Privacy Notice

Personal data

Any information about an identified or identifiable person: your email address, your IP address, the account identifier we give you, and what you send us where it identifies you.

Processing

Anything done with personal data: collecting, storing, using, sending, changing, disclosing or deleting it.

Controller

Whoever decides why and how personal data is processed. For the Services, that is Sub Zero Labs OÜ.

Processor

A company that processes personal data for us, on our instructions: our hosting, storage and AI providers. They may not use your data for their own purposes.

Content

What you put into the Services (messages, characters, personas, directions) and what the Services generate from it (replies, scenes, images, voice).

Each row is one processing activity, the data it involves, and the legal basis we rely on under the GDPR. Where the basis is consent, you can withdraw it at any time; see Your rights.

If you do not give us the data a contract needs, such as an email address, we cannot give you an account.

We never see or store your full card number, expiry date or security code. On the website, card details are entered on and processed by our payment provider, on its own systems.

Card payments on the website are processed by Finby, a licensed European payment institution. To process a payment it receives what its fraud, risk and settlement obligations require: typically your name and email address, the card's scheme, last four digits and issuing country, the amount and currency, your IP address, and the outcome. For that processing Finby is an independent controller, under its own privacy policy and financial-services law, including anti-money-laundering rules.

What comes back to us is limited: whether the payment succeeded, our own reference for it, the amount and currency, the time, the card's brand and last four digits, and, for a subscription, Finby's reference that lets us charge the same card at renewal. That reference is not your card number and cannot be used anywhere else.

Charges appear on your card statement as CHARACTERX.APP, which does not describe the content of the Services.

In the iOS app, purchases are made through Apple, which processes your payment as an independent controller under its own privacy policy. We use RevenueCat to learn from Apple which subscriptions and packs your account holds; it receives your account identifier and your purchase records. We never receive your Apple payment details.

This section matters more than any other, so it is stated plainly.

• Your messages are sent to AI model providers. A character's reply is written by a large language model running on third-party infrastructure; sending it your message, the conversation so far and what the character remembers is the only way a reply can exist. The same is true of the sentence you create a character from, and of the directions behind images and voice.
• We instruct our AI providers not to use your Content to train their models, and choose services on that basis. We cannot audit their infrastructure, and we tell you so rather than promise otherwise.
• We do not train our own models on your chats, and we do not sell, rent, publish or share them with anyone for their own purposes.
• We keep your chats so you can come back to them and so characters can remember what happened. That is a feature, and it is why the history exists.
• Your chats can reveal intimate things about you, including your sexual preferences. We process them only to provide the Services to you, and to keep them safe as described in Safety and reports.
• Generated output can be wrong. Do not treat it as fact, advice, or the words of a real person.

Do not put into a chat what you would not want processed this way. Characters are software; they have no need to know who you really are. Never share your full name, address, financial details, identity numbers, passwords, or another person's personal data in a conversation.

You can delete a chat from your Library, and deleting your account deletes all of them, as set out in How long we keep data.

Pictures and audio are delivered through file URLs. We do not list your private media publicly, but someone with a working file URL may be able to open it. Avoid sharing those URLs if you want the media to remain private.

Safeguards are built into how content is generated, so that characters are adults and are painted as adults, and a model may refuse or change a request. What you type to create a character, a persona, a scene or a picture is read by an automated check, using our lists of prohibited terms and an AI review, and a refused picture request or a request the AI review stops is recorded with your account and the time. We do not read your chats out of curiosity.

When we receive a report, or otherwise have reason to believe our Terms or Content Policy have been broken, authorised staff may review the content concerned, other content on the account, and the account's data, and may act on it: removing content, restricting features, or suspending or closing the account.

We have zero tolerance for sexual content involving minors. Where we find it, we may report the material and the associated account data to the competent authorities as the law requires or permits. This processing does not depend on your consent.

We disclose personal data only where it is needed to run the Services, where we have a legitimate interest, where you have consented, or where the law requires it. We do not sell personal data, and we do not share it with anyone for their own marketing.

These are the providers we currently rely on:

We also disclose personal data to our professional advisers (lawyers, accountants) where we need their advice; to law-enforcement, regulatory and judicial authorities where the law requires it or to protect someone's vital interests; and, in a merger, acquisition or sale of assets, to the buyer and its advisers, in which case your data stays under this notice until you are told otherwise.

We may share aggregated or de-identified statistics that cannot be linked back to you.

