Privacy Policy

Effective Date: October 11, 2026

This Privacy Policy ("Policy") is provided by Fanchaty AI LTD ("Company," "we," "us," or "our") to explain how we collect, use, process, and protect your personal data in connection with your use of the Fanchaty.ai website and its associated digital platforms ("Platform" or "Services").

This Policy has been prepared in compliance with applicable data protection laws, primarily the General Data Protection Regulation (EU) 2016/679 ("GDPR"). By using the Platform, you acknowledge that you have read and understood this Policy.

1. Data Controller

Under the GDPR, the entity determining the purposes and means of processing your personal data is the Data Controller: Company Name: Fanchaty AI LTD (Company Number: 16983888) Contact Email: [email protected]

In this Policy, the terms "user" and "you" refer to visitors and registered members of Fanchaty.ai.

2. Scope of Services

Fanchaty.ai is an online chat platform that allows you to interact with virtual and fictional characters using artificial intelligence algorithms. The Services include:

• Chatting with AI,

• Generation of content (text, image, audio, etc.),

• Account/membership creation,

• Features based on paid subscriptions and token usage.

During these processes, certain personal data of yours is processed.

3. Categories of Personal Data Processed

While using the Platform, the following categories of data may be processed:

• Account Data:

  Email address, username/nickname and profile preferences (optional).

  In the Google Play app we also collect your date of birth to confirm that you are 18 or older. It is processed only for this age check, is not used for marketing and is not shared with third parties.

  IMPORTANT: The platform does NOT use passwords. You sign in using a one-time

  verification code sent to your email address, or via Google Sign-In. For this

  reason, no password of yours is stored in our systems.

• Usage Data: Login/logout dates and times, IP address, derived city/country location, device information (mobile/desktop, browser type), token/limit balance, and subscription plan.

• Web App Usage Data (Optional): If you open the site as an installed app and have allowed analytics cookies: a random device identifier generated in your browser, the days on which the app was opened and how it was opened (web app or Android app), device type (iOS / Android / desktop / other), the install moment on Android as reported by the browser, the number of chat messages sent from the app per day and, if you are logged in, your account. If an "Install the app" suggestion is shown to you while you use the site in a browser, then — again only with analytics consent and under the same device identifier — we also record the day it was shown, whether you tapped its button or dismissed it, and your choice in the browser's own install dialog. No IP address, browser fingerprint or message content is stored in these records. Details: Section 4.9.

• Phone Notification Data (Optional): If you turn on phone notifications in the installed app: the notification subscription your browser creates for that device (the notification address at the push service and the encryption keys; stored encrypted in our systems), device type (iOS / Android / desktop / other), your time zone, when the subscription was created and last refreshed, and delivery results (time of the last successful delivery, error count); which notification types you have turned on (your preferences); consent records (date, the types turned on at that moment, the version of the consent text you saw, the country code derived from your IP address, whether the separate consent box was ticked if it was shown, and whether consent was given in the consent prompt or in account settings); and the notifications sent to you (type, title and text, language, the page to open, time and result of sending, and whether you tapped the notification; in reply and "misses you" notifications the text also contains the character's name). To avoid showing the consent prompt more often than necessary, we also count on your account how many times it has been shown and on how many different days the app was opened. No separate record is kept to decide when "misses you" reminders are sent or stopped; we use the time of your last message, the last time you opened the app and whether you tapped earlier reminders. When you view a chat on screen while logged in, a short-lived marker of this may also be kept so that a reply notification is not sent unnecessarily (even if you have not turned notifications on). To show the unread count on the app icon, we also keep, for your account, the number of notifications sent to you since you last opened the app. The content of your chat messages is never included in a notification, and your IP address is not stored in these records. Details: Sections 4.7 and 4.10.

• Error Reports: When something fails on the Platform (for example a page that will not load), we record the technical error text, the address of the page where it happened and your browser type so that we can fix it. These records are necessary to keep the service working and rely on our legitimate interests. Before anything is stored, details such as email addresses, session tokens, payment details and IP addresses are removed automatically, and query parameters are stripped from the page address. Error reports are deleted after 90 days at the latest.

• Content Data: Messages and prompts you enter during chats, AI outputs (responses, generated content), and preferred character settings.

• Payment Data (if applicable): Full name related to the payment, transaction amount, currency, date and time, masked card details (e.g., last 4 digits), payment reference number, and technical data required by the payment provider.

