← Back

Privacy Policy

Last updated: April 26, 2026

This Privacy Policy explains how [COMPANY NAME] (“we,” “us,” or “our”) collects, uses, and shares information about you when you use [PRODUCT NAME] (the “Service”).

We aim to be straightforward. If something here is unclear, contact us at privacy@example.com.

1. Information We Collect

1.1 Information you provide

  • Account information: email address, password (stored hashed), age confirmation, and optionally a display name.
  • Conversations: the messages you send to Personas and the responses they generate.
  • Payment information: we do not directly store your full payment card details. Stripe (or our payment processor) handles those. We store transaction records (amount, date, status, processor reference IDs) and a customer reference.
  • Support communications: if you email us, we keep that correspondence.

1.2 Information collected automatically

  • Device and connection data: IP address (we hash and store; we do not retain raw IPs longer than required for abuse prevention), user agent, referrer URL, and approximate location derived from IP.
  • Usage data: features used, time and duration of sessions, errors encountered.
  • Cookies and similar technologies: session cookies for authentication and pre-signup chat continuity. We do not use third-party advertising cookies.

1.3 Information from third parties

  • OAuth providers: if you sign in with Google, we receive your email address and basic profile information from Google. We do not access your Google contacts, calendar, or other Google services.
  • Payment processor: Stripe (or our processor) tells us whether a payment succeeded, was refunded, or was disputed.

2. How We Use Information

We use the information we collect to:

  • Provide the Service: authenticate you, generate Persona responses, deliver the conversational experience.
  • Process payments and prevent fraud.
  • Maintain conversational context, including using prior messages to inform Persona responses (this is what makes the Service feel coherent).
  • Send transactional emails (purchase confirmations, password resets, security notices).
  • Send re-engagement emails (Day 1, 3, 7 lifecycle messages) — you can opt out at any time on your Account page.
  • Detect and prevent abuse, including content moderation and rate limiting.
  • Comply with legal obligations and enforce our Terms of Service.
  • Improve the Service in aggregate. We do not train large language models on your conversations without your explicit opt-in consent.

3. Specific Notes About AI Conversations

Because Persona conversations are the heart of the Service, we want to be especially clear about how they're handled.

  • Storage: conversations are stored in our database so you can return to them later. Conversations are encrypted at rest and in transit.
  • Embeddings: we compute vector embeddings of messages for semantic search (so Personas can recall earlier topics). Embeddings are stored alongside conversations and deleted when the underlying conversation is deleted.
  • Persona memory: Personas may form structured “facts” about you based on what you tell them (e.g., your name if you share it). You can view and delete these on the Account page.
  • Third-party AI providers: we use third-party large language model APIs (Anthropic, OpenAI, others) to generate Persona responses. Your messages are sent to these providers in real time. These providers contractually agree not to retain or train on this data beyond what is necessary to deliver the response.
  • Content moderation: we run automated moderation on inputs and outputs. Flagged content may be reviewed by our team for safety purposes.

4. How We Share Information

We share information only as described here:

  • Service providers: we use vendors to operate the Service — hosting (Vercel), database (Supabase), payments (Stripe), email (Resend), AI APIs (Anthropic, OpenAI, Together), analytics (PostHog), error tracking (Sentry), and content moderation services. They process information only on our instructions.
  • Legal requirements: we may disclose information when required by subpoena, court order, or law, or when necessary to investigate fraud, protect safety, or enforce our rights.
  • Business transfers: if we're involved in a merger, acquisition, or asset sale, your information may be transferred. We'll notify you before this happens.

We do not sell your personal information. We do not share your conversations with advertisers. We do not allow third parties to advertise to you based on your conversations.

5. Your Rights and Controls

5.1 Universal controls

From your Account page, you can:

  • View your payment history and credit transactions.
  • Opt out of re-engagement emails.
  • Permanently delete your account and associated data.

5.2 EEA, UK, and Swiss residents (GDPR)

If you reside in these jurisdictions, you have the right to:

  • Access your personal data we hold about you.
  • Rectify inaccurate data.
  • Erase your data (Right to be Forgotten) — see Section 5.1 above for the deletion path.
  • Restrict processing in certain circumstances.
  • Receive a copy of your data in a portable format (Right to Data Portability) — email privacy@example.com to request.
  • Object to processing based on legitimate interests.
  • Withdraw consent where we rely on consent.
  • Lodge a complaint with your local data protection authority.

Our legal bases for processing: contract performance (operating the Service for you), legitimate interests (improving the Service, preventing fraud, providing security), consent (re-engagement emails), and legal obligations.

5.3 California residents (CCPA / CPRA)

You have the right to:

  • Know what personal information we've collected.
  • Delete your personal information.
  • Correct inaccurate personal information.
  • Opt out of “sales” and “sharing” of personal information — we do not sell or share for cross-context behavioral advertising.
  • Limit the use of sensitive personal information.
  • Non-discrimination for exercising your rights.

5.4 How to exercise rights

Most rights can be exercised through your Account page. For anything else, email privacy@example.com and we'll respond within 30 days.

6. Data Retention

  • Account data and conversations: retained while your account is active.
  • Deleted accounts: profile, conversations, messages, and embeddings are deleted immediately when you delete your account.
  • Payment records: retained as required by tax and accounting laws (typically 7 years), with personally identifying fields removed on account deletion where possible.
  • Moderation logs: retained up to 2 years for safety and audit purposes, with personally identifying fields removed on account deletion.
  • Hashed IP addresses (rate limiting): 30 days.
  • Email events: 1 year, then aggregated.

7. Security

We use industry-standard practices: TLS encryption in transit, encryption at rest, access controls, audit logging. No system is perfect. If we discover a breach affecting your data, we'll notify you in accordance with applicable law.

8. International Transfers

Our infrastructure and some service providers are located in the United States and other countries. By using the Service, you consent to your information being transferred to and processed in these locations. Where required (e.g., from the EEA to the US), we rely on Standard Contractual Clauses or equivalent safeguards.

9. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect information from children. If we learn we have collected information from a child, we will delete it. If you believe a child has used the Service, contact privacy@example.com.

10. Cookies and Tracking

We use:

  • Strictly necessary cookies: session authentication, pre-signup chat continuity, security.
  • Functional cookies: preferences and settings.
  • Analytics: aggregated, privacy-respecting product analytics (PostHog) to understand usage patterns. No cross-site tracking.

We do not use third-party advertising cookies or pixel trackers.

11. Changes to This Policy

We may update this Policy. Material changes will be communicated via email or in-product notice. The “Last updated” date at the top reflects the latest revision.

12. Contact

Questions, concerns, or rights requests: privacy@example.com

Mailing address: [ADDRESS]

EU/UK Data Protection Officer: [NAME / EMAIL] (if applicable)