Several of the providers above are established or process data outside the European Economic Area, principally in the United States, and, for some chat generation, in China. Your personal data may therefore be transferred there.

Where it is, we rely on an adequacy decision of the European Commission where one covers the recipient, and otherwise on the Commission's Standard Contractual Clauses together with technical and organisational safeguards. You can ask us for a copy of the safeguards for a specific transfer, with commercially confidential terms removed.

We keep personal data while your account exists and for as long as we need it for the purpose we collected it, unless the law requires otherwise.

Deleting your account does not remove records we must keep by law, and does not undo a report already made to an authority.

There are no advertising cookies, no analytics tools and no cross-site trackers on the website. Nothing we store on your device is used to profile you or to target advertising.

What we do store is strictly necessary: the cookies and browser storage that keep you signed in and keep your session secure, a cookie recording that you confirmed you are an adult when you arrived (kept for up to a year), and a few small interface choices remembered on your device. These do not need consent under the ePrivacy rules, because the Services cannot work without them.

A partner's link. If you arrive through a partner's link (one carrying ?ref=), we keep that partner's code in your browser's local storage for up to 90 days, with the page you landed on and a random identifier for your browser, so the partner who introduced you is credited if you create an account. It is not used to profile you, is never combined with your chats or pictures, and a partner sees it only as a count. Clearing your browser's storage removes it.

Google's sign-in. When the sign-up screen opens in Chrome, Edge or another Chromium browser, Google's sign-in script keeps one cookie on our site, called g_state, for up to 180 days. It records when Google last offered you its one-tap sign-in, so Google does not offer it too often. Google's script is loaded only on the sign-up screen, and Google's own cookies on Google's sites are under Google's policy.

When you pay, Finby's payment pages are served by Finby and may set their own cookies under Finby's policy.

You can clear or block cookies and storage in your browser, but you will be signed out and parts of the Services will stop working.

Under the GDPR and similar laws you have these rights over your personal data. Using them is free, and never counts against you.

Access

Confirmation of whether we process your data, a copy of it, and information about the purposes, recipients, retention and source.

Rectification

Have inaccurate data corrected and incomplete data completed. Much of this you can do yourself in the Services.

Erasure

Have your data deleted where it is no longer needed, where you withdraw consent and no other basis applies, where you successfully object, or where it was processed unlawfully. This does not override what the law requires us to keep.

Restriction

Have processing paused while accuracy or an objection is checked, where processing is unlawful but you do not want deletion, or where you need the data for a legal claim.

Portability

Receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where feasible.

Objection

Object at any time to processing based on our legitimate interests. We stop unless we have compelling grounds that override your rights, or need the data for a legal claim.

Withdraw consent

Withdraw any consent you gave, at any time. It does not affect processing that already happened, and it may mean we can no longer provide part of the Services.

No automated decisions with legal effect

We do not make decisions with legal or similarly significant effects about you by purely automated means. An automated check may refuse a single request; restricting an account needs a person to confirm it, and you can ask for a person to review any restriction.

To use any of these rights, write to support@characterx.app from the email address on your account. We may need to confirm it is you. We answer within one month; if a request is complex we may extend that by up to two more months, and will tell you why within the first month.

If you live in California, you also have the right to know what we collect, to have it deleted or corrected, and not to be discriminated against for using those rights. We do not sell or share personal information as the CCPA defines those terms. Use the same address.

Security

We use technical and organisational measures suited to the risk: encryption in transit, access controls and least-privilege access to production systems, and providers chosen for their own security. We hold no card numbers and no plain-text passwords.

No system is perfectly secure. If a breach is likely to put your rights at high risk, we will tell you and the supervisory authority as the GDPR requires.

Minors

The Services are for adults. We do not knowingly collect personal data from anyone under 18, or under the age of majority where they live if that is higher. If we learn an account belongs to a minor, we close it and delete its data as quickly as we can. If you believe a minor has an account, tell us at support@characterx.app.

For any question about this notice, or to use your rights:

Controller

Sub Zero Labs OÜ

Registered office

Sepapaja tn 6, 15551 Tallinn, Estonia

Register code

17449187

Email

support@characterx.app

We would rather resolve a concern with you directly, so please come to us first. You always have the right to complain to a supervisory authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the authority in the EU country where you live or work, or the Information Commissioner's Office if you are in the UK.

We update this notice when our practices or the law change. The new version is posted here with a new date, and takes effect when posted. Where a change is significant we will tell you before it takes effect, by email or in the Services, and where it needs your consent we will ask for it.