Sex Worker Search

Amy is high profile and outspoken on topics she's passionate about. Based in New York.

Audrey Astor

An Au naturelle belle in London with a Fabulous derrière. Enthusiast of literature, dinner dates, pina coladas, and globetrotting adventures.

Cassandra Gray

A classic English rose based in London. Recent posts about a USA tour, 2024 bucket list and foodie inclinations.

Claude Love

The Thinking Man's Companion. A high class submissive based in London. Posts about How to be a good Dom, Master, or Sir, The psychology of sex and A Submissive's Guide to Bottoms.

Cara Greene

Modern-day courtesan & confidante in Manchester and London. Latest post is on FMTY vs. Booking a Companion on Tour: Pros and Cons.

Carrie Young

A professional submissive and escort based in London. A spankee & performer with pup & babygirl leanings. Check out her post on The Joys of Erotic Humiliation.

Darla Blake

Catholic School Girl turned Fallen Angel based in London. Her Come on Over post about the joys of cum on face is recommended reading.

Danny Gold

Holistic Pleasure Coach & Playmate, Psychedelic Healer and Kinky Gender-Fluid Vibe-Seeker based in New York. An unusual and eclectic blog from the perspective of a non binary escort.

Elizabeth of London

A refined stylish high class sensual BI-companion based in London. Check out her latest Torture Goddess post about teasing, edging and orgasm denial.

Elle Voss

Dirty thinker and martini drinker in London. The Birthday Party is a fun read. that's what I call a real party!

Gen West

Hellga, The Lady in Latex

Your charming & witty companion, A lover of sci-fi, history, old movies & slow moments. A hopeless romantic with a modern edge. Based in Australia. Only one blog post so far but I hope to see more. When 3 isn't a crowd.

The Fetish Force based in London. Lots of great kinky posts here and if you're ever looking for an hourly rental playspace in London, check out her BDSM Dungeons post.

Jayme

A passionate soul who loves to entertain both men and women. A veteran in the world of seduction and sensual entertainment. Based in Melbourne. Thoughtful blog posts.

Katie Love

Another Londoner. Katie's blog posts are direct and to the point.

Kellie Moore

Based in Cleveland. Kellie's post about Barriers To Entry: Why A Gentleman Will Screen is an interesting read.

Louisa Knight

On Aural Pleasure. No, that's not a typo. Based in London.

Madame Caramel

Based in London but touring everywhere. Madame Caramel is a global phenomenon.

Margot de Saint Phalle

Musings from a Vancouver escort.

Marisa Montague

Insatiable wanderer and international dream girl based in New York. That's an amazing image on her Miami post with the wave crashing over her. Wow.

Miss Kim Rub

Queen Bee, Strong leader, Real Matriarch. O.G. BDSM/Mistress Workshop teacher 13 years. Miss Kim is a wealth of knowledge about BDSM and a prolific blogger.

Miss Lilly Watson

Perky blonde dinner and travel partner dating in London, Paris and FMTY. City chic. Bit posh. Very dirty. Lilly is bright and eloquent. Great blog posts.

Miss Muffin

Wee Petite Independent Girlfriend Experience Escort in Zurich, Switzerland. Fetish, submissive, Kinky Escort and Luxury GFE. See what she's cooking up.

Mistress Ruby Enraylls

Lifestyle Femdom Mistress - Professional Dominatrix - Fetish & BDSM Expert in Settle. Infrequent but quality posts.

Oz Bigdownunder

My own personal blog. I'm based in London and touring internationally. Specialising in cuckolding, forced bi, couples and duos. My blog is an outlet for my creative juices and weird, nerdy, sense of humour. I put a lot of time and effort into my posts and it's a labour of love. I'm really proud of what I create there and hope you enjoy my writing.

Sandra

London's best massage and a very naughty girl. Sandra loves getting gangbanged and she'll tell you all about it.

Shae Ashbury

The dad bod inspector & kinky playmate. Manhattan and worldwide. joy, pleasure, and wild abandon sound like worthy pursuits to me. Read all about it.

Sienna

British. Lost siren of the sea and professional smooth operator. In DC. Her first time with a woman will leave you wanting more.

Silk Somatics

Helping people develop healthier relationships with intimacy and set boundaries in love, life and everything in between. Holistic SW Mentor in St Louis. Has a lot to say. Start with the self care post.

Stormi Sloane

Musings on VIP Escorts, Milking Massage in NYC.

Tanya VIP Companion

A luxurious world of elegance and sophistication in Zurich, Helsinki and London.

The Honest Courtesan

Frank commentary from a semi-retired call girl. 14 years worth of about 30 posts per year. All of them an unapologetic whore’s-eye view on the world with a special outrage reserved for bias, hypocrisy and discrimination. Especially at the hands of the United States justice system.

Vaughn Wolff

Seattle, WA. Ageless Vampire/30 Something Millennial. Brunch/Lunch/Dinner Date. Good eater/ Voracious Reader. Dog lover & Cat Curious.

The platforms sex workers use for advertising all have terms and conditions pages listing their privacy policies. I have taken a close interest in reading these policies since it seems that many directories give themselves permission to sell our personal details, and even our identity documents, to advertisers and to hand over our identities to the authorities without requiring a subpoena.

Escort directories have been hacked and raided before and will get hacked or raided again. Unfortunately, many directories take copies of our identity documents and selfies and just leave them lying around unencrypted.

Our identities have value in that they can be sold to spammers and used for leverage to make a deal with authorities. I don't see why escort directories need a full non redacted copy of our identity documents and an un-blurred selfie.

My recommendations

If they need to know your year of birth, fine, send them a copy of your ID with everything except the year of birth hidden.
If you're "face in" on your ads, why shouldn't you also be "face in" on your verification? Blur your face on your ID that you send in.
If they get hacked, do you want your identity stolen? Put a cross Through your ID saying "for X Directory verification purposes only." (replacing the "X" with the name of whichever directory you're verifying for.)

Example

I sent emails asking about privacy policies to Tryst.link, Eros, Megapersonals, Slixa, Listcrawler, P411, Eroticmonkey, Ourhome2, Humaniplex, Adultsearch, Theeroticreview, Leolist, Terb, Adultwork, Vivastreet, Eurogirlsescort, Scarletblue, Ivysociete, Escortsandbabes, Massagerepublic, Rentmen, Hunqz and Sleepyboy.

These are my findings.

Discovery

Here are the questions I asked:

Do you require personally identifying information from sex workers for verification?
Identity documents?
Selfies?
Can these be partially obscured or redacted?
Do you sell our identities and/or personal details to third party advertisers?
Do you take any steps to secure our identities from hackers or in case your servers were seized?
Are our identity documents and selfies deleted after verification?
Stored offline?
Encrypted?
If you were told you could protect yourself from prosecution by freely handing over the identities of sex workers to authorities, would you do so?
Or would you put up a fight and demand that they get a subpoena?
Do you honour deletion requests?
In entirety?
How long does this take?

I sent the emails on September 2nd 2024. Only P411, Hunqz and Rentmen have replied. Tryst said they will respond to my questions in a few weeks time. (They have responded and it is included below.)

Table of platforms and known privacy standards

Note: The data displayed here is based on either responses (if received from my request) or determined by the Terms & Conditions and Privacy Policies found on those sites.

Scroll down to the "Details and Responses" section to see responses along with links to their site policies and questions or concerns I have about them.

