This Privacy Policy explains what personal data Leewardworks (“Leewardworks”, “we”, “us”) collects, why, how long we keep it and who receives it. It covers the Leeward desktop app for macOS and Windows, our servers and the website leewardwork.com (together, “Leeward”).
Leeward is a CRM for agencies that manage creator accounts on OnlyFans and Fansly. Agencies connect their models’ accounts, chat with fans in Leeward Chat, send PPV from the vault, manage chatters, shifts and payroll, follow analytics and alerts, and use the AI administrator and the message translator. Questions about this policy: [email protected].
1. Who is responsible for your data
For the agency account, billing, the referral program and visitors of our website, Leewardworks decides how personal data is processed and is responsible for it.
For the data an agency puts into Leeward — connected creator accounts, chats, fan data, the team and its work — the agency decides what is processed and why. For that data the agency is the controller, and Leewardworks processes it on the agency’s behalf and on its instructions (see section 4).
2. What data each part of Leeward uses
Below, for each part of Leeward: what data it uses, why, how long we keep it and who else receives it. “Hosting providers” are the companies whose servers run Leeward.
Desktop app and automatic updates
- Data
- App version, operating system (macOS or Windows), a technical device identifier and the IP address of the connection.
- Why
- To deliver automatic updates, keep sign-in secure, let staff work only from approved devices, detect tampering with the app and prevent abuse of trials and licenses.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- Leewardworks, our hosting providers and Cloudflare.
Agency account and sign-in
- Data
- Agency name, owner email address, sign-in codes, settings and the plan of each model.
- Why
- To create and run your account and let you sign in.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- Resend delivers sign-in codes and service emails.
Connected OnlyFans and Fansly accounts
- Data
- Session data of each connected creator account (stored encrypted), username, avatar and profile data returned by the platform.
- Why
- To work with OnlyFans and Fansly on the agency’s behalf: read and send messages, load statistics and content.
- How long
- Until the model is disconnected or the agency account is deleted, and up to 30 days after that.
- Who receives it
- OnlyFans or Fansly, when the app makes requests to them on your behalf.
Leeward Chat
- Data
- Chats and messages, fan usernames, notes and tags, purchase and spending history, PPV offers and who on the team sent what.
- Why
- To show and send messages, build the fan panel and keep the team’s work in one place.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- OnlyFans or Fansly, when a message is sent.
Vault and PPV
- Data
- Information about media in the platform vault (IDs, names, previews, prices) and the history of what was sent to whom. Files you upload pass through our servers on their way to the platform.
- Why
- To organize content, send PPV and track what each fan already received.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- OnlyFans or Fansly, when content is uploaded or sent.
Team: chatters, roles and access
- Data
- Name or nickname, email address, role, permissions, assigned models, devices used to sign in and an activity log (sign-ins and actions in chats).
- Why
- To control who can see and do what, protect creator accounts and help the agency review its team’s work.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- Resend delivers invitations and sign-in codes.
Shifts, timesheet and payroll
- Data
- Shift schedules, time on shift, sales attributed to each chatter and payroll calculations.
- Why
- To run shifts and calculate pay.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- Only Leeward and our hosting providers.
Analytics and alerts
- Data
- Earnings, subscribers, message and sales statistics received from the platforms, and your alert settings.
- Why
- To show dashboards and warn you about drops, risks and unusual activity.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- Alerts can also be sent to Telegram if you turn that on.
AI administrator
- Data
- The question you type and the screen you ask it from. Before a request leaves our servers, names of models and staff, email addresses, @usernames and amounts are replaced with placeholders. Results are passed to the model only in anonymized form.
- Why
- To answer questions about your agency and perform the actions you ask for.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- AI model providers: Groq, with Anthropic as an alternative. They receive only the anonymized request.
Message translator
- Data
- The text of messages you choose to translate and the target language.
- Why
- To translate messages between you and fans.
- How long
- Translations are kept as part of the chat (see Leeward Chat).
- Who receives it
- A translation service: Google Translate, with DeepL as a backup. It receives the text only to translate it.
Telegram notifications
- Data
- If you connect Telegram: your Telegram chat ID and the text of the notifications (for example, new messages, sales and alerts).
- Why
- To send notifications to Telegram.
- How long
- The chat ID is kept while notifications are on. Telegram stores delivered messages under its own policies.
- Who receives it
- Telegram.
Billing and balance
- Data
- Account balance, invoices, payments per model, payment status, amount, currency and transaction reference. We do not receive card data or private wallet keys.
- Why
- To accept payment in cryptocurrency, pay for models from the balance and keep accounting records.
- How long
- As long as accounting rules require.
- Who receives it
- NOWPayments processes cryptocurrency payments.
Free trial
- Data
- Which models used a trial and when, together with the device identifier.
