

Managing director: Jakob-Moritz Bach
Local court (Amtsgericht) of Hannover, HRB 228251
Email: info@prncasting.com

NaughtyAvocado GmbH is the sole controller within the meaning of Art. 4(7) GDPR for both services, the website prncasting.com and the application route at apply.prncasting.com. There is no joint controllership under Art. 26 GDPR.

2 · One file for three brands

The same company also runs the talent files STR8CASTING and STR8HUNTER. All three share one single file: your application sits in the same database, and the staff handling enquiries for the other two brands can see it and consider you for suitable enquiries. That is the point of it, you reach more enquiries than through one brand alone. Because this involves data about your sex life, we obtain your explicit consent for it in the form under Art. 9(2)(a) GDPR, and its wording names NaughtyAvocado GmbH and all three brands.

Technically the application route is the same software that takes applications for STR8CASTING and STR8HUNTER, on the same server. You will notice this in two places, and we tell you in advance so that you do not mistake it for an error or for fraud: the age and identity check carries the name STR8CASTING, and for the time being our emails are sent from info@str8casting.com even where PRNCASTING appears as the sender.

3 · The website prncasting.com

This website sets no cookies, embeds no third-party content and uses no analytics or tracking. Fonts are served from our own server. Each language has its own address, so your language choice does not need to be stored. On access our host records the usual server log files: the page requested and the time, the volume transferred and a success message, browser type and version, operating system, the previously visited page if your browser sends it, and the IP address. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest being the technically faultless and secure operation of the site. The data is not combined with other sources.

The site is served by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA, as our processor under a contract pursuant to Art. 28 GDPR. Netlify keeps the logs for up to 90 days in the live system and up to one year in its archive. Processing takes place in the United States. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework, so the transfer relies on the European Commission’s adequacy decision under Art. 45 GDPR.

4 · The application route

What we collect: your first and last name, email address, country, town, date of birth, mobile number, height, weight, gender and gender identity, for male applicants also penis length, and your preferred contact channel with the number or profile name. Your sexual orientation, a grid of sexual practices with the answers yes, no or maybe, your limits, fetishes and preferences, the fields you want to work in, your own goal and a free text about yourself. Links to your profiles. Photos and, if you wish, videos, including images showing you nude, and close-up images. The result of the age and identity check. The referring page without its query string, and the campaign parameters in the address you used, with no IP address, cookie or cross-site identifier stored. With every consent: the time, a checksum of the wording you agreed to, and your shortened IP address, the first three of four blocks for IPv4 and the first four of eight for IPv6.

If you apply as a couple, each person applies separately, with their own details, their own age and identity check and their own consents. The images in one application show only the person applying.

Purposes and legal bases. We process your details to assess your application and to initiate a possible cooperation, that is managing your OnlyFans account, placing you with productions, webcam platforms and modelling clients, or approaching you for one of our own productions. The legal basis is Art. 6(1)(b) GDPR, pre-contractual measures at your request. Your sexual orientation, gender identity, the practices grid, your limits, fetishes and preferences and your images are special categories of personal data under Art. 9(1) GDPR. We process them solely on your explicit consent under Art. 9(2)(a) GDPR, which you give separately in the form and may withdraw at any time. The same consent covers the shared file described in section 2. The biometric comparison in the identity check is covered by a second, separate explicit consent. The age check also serves our legal obligation, because possessing nude images of a minor is a criminal offence under § 184c of the German Criminal Code, so we additionally rely on Art. 6(1)(c) GDPR. We further rely on Art. 6(1)(f) GDPR for the origin of your visit, for abuse prevention, for the audit log and for backups.

Withdrawal. You can withdraw any consent at any time, without giving reasons, with effect for the future. A plain email to info@prncasting.com is enough. If you withdraw a consent under Art. 9 GDPR, the basis for the application falls away: your images are blocked immediately, nobody can view or pass them on, and we can no longer process the application. If you ask for deletion we delete without delay, otherwise at the latest when the period in section 6 expires.