Platform	Accepts partially obscured or redacted identity documents	Refrains from selling personal details to third parties	Encryption used to secure our identities	Identity documents and selfies are deleted after verification	Withholds identities from authorities unless subpoena provided	Honours deletion requests partially	Deletion requests honoured entirely	Processing time for deletion requests
Tryst	No	Yes	Yes	Yes	Yes	Yes	Yes	Instant
Eros	No	No	No	No	No	No	No	18 months?
Megapersonals	No	No	No	No	No	No	No	No
Slixa	No	No	Yes	No	No	No	No	No
Listcrawler	No	No	No	No	No	No	No	No
P411	No	Yes	Yes	No	Yes	Yes	No	No
Eroticmonkey	No	Yes	Yes	No	No	No	No	No
Ourhome2	No	No	No	No	No	No	No	No
Humaniplex	No	Yes	No	No	No	No	No	No
Adultsearch	No	No	No	No	No	No	No	No
Theeroticreview	No	Yes	Yes	No	No	No	No	No
Leolist	No	No	No	No	No	Yes	No	No
Terb	No	No	Yes	No	No	Yes	No	No
Adultwork	No	No	No	No	No	No	No	No
Vivastreet	No	No	No	No	No	No	No	No
Eurogirlsescort	No	Yes	Yes	No	Yes	No	No	No
Scarletblue	No	No	Yes	No	No	No	No	No
Ivysociete	Yes	No	No	No	No	Yes	Yes	30 days
Escortsandbabes	No	No	No	No	No	No	No	No
Massagerepublic	No	No	No	No	No	No	No	No
Rentmen	Yes	Yes	Yes	No	Yes	Yes	No	7 days
Hunqz	No	Yes	Yes	Yes	Yes	Yes	Yes	1 day
Sleepyboy	No	No	No	No	No	No	No	No

Operating Locations

Where a platform is located can impact the laws and policies of a company.

Eroticmonkey, Ourhome2, Humaniplex only operate in USA.

The USA approach to privacy laws is more fragmented and industry specific than the GDPR in Europe but they do have the Federal Trade Commission (FTC) Act.

The FTC enforces rules related to consumer protection, including privacy and data security practices. Under the FTC Act, the agency can take action against companies engaging in unfair or deceptive practices concerning the handling of personal data.

Several other states besides California, like Virginia, Colorado, and Connecticut, have introduced comprehensive privacy laws similar to the GDPR. These laws grant consumers certain rights over their data and place obligations on businesses handling personal data.

Leolist and Terb are exclusive to Canada.

Privacy laws in Canada come under the Personal Information Protection and Electronic Documents Act (PIPEDA).

PIPEDA is the federal law that governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activities across Canada. Key provisions include:

Consent: Organizations must obtain meaningful consent to collect, use, or disclose personal information.
Data Access and Correction: Individuals have the right to access their personal data and request corrections if necessary.
Reasonable Use: Organizations can only collect information necessary for the purpose they have outlined, and they must handle that data responsibly.
Safeguards: Organizations must protect personal information through appropriate security measures.

Scarletblue, Ivysociete, Escortsandbabes list sex workers based in Australia.

Australia's primary federal privacy law is The Privacy Act 1988. It regulates how personal information is handled by government agencies, organizations with an annual turnover of more than AUD 3 million, and some smaller organizations. Key elements include:

Australian Privacy Principles (APPs): The act is based on 13 Australian Privacy Principles, which outline the standards, rights, and obligations related to the collection, use, disclosure, and storage of personal information. The APPs cover areas such as:

Open and transparent management of personal information
Anonymity and pseudonymity
Collection of solicited personal information
Use and disclosure of personal information
Data security and access rights to personal information
Consent: Organizations must generally obtain consent to collect, use, or disclose personal information, unless exceptions apply (e.g., for law enforcement purposes).

The remaining directories all operate in Europe.

Tryst.link, Eros, Megapersonals, Slixa, Listcrawler, P411, Adultsearch, Theeroticreview, Adultwork, Vivastreet, Eurogirlsescort, Massagerepublic, Rentmen, Hunqz and Sleepyboy all list advertiser profiles based in Europe so they are all required by law to comply with GDPR.

The General Data Protection Regulation (GDPR) is a European Union law that sets guidelines for the collection, processing, and storage of personal data of individuals within the EU. It aims to enhance individuals' control over their personal information and imposes strict penalties on organizations that fail to comply.

Details and Responses

Tryst.link

Tryst's Privacy Policy and Tryst's Terms.

Tryst.link has replied to my email:

Do you require personally identifying information from sex workers for verification?

Identity documents?

Yes, a form of government issued ID is required to advertise on Tryst. This became a requirement as a result of changes made by Payment Processors in 2021.

Selfies?

To sign-up for Tryst, we require two different selfies which is processed internally by our verification team:

A selfie where you’re holding up your identification. This helps us to make a match your face to your ID. These photos (and any additional photos of ID) are automatically deleted as soon as possible, for example within 24 hours after approval.

A selfie where you’re holding a handwritten sign. This photo is stored until your account is deleted.

Both selfies are processed at the same time, ensuring that the person in the first selfie is the same as in the second. The selfie with the sign is kept for the life of the account to help match future photo uploads and assist in verifying your identity if you lose access to your account.

Can these be partially obscured or redacted?

We can’t accept redacted identification documents as a result of the requirements set out by Payment Processors terms of service for adult sites.

You can read more about these changes and the impact financial discrimination has had on the sex working community via the #AcceptanceMatters campaign and the Free Speech Coalition’s: financial discrimination report. You can also find out more about our verification process in our Age verification on Tryst.link knowledge base article.

https://help.tryst.link/en-gb/14/142

Do you sell our identities to third party advertisers?

No, we do not and will not ever sell any data to third-parties.

Do you take any steps to secure our identities from hackers or in case your servers were seized?

Tryst is a collective of current and former sex workers and technologists, we know how damaging a data breach is to the community and to our reputation. We take the security of our platform seriously, and commit to notifying our users if there was ever a data breach.
We tightly control who has access to your information. We think it's important that your sensitive information is only viewed when it needs to be, and only by the person who needs to see it.
We use multiple layers of encryption when accessing and storing your information, where each layer adds additional protection to the one inside it. These layers include encryption of your data, held on encrypted servers, accessible only via encrypted connections and authenticating with multiple factors. We also log all access and have auditing processes that monitor access to this information.
We specifically chose to host your sensitive data only on servers in the EU due to the higher level of protections provided through the privacy and international human rights laws that apply there.
While technological protections are important, they're not a complete solution. We also have strong internal policies and processes that minimise how much of your personal information our team members see. This includes deleting your data as soon as we can, once we are in compliance with the requirements we needed it for. We audit the access logs regularly and make sure that there are no unapproved actions.

Are our identity documents and selfies deleted after verification?

As soon as we can, answered in more detail in the answer to the ‘selfies’ question.

If you were told you could protect yourself from prosecution by freely handing over the identities of sex workers to authorities, would you do so?

From our reading, we take this question as “Would we hand over all of our users data if it meant we’d walk away from prosecution” the answer is no, we have not, do not, and would not.

Or would you put up a fight and demand that they get a subpoena?

As a standard, all websites should require a valid and verifiable subpoena for data requests to ensure its upholding basic legal standards, and most importantly the human rights and privacy of its users.

All data requests must be accompanied by a valid and verifiable subpoena. The subpoena must be issued by a recognised authority and comply with all the relevant legal standards. We will thoroughly verify all legal requests for its authenticity and scope before considering the release of any data, and will only disclose information when legally obligated to do so.

