CandysAI Privacy Policy
Version: 2026-10-26 · effective from: 2026-10-26
1. Data controller
The controller of your personal data is Adam Smentoch, running a business under the name samSEO - Adam Smentoch, ul. Aleja Wolności 2c/1, 84-300 Lębork, Poland, tax ID (NIP) 8411683192, REGON 529295307 (hereinafter “we”).
Contact in personal data matters: samseo.reklama@gmail.com or the form at https://candysai.com/en/contact. We have not appointed a data protection officer.
2. The most important points
- We store your conversations with characters so that the characters can remember them. We send fragments of conversations to an artificial intelligence provider (OpenAI) so that the character can reply.
- The service administrator has access to conversations (safety, moderation, service quality). Every such access is logged.
- Messages are checked automatically for prohibited content and signs of danger to life. In a serious situation we may pass the necessary data to emergency services.
- We do not sell your data and do not use conversations for advertising.
- Statistics (Google Analytics) and the advertising pixel are enabled only after your consent in the cookie banner.
- You can download your data and delete your account in My account → Privacy.
3. What data, for what purpose, on what legal basis and for how long
| Data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|
| E-mail, nickname, password (hashed), language, time zone, date of birth (optional), Google account data when signing in with Google (name, e-mail, identifier) | Running your account and providing the service | Art. 6(1)(b) (contract) | Until the account is deleted (14 days after the request) |
| Gender (optional, if you provide it) | Service statistics, wishes from characters on days such as Women's Day or Men's Day | Art. 6(1)(a) (provided voluntarily; you can remove it in your profile) | Until changed in your profile or the account is deleted |
| Confirmation of age and acceptance of the terms (date, version, IP address) | Proof of consent and protection of minors | Art. 6(1)(c) and (f) | For the lifetime of the account and until claims become time-barred |
| Conversation content, relationship summaries, information remembered by characters, your persona description | Chat and character memory | Art. 6(1)(b) | Until the account is deleted; “Start over” hides the conversation, the archive is kept until the account is deleted |
| Messages and remembered information you deleted or edited (and their original content) | User safety, handling reports, establishment, exercise or defence of legal claims | Art. 6(1)(f); Art. 17(3)(e) GDPR | Until the account is deleted; the character does not see or use them |
| Events from your life mentioned in conversation (e.g. an exam date), reminders | Messages from characters who write first | Art. 6(1)(b); you can turn this off in the settings | Until the event, then as part of the conversation |
| Push notification subscription (technical browser address) | Sending notifications | Art. 6(1)(a) (consent in the browser) | Until notifications are turned off or the account is deleted |
| Generated images, characters from the creator | Image and creator features | Art. 6(1)(b) | Until you delete them or the account is deleted |
| Purchase and Coin history, country of payment, Stripe payment identifiers | Selling Coins, settlements, accounting, complaints | Art. 6(1)(b) and (c) (tax law) | 5 years from the end of the tax year |
| IP address and browser information at sign-in and with messages | Security, abuse prevention, help in dangerous situations | Art. 6(1)(f) (legitimate interest) | 90 days |
| Country determined from the IP address at sign-in (local DB-IP Lite database, the IP is not sent anywhere) | Service statistics (which countries users come from), choosing helpline numbers | Art. 6(1)(f) (legitimate interest) | Until the account is deleted |
| Reports, moderation decisions, appeals | Content moderation (Digital Services Act) | Art. 6(1)(c) and (f) | 2 years after the case is closed |
| Safety events (conversation fragment, assessment result, IP) | Protection of life and health | Art. 6(1)(d), Art. 9(2)(c) (health data) | 90 days; if passed to emergency services, 2 years; then anonymised |
| Messages from the contact form | Answering a question or complaint | Art. 6(1)(f), for complaints (c) | Until the matter is settled and claims become time-barred |
| Statistical and marketing data from cookies | Visit statistics, advertising effectiveness | Art. 6(1)(a) (consent in the banner) | As described in the Cookie Policy |
We keep backups of the service for 14 days, so deleted data may remain in them for at most that long.
Providing data to create an account and make purchases is voluntary, but without it we cannot provide the service.
4. Conversations with characters and AI providers
- For a character to reply, a fragment of the conversation together with the information the character remembers about you is sent to the language model provider OpenAI, L.L.C. (San Francisco, USA). The same provider creates conversation summaries, memory entries and images, and checks messages and images for prohibited content (moderation). The provider acts on our behalf and, under its business terms, does not use data sent through the API to train its models.