• Contact & Support Data: Contact forms, support tickets, email correspondence, descriptions of your requests, and screenshots (if any).

• Marketing Preferences (Optional): Newsletter/announcement subscription status and marketing consent.
  

  ---

4. Purposes and Legal Bases for Processing

We process your personal data for the following purposes, relying on the legal bases set out in Article 6 of the GDPR:

• 4.1 Account Creation and Management

  • Purposes: Registering your membership, creating your account, managing passwords, logging in, and displaying token balances.

  • Legal Basis: Performance of a Contract (Art. 6(1)(b)) and Legitimate Interests (Art. 6(1)(f)) for platform security.
    

• 4.2 Provision and Customization of Services

  • Purposes: Operating the AI chat feature, delivering a customized experience based on your character/content settings, and running the technical infrastructure.

  • Legal Basis: Performance of a Contract (Art. 6(1)(b)).
    

• 4.3 Execution of Payment Transactions

  • Purposes: Collecting subscription fees, processing transactions via payment gateways/banks, and maintaining billing/accounting records.

  • Legal Basis: Performance of a Contract (Art. 6(1)(b)) and Compliance with a Legal Obligation (Art. 6(1)(c)).
    

• 4.4 Support and Communication

  • Purposes: Receiving and responding to your inquiries, complaints, and resolving account/payment issues.

  • Legal Basis: Performance of a Contract (Art. 6(1)(b)) and Legitimate Interests (Art. 6(1)(f)) for customer satisfaction.
    

• 4.5 Security, Fraud Prevention, and Moderation

  • Purposes: Automated detection of rule violations or abuse, content moderation, and reporting to authorities if illegal acts are detected.

Legal Basis: Legal Obligation (Art. 6(1)(c)) and Legitimate Interests (Art. 6(1)(f)) to protect the platform and users.

Regarding Automated Processing: Content moderation is carried out by automated systems and may prevent one of your messages from being sent. These checks are not infallible. If you believe an automated decision was made in error, you may request human review by writing to [email protected]. Decisions with permanent consequences, such as account closure, are taken only following human review.

• 4.6 Service Improvement and AI Training

4.6 Service Improvement

Purposes: Debugging, performance and cost analysis, measuring service quality,

and developing new features.

Legal Basis: Legitimate Interests (Article 6(1)(f)).

NOTE: Your chat content is NOT used to train OUR OWN artificial intelligence

models. The platform uses pre-trained models provided by third-party model

providers.

• 4.7 Marketing and Announcements (Optional)

  • Purposes: Sending emails or notifications regarding new features, campaigns, and updates.

  • Phone notifications: Announcement and offer notifications and "misses you" reminders (notifications reminding you that your characters are waiting for you when you have not visited for a while) fall under this heading. If you connect from the European Union or another European Economic Area country, the United Kingdom or Switzerland, the consent prompt shows a separate, unticked box for these two types; if you do not tick it, they are not turned on. In other countries, "Yes" in the consent prompt turns these types on as well. If a notification type is already on for your account, a "Yes" given on a new device does not change your existing choices. On a device where you turn notifications on from account settings, these two types are not turned on automatically; you receive them only if you switch them on yourself. You can turn each type off individually in the "Phone notifications" section of your account settings; your choices are linked to your account and apply to all your devices. Phone notifications about new features and important updates about your account are covered by Section 4.10, not by this heading.

  • "Misses you" reminders: By default, these are sent only if you have not written a message and have not opened the app for at least 3 days; they arrive between 11:00 and 21:00 local time (based on your device's time zone) and at most once every 3 days. A reminder is sent in the name of the character you last chatted with (provided that character is still published), for example "Elif misses you."; chats you have deleted are not used for this. If you do not respond to 3 reminders in a row (you do not tap the notification, write a message or open the app), no further reminders are sent; the count starts again when you write a message, open the app or tap a reminder. The periods and numbers in this paragraph are default values.

  • Announcements as phone notifications: A short summary of an announcement we publish on the site may also be sent as a phone notification. It goes only to members who have the "Announcements and offers" type turned on and to whom the announcement is also shown on the site. By default, announcement and offer notifications are limited to at most 1 per day and 3 per week for each person; notifications above this limit are not sent. If an announcement is withdrawn or expires, its notifications that have not been sent yet are not sent either.

  • Legal Basis: Explicit Consent (Art. 6(1)(a)). You can opt out at any time (see Section 8).
    