Do you honour deletion requests?

Yes. We try to minimise the data we store on active users, as well as deleting inactive accounts, which you can read more about here. https://help.tryst.link/en-gb/23-profile/174-what-happens-if-i-stop-using-my-account

https://help.tryst.link/en-gb/14/142

In entirety?

For all profile information, including photos, yes. With the caveat that we are required by law (as disclosed in our Terms) to maintain financial records.

How long does this take?

This depends on how the deletion request is initiated, you can delete your account at will (https://help.tryst.link/en-gb/14-faq/142-how-do-i-delete-my-tryst-account) or you can raise a support request (https://app.tryst.link/support/new) with our team who can assist if you’ve lost access to your account, but this will take some additional time as our team will need to verify you to complete your request.

For inactive accounts, see this article on our knowledge base that outlines when we consider your account to be inactive, how long you have to reactivate it, and when each step in the process to deletion happens (https://help.tryst.link/en-gb/23-profile/174-what-happens-if-i-stop-using-my-account).

I also asked Tryst.link some follow up questions.

Tryst.link Privacy Terms state =

"We may disclose personal information to: third party service providers for the purpose of enabling them to provide their services, including (…) marketing or advertising providers, (…) (and to) courts, tribunals, regulatory authorities and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights; "

Why does it say you disclose personal information to advertising providers? and to defend our (tryst's) legal rights without mention of requiring a subpoena?

“Why does it say you disclose personal information to advertising providers?”

This is considered a standard clause because of how the internet works, but when we say “We may disclose personal information to third party services for the purpose of enabling them to provide their services” this means we may share some of your information with other services who are acting on our behalf to run the platform - it doesn’t mean we are selling your data.

For example, let’s consider analytics, we pay a third-party company to license their software to process that we host to process this data internally. In the event we require support from this company, we would be obliged to give them access to our system in order for them to provide us that support, which in turn, may result in the disclosure of information but access to our system and data is covered by confidentiality and licensing agreements.

“and to defend our (tryst's) legal rights without mention of requiring a subpoena?”
There are two parts to this question, both are fairly standard clauses:

We have used broad language in this clause such as “as required by law, legal proceedings, regulatory and law enforcement authorities” to ensure that we cover the different type of legal obligations, including subpoenas and their local variants.

To reiterate, we will thoroughly verify all legal requests for its authenticity and scope before considering the release of any data, and will only disclose information when legally obligated to do so.

When a policy states “In order to establish, exercise or defend our legal rights” it means that if a user of the platform makes a legal claim or accusation of wrong doing against the platform, the platform may be required to use or share information about the user to legal representation or the courts to defend against the claim.

Also Tryst.link terms says "Upon termination of your account, in accordance with our Privacy Policy, the platform will remove your profile and photos but we will keep data required for business operations such as but not limited to; verification information, payment information, support conversations, and audit history."

Does that apply if someone deletes their own account? The verification information you keep according to that quote doesn't include the selfies and pics of identity documents since you said those are deleted within 24 hours of approval?

"Upon termination of your account, in accordance with our Privacy Policy, the platform will remove your profile and photos but we will keep data required for business operations such as but not limited to; verification information, payment information, support conversations, and audit history."

There are two parts to this question, the audit history and the verification information:

Audit history is referring to the actions taken by a team member (such as the outcome of a photo review) but when an account is deleted, the associated user data (any identifying information and the actual photo) is removed, but the audit record is kept to state that this team member performed an action on our platform.

This clause is worded this way to cover instances that fall outside of the platform, specifically our support system. This system falls into its own data retention schedule which is separate from the platform, and depending on the classification of the ticket it will determine how long it’s stored for, such as if it’s business critical that has regulatory requirements, or non-business critical tickets such as account deletion where a user has lost account access and must be verified to action.

To add to that, support tickets that are deleted will include a record that it was deleted, the time it was deleted, the ticket number, and an anonymised user for record integrity.

Eros

I didn't get a reply from Eros. Their data processor, based in Switzerland, with this email address: [email protected] ignored my email.

Of all the escort directories, Eros has by far the worst track record regarding privacy and data security.

They've been raided before by Homeland Security , had servers full of unencrypted sex worker identities seized and it's rumoured they continue to operate due to some kind of deal involving continuing to hand over the identities of sex workers.

Their privacy policy makes no mention of allowing people to obscure any part of their identity documents or selfies used for verification.

They do sell our personal data to advertisers. Their terms say:

"We may use your personal information or share your personal information with third parties to: (...) Serve marketing or advertising materials to you; and Provide any other good or service to you with your consent."

They also give themselves permission to hand over our identities to the authorities.

"We may disclose your personal information to third parties, without notice if, in our sole discretion, we believe that it is reasonable to do so to: (...) Protect ourselves."

Their terms are clear about retaining personal information.

"We reserve the right to retain publicly available information and de-identified information for any legitimate business purpose without further notice to you or your consent."

Their terms say they will delete personal data on request.

"Right of erasure/deletion/omission ("right to be forgotten"): You have the right to request that personal data relating to you be deleted immediately and the personal data must be deleted immediately if one of the reasons listed in the Swiss or European legislation applies, for example that the data are no longer necessary for the purpose for which they were collected."

But I have screenshots of emails to prove that when this is requested, they refuse and tell people to just log out and leave their accounts inactive for 18 months and then their data will be deleted automatically. I have screenshots of follow up emails from after the 18 months to show that even this did not happen.

Megapersonals

Megapersonals' Privacy Policy says:

"authorized agents may require you to provide additional information as necessary to verify the accuracy of your identity and your information."

Doesn't say whether identity documents and/or selfies are required in all cases or whether these can be partially anonymised.

They do sell personal details to advertisers.

"To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you."

They make no mention of any measures taken to secure our identities or personal details. They do say regarding if they get hacked...

"...we shall not be liable for any recording or release of private information, personal data, or your Posts, and you hereby release us from all liability and claims associated therewith."

The paragraph "We will fully cooperate with law enforcement authorities or orders from courts of competent jurisdiction which request or direct us to disclose the identity or location of any user in breach of these Terms of Use, in accordance with our privacy policies, law enforcement policies, and applicable law or regulation." implies they don't care about subpoenas or court orders and will identify us to any and all authorities who ask.

Regarding deletions:

"Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request."

So they might delete your personal data. Partially. Maybe.

Slixa

Slixa Advertiser Agreement "requires that all advertiser accounts are subject to age verification. Advertisers must supply a true and accurate color copy of a current, valid, government issued ID via the website’s secure verification page."

Doesn't say if the ID can be partially redacted or if it's deleted after verification.

Slixa's Privacy Policy says Slixa does use our personal details to "tailor marketing". Does this mean they sell our identities to advertisers?

A big win for Slixa with their data security statement:

"We use all reasonable measures to protect Your personally identifying information that is stored within our database (including data encryption, SSL, strong password requirements and firewalls), and we restrict access to member information to those employees who need access to perform their job functions, such as our customer service personnel and technical staff."

That's what we like to hear.

Slixa will share our identities with third parties

"6.1.1 To comply with any laws including, but not limited to, the Electronic Communications Privacy Act or any other legal or governmental requests for information;

6.1.2 If disclosure is necessary to identify, contact, or to bring legal action against a person who may be in violation of Slixa Terms and Conditions;

6.1.3 As is reasonably necessary to operate the Website;

6.1.4 To protect Slixa, its Users, its Advertisers, and the general public. Slixa will only disclose a User’s information when it is compelled and /or required to do so by law (for example, in response to a court order or subpoena). Where permitted by law, Slixa will not disclose any information pertaining to any User without first presenting the User with an opportunity to object to said disclosure."

