Privacy
Policy

Viktor Kerner
Sole Proprietorship (Jednoosobowa działalność gospodarcza)
Polna 7, 64-000 Kiełczewo, Poland
Email: legal@ailina.chat

Responsible data protection supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland. As an EU citizen, you can also contact the data protection authority of your country.

Account and Authentication Data:

Your Google account is used once for authentication. We store your email address and user ID.

Chat Content:

Your messages are stored on our servers (Supabase) to show you your chat history. This data is encrypted and only visible to you.

Voice Messages:

When you record a voice message, the audio file is stored encrypted on our servers (Supabase Storage, EU) so you can listen to it again later. Voice messages are automatically and irrevocably deleted after 3 days. Deletion is automated via a daily cleanup process. Audio files are not shared with third parties and not used for AI training. AI-generated voice responses (text-to-speech) are deleted after 14 days.

Metadata:

We store timestamps, characters used, and usage statistics to improve our service.

Payment Data:

All payments are processed through our payment service provider Centrobill (Centrobill Ltd., EU, PCI-DSS certified). Card and bank details are entered exclusively on the encrypted Centrobill payment page, we never store card or bank data. We only receive: transaction ID, status, amount, product identifier and timestamp. This data is used for activating your subscription/coin balance, invoicing, and statutory retention (e.g. § 147 AO, § 257 HGB, typically 10 years for tax and commercial law purposes). Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (statutory retention obligation).

Existing customers: If you make a purchase, we use your email address to occasionally inform you about our own similar offers (e.g. your remaining diamond balance or new features). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in direct marketing, Recital 47) in conjunction with § 7(3) UWG. You can object to this use at any time, free of charge , via the unsubscribe link in every email or in your profile settings. After an objection you will receive no further advertising.

Newsletter: We send promotional newsletters without a prior purchase exclusively with your explicit consent (Art. 6(1)(a) GDPR), given when you check the newsletter box. You can withdraw this consent at any time with effect for the future, withdrawal is as easy as giving consent (unsubscribe link / profile).

✓ Authentication and account management
✓ Storage and display of your chat content
✓ Improvement of our AI models (anonymized)
✓ Sending important service notifications
✓ Security and abuse prevention

Right of Access: You can find out at any time what data we have about you.

Right to Deletion: You can delete your account and all associated data at any time.

Right to Data Portability: You can export your data in a standard format.

Right to Rectification: You can correct inaccurate data.

We only share your data when:

✗ You explicitly consent
✗ It is legally required (e.g. law enforcement)
✗ It is necessary for the provision of essential services

We work with the following service providers:

✓ Supabase , Authentication, database and file storage (EU servers)
✓ Google , OAuth login
✓ Centrobill , Credit card processing (EU data processor, PCI-DSS certified; card entry happens exclusively on the Centrobill page, we only receive transaction IDs and status)
✓ AI providers for text generation (chat responses and memory extraction; servers in the USA, Standard Contractual Clauses in place, your content is not used for AI training)
✓ AI providers for image and video generation (USA, SCCs in place)
✓ AI providers for speech synthesis and speech recognition (USA, SCCs in place)
✓ AI providers for automated content moderation, including a compliance review service required by the card networks (Visa/Mastercard) (USA, SCCs in place)
✓ Embedding provider for the memory system (EU provider; only text fragments without account data are transmitted)
✓ Sentry , Error and performance monitoring (EU servers)
✓ Amplitude , Usage analytics (EU servers, consent only)

Personal chat content is never shared with third parties for their own purposes (e.g. marketing or sales). Transmission to the above-mentioned technical service providers is exclusively for the purpose of providing the service (generating responses/images). We have concluded data processing agreements with these providers that prohibit the use of your data for their own purposes (e.g. AI training).

Note: The specific AI providers and models used are part of our trade secrets and may change as technology evolves. We will provide a complete, up-to-date list of our data processors upon request to support@ailina.chat as part of your right of access (Art. 15 GDPR).

Data transfer to third countries: Some of our service providers are based in the USA. Data transfer is based on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. Where possible, we use EU servers (Supabase, Amplitude, Sentry).