    ---

4.8 Refer & Earn Programme

If you join the programme, or arrive through a referral link, the following data is also processed. A separate document explains this in detail: Refer & Earn Privacy Notice.

• Referral link cookie: when you click a referral link, a signed cookie is kept in your browser so we can recognise who invited you. Legal basis: your consent (see the cookie notice). If you do not consent, you can enter the referral code manually when you sign up.
• Device recognition cookie: used to prevent self-referral and reward farming with multiple accounts. Legal basis: legitimate interest (fraud prevention).
• Fraud signals: irreversible hashes of details such as device, IP and email are stored; the raw values are not kept for this purpose. Legal basis: legitimate interest.
• Payout details (affiliates only): your USDT wallet address and, once before your first withdrawal, your full name, country of residence, date of birth and a tax declaration. Name and date of birth are stored encrypted, shown only masked in the panel and never read back. Legal basis: performance of a contract and legal obligation.
• Earnings and payout records: kept to meet our accounting and tax obligations.

You cannot see the identity of the people you invite; the panel shows only a pseudonym and a day-level date.

4.9 Web App Usage Statistics

When you open the site as an installed app (from its icon on your home screen or desktop) and when an "Install the app" suggestion is shown to you in the browser, we process the data listed under "Web App Usage Data" in Section 3 so that we know how many people install and use the app and can improve the suggestion and the app.

• Legal basis: your consent (Art. 6(1)(a)) — the analytics cookie consent in the cookie banner. If you do not give it, none of this is recorded; if you withdraw it, the device identifier in your browser (fc_cihaz) is deleted and recording stops. See the Cookie Notice.
• Link to your account: if you are logged in, the records are linked to your account. If the app is known to have been opened on a device of the same type (iPhone or Android) linked to your account, this information is also used to stop showing the "Install the app" suggestion on your other devices of that type.
• Marketing emails: if you have also given marketing consent in the cookie banner and are logged in, a "web app user" tag is added to your account; this tag may be used to choose which members receive our marketing emails. Analytics consent alone is not enough for this tag. You can unsubscribe from marketing emails at any time (see Section 8).

4.10 Phone Notifications (Service and Replies)

If you use the site as an installed app, you can turn on phone (device) notifications. Notification permission is requested only in the installed app and only after you have logged in; it is never requested in a browser tab. For these notifications we process the data listed under "Phone Notification Data" in Section 3.

• Service notifications: the type shown in the app as "New features and important updates about your account"; for example a new feature, or an update about your payment or your Refer & Earn account.
• Reply notifications: notifications sent when your character replies to you. The notification is sent about 2 minutes after the reply arrives; it is not sent if you have seen the reply in the app or on the site in the meantime, or if you have deleted the chat. To tell whether you have seen it, when you view a chat on screen while logged in we keep a short-lived marker of which chat you saw and when; this marker may be created even if you have not turned notifications on, contains no message content and is deleted automatically after 15 minutes. The marker relies on our legitimate interest (Art. 6(1)(f)) in not sending you a notification you do not need.
• Number on the app icon: if your phone supports it, the number of notifications sent to you since you last opened the app is shown on the app icon. The number is reset when you open the app, and removed from the icon on that device when you log out.
• If you leave while waiting for a reply: in character chats (except roleplay chats), if you close the chat screen or the app while a reply is being written (even if you have not turned notifications on), the reply is still generated, checked as usual and saved to your chat history, so you will find it in the chat when you come back. If a voice message or photo is being prepared in that turn, it is also produced and counts toward your voice message or photo allowance.
• Legal basis: your consent (Art. 6(1)(a)), meaning that you turn notifications on in the app's consent prompt or in account settings and grant your phone's (browser's) notification permission. Counting how many times the consent prompt has been shown and on how many different days the app was opened relies on our legitimate interest (Art. 6(1)(f)) in not showing the prompt more often than necessary, and does not depend on analytics cookie consent.
• Lock screen: notification texts are kept short and neutral; the content of your chat messages, amounts and explicit wording are never included. In reply and "misses you" notifications the character's name may be visible on your lock screen (for example "Elif replied to you."); the content of the message is never shown. If a character's name contains explicit wording, that notification is not created at all; the text of announcement notifications also goes through the same automated check before it is saved. If other people can see your phone, you can turn these two types off in account settings or hide notification content on the lock screen in your phone's settings.
• Consent records: when you give permission and when you change your notification preferences, the consent record listed in Section 3 is kept so that we can demonstrate your consent.
• Delivery: notifications are delivered through your device's push service (see Section 5). For announcement, offer and "misses you" notifications see Section 4.7; for how to turn notifications off see Section 8; for retention periods see Section 7.