If it was just 6.1.4, that would be perfect.

Doesn't seem to say anything about deletion requests.

Listcrawler

Listcvrawler's Privacy Policy says they'll give our identities to anyone who asks for pretty much any reason:

"We may disclose IP addresses, and/or associated email address, telephone numbers, or other information about, if (i) required to do so by law, court order or subpoena, or as requested by other government, law enforcement, or investigative authority, (ii) we in good faith believe that such disclosure is necessary or advisable, including without limitation to protect the rights or properties of the Site, (iii) we have reason to believe that disclosing your personal information is necessary to identify, contact or bring legal action against someone who may be causing interference with our rights or properties, or has breached an agreement, or if anyone else could be harmed by such activities or interference, (iv) if we determine an ad posted violates our Terms of Use or the rights of a third party, or (v) there is an emergency involving personal danger. We may also share information if we believe it is necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or as otherwise required or permitted by law."

Doesn't say anything about data security, selling personal details to advertisers or deletion requests.

P411

P411 replied to my email.

"Thanks for taking the time to write.

The only time we would release that information is if a Spanish court (we are in Spain and abide by Spanish law only) issued a subpoena specifically asking for that information. Of course, we would have our legal counsel review the subpoena first before doing anything. To this date, we have never been subpoenaed for any information.

We retain age documentation images to match account holders to other accounts. This is particularly important when it comes to accounts that have suspended or revoked for negative behavior. However, it's much less important when an account has never shown us any indication there are any issues, and those identification images would be deleted by request."

P411's Privacy Policy says:

"COMPANIONS: When you sign up for a companion account, Preferred411 collects some personal information for verification purposes, including and not limited to: full name, e-mail address, telephone number, website url, etc. Preferred411 also requires images of you and your government identification to prove that you are over the age of 21. These images are kept as encrypted data to ensure that companion accounts are not shared with anyone other than the account holder. We also require a username, email address and security questions."

Regarding Deletion of Information

"Other than your P411 Id, all information found on your profile is wholly within your control and can be updated at your convenience. You can view what other members see about you, by clicking Companion View (admirers) or clicking on your thumbnail (companions). If you would like your information to be completely deleted from our servers, provide us with a detailed written request. This will result in your account and information being permanently removed from Preferred411 and the complete loss of use of member areas of the site. In limited cases, where we suspect unfavorable, fraudulent or criminal activity is taking place, as well as any activity that violates our Terms & Conditions, your information will not be deleted for the protection of Preferred411 and/or its members."

Their data security policy:

"The entire Preferred411 site is secured by using 128 bit SSL technology. Every effort is made to ensure the security of our servers and the data we retain. However, we are unable to make any guarantees that our measures will prevent an illegal hacking, which could result in the data on our servers being compromised. You assume this risk by voluntarily providing your information to Preferred411, with the understanding that such hacking incidents can occur despite reasonable security measures being in place."

Eroticmonkey

Eroticmonkey's Privacy Policy doesn't say whether they require ID or selfies or what they do with these.

They talk about personally identifying information (PII) in their terms and say

"We will never sell, rent, or loan your PII without your express written consent. We sometimes use third parties to help with some of the services available through the Site, such as third party software and service vendors, partners and consultants. When we supply PII to these third parties, we require them to use it only for the function they are helping us with. (...) We will disclose PII as required by law, or if in our judgment it is necessary to protect our company or our users from loss or liability."

So they won't sell PII to advertisers but will give PII freely to authorities without requiring a subpoena to protect themselves.

No mention of deletions.

Re data security

"We keep PII you provide on servers that are protected by industry-standard firewalls and other technological means against intrusion or unauthorized access. They are located in a physically secure facility, and only our employees and agents with a need to know the information are given access. While no amount of security can give a perfect guarantee, you can have a high degree of confidence that the personally identifiable information you give us is protected from unauthorized access and use."

Ourhome2

Doesn't have a Privacy Policy.

All they say on the subject is:

"Only anonymized registrations are allowed; as far as GDPR/CCPA goes, OH2 follows the protocol outlined below: Anonymous information, as information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable'. The GDPR/CCPA do not apply to anonymized information."

This is not very helpful eg if you're a sex worker who wants their personal details deleted from their site.

Humaniplex

Humaniplex's Privacy Policy doesn't say whether they require sex workers to send identity documents and/or selfies for verification.

They do say loud and clear:

"Your Information Is NEVER Used for Marketing, Promotion, or Advertising by Third Parties! - We do not sell or lease personal information. Many websites, specifically socials networks such as this one, choose to sell their users' personal information to third parties so that those third parties can advertise to you. Worse yet, many sites profile your browsing habits to try to generate a picture on the things you might buy and then sell that information to third parties. That is not the case here, and never will be."

This is the best statement I've seen on the topic on any of the escort directories. All the directories should have words to this effect in their privacy policies.

Sadly their statement regarding legal requests is a failure.

"If we have a good faith belief that the response is required by law, we may disclose information pursuant to subpoenas, court orders, or other requests (including criminal and civil matters). This may include honoring requests from jurisdictions outside of the United States where we have a good faith belief that the response is required by law under the local laws in that jurisdiction, apply to users from that jurisdiction, and are consistent with generally accepted international standards. We may also share information when we have a good faith belief it is necessary to prevent fraud or other illegal activity, to prevent imminent bodily harm, or to protect ourselves and you from people violating our Terms of Service. This may include sharing information with lawyers, courts or other government entities."

There's no need for this. Just say "We won't give your personal details to any law enforcement, legal or government entity unless we receive a subpoena from a court of law."

They don't say anything about deletions.

Adultsearch

Adultsearch's Privacy Policy uses almost the exact same phrase as Eros re:

"We may disclose your personal information to third parties, without notice if, in our sole discretion, we believe that it is reasonable to do so to: (...) Protect ourselves."

The full quote on Adultsearch says:

"we may disclose passively-collected information about Users, (...) for any reason without notice if, in our sole discretion, we believe that it is reasonable to do so, including, but not limited to: To satisfy any laws, such as the Electronic Communications Privacy Act, regulations, or governmental, or legal requests for such information; To disclose information that is necessary to identify, contact, or bring legal action against someone who may be violating our Terms of Use and other policies and procedures; To operate our Services properly; To protect ourselves, our Users, and the general public. We specifically reserve the right to disclose any and all information to law enforcement in the event that a crime including, but not limited to, fraud-related offenses is committed, is suspected, or if we are compelled to do so by lawful criminal, civil, or administrative process, discovery requests, subpoenas, court orders, writs, or reasonable request of authorities or persons with the reasonable power to obtain such process;"

I don't like that bit about "reasonable request". It's far too ill-defined and open to interpretation. If you require a subpoena, just say you require a subpoena.

In the next paragraph they say:

"We do not intend to cooperate with private-party litigants and others seeking information unless compelled to do so through lawful court or administrative process, such as subpoenas, court orders, or writs."

So why do they need to they need to give themselves permission to give our identities to whomever, to protect their own interests, without requiring a subpoena via that "reasonable requests"?

Theeroticreview

TER is primarily a review site aimed at getting clients to register and write reviews about sex workers.

