Privacy & Cookie Policy
Version 2.0 · Effective 25 September 2026 · Last reviewed 25 September 2026
In short
Skyline Online LLC, trading as ChatNow, is the controller of your personal data. Guests give a username, gender, age and city; members also give an email address, a password and a date of birth. Guest content is deleted 24 hours after you leave and connection logs are kept for 12 months. We never see your age-check documents or your card number, and we do not sell personal data. Analytics and advertising cookies are set only with your consent. Email privacy@chatnow.fr to use your rights; you can also complain to the ICO.
1. Who is responsible for your data
The controller is Skyline Online LLC, a limited liability company registered in New Mexico, USA, 1209 Mountain Road Place NE, Ste N, Albuquerque, NM 87110, USA, trading as ChatNow (company details). Its UK representative under Article 27 of the UK GDPR is DataRep, 107-111 Fleet Street, London EC4A 2AB.
Data protection contact, for requests and complaints: privacy@chatnow.fr.
Three organisations are independent controllers under their own privacy notices: AgeVerif for your age check, Google LLC if you sign in with Google, and Stripe for card payments.
2. What we collect
- Guests: a username (3 to 20 characters), gender (Man, Woman, Trans, CD or Couple), age and city, chosen from a list (no GPS). No email or password.
- Members: email address, password (at least 12 characters, stored only as a PBKDF2-SHA512 hash), date of birth and gender. Optionally a bio and up to 10 photos. We keep your contacts, blocks and mutes. Google sign-in passes us only your email address.
- Content: public messages, private messages, images and voice notes.
- Webcam and voice: live streams are relayed through our own media servers and never recorded or stored by ChatNow. No facial recognition. Anyone watching can still capture a stream on their own device.
- Technical data: IP address, a device identifier stored in a cookie, session ID and connection timestamps. VPN and proxy detection is used only against spam and abuse.
- Age check: we receive only a yes/no result from AgeVerif. No document, photo or age estimate reaches us (see age assurance).
- Premium: transaction ID, amount, currency, plan and date. We never see your card number. The charge appears as "SKYLINE-ONLINE".
- Correspondence and moderation records: emails; reports by or about you, flags, decisions, sanctions, ban records and evidence snapshots.
Other sources: users who report or mention you, our providers (age-check result, Cloudflare anti-bot check, hash matches) and public authorities.
3. Why we use it and our lawful bases
"Recognised legitimate interest" (Art. 6(1)(ea) and Annex 1, inserted by the Data (Use and Access) Act 2025) covers crime prevention and safeguarding without a balancing test.
| Purpose | Data | Lawful basis (Art. 6 UK GDPR) |
|---|---|---|
| Running the chat: accounts, rooms, messages, media, webcam relay, profiles, contacts | Guest and member data, content, technical data | Contract, 6(1)(b) |
| Premium; tax records | Account data, transactions | Contract, 6(1)(b); legal obligation, 6(1)(c) |
| Age assurance | Yes/no result, session token | Legal obligation, 6(1)(c): Part 3, Online Safety Act 2023 |
| Moderation, reports, complaints and appeals | Content, moderation records, technical data | Legal obligation, 6(1)(c): ss.10, 20 and 21 OSA 2023; legitimate interests, 6(1)(f) |
| Detecting CSEA content and reporting it to the NCA | Images, content, account data, connection logs | Legal obligation, 6(1)(c): s.66 OSA 2023 and the 2026 Regulations; recognised legitimate interest, 6(1)(ea) |
| Security, spam and fraud prevention, bans | Technical data, ban records | Legitimate interests, 6(1)(f); recognised legitimate interest, 6(1)(ea), where the conduct is criminal |
| Valid requests from police, courts and regulators | What the request lawfully covers | Legal obligation, 6(1)(c); recognised legitimate interest, 6(1)(ea) |
| Answering your emails | Correspondence, account data | Contract, 6(1)(b), or legitimate interests, 6(1)(f) |
| Aggregate statistics that do not identify you | Technical data, usage counts | Legitimate interests, 6(1)(f) |
| Analytics and advertising cookies | Cookie identifiers, pages visited | Consent, 6(1)(a); PECR reg. 6 |
| Marketing emails to members who opted in | Email address | Consent, 6(1)(a); PECR reg. 22 |
| Legal claims | What is relevant to the claim | Legitimate interests, 6(1)(f) |
Our legitimate interests: security, preventing spam, fraud and ban evasion, enforcing the Terms, answering correspondence, aggregate statistics and legal claims. We use the minimum data for limited periods. You can object (section 10).
