Privacy Policy

The data controller is [To be completed: legal name and address of the data controller].

For any question regarding your personal data: [To be completed: contact email].

We only collect the following data:

• Account data: email address, display name, password (stored hashed, never in plain text);
• Preferences: interface language, companion customization preferences;
• Usage content: conversations with AI companions, generated images, characters and personas you create;
• Payment data: processed exclusively by our provider Stripe — your card numbers never pass through our servers and are never stored by us; we only keep the transaction history (amount, date, status);
• Technical data: connection logs and session identifiers, required for the security of the Service.

Your data is processed for the following purposes:

• Providing the Service (account, conversations, image generation, hearts) — legal basis: performance of the contract;
• Payment processing and invoicing — legal basis: performance of the contract and legal obligations (accounting);
• Security, fraud and abuse prevention — legal basis: legitimate interest;
• Service-related communications (transactional email) — legal basis: performance of the contract; any marketing communication would rely on your consent, revocable at any time.

Your account data, conversations and images are kept as long as your account is active. If you delete your account, all of this data is erased within 30 days.

Billing data is kept for the duration required by legal and accounting obligations (up to 10 years).

Your data is never sold. It is shared only with the processors strictly necessary to operate the Service:

• Stripe (payment processing): receives the data needed for payment; Stripe is PCI-DSS certified and covers its international transfers with standard contractual clauses;
• Venice AI (AI generation): your conversations are sent to the Venice AI inference API in order to generate companion replies and requested images; only the data needed for generation is transmitted;
• Hosting provider: [To be completed: name and address of the hosting provider], which stores Service data.

Your data may also be disclosed to competent authorities where required by law.

Under the GDPR, you have the following rights over your data:

• right of access: obtain a copy of the data we hold about you;
• right to rectification: have inaccurate data corrected;
• right to erasure: request deletion of your account and data;
• right to portability: receive your data in a structured, machine-readable format;
• right to object and to restriction: object to certain processing based on legitimate interest;
• right to withdraw your consent at any time, for processing based on it.

To exercise these rights, write to us at [To be completed: contact email]. We respond within one month at most. You may also lodge a complaint with your supervisory authority (in France: the CNIL, www.cnil.fr).

The Service only uses technical cookies and local storage (localStorage): keeping your login session, remembering your preferences (language, age verification, daily rewards).

We do not use any advertising cookies or third-party tracking tools for advertising purposes.

We implement appropriate technical and organizational measures to protect your data: encrypted communications (HTTPS), password hashing, access segregation, logging. In the event of a data breach likely to create a high risk for your rights, you will be informed in accordance with the GDPR.

For any question about this policy or your personal data: [To be completed: contact email].