4.11 Profile Picture

If you upload a profile picture, it is checked automatically before it is published. For this check a reduced copy of the picture is sent to an artificial intelligence provider, and the provider is asked not to collect that copy. A picture that fails the check (is rejected) is not stored (except as described below). Some pictures are also reviewed by an administrator before they are published; a picture awaiting review is deleted no later than 14 days after upload.

• Fingerprint: for a picture flagged as appearing to show a minor, we keep only a fingerprint (a digest value) that prevents the same picture from being uploaded again and cannot be used to recreate the picture; the picture itself is not stored.
• Possible child sexual abuse material: Possible child sexual abuse material is stored in encrypted form, together with the upload time, account information and the upload IP address, and is reported to the competent authorities, in order to protect children and to comply with our legal obligations. This record is kept for 1 year after the report, or for as long as the authority requests, even if the account is deleted, and to the extent permitted by law it is excluded from data download and erasure requests. When this period ends, the image, the IP address, the username and the file digests are deleted; only a short record showing that the report was made (account ID, date, reference number) remains.
• Legal basis: the picture check and the fingerprint rely on our legitimate interests (Article 6(1)(f)) in protecting the Platform and children; storing and reporting possible abuse material relies on our legal obligations (Article 6(1)(c)) and our legitimate interests (Article 6(1)(f)).

5. Data Sharing and Recipients

We do not sell your personal data. We may share your data, strictly limited to the stated purposes, with:

Service Providers: Hosting/cloud providers, payment processors, email delivery services, and technical support/security providers.
Artificial Intelligence Service Providers: In order to generate chat responses,

your messages and character settings are transmitted to model providers

(including DeepSeek, Google and similar model providers accessed through

OpenRouter). For voice features, audio and speech-to-text data may be

transmitted to ElevenLabs; for image generation, your image prompts may be

transmitted to Novita; and for content moderation, message text may be

transmitted to Hotmate.

Some of these providers are located outside the European Economic Area,

including the United States of America and the People's Republic of China.

Such transfers are carried out subject to the safeguards described in Section 6. The transmission of your chat content to these providers is necessary for the operation of the service (Performance of a Contract, Article 6(1)(b)).

Phone Notification (Push) Services: If you have turned on phone notifications, they are delivered through the push service used by your device and browser: Google Firebase Cloud Messaging, Apple Push Notification service, Mozilla Push Service or Microsoft Windows Push Notification Services. Your device and browser determine which service is used. The notification text (including the character's name in reply and "misses you" notifications) is end-to-end encrypted, so these services cannot read it. They do see your device's notification address, that the notification was sent by Fanchaty, the time it was sent, the size of the encrypted data and the delivery settings (for example how long the notification may be held at most and its priority). Some of these services are located outside the European Economic Area, including the United States of America; such transfers are carried out subject to the safeguards described in Section 6. This transmission is necessary for the notifications you have chosen to turn on to reach you.

• Professional Advisors: Lawyers, accountants, and auditors.

• Authorities: Law enforcement or regulatory bodies when legally required or mandated by a court order.

• Authorized Staff: Internal personnel who need access to perform their duties.
  

  ---

6. International Data Transfers

Our servers or some of our technology service providers may be located outside the European Economic Area (EEA). In such cases, your personal data will only be transferred internationally if appropriate safeguards are in place, such as:

• An Adequacy Decision by the European Commission for the recipient country.

• The implementation of Standard Contractual Clauses (SCCs) approved by the European Commission, alongside your explicit consent or other valid transfer mechanisms under GDPR Chapter V.
  

  ---

7. Data Retention

Your personal data is retained only for as long as necessary to fulfill the purposes outlined or as required by law:
Account Deletion and Recovery Process: When you delete your account, your access

is terminated immediately and the automatic renewal of your subscription, if any, is stopped. For 30 days following deletion, you may recover your account by signing in with the same email address; during this period your chat history and

any remaining membership term are preserved. At the end of the 30-day period,

access to the account using that email address is permanently closed.

After that period, data subject to the statutory retention obligations set out

below (in particular payment/invoicing records and security/moderation records)

will continue to be retained for the periods prescribed by applicable law. Your remaining data will be deleted or anonymised.