- You can see the list of information remembered by a character on the page “What [character] remembers about you”. You can correct or delete it there. A character forgets deleted or edited information (just like a deleted chat message) and stops using it, but we keep a copy, together with the original content, until the account is deleted, visible only to the administrator. This serves user safety, the handling of reports and the establishment, exercise or defence of legal claims. The copy is also included in the data copy you can download.
- Administrator access. An authorised administrator of the service has access to the content of conversations and remembered information of all users. The administrator uses it to ensure user safety (including responding to situations of danger to life), to moderate content and handle reports, and to maintain and improve the quality of the service (e.g. diagnosing errors in characters’ replies). Every time a conversation is opened, this is logged automatically (who, when, whose conversation, with which character). Moderators only see conversations related to reports and safety alerts. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) and, in situations of danger to life, Art. 6(1)(d).
- Characters are fictional. Their replies are not medical, legal or psychological advice.
5. Safety and situations of danger to life
- Automatic detection. Every message is checked automatically for prohibited content and signs of danger (e.g. suicidal thoughts). When the filter detects something, a language model assesses a short fragment of the conversation (up to 15 messages) to tell, for example, a joke or fiction apart from a real threat.
- Response. In case of danger, the character steps out of its role, shows care and gives a contact for help. For the following few days it talks more gently.
- Alert. In a serious situation, an authorised member of our team receives a notification (e-mail, push, Telegram) without the content of the conversation. They see the conversation fragment only in the administration panel; every access is logged.
- Passing data to emergency services. Where there is a justified suspicion of an immediate threat to your life, we may pass to emergency services (112, police) the data needed to help you: e-mail, account name, IP address with connection time, browser information and the messages indicating the danger. Legal basis: Art. 6(1)(d) and Art. 9(2)(c) GDPR (protection of vital interests).
- Country from the IP address (to give you the right helpline) is determined with the local DB-IP Lite database on our server, without sending the IP address to anyone.
6. Who we share data with
We entrust data only to providers needed to run the service (processors) or pass it to independent controllers when you use their services:
| Recipient | Role | Scope | Country |
|---|---|---|---|
| HITME.pl, ul. Wiczlińska 34, 81-578 Gdynia, Poland, NIP 8792487067 | Server hosting, e-mail | All service data | Poland |
| OpenAI, L.L.C. | Character replies, memory, images, moderation | Conversation fragments, remembered information, image descriptions | USA |
| Stripe Payments Europe, Limited | Payments (independent controller of payment data) | E-mail, amount, payment data | Ireland (EEA) |
| Google Ireland Limited | Sign-in with Google (if you use it), Google Analytics (after consent) | Google sign-in data; statistical data from cookies | Ireland / USA |
| Cloudflare, Inc. (Turnstile) | Protecting forms against bots | IP address, browser information | USA |
| Push notification providers (Google, Apple, Mozilla, depending on the browser) | Delivering notifications | Encrypted notification content, technical address | USA / EU |
| Telegram | Safety alerts for our team | Alert level and time, link to the panel, without conversation content or user data | United Kingdom / United Arab Emirates |
| Meta Platforms Ireland Ltd (Meta Pixel) | Advertising measurement, only after marketing consent and when we run ads | Cookie data | Ireland / USA |
| Emergency services, police, courts | Where required by law or to protect life | The necessary minimum | Poland |
Data is transferred outside the European Economic Area (USA) on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) for companies certified under it, or of standard contractual clauses approved by the Commission.
7. Your rights
You have the right to: access your data and receive a copy, rectification, erasure, restriction of processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting earlier processing).
- Copy of your data (including conversations and character memory): My account → Privacy → Download data.
- Account deletion: My account → Privacy; we delete it 14 days after the request.
- Cookie consent: the “Cookie settings” link in the footer.
- Other matters: write to samseo.reklama@gmail.com. We reply within one month.
You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl), or with the data protection authority in your EU country.
8. Automated decisions
Automatic filters may stop a message or an image and limit free replies when there are many accounts from one IP address. Decisions to block an account are made by a human. We do not profile you for advertising purposes based on your conversations.
9. Data security
The connection to the service is encrypted (HTTPS). Passwords are stored as cryptographic hashes and provider keys in encrypted form. Access to the administration panel requires an additional e-mail code, and access to conversations is logged.
10. Minors
The service is intended exclusively for adults. If we learn that an account belongs to a person under 18, we will delete it together with its data.
11. Changes to this policy
We inform you of significant changes by e-mail and in the service. The current version is always available at https://candysai.com/en/privacy-policy.