Adult-industry operators don't need a "we take privacy seriously" graphic. They need to know exactly what's signed, what's logged, what's reported, what's protected, and what's never shared. Below is the actual position — what Wave69 does on confidentiality, data protection, age verification, 2257 record-keeping, payment processor relationships, and the legal frameworks our clients run inside.
Every project is covered by an NDA as standard. Not on request. Not on bigger projects only. Every engagement starts with a signed NDA before we receive any sensitive material — your URLs, your client data, your operational details.
Your name doesn’t appear in our portfolio without explicit written permission. When you see Luxury Sweets, BKK Escort Service, Yasmin of Kent, Minx Massage, or Noa Aliya credited in our work, every one of those clients has signed off on being shown. Most of our clients prefer to remain anonymous and we honour that without exception.
Internal team access is need-to-know. A specific account manager, a specific designer, a specific developer, a specific SEO. We don’t broadcast client details into all-hands meetings or shared knowledge bases.
No client data is used to pitch other clients. Your competitive intelligence stays inside your engagement. We don’t run “we worked on a similar agency in your city” pitches that turn out to be your data anonymised.
At end of engagement, we hand back and step away. Domain, files, hosting credentials, accounts, design source, content — all in your name from day one and remain yours. We retain only what we’re legally required to retain (invoicing records, broad project metadata) for the period required.
GDPR-compliant by default on every build. Cookie consent, privacy notice, data subject rights, processor agreements where we handle your customer data, lawful-basis documentation. We don’t ship a site that doesn’t meet UK and EU GDPR baselines.
Data minimisation in every form we build. We collect what you actually need to do the work and nothing extra. Form fields are scoped, retention periods documented, deletion paths built in.
Customer-data segregation across hosting and CRM. Where we set up your hosting we ensure customer data lives in environments with proper access controls. Where you operate a CRM with client data (escort screening, deposit information, repeat-client lists), the architecture is built so this stays on your side and never reaches ours by default.
Subprocessor transparency. When we use third-party tools (analytics, email, hosting, gateways), we disclose which ones in writing as part of every engagement. You can request changes if any of them don’t fit your jurisdiction.
Every Wave69-built site has age verification implemented at the infrastructure layer, not as a third-party plugin. That means:
For clients producing or hosting visual depictions of sexually explicit conduct (escort agency profile photography, fansite creator content, adult production), 2257 record-keeping is a US federal requirement. Where this applies to your operation:
If your operation is UK-only with no US distribution, 2257 doesn’t apply to you. We’ll tell you that on the discovery call rather than scoping unnecessary infrastructure.
We integrate adult-tolerant payment gateways into your build — CCBill, Paxum, Verotel, NETBilling, Epoch, Segpay, Stripe (where the use case is allowed). What this means in practice:
Wave69 is a trading name of Logicsofts Solutions Ltd, a private limited company incorporated in England and Wales on 16 May 2011.
All client engagements are entered into by Logicsofts Solutions Ltd under the Wave69 trading name. Every project is covered by a signed NDA and governed by our Terms & Conditions.
We don’t accept work that asks us to facilitate operations that are illegal in the client’s jurisdiction. Across the markets where we work — UK, USA, Australia, Europe, parts of Asia — the legal frameworks vary. The client is the publisher of their content and the operator of their business. We are the technology partner.
If your operation crosses jurisdictions (e.g. UK-based agency with US clients), we’ll help you build infrastructure that respects each jurisdiction’s requirements — or we’ll tell you the request isn’t something we can support.
If you need anything detailed about our position on a specific compliance area — DSA in the EU, the Online Safety Act in the UK, FOSTA-SESTA implications in the US, German JMStV requirements, or anything else — ask. We're not going to pretend complexity doesn't exist.