Storage in your browser. The application route stores three values in your browser, not on our server: your entries so far as a draft, which also contains details about your sex life but never your consents and which expires after thirty days, your language choice, and, for the duration of your visit, the referring page. These are necessary to provide the service you asked for, § 25(2)(2) of the German TDDDG. They are not transmitted to us and not used to recognise you. You can delete them in your browser settings at any time and will then lose your draft. On a shared device you should do that after submitting.

5 · Age and identity check

Before any images can be uploaded, an age and identity check is mandatory. It is carried out by Didit Identity Spain, S.L., CIF B22929327, Calle Nápoles 227, P. 1, 08013 Barcelona, Spain, as our processor under a contract pursuant to Art. 28 GDPR. The check page carries the name STR8CASTING because we run one application there for all three brands.

You photograph an official photo identity document and record a live capture of your face. While you capture the document, the front camera also takes an image of your face. Didit reads the data from the document, checks that it is genuine, compares your face with the photograph and evaluates your IP address and device data in order to detect forgeries and connections through VPNs or data centres. Biometric data is processed in doing so. We send Didit your email address and an internal reference for your application.

We store the result, the time, the identifiers of your check sessions, the number of attempts, the date of birth read from the document, the name read from it and, where present, the address read from it. Didit stores the images of the document, the live capture, the biometric features derived from them, the document data read and your IP and device data. We have set the retention period there to one year, after which Didit deletes the data of that session, and the biometric template is deleted with the session. Didit told us in writing on 11 September 2026 that it keeps its own verification logs for 365 days and then deletes them.

Not everything Didit does is done on our behalf. Under our contract Didit may act as an independent controller for three of its own purposes: training, validating and improving its models, fraud heuristics, document classifiers, liveness detection and risk scoring; detecting and preventing recurring fraud, document forgery, presentation attacks, account takeovers and known abuse patterns across its whole platform; and protecting the confidentiality, integrity and availability of its own service, including incident response, logging and forensics. For these it uses anonymised, aggregated or pseudonymised data derived from the data arising in your check through our account. The contract does not specify which data that is, but it does state that pseudonymised data remains personal data. The contract names Didit’s legitimate interest and a substantial public interest in establishing identities securely and preventing fraud as the legal basis, which is the provider’s own assessment and not ours.

We have switched off the use for training and improving the models for our entire account, for the organisation and every application below it, so this covers your check as well. Didit confirmed this in writing on 11 September 2026 and at the same time told us that models already trained are not retroactively untrained. For the two remaining purposes, fraud prevention and the security of its service, we have no such confirmation.

That does not replace an objection of your own. In so far as Didit relies on a legitimate interest, you may object under Art. 21(1) GDPR, addressed to Didit, for data protection questions at privacy@didit.me and its data protection officer at dpo@didit.me. For everything else we remain your contact at info@prncasting.com.

Didit’s main infrastructure is within the European Economic Area under the contract. Didit may involve sub-processors and Didit Identity, Inc. in the USA. Any transfer there relies, under the contract, on an adequacy decision under Art. 45 GDPR or on the standard contractual clauses under Art. 46(2)(c) GDPR, published as Implementing Decision (EU) 2021/914 on eur-lex.europa.eu.

Didit checks the document, liveness and face match automatically. If the date of birth read from the document gives an age below 18, we accept no images. If Didit rejects the check you may repeat it up to five times, and if you think a rejection is wrong, write to us and a human will look at it. A human always decides on your application, there is no solely automated decision within the meaning of Art. 22 GDPR.

6 · Your images, recipients and retention

Your photos and videos are stored encrypted (AES-256-GCM) on our server in Germany and are not reachable through any public address. Your other details are in our database on the same server. They can be viewed, after logging in, by authorised staff and by you yourself once you have a creator account. Every access is logged.