It is possible to register as a provider but I couldn't find anything in their terms saying whether ID or selfies are required, whether they can be partially redacted or whether they're deleted after verification.

TER's Privacy Policy says:

"we will keep your Personal Information private and will not share it with third parties, unless such disclosure is necessary to: (a) comply with a court order or other legal process; (b) satisfy our legal obligations to cooperate with law enforcement or other investigating agencies; (c) satisfy any laws or regulations, or, governmental or legal requests for such information; (d) protect our rights or property, or the rights or property of others; or (d) enforce our Terms of Use Agreement."

Their data security policy says:

"We take measures, including data encryption, to protect the transmission of all sensitive user information. We make every reasonable effort to help ensure the integrity and security of our network and systems, and use commercially reasonable safeguards to preserve the integrity and security of your Personal Information. Nevertheless, we cannot guarantee that our security measures will prevent third-parties from illegally “hacking” into our computers and obtaining this information. You assume the risk of such breaches to the extent that they occur despite our reasonable security measures."

They don't say anything about deletions.

Leolist

Leolist's Privacy Policy says they will sell your personal information to advertisers.

"We may use your Data to show you LeoList adverts and other content on other websites. If you do not want us to use your Data to show you LeoList adverts and other content on other websites, please turn off the relevant cookies (please refer to the section headed “Cookies” below). (...) any of our group companies or affiliates - for the purpose of marketing where relevant;"

They say they will hand our data to:

" relevant authorities, such as law enforcement - to facilitate the detection, prevention, or investigation of a crime or offence, or in connection with other lawful requests for your Data;"

They do not say what they consider to constitute a lawful request.

They won't fully delete personal details on request.

"we will only hold your Data on our systems for the period necessary to fulfil the purposes outlined in this privacy policy or until you request that the Data be deleted. 19. Even if we delete your Data, it may persist on backup or archival media for legal, tax or regulatory purposes."

No mention of encryption or any other steps taken for data security.

Terb

Doesn't have a contact email on their site. I filled out the contact form but they haven't replied.

It does say they'll honour deletion requests. (you) "have the right to request the erasure of your personal data. Please contact us if you would like us to remove your personal data."

Re data security "We are committed to ensuring that any information you provide to us is secure. In order to prevent unauthorized access or disclosure, we have put in place suitable measures and procedures to safeguard and secure the information that we collect."

That doesn't really tell us anything about their data security.

Doesn't say anything about not selling info to spammers or giving identities to authorities.

Adultwork

Does require identity documents and does not accept anything partially redacted.

They also have quite invasive and weirdly old fashioned verification requirements eg making sex workers get their picture taken next to a phonebox while holding up a copy of that days newspaper.

Their Privacy Policy says they will sell your identity to advertisers "To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you".

Regarding data security they say "We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business 'need to know'. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so."

They do say you have the "Right to Erasure. Every individual has the right to be forgotten upon request. The Data Controller must remove your Personal Data from its systems and request the same of any third-party systems of that controller." under GDPR.

But "In the event of a law enforcement request involving your account or the data we hold about you on file. We are obliged by law to comply with the request and retain the data until the case has been closed by Law enforcement. Data may be held beyond the deletion request for the basis of complying with law enforcement."

I've heard from multiple UK based sex workers that they are entirely face in and have only ever shown their face in one place = Adultwork verification selfies and identity documents sent to AW, and yet they have been denied entry to USA due to facial recognition detecting a connection to sex work. ie Adultwork has given at least some, possibly all, of the selfies and ID they hold to USA border control.

Vivastreet

I sent them a message on twitter where I've spoken to Viva before. They read the message. It's marked as "seen". They haven't replied.

Does require "ID Verification for the purpose of registering as a Registered Escort on the Site".

No mention of partially redacted ID.

Vivastreet's Privacy Policy says they will hand over our identities "Where we need to comply with a legal or regulatory obligation. Where we consider it to be in the interests of our Users (Registered Escorts or otherwise) or in the public interest, we may provide Personal Data to law enforcement to assist them with an investigation. If we believe that you are a victim, we may provide your Personal Data without obtaining your prior consent for your protection."

They say "To undertake an Identity Verification Check, you will be asked to upload a ‘selfie’ photograph of yourself and a supporting identity document. These will then be verified by third-party technology"

Doesn't say who the third party is, which country they're in or which data protection laws they are subject to.

"We may also disclose your Personal and Biometric Data if required to do so by law, or if we believe that disclosure is necessary to comply with any applicable law, or to defend our own rights or property, or to safeguard you or others. This may involve discussing the information we hold with law enforcement agencies if we believe or suspect that you are using the Site to engage in criminal and/or illegal activity. Law Enforcement may also choose to disclose this information further to other security services to comply with any applicable law or if they believe doing so will safeguard others."

The "defend our own rights" line could mean they'll give our identities to anyone who asks if they think it is good leverage to protect themselves from prosecution.

Doesn't mention encryption.

You can request data erasure but they might not honour that request.

"Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. "

They will sell your identity to advertisers, possibly even if you specifically ask them not to.

"You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms."

Eurogirlsescort

Eurogirlescort's Privacy Policy says verification using ID and selfies is optional.

"We as the administrator do verify profiles. These profiles have VERIFIED status (in blue). Each girl who advertise on our site has "verification" option in the account. We require verification pictures or face + ID picture as proof that profile is real. If the girl sends required verification pictures we give "verified" status."

Unless you look underage.

"Our company will manually review each post and pictures before it goes LIVE online. If we determine that age of the model/escort is in question, we may ask for ID and age verification and we reserve the right to refuse to post"

This is good to see "We do not collect personal information to trade, sell or give away in any way. (...) Any and all the information collected on this website will be kept strictly confidential and will not be sold, reused, rented, disclosed, or loaned! We respect the right of users to remain anonymous and will endeavour not to knowingly disclose user identities unless directed by a court of law."

Also good = " several layers of encryption and several layers of security to prevent unauthorised access protect all of the sensitive customer data we collect."

No mention of deletion requests.

Scarletblue

Scarletblue's Privacy Policy

says they do collect "results of any identity checks or verifications".

Nothing about partially redacted ID or selfies.

"We do not ask for or collect your identity documents, such as your drivers licence, passport, or any other identity documents, or verify your identity. A third-party service provider may complete identity checks on our behalf from time to time when you provide your identity documents to the service provider through their function on our website. This function is not linked with us, and we do not have access to any information that is entered into the function. The third-party service provider will handle your personal information in accordance with its privacy policy."

Doesn't say who the third party is, where, or what legal requirements they are subject to. When this policy was announced, the announcement went over like a lead balloon on sex work twitter and reddit.

They sell our personal information to advertisers and will give our identities to authorities.

"We may disclose your personal information to the following third parties: (a) our business or commercial partners; (b) our professional advisers, dealers and agents; (c) third parties and contractors who provide services to us, including customer enquiries and support services, IT service providers, data storage, webhosting and server providers, marketing and advertising organisations, payment processing service providers; (d) payment system operators and debt-recovery functions; (e) third parties to collect and process data, such as Google Analytics, Google Display Network, DoubleClick, Yahoo, Adobe, Campaign Manager, and Microsoft; and (f) any third parties authorised by you to receive information held by us. If you are a contractor, we may disclose your information to payment system operators and debt-recovery functions. We may also disclose your personal information if we are required, authorised or permitted by law. We may send information to third parties that are located outside of Australia for the purposes of providing our services. These third parties are located in Cyprus, although this list may change from time to time. Disclosure is made to the extent that it is necessary to perform our functions or activities."