Step-by-step deletion instructions, and how to request deletion if you cannot sign in: Account deletion page.

• Account & Usage Data: Retained while your account is active, and for a reasonable period (e.g., 3–5 years) after closure for potential dispute resolution.

• Payment & Billing Data: Retained for 5 to 10 years to comply with tax and commercial laws.

• Web App Usage Data: Daily records (openings and message counts) and install and install-suggestion events are deleted after 180 days. A device record is deleted after 180 days without use; device records not linked to an account and used on only one day are deleted after 100 days. If you delete your account, the device record's link to your account is removed.

• Phone Notification Data: Records of notifications that were skipped or could not be sent because they expired are deleted after 7 days; other notification records are deleted after 90 days. A device's notification subscription is deleted when you log out on that device or delete your account. A subscription is cancelled when the push service reports that it is no longer valid, when you do not open the app while logged in for 60 days, or when deliveries repeatedly fail with a permanent error; a cancelled subscription record is deleted after 30 days. While notifications are not open to everyone (temporarily switched off or during a gradual rollout), and during the first 60 days after they are reopened to everyone, this 60-day period does not run; even then, a subscription is cancelled no later than 180 days after it was last refreshed. Your notification preferences and the consent prompt counters are deleted when you delete your account. The marker of when you viewed a chat on screen (see Section 4.10) is deleted automatically after 15 minutes. The unread notification count on the app icon is reset when you open the app; if you do not open the app, it is deleted automatically 30 days after the last notification. Consent records are kept as proof of your consent for as long as your account exists and are deleted 30 days after your account is deleted.

• Marketing Data: Retained until you withdraw your consent, or deleted/anonymized after a prolonged period of inactivity. Once the retention period expires, data is securely deleted or anonymized.
  

  ---

8. Marketing Communications and Right to Object

If you have opted in to receive marketing emails:

• You can withdraw your consent at any time by emailing [email protected] or clicking the "unsubscribe" link in our emails.

• Note: Opting out of marketing does not affect essential service-related emails (e.g., password resets, billing notices).
  

Phone notifications: You can turn phone notifications, or some of them, off at any time:

• Account settings → Phone notifications: turn each type (service, replies, announcements and offers, "misses you") off individually; your choice applies to all your devices.

• Your phone's notification settings: turn off Fanchaty's notification permission in your phone's (or browser's) settings.

• Logging out: when you log out on a device, that device's notification subscription is deleted.

• Turning off only some notifications: for example, if you do not want character names to appear on your lock screen, it is enough to turn off the reply and "misses you" types; your other notifications keep coming.

9. Children’s Privacy

Fanchaty.ai is strictly not intended for individuals under the age of 18. If you are under 18, you must not use the Platform. Where we determine that an account has been created using a false declaration of age, access to that account will be blocked and the associated data will be deleted in accordance with applicable law, without prejudice to statutory

retention obligations.

10. Your Data Protection Rights (Under GDPR)

Depending on your location, particularly within the EEA or UK, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.

• Right to Rectification: Request correction of inaccurate or incomplete data.

• Right to Erasure ("Right to be Forgotten"): Request deletion of your data, subject to legal exceptions.

• Right to Restriction of Processing: Request that we temporarily halt processing your data.

• Right to Data Portability: Receive your data in a structured, machine-readable format to transfer to another controller.

• Right to Object: Object to processing based on legitimate interests or for direct marketing.

• Right to Withdraw Consent: Withdraw previously given consent at any time.

• Right to Lodge a Complaint: You have the right to file a complaint with your local Data Protection Authority (DPA) if you believe our processing violates the GDPR.
  

  ---

11. How to Exercise Your Rights

To submit a request regarding your privacy rights, please contact us at: 📩 [email protected] We will respond to your request within 30 days, as required by the GDPR. We may request additional information to verify your identity before fulfilling your request.

12. Data Security

We implement appropriate technical and organizational measures (such as access controls, encryption, logging, and firewalls) to protect your personal data against unauthorized access, loss, alteration, or unlawful disclosure. While no system is 100% secure, we continuously strive to apply reasonable and up-to-date security practices.

13. Changes to the Privacy Policy

We may update this Policy from time to time. The updated version will be:

• Published on the Platform,

• Reflected in the "Effective Date" at the top of this document. For significant material changes, we may notify you via email or an in-platform alert. Continued use of the Platform signifies your acknowledgment of the updated Policy.