If we pass images on with your consent, the recipient we name receives a personal link valid for 72 hours that can be retrieved once. What is passed on is the original file, carrying a technical marker that later allows a shared file to be traced to us and to that recipient. A file can contain data your camera writes into it, including the time and, if you allowed that on your device, the place the photo was taken. If you do not want that, switch location data off in your camera before taking photos. Application material is never published and never used for advertising. Publication only happens under a separate contract and with your explicit consent in written form.

Our processors are, each under a contract pursuant to Art. 28 GDPR unless stated otherwise: Toys4Fans GmbH, Luhnenstraße 7, 30559 Hannover, a sister company, for the server infrastructure of the application route, engaging Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, as a further processor, with servers in Germany; TFS Group GmbH, Luhnenstraße 7, 30559 Hannover, our parent company, for the notification emails to our management mailbox and for the email traffic of our domain, engaging Microsoft Ireland Operations Limited, Dublin, and IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, as further processors, with possible processing in the United States under the EU-U.S. Data Privacy Framework in which Microsoft Corporation participates; Netlify, Inc. for this website; and Didit Identity Spain, S.L. for the age check, which for the part described in section 5 is not our processor but an independent controller. The notification emails contain only the type of event, the time, an internal number and a link into our back office, never your name and nothing from your application.

If you choose WhatsApp or Instagram as your contact channel, we write to you there. Those messages run through WhatsApp Ireland Limited or Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, which are independent controllers for that and also transfer data to the United States.

Material is passed to productions, studios, webcam platforms, modelling clients, agencies or any other third party solely on your prior consent relating to that specific recipient, whom we name, together with the purpose and the scope. On request we tell you the specific recipients your data went to, Art. 15(1)(c) GDPR as interpreted by the Court of Justice (judgment of 12 January 2023, C-154/21).

Retention. Netlify logs up to 90 days live and up to one year archived. If no cooperation results, the complete application is deleted at the latest thirty days after the decision. While a decision is pending we keep it for no longer than six months after receipt. An application without all required images uploaded within thirty days counts as not submitted and is deleted after that period. If you consented to remaining in the file, your application stays after a rejection until you withdraw, for no longer than twelve months, and we ask again before that. If we take you into the file, it stays for as long as that place lasts and you can withdraw at any time. Name, date of birth and address read from the document are kept with your application, and if you have signed the age declaration as a creator, for the period stated there. For the record of your consents, the type, version and time remain as evidence under Art. 7(1) GDPR, while the shortened IP address is removed when your application is deleted, after which the row can no longer be attributed to a person. Emails you send us stay in our mailbox until your enquiry is dealt with and are then deleted unless a statutory retention obligation applies. The audit log of who decided or sent what and when is a continuous hash chain and is not altered afterwards, individual entries can contain your email address, and if you request deletion we remove the personal reference from those entries. Daily backups are deleted after sixteen days at the latest, so a deleted image can still be contained in a backup for that period, which is used only to restore the system after a technical failure.

Before a period expires we send two reminders by email, seven days and one day beforehand. If required images are still missing the reminder leads back to the upload, in all other cases you can choose whether we keep or immediately delete your data, and if you do nothing it is deleted. You can request deletion at any time at info@prncasting.com.

7 · Is providing data mandatory?

Applying is voluntary. You are under no legal or contractual obligation to provide us with data. Without the details marked as mandatory in the form and without a passed age and identity check we cannot process an application, and you suffer no disadvantage beyond that. Details on sexual orientation, gender identity, practices and limits as well as height, weight and, for men, length are mandatory, because we need them to assess your suitability, to match you with enquiries from webcam, production and modelling, to approach you for our own productions and to plan your OnlyFans account. Details on fetishes are optional.

8 · Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)). Write to info@prncasting.com. You may also lodge a complaint with a supervisory authority. The competent authority is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

9 · Data security and status

Both services use TLS encryption throughout and redirect unencrypted requests immediately to an encrypted connection. Access to the applicant administration is restricted to authorised persons and secured by a second factor. Every access to images is logged.

This policy is as of October 2026. The German version is the authoritative one.