Again with the unnamed third parties =

"We take all reasonable steps to protect personal information under our control from misuse, interference and loss and from unauthorised access, modification or disclosure. We hold your personal information electronically in secure databases operated by our third-party service providers. We protect the personal information we hold through using secure ‘bcrypt’ hashing when storing user passwords, not storing any credit card information in the Scarlet Blue databases, using secure hosting providers, storing data in secured internal databases, firewalls and login password protocols and secure and access-controlled premises."

No mention of right to erasure.

Ivysociete

Ivysociete's Privacy Policy

Ivysociete posted on reddit asking for feedback about their site. Here is our conversation =

Oz>

I'd like to ask about your commitment to privacy if I may.

Your terms and conditions page says you require identity documents and face pictures for verification and then your privacy policy says =

We may disclose personal information to:

a parent, subsidiary, or affiliate of our company
third party service providers for the purpose of enabling them to provide their services, for example, IT service providers, data storage, hosting and server providers, advertisers, or analytics platforms
our employees, contractors, and/or related entities
our existing or potential agents or business partners
sponsors or promoters of any competition, sweepstakes, or promotion we run
courts, tribunals, regulatory authorities, and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise, or defend our legal rights
third parties, including agents or sub-contractors, who assist us in providing information, products, services, or direct marketing to you third parties to collect and process data

My one regret as a sex worker is that I signed up for various directories and gave them my selfies and identity documents. Directories have been hacked and raided before and it will happen again. I wish I'd just built my own personal website on day one and promoted it via writing on my blog regularly for SEO, getting backlinks, co-promoting with other providers, social media etc.

I wish I'd never registered on any directories and I would love to see a future where more sex workers keep their identities safe and secure by not using directories and clients find our personal websites on search engines instead of using directories.

If a genie would grant me 3 wishes, I'd decriminalise all sex work everywhere on the planet such that it would be illegal to treat a sex worker differently to any other sole trader business, wipe all the selfies and identity documents every sex worker has ever sent to a directory off the internet, and give every sex worker their own personal website.

My question is, is all that disclosing of our personal information really necessary? Could you not just do your verification and then delete the identity documents and selfies without a trace? If you must keep them eg to protect yourself in case you get accused of advertising minors, could you not put them on a secure, encrypted hard drive, offline, somewhere secure and write into your terms that you'll never share the contents of that drive with anyone unless a court of law forces you to?

IS>

Thank you for your feedback. Please note that all advertisers on ivysociete.com are required to submit a verification image to ensure the legitimacy of profiles. However, advertisers have the option to blur their face in the image. The only requirements for this verification are to wear the same outfit, take a full-body photo, hold a sign, and raise three fingers on the other hand. As a "face-in" escort myself, who prefers not to show my face in photos, I completely understand the importance of maintaining privacy.

Regarding ID verification, it's optional for clients and not mandatory. It's simply another way to verify themselves if they feel more comfortable with it.

As for the terms and conditions, we don't share private images with a third party. Including a clause about sharing information with third parties is a common practice in terms and conditions.

Oz>

Thank you for replying.

So ID verification is optional for clients but is it mandatory for sex workers?

I would have thought mandatory otherwise there's nothing preventing minors from being pimped out on your site?

If you're not going to share private images or identity documents with third parties, why not say that in your terms and conditions?

Sorry to be difficult about this but I think this is a big problem in our industry. Our identities have value to advertisers and to the authorities. I just don't believe many, if any, of the platforms we use are trustworthy, or competent, enough to be entrusted with our identities.

The way your terms are worded sounds like you reserve the right to hand over our identities to anyone and everyone who offers to pay you or threatens to indict you, or offers you some kind of legal deal or immunity in exchange.

IS didn't reply. I tried messaging them as a reply to their tweet about the redesign but they deleted my tweet reply.

Escortsandbabes

Escortsandbabes's Privacy Policy doesn't say whether they require identity documents or selfies or if so, how these are handled.

"Unless you object, your personal information may be used to: (...) assist us with our marketing"

Sounds like they do sell personal info to advertisers.

"we may disclose personal information in special situations where we have reason to believe that doing so is necessary to identify, contact or bring legal action against anyone damaging, injuring or interfering (intentionally or unintentionally) with our rights or property, users or anyone else who could be harmed by such activities."

and they'll disclose to authorities. No mention of requiring a subpoena.

No mention of encryption.

Doesn't say they honour deletion requests.

Massagerepublic

Massagerepublic's Privacy Policy

GDPR Compliance Policy

"Advertiser registration form – the object and the basis of the data processing Your personal data provided through this form are processed in order to register your account on our server. Providing us with your personal information is necessary, and abstaining results in our inability to register your account."

So they do require identity documents. Doesn't say about selfies.

"your personal data might be disclosed to third parties, including (...) the marketing agencies, the e-commerce agencies"

Translates as they do sell your personal information to advertisers.

No mention of encryption.

Their GDPR page mentions "the right to delete personal data (the right to be forgotten)" but doesn't say how this happens or how long it takes.

Rentmen

View Tech Stack on BuiltWith

I got a reply from Rentmen responding to my questions as follows:

Do you require personally identifying information from sex workers for verification?

We require personal identifying information from all of our advertisers, aiming to confirm the users’ identity and age.

Identity documents?

The users are requested to present a state-issued document, confirming their date of birth. Any document with a photo of the user and date of birth is sufficient.

Selfies?

In some cases, when the administration needs more information to confirm the user, the so-called photo verification is required. The user needs to take a selfie holding a sign with the website name and the date the selfie is taken.

Can these be partially obscured or redacted?

Yes, the user can partially cover the ID - compulsory information that must
be visible is:

Face - we need to be sure the person from the ID is the same as the
person in the profile gallery.

Data of birth - to confirm the user is over 18.

Expiration date - we need to be sure the document is valid, not expired.

Name - KYC (Know Your Customer) requirements by the card operators.

Do you sell our identities and/or personal details to third-party advertisers?

We do not sell or share personal data of our users to third-party advertisers under any circumstances. We believe that apart from the moral and ethical norms that the company follows in this direction, any proposals would be rejected due to the fact that we believe that such an act would have an extremely negative impact on the image of the company and the products that we manage.

Do you take any steps to secure our identities from hackers or in case your servers were seized?

Yes, as I mentioned, we follow the rules and regulations of the GDPR and the highest standards for storing the personal data of our users. We have implemented state-of-the-art security measures to prevent any data breaches. Furthermore, your data is encrypted, meaning that in case of a data breach, it will not be readable for the hackers.

Are our identity documents and selfies deleted after verification?

In order to comply with our legal obligations, photo and ID verifications are stored and are needed regarding ongoing monitoring of profile accuracy. For example, if a user changes entirely the photos of their profile gallery and replaces them with others, we need to be sure the newly uploaded photos match the users' photo verification previously provided.

Stored offline?

For security reasons, such information cannot be provided.

Encrypted?

As I previously mentioned, the personal data of our users is protected and encrypted and only limited and licensed staff members have access.

If you were told you could protect yourself from prosecution by freely handing over the identities of sex workers to authorities, would you do so?

We would share data with authorities only if the request is legally valid and in compliance with GDPR and other applicable privacy regulations.

Or would you put up a fight and demand that they get a subpoena?