All characters, profile pictures, chat responses, generated images, videos and voice messages displayed on ailina.chat are fully AI-generated and do not depict real persons.

What data is sent to AI services:

• Chat (AI text generation): The last ~20 messages of your conversation are sent as context to our AI provider to generate a response. Chat content is not used by the providers for training (zero data retention / no storage).
• Content moderation (two-layer): Each user message is checked by a two-layer automated moderation system before being forwarded to the chat system. Only the text content of the message is transmitted, no account data or personal information.
• Compliance moderation (card-network requirement): Required by our payment provider for card-network compliance (Visa/Mastercard). Every chat message (user input + AI response) is asynchronously submitted to a specialized compliance review service. Transmitted data: message text, user ID, email address and the character you're chatting with. Three or more flagged messages within 30 days result in automatic account suspension.
• Image and video generation: Only text prompts (image descriptions) and possibly a character reference image are sent to the AI provider. Your personal messages are NOT used for image generation.
• Speech synthesis and speech recognition: For AI voice replies, only the text of the bot response is sent to the speech synthesis provider. If you record a voice message, the audio file is transmitted to an AI speech-recognition provider for transcription and is not permanently stored there.
• Memory (in-house system): Memory facts extracted from conversations (e.g. preferences, mentioned interests) are stored in our own database (EU) to maintain context across multiple sessions. Extraction is performed via our AI text provider (see Chat). For semantic search, only text fragments without account data are transmitted to an EU embedding provider for vectorization.

The LoRA models used are freely available open-source weights and do not contain biometric data of real persons.

Your data is transmitted using modern encryption technologies (TLS/SSL). Chat content is encrypted on our servers.

However: No method is 100% secure. We cannot guarantee absolute security.

We use cookies and similar technologies. On your first visit, you will be asked for consent via a cookie banner. Both options (“Only Necessary” and “Accept All”) are presented equally.

Legal Basis: Art. 6(1)(a) GDPR (consent) for analytics cookies, Art. 6(1)(f) GDPR (legitimate interest) for necessary cookies.

Necessary Cookies (always active, no consent required):

✓ sb-*-auth-token , Supabase session (authentication, validity: session)
✓ ailina_age_verified , Age verification (30 days)
✓ ailina_cookie_consent , Your cookie settings (unlimited until revocation)

Analytics Cookies (only with your explicit consent):

Provider: Amplitude, Inc. Usage analytics
Server location: EU (Frankfurt, GDPR-compliant)
Storage duration: Amplitude cookies are stored for a maximum of 12 months
Data processing: Agreement pursuant to Art. 28 GDPR with Amplitude

What is collected (only with consent):

✓ Page views and navigation behavior
✓ Clicks on buttons and interactive elements (e.g. “message sent”, “character selected”)
✓ Wizard progress during character creation (step numbers)
✓ Technical information: browser type, device type, screen size, operating system
✓ Anonymized session recordings (Amplitude Session Replay) for error detection

What is NOT collected:

✗ Chat content or personal messages
✗ Passwords or payment data
✗ Email addresses (except as pseudonymized user ID)
✗ IP addresses are not stored by Amplitude

Purpose: Improving user-friendliness, detecting errors and non-functioning elements, optimizing user flow during the beta phase.

Revocation: You can revoke your consent at any time via the “Cookie Settings” link in the page footer. From the point of revocation, no further analytics data will be collected.

We do NOT use Google Analytics and do NOT share tracking data with third parties.

Your chat content is stored as long as your account is active. After account deletion, all data is deleted within 30 days. Accounts that remain fully inactive for more than 12 months (no login and no messages) are automatically deleted after a prior email reminder (storage-limitation principle, Art. 5(1)(e) GDPR).

If we change this privacy policy, we will notify you by email.

Questions about data protection? Contact us: legal@ailina.chat

You have the right to file a complaint with the competent data protection supervisory authority. For our registered office in Poland, the UODO (Urząd Ochrony Danych Osobowych) is responsible. You can also contact the authority in your EU country.