4. Special category data
Choosing "Trans" or "CD" reveals gender identity, which we treat as special category data; joining an adult room or describing your preferences can reveal your sex life or sexual orientation (Article 9 UK GDPR).
We rely on your explicit consent, Article 9(2)(a): a separate confirmation you click when you select "Trans" or "CD", and another the first time you enter an adult room. Nothing is pre-selected; without it the rest of the service remains available. Withdraw at any time by changing the field, leaving the room or, as a member, deleting the field in settings.
For moderation we also rely on the substantial public interest conditions in Schedule 1 to the Data Protection Act 2018. Special category data is never used for advertising, never shared with advertising partners and never used for automated decisions about you.
5. Moderation and automated decisions
- Human review. Moderators review reported content, including private messages, images and voice notes.
- AI text classifier. The text of public and private messages, and bios before they go live, is analysed after sending by an AI classifier run through the OpenAI API (GPT-4o-mini). Only the text is sent, never your email, IP address or username. Flagged content is removed automatically and logged, and a moderator reviews every flag.
- Image hash-matching. Every uploaded image is fingerprinted and compared with known child sexual abuse material (Project Arachnid) and with intimate images registered with StopNCII.org.
- Anti-spam rules: flood detection, banned words, rate limits, one session per account.
Automatic removal, a short mute or a rate limit can happen without a human looking first. No permanent ban is applied on a purely automated basis without human review. Under Articles 22A to 22D of the UK GDPR you can obtain human review, put your point of view and contest the decision: appeals are decided within 14 days by a different reviewer. See the sanctions.
6. Who we share it with
We do not sell personal data.
| Recipient | Role and data | Country |
|---|---|---|
| Contabo GmbH, München | Processor: hosts the chat and all stored user data | Germany |
| Hetzner Online GmbH, Gunzenhausen | Processor: serves the website pages | Germany |
| AgeVerif | Independent age-check provider; returns only yes/no | Europe |
| OpenAI, L.L.C. | Processor: text classification; message text only | USA |
| Canadian Centre for Child Protection (Project Arachnid) | Image hashes, for CSAM matching | Canada |
| Google LLC | Optional sign-in (independent controller); Google Analytics 4, anonymised, after consent | USA |
| Resend, Inc. | Processor: transactional emails | USA |
| Cloudflare, Inc. | Processor: anti-bot check and DDoS protection; IP addresses | USA |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payment processor for Premium; independent controller for card data | Ireland / USA |
| Internet Watch Foundation; StopNCII.org | Image hashes only | UK |
| National Crime Agency, police, courts, regulators | Under a legal obligation or valid legal request | UK |
Advertising partners, listed in the cookie preference centre, receive only what their cookies collect after your consent; never your messages, profile, age-check result or special category data.
Authorities. We disclose data when the law requires it, on a valid legal demand, or in an emergency involving a risk to life (see requests from authorities). Under section 66 of the Online Safety Act 2023 and the 2026 Regulations we must report all detected CSEA content to the National Crime Agency. A report includes the content, the IP address and port, and the account data we hold, including login IP addresses for the previous three months. Your rights to object and to erasure do not apply to these disclosures.
7. International transfers
Your data is stored in Germany. Transfers to the European Economic Area and Canada are covered by UK adequacy regulations (section 17A, Data Protection Act 2018).