As I have already specified, we follow the principles of the GDPR, where the reasons and methods for requesting personal data of a user are regulated. Here I should specify that mass provision of personal data to users is absolutely prohibited and would not be respected for any reason. A request for the provision of personal data may be made to investigative authorities in connection with an active criminal investigation. In such a situation, the investigating authority should identify itself by providing documents containing the reason for the request for personal data, as well as what specific personal data are needed for the relevant investigation. For example, if an investigative body were to contact us and request all available data of our user, their request would be considered unlawful and would not be honored.

Do you honour deletion requests?

Yes, of course. Again, following the GDPR, we accept requests for deletion of personal data. Also, any user can request from us what personal data we collect about them.

In entirety?

In some specific cases, we may retain personal information for a longer period. For example, accounting information such as invoices contain personal information. Under the law, we must retain this information for 10 years.

How long does this take?

The period for consideration of requests for the provision of personal data is processed for a period not longer than 7 days.

Hunqz

Hunqz's Privacy Policy

Hunqz replied to my email and responded to each of my questions:

Do you require personally identifying information from sex workers for verification?

No

Identity documents?

No

Selfies?

Only needed if profile gets reported multiple times for being fake

Can these be partially obscured or redacted?

Not, if we need to check a user's identity

Do you sell our identities and/or personal details to third-party advertisers?

Of course not

Do you take any steps to secure our identities from hackers or in case your servers were seized?

Of course

Are our identity documents and selfies deleted after verification?

Users upload their verification picture if needed to a private folder for us to review the user's identity. Afterwards the user can delete the picture.

Stored offline?

N.A

Encrypted?

N.A

If you were told you could protect yourself from prosecution by freely handing over the identities of sex workers to authorities, would you do so?

Or would you put up a fight and demand that they get a subpoena?

It wouldn't be legal in the Netherlands to hand over our user's identities to authorities.

Do you honour deletion requests?

Of course. This is also covered under the GDPR

In entirety?

Yes, see our privacy statement for more information (https://www.romeo.com/en/privacy/)

How long does this take?

These requests are normally processed within one working day.

I replied with a few additional questions, querying the term "legitimate interest" and "if the police demand this" and they kindly replied again:

"By legal terms (GDPR) it wouldn't be a legitimate interest to share user data with advertisers.

In our privacy statement (https://www.romeo.com/en/privacy/) we also list what kind of third party we are sharing data with. In this particular case we share some data with an external Fraud Prevention System to keep "the bad guys" (e.g. commercial profiles created through bots) from our platform. This for instance is a legitimate interest, because Fraud harms both our platform and also potentially our users.

If any local police contacts us, they are sent the following text which clearly defines what's needed to receive any data:

Dear Sir or Madam,

There are two ways in which information can be sought from the Netherlands, either using IP (Interpol/Europol or Liaisons) channels for police to police non evidential requests

or –

if requiring information evidentially then you will need to engage your prosecutor office for them to send an International Letter of Request to the Netherlands to ask for the information on a formal basis.

It is a requirement in the Netherlands for information that is sought as evidence from a foreign jurisdiction to be requested via an European Investigation Order (EIO), which then provides the Netherlands a legal basis to gather the evidence from the business, institution etc. on your behalf. Your prosecutor will be in a position to provide the necessary EIO and sent by post to the Dutch authorities. (...)

This means that we also never hand out any data directly to local police offices but always go through our contacts at the Dutch police."

Sleepyboy

Sleepyboy's Privacy Policy says "Sleepypro SL may disclose your Personal Data in the good faith belief that such action is necessary to comply with a legal obligation, to protect and defend the rights or property of Sleepypro SL, to prevent or investigate possible wrongdoing in connection with the Service, to protect the personal safety of users of the Service or the public, and to protect against legal liability."

So they can identify you to law enforcement and here's no mention of requiring a subpoena.

"Advertising Cookies. Advertising Cookies are used to serve you with advertisements that may be relevant to you and your interests."

"To provide you with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information"

So they do sell our personal data to advertisers.

No mention of encryption. Only the disclaimer "The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security."

They recognise right to deletion "Sleepypro SL aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data." but it doesn't say whether this will be entirety or commit to a timeframe.

I've been researching regarding best business practices for sex work industry websites.

As you may have gathered if you read my previous post on Tech Stacks, the leading escort directories almost all have a terrible track record for customer service, security and privacy.

I very much intend for Sex Worker Search to be a part of the solution, not a part of the problem.

VISA does not explicitly ban escort websites from using their products as far as I can tell.

Within VISA's Merchant Data Standards Manual, Escort services are given the Merchant Category Code 7273. Merchants classified with this MCC provide dating and escort services, including online services.

Escort Services under Merchant Category Code 7273 are not prohibited from accepting VISA card payments however they are categorised as high risk.

Merchants categorized under high-risk must register and pay higher fees, which include $950 per year for registration and additional transaction fees. This ensures that Visa can maintain oversight and manage risks associated with high-risk categories.

In addition, high risk merchants are subject to audit in order to ensure that they are complying with all relevant rules and regulations.

For example this post on the Xbiz website is about the Visa Integrity Risk Program (VIRP) for maintaining proper controls and oversight to prevent illegal transactions from entering the Visa payment system.

I believe the recommended guidelines for compliance with VIRP are well worth understanding considering I have been working hard to try to find a payment portal provider so I can accept credit card payments for premium listings and because I think following the rules and regulations relevant to our industry is the right thing to do.

The following are examples of rules within VIRP which the owners of websites related to sex work need to adhere to.

Content Compliance

Merchants must ensure that their sites do not host CSAM (Child Sexual Abuse Material), bestiality, incest, or non-consensual content.

These types of content are all banned from Sex Worker Search. Sites that mention any of these types of content cannot be indexed in search results.

Content Moderation

Merchants are required to have strict content moderation policies in place, which include monitoring user-generated content, blocking inappropriate material, and employing both human and automated tools for these tasks.

Sex Worker Search is committed to keeping search results clear of any content that is not allowed under our terms. We do have people working to ensure that this is the case.

Proactive Policies Against Exploitation

Merchants need to have detailed policies to prevent human trafficking, sex trafficking, and exploitation, including rigorous age verification, content monitoring, and reporting mechanisms for suspicious activity.

I'm in the process of drafting a Terms and Conditions page that will outline in detail what Sex Worker Search is doing to ensure that none of the sites indexed here are involved in prevent human trafficking, sex trafficking, or exploitation.

I have manually read through every site currently indexed and I am confident that none of them are in any way involved in any of the above criminal activities.

There is nothing wrong with consenting adults having sex. There is nothing wrong with sex work.

Sex Work is not inherently exploitative and I will continue to work hard to ensure that any website that does show evidence that someone may have been coerced or exploited in any way is not indexed. I will also alert the relevant authorities.

Marketing

Merchants are prohibited from marketing based on non-compliant search terms or engaging in noncompliant affiliate marketing promotions.

Sex Worker Search is not connected with any affiliate marketing promotions.

Human Trafficking

Merchants must have effective policies in place that prohibit the use of their websites to promote or facilitate human trafficking, sex trafficking, or abuse. Participation in an anti-trafficking organization is highly recommended.

I have contacted National Ugly Mugs to ask how I can support NUM. I asked them for permission to add a banner for NUM to my footer and encourage people to use the NUM checker tool and contact NUM to make incident reports, access information, support and resources when we are victims of crime and to request assistance when dealing with the police.

I also plan to set up a monthly donation via the NUM donations page.

Takedown Requests

Merchants must enable users to report noncompliant content and allow models to request the removal of content depicting them. Additionally, merchants must provide monthly reports to their payment service provider.

