🔒 Privacy Policy

Intimate AI ("we", "us", "our") is the data controller for your personal data processed through our Service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information under the General Data Protection Regulation (GDPR) and applicable Swedish law.

2. Information We Collect & Legal Basis

2.1 Information You Provide (Legal basis: Contract performance, Art. 6(1)(b))

• Account Information: Email address, username, password (bcrypt-hashed)
• Marketing Consent: Whether you opted in to marketing communications (Legal basis: Consent, Art. 6(1)(a))

2.2 Payment Information (Legal basis: Contract performance, Art. 6(1)(b))

• Processed directly by CCBill, Stripe, or NOWPayments — we do NOT store credit card numbers
• We receive: transaction ID, amount, status, and payment method type only

2.3 Automatically Collected Information (Legal basis: Legitimate interest, Art. 6(1)(f))

• Usage Data: Pages visited, features used, time spent — collected via anonymised analytics
• IP Address: Hashed using SHA-256 with a private salt before storage. We do not store raw IP addresses in analytics.
• Session Data: Anonymous session identifiers (no PII)
• Cookies: See our Cookie Policy for details

2.4 Conversation Data (Legal basis: Contract performance + Explicit consent, Art. 6(1)(b) & Art. 9(2)(a))

• AI chat messages and conversation history
• Content preferences and interaction patterns

3. How We Use Your Information

• Provide the Service: Deliver AI conversations and content (Contract)
• Payment Processing: Handle transactions and billing (Contract)
• Analytics: Improve Service quality using anonymised data (Legitimate interest)
• Marketing: Send promotional emails only with your consent (Consent)
• Legal Compliance: Respond to legal requests, prevent fraud (Legal obligation)
• Security: Detect and prevent abuse, fraud, and unauthorized access (Legitimate interest)

4. Third-Party Processors & Data Sharing

4.1 Payment Processors

• CCBill — Credit card processing for adult content. Privacy Policy
• Stripe — Credit card processing. Privacy Policy
• NOWPayments — Cryptocurrency payments. Privacy Policy

4.2 Offerwall Provider

CPAGrip — When you use the offerwall for free credits, CPAGrip may collect device information, IP address, and offer completion data. Privacy Policy

4.3 Advertising Network

ExoClick / NeverBlock — Ad serving (only when you consent to advertising cookies). Privacy Policy

4.4 AI Processing

AI conversations are processed using the Groq API (cloud) or Ollama (local). Chat messages are sent to the AI provider for response generation. No payment data or personal identifiers are sent to the AI service.

4.5 Infrastructure

• Backblaze B2 — Media storage (images)
• PostgreSQL — Database (hosted on our servers)

5. International Data Transfers

Your data may be transferred to processors outside the EU/EEA. We ensure adequate safeguards through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Processing only with providers that offer adequate data protection

Transfers may occur to: United States (Groq, Stripe, Backblaze), other countries as needed for payment processing.

6. Data Retention

• Account Data: Retained until you delete your account
• Conversation History: Retained for 90 days or until account deletion
• Transaction Records: Retained for 7 years (Swedish bokföringslagen — accounting law obligation)
• Analytics Data: Anonymised; retained for 24 months maximum
• Contact Form Submissions: Retained for 12 months

7. Your Rights Under GDPR

As a data subject, you have the following rights:

7.1 Right of Access (Art. 15)

Request a copy of all personal data we hold about you.

7.2 Right to Rectification (Art. 16)

Update your account information anytime in your Dashboard.

7.3 Right to Erasure (Art. 17)

Delete your account and all associated data via Dashboard → Settings → Delete Account. Transaction records are retained for 7 years as required by Swedish law but are anonymised.

7.4 Right to Data Portability (Art. 20)

Download all your data in machine-readable JSON format via Dashboard → Settings → Export Data.

7.5 Right to Withdraw Consent (Art. 7(3))

You can withdraw marketing consent at any time via your Dashboard or by unsubscribing from emails.

7.6 Right to Lodge a Complaint

You can lodge a complaint with the Swedish Data Protection Authority:
Integritetsskyddsmyndigheten (IMY)
Website: www.imy.se
Or with your local EU/EEA Data Protection Authority.

7.7 How to Exercise Your Rights

Email support@intimateai.site with your request, or use the self-service options in your Dashboard. We will respond within 30 days.

8. Cookies & Tracking

We use a cookie consent banner that lets you accept or reject non-essential cookies before they are set. See our full Cookie Policy for details.

• Essential cookies: Always active (authentication, session management)
• Analytics cookies: Only with your consent
• Advertising cookies: Only with your consent

9. Data Security

10. Children's Privacy

11. California Privacy Rights (CCPA)

California residents have the right to:

• Know: What personal information we collect
• Delete: Request deletion of your data
• Opt-Out: We do not sell personal information
• Non-Discrimination: Same service quality regardless of privacy choices

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or prominent website notice at least 30 days in advance. Continued use after the effective date constitutes acceptance.