Transfers to OpenAI, Google, Resend, Cloudflare and Stripe, Inc. in the United States rely on the UK Extension to the EU-US Data Privacy Framework. Where a service is not covered, we use the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment. We have told these processors that the data may reveal sexual orientation.
Our US-based staff access the systems under the controls in section 9. Ask privacy@chatnow.fr for a copy of the safeguards.
8. How long we keep it
| Data | Kept for | Why |
|---|---|---|
| Guest data and content | 24 hours after the guest leaves | Time to act on a report |
| Member content and account data | Until you delete it; deleted or anonymised within 30 days of account deletion | Providing the service |
| Connection logs (IP address, timestamps, device identifier) | 12 months | Security, abuse investigation, CSEA reports |
| Moderation records (reports, decisions, appeals, evidence) | 12 months | Appeals, repeat behaviour, Online Safety Act compliance |
| Ban records | 12 months; 3 years for permanent bans | Enforcing the ban |
| CSEA reports to the NCA | Report reference 5 years; reported content and associated data 12 months | 2026 Regulations (statutory) |
| Age-check result | Current session only | Re-checked each session |
| Premium transactions | 6 years | HMRC record-keeping |
| Correspondence, rights requests, complaints | 24 months | Follow-up and evidence |
| Cookie choice and consent record | 6 months | Remembering your choice, then asking again |
Data needed for a legal claim, or under a lawful preservation request, is kept until the matter is closed, then deleted.
9. Security
All connections use TLS. Passwords are hashed, input is validated, rates are limited, and every use of moderator and administrator tools is restricted and logged. If a breach is likely to put your rights at risk we notify the ICO within 72 hours and, where the risk is high, tell you directly. Vulnerabilities: see security reports.
10. Your rights
| Right (UK GDPR) | What it means at ChatNow |
|---|---|
| Access (Art. 15) | A copy of your data; other people's information is redacted. |
| Rectification (Art. 16) | Members edit their profile in settings; email us for anything else. |
| Erasure (Art. 17) | Members delete their account in settings. Data under statutory retention or needed for a ban (section 8) is kept. |
| Restriction (Art. 18) | We keep but stop using data while a dispute is checked. |
| Portability (Art. 20) | Members receive the data they gave us in a machine-readable format. |
| Objection (Art. 21) | To legitimate-interest processing, unless we show compelling grounds; to marketing, always. Not to age assurance or CSEA reporting. |
| Automated decisions (Arts. 22A to 22D) | Human review of any automated outcome (section 5). |
| Withdraw consent | Cookies: "Cookie settings". Special category data: change the field or leave the room. Marketing: unsubscribe link. |
How to ask. Email privacy@chatnow.fr, write to the registered office or to our UK representative. Say which right and which username or account email. We never ask for an identity document: a member writes from the registered email or confirms a one-time link; a guest must write within 24 hours of leaving, from the same device and session.
Requests are free and answered within one month, extendable by two months for complex requests. Manifestly unfounded or excessive requests may be refused or charged, with reasons.
What we cannot do: identify a guest after 24 hours; provide streams, which are never recorded; recover deleted content; hand over another person's data; or reach data held by AgeVerif, Google or Stripe.
11. How to complain
To us. Section 103 of the Data (Use and Access) Act 2025 gives you a right to complain to us. Email privacy@chatnow.fr with the subject "Data protection complaint". We acknowledge within 30 days and give a written outcome without undue delay. Complaints about a moderation decision go through Report & complaints.
To the ICO, at any time, although it normally expects you to contact us first: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; ico.org.uk/make-a-complaint. You may also seek a remedy, including compensation, in the courts.
12. Children
ChatNow is for adults only; every visitor passes a highly effective age check. We do not knowingly collect data from anyone under 18; a minor's session or account is terminated and its data erased, subject only to any legal duty to preserve evidence. If you believe a user is under 18, email safety@chatnow.fr. See Age assurance & child safety.
15. Changes to this policy
We review this policy at least once a year and whenever the service or the law changes. Before using your data for a new purpose, we tell members by email and guests by a notice at entry. Past versions are listed in the Terms.