Sex Worker Search does not host any images, videos or media of any kind. The Site titles and meta descriptions that appear in search results are the meta data that those websites are telling search engines to index. However, I understand that people may have reasons for wanting their site removed from search results eg if they've retired or are on hiatus, and I am more than happy to do so. As per the FAQ page, welcome to email [email protected] and I will remove your site from search results within 24 hours.

Note from Love Sudo: Thank you for having me add comments to this post. Anything in this colour is our words with the hope to educate readers about the tech mentioned.

In building Sex Worker Search, with significant help from Love Sudo, my goal is to select technology that prioritises privacy and security while being ethical and effective for the workers who list with us and the clients seeking their services.

I’m fascinated by the diverse tech stacks used by sex workers for their websites. Recently, I discovered that I could analyse the tech stacks of other escort directories. To satisfy my curiosity, and hopefully learn how to improve this website, I examined the top 10 escort directories using BuiltWith and Ahrefs. The sites I looked at were: Adultwork, Tryst, Eros, Eurogirlescort, Privatedelights, Megapersonals, The Erotic Review (TER), Rentmen, Eccie, and P411.

Note from Love Sudo: A website comprises many elements: hosting, code, databases, analytics, and more. Many modern websites have evolved into fully-fledged applications designed to function seamlessly within a browser. The term "tech stack" refers to the complete set of platforms and tools used by a domain, including information about email handling as well.

Here are some intriguing insights I've uncovered about these top 10 escort directories, ranked by traffic from most to least visited according to Ahrefs. I’ve included summaries from Ahrefs to explain the traffic each directory receives and used data from BuiltWith to analyse the technology each directory employs.

My primary goal is to identify common technologies and evaluate their advantages and disadvantages for websites in the sex work industry.

Top 10 Sex Directories

Adultwork

I was completely surprised to discover that Adultwork receives the most traffic among all the sites I analysed. Despite its limited use outside the UK, Adultwork stands out in terms of traffic. In my opinion, it has the most outdated, unattractive, and user-unfriendly interface I’ve ever seen on an escort directory—it looks like a web marketplace from 1995.

Adultwork is notoriously difficult for sex workers to deal with. Every interaction I’ve had or observed with them has been frustrating, as if they take pleasure in being as uncooperative as possible. Moreover, there are troubling rumours that Adultwork shares the identity documents and selfies used for verification directly with U.S. border control. Accounts from sex workers report being flagged by facial recognition at the U.S. border and sent back to the UK, despite only giving these images to Adultwork for verification. For more details on this, visit the Sexworkersonly subreddit.

Despite all this, Adultwork remains inexplicably popular. It is, by a significant margin, the most frequented escort directory in the UK.

Notable insights from their tech stack are the use of Cloudflare (see Stack / Tool Insights section for an explanation of my thoughts, links to the tool, and notes from Love Sudo, about each of the tools used), Google Analytics, US Privacy User Signal Mechanism, ASP.NET, RSS, Atlassian Cloud, DoubleClick.Net, Amazon SES, SendGrid, Azure, and GoDaddy SSL.

I've spoken to Amazon and SendGrid about using their products and they both told me sex work-related sites are banned according to their terms of service, but Adultwork somehow seems to be using them.

The site has had more than 10 successful copyright takedown requests since 2011.

No surprise there. I expect all these directories get thousands of DMCA infringement reports sent via email directly to their site contact email, via their hosting company or via Cloudflare.

If an escort directory is displaying your images without your consent, find a template online for a legal take down notice and email it to the site contact. If they ignore you, do a whois hosting search and find the contact for their hosting provider if possible and send them the takedown notice. The site will get a warning which is usually enough to get them to remove the images. If they're using Cloudflare so their hosting is hidden, fill out the abuse report form here.

I'm surprised to see they're able to use Doubleclick. It's a Google product based in USA where sex work is illegal and is explicitly banned according to their terms of use.

Tryst

Whenever Tryst is mentioned on the Sexworkers subreddit, it's inevitably someone in a state of despair because they're desperate to get started and begin earning money as a sex worker but they've been waiting months for Tryst to verify them so their ad can get approved and become active.

Recently, Tryst has said that they've gotten their processing times down to an average of ten days but there are still people on reddit saying they've been waiting for months.

Notable insights from their tech stack are the use of PostHog, Ruby On Rails, AT Protocol DID Placeholder, Sentry, Let’s Encrypt, OVH, Hetzner, and BunnyCDN.

The site has had more than 10 successful copyright takedown requests since 2011, indicating a history of dealing with copyright issues.

Eros

Eros is an "interesting" one. They were raided in 2017 and their servers were seized by the feds, but they're still up and running. Rumour has it they're still up and running because they made a deal with the feds to provide an ongoing supply of the identities of all their users.

There's limited data for Eros. I guess escort directories that are effectively owned and operated by the CIA are more difficult to parse than others.

Notable insights from their tech stack are the use of Google Analytics, Ionic, SSL, and WAI-ARIA.

Eurogirlescort

Notable insights from their tech stack are the use of Google Analytics, US Privacy Signal Mechanism, Cloudflare, Nette Framework, DoubleClick.net, FastMail, and SSL.

The site has had more than 10 successful copyright takedown requests since 2011.

Privatedelights

I've seen multiple people on reddit complaining that Privatedelights is inconsistent in their approach to verifying accounts. They're said to pick and choose who they want on the platform and are allegedly racist in having an unspoken policy of rejecting African American providers.

Notable insights from their tech stack are the use of Express, Cloudflare, tawk.to, SSL, DNSSEC, and Amazon AWS EC2.

Megapersonals

Judging from mentions on reddit, their Fraud Bot tends to be a bit overzealous. One of their admins has a reddit account and is quite quick to respond to username mentions so if you are having trouble with MP, post on reddit and mention /u/megapersonalsreal.

Notable insights from their tech stack are Cloudflare, Java EE, GStatic Google Static Content, Openads/OpenX, SWFObject, SSL, and WorldStream.

The Erotic Review (TER)

Like all escort review sites, the denizens do like to write a graphic Penthouse Forum style account of their encounters filled with gratuitous detail. Many sex workers, especially in countries like USA where sex work is illegal, go out of their way not to mention specific sexual services in exchange for payment and very much do not consent to having these details published on review sites. One positive of receiving negative reviews on sites like this is that other reviewers, AKA hobbyists, are less likely to contact you. The hobbyist is distinguished by haggling, boundary pushing and casual misogyny so filtering them out is a good thing.

Notable insights from their tech stack are Google Analytics, User Privacy User Signal Mechanism, ASP.NET, GStatic Google Static Content, Cloudflare, DoubleClick.Net, and SSL.

The site has had more than 10 successful copyright takedown requests since 2011.

Rentmen

A male escort directory. I'm so happy that I don't need to use directories any more since my personal site ranks high enough on google for search terms related to the services I specialise in that I get enough clients from my own site without using any directories. I used to have an ad on rentmen and for every one genuine client, I'd get literally hundreds of timewasters. Ugh.

Notable insights from their tech stack are Google No Translate, Next.js, React, and Cloudflare.

Eccie

A toxic hobbyist community. It used to be popular. It's been hacked multiple times. Only ever gets mentioned on reddit as something to avoid like the plague.

Notable insights from their tech stack are Google Analytics, Cloudflare, US Privacy User Signal Mechanism, vBulletin, DoubleClick.Net, and Webair.

P411