- Why
- To give each new model its 7-day trial and prevent repeated trials for the same model.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- Only Leeward and our hosting providers.
Referral program
- Data
- Your referral link, the agencies that signed up through it, their payments counted for rewards, your reward balance and payout details.
- Why
- To calculate and pay rewards and detect abuse.
- How long
- Reward and payout records: as long as accounting rules require. The rest: as above.
- Who receives it
- NOWPayments, when a payout is made in cryptocurrency.
Website leewardwork.com
- Data
- Visits are counted without cookies: for each visit we compute a one-way hash of IP address + user agent + the current day, so a visitor is counted once per day. We do not store IP addresses. Together with the hash we record the page address, referring site, campaign tags (UTM), clicks on links and buttons and scroll depth.
- Why
- To understand website traffic in aggregate and protect the site from bots and attacks.
- How long
- The hash cannot link a visitor across days and is used only for daily statistics.
- Who receives it
- Cloudflare (website delivery, DDoS protection, Turnstile bot checks), which processes technical data such as IP address and browser signals. Google Ads, only if you allow advertising cookies.
Support
- Data
- Your emails to us and our replies.
- Why
- To answer you and improve Leeward.
- How long
- While the agency account is active and up to 30 days after it is deleted.
- Who receives it
- Resend delivers our replies.
3. Legal bases
- Performance of our contract with the agency — running the app, connected accounts, Leeward Chat, vault, team, shifts, analytics, AI administrator, translator, notifications, billing and trials.
- Our legitimate interests — security, protecting creator accounts, preventing fraud and abuse of trials and the referral program, and aggregate website statistics.
- Legal obligations — accounting and answering lawful requests.
We do not sell personal data and do not share it for cross-context behavioral advertising. We do not make automated decisions that have legal or similarly significant effects on you.
4. The agency’s responsibilities
- The agency may connect only accounts of models who have agreed to the agency managing them through Leeward, and is responsible for having that consent.
- The agency must follow the rules of OnlyFans and Fansly and the laws that apply to it, including when its team chats with fans and sends content.
- The agency is responsible for informing its chatters, models and, where the law requires it, fans about how their data is processed in Leeward.
- Models, fans or chatters who want to exercise their rights over data held by an agency should contact that agency; we will help the agency respond. An agency that needs a data processing agreement can request one at [email protected].
5. Summary of recipients
- Cloudflare — website and API delivery, DDoS protection, Turnstile bot checks.
- NOWPayments — cryptocurrency payments and payouts.
- Resend — sign-in codes, invitations and service emails.
- Groq and, as an alternative, Anthropic — AI administrator, anonymized requests only.
- Google Translate and, as a backup, DeepL — message translation.
- Google Ads — on the website, only if you allow advertising cookies: which ads bring visitors (see the Cookie Policy).
- Telegram — notifications, only if you turn them on.
- OnlyFans and Fansly — when Leeward works with connected accounts on your behalf.
- Hosting providers that run our servers.
- Authorities, when required by law, and a successor if Leewardworks is reorganized or sold (this policy will continue to apply).
These providers may use the data only to provide their services and process it under their own terms and privacy policies.
6. International transfers
Our providers may process data outside your country. Where the law requires it, transfers are protected by appropriate safeguards, such as the standard contractual clauses offered by those providers.
7. Retention and deletion
Unless a different period is given in section 2, we keep data while the agency account is active and delete or anonymize it within 30 days after the account is deleted. Billing and reward records are kept as long as accounting rules require. Agencies can remove chatters and disconnect models in the app at any time and can ask us at [email protected] to delete related data sooner.
8. Security
Creator sessions are encrypted at rest, data is transferred over encrypted connections, staff can be limited to approved devices, and access to our servers is restricted. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as required by law.
9. Your rights
Depending on where you live, you may have the right to access your personal data and get a copy, correct it, delete it, restrict or object to its processing, receive it in a portable format, withdraw consent, and complain to your local data protection authority.
California residents have the right to know what personal information we collect, use and disclose, to delete and correct it, and to opt out of its sale or sharing. We do not sell or share personal information as defined by the CCPA, and we will not treat you differently for exercising your rights. You may use an authorized agent.
To exercise any right, write to [email protected] from the email address linked to your account, or explain how we can verify your request. We answer within the time required by applicable law (for example, one month under the GDPR and 45 days under the CCPA).
10. Age
Leeward is only for businesses and adults aged 18 or older. We do not knowingly collect personal data from anyone under 18 as a user of Leeward.
11. Third-party platforms
OnlyFans, Fansly, Telegram and other third-party services process data under their own privacy policies. We are not responsible for their practices.
12. Changes to this policy
We may update this policy. We will post the new version on this page with a new date and, for material changes, notify agency owners by email.
13. Contact
Leewardworks · [email protected]