This explains what personal data StivPik processes about you, why, for how long, and what you can demand.

Last updated: 7 September 2026

1. Data controller

MarketPalace ApS, company reg. no. 46641566, Møllevej 17, 2970 Hørsholm, Denmark, is the data controller. Write to support@stivpik.com with questions or to exercise your rights.

2. A note on sensitive data

An ad on StivPik says something about your sex life. That is a special category of personal data under Article 9 of the GDPR, and we process it solely on the basis of your explicit consent, which you give when you create the ad. You can withdraw that consent at any time by hiding or deleting your ad — then we stop showing it.

The same applies if you, as a visitor, follow, save or message an advertiser: such data can reveal something about your sex life, and it is therefore processed only because you choose to use those features.

3. What we process, and why

All visitors

  • Age confirmation — that you have confirmed being over 18. Basis: legal obligation and our legitimate interest in not showing adult content to children.
  • Reports — the reason, any link and your email if you give one. The email is deleted once the report has been handled. The decision itself is kept for five years without the reporter's identity. Basis: legal obligation (DSA arts. 16–17).
  • Technical logs — IP address, time and which page was requested. Used for operations, troubleshooting and stopping abuse. Basis: legitimate interest.
  • Approximate location — we look up your country from your IP address to show relevant content. If you share your precise location yourself, we store it rounded to about 100 metres in your own browser for 30 days. Basis: consent.

Accounts

  • Name or username, email and/or mobile number, password in hashed form, and when you were last active. Basis: performance of our agreement with you.
  • One-time login codes. Basis: agreement and security.

Advertisers

  • Safety timer — the time you expect to be back, an optional email address for someone you choose yourself, and your message to them. The row is deleted when you check in, and at the latest a day after the timer has run out. We store nothing about who you are with.
  • Your private blocklist — phone numbers are stored only as a fingerprint that matches your ad alone. Neither we nor other advertisers can read the numbers or see whom you have blocked.
  • Control signals — we cross-check data already in your ad and account (the same phone number on several ads, several advertiser accounts from the same connection on the same day, many photos in a short time, frequent city changes, third-person wording and photos resembling others') to detect ads run by someone other than the advertiser. A signal is never a decision: a person looks at it, and you may be asked to confirm that you run the ad yourself. Basis: legitimate interest in preventing exploitation.
  • The content of the ad: name, age, description, services, prices, location, availability, contact details and photos.
  • Proof of age and identity for verification. It is stored outside the web root, only we see it, it is used only to confirm you are who you say, and it is deleted automatically the moment the check is decided — whether the answer is yes or no. The decision itself is kept.
  • Statistics on views and clicks for your ad, so you can see how it performs.
  • If you opt in under Settings, we send an e-mail every Monday with the week's numbers for your own ad. You can turn it off in the same place.

Members

  • Who you follow, your favourites, your points and gifts, your reviews and posts, and your search agents.
  • Messages you send through the site. They are stored so the conversation can continue, and so we can handle a complaint about harassment.

4. Who receives the data

We do not sell data and do not use it for third-party marketing. We use these processors and recipients:

  • Simply.com — hosting and operation of server and database (EU).
  • Our mail provider — sending email with codes and notifications.
  • Push services — if you turn on notifications, your browser vendor (for example Mozilla, Google or Apple) passes the message to your device. The content is encrypted in transit.
  • OpenStreetMap — map tiles are fetched from their servers when you use the map view. They see your IP address.
  • DB-IP — the database used to look up country from an IP address. The lookup happens on our server, not theirs.
  • Authorities — where we are obliged to, or on suspicion of coercion, trafficking or minors.

5. How long we keep it

  • Account and ad — for as long as you have an account. If you delete the account, we immediately remove your messages, photos, favourites, follows, notifications and search agents, and the account itself is anonymised so name, email and phone number disappear.
  • Unconfirmed sign-ups — deleted automatically if never completed.
  • One-time codes — deleted shortly after use or expiry.
  • Control signals — login traces are deleted after 30 days, the ad's change history after 90 days, and handled signals after 12 months.
  • Moderation decisions — what we did, when and on what basis is kept for five years, also if you delete your account. It is our documentation that we react to misuse.
  • Accounting records — orders and payments are kept for five years after the end of the financial year, because Danish bookkeeping law requires it. This applies even if you delete your account.
  • Backups — data appears in backups for a limited period until the oldest copies are cleared.

6. Your rights

You have the right to access what we hold about you, to have incorrect data corrected, to have data erased, to have processing restricted, to object, and to receive your data in a common format. Write to support@stivpik.com and we will answer within a month.

If you are unhappy with how we handle your data, you can complain to the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.

7. Security

The site runs over an encrypted connection. Passwords are never stored in readable form. Access to data is limited to those who need it, and changes made from the admin area are logged. Photos are reviewed manually before they become visible.

8. Changes

If we change this policy, we update the date at the top. Significant changes are announced on the site.