Privacy notice

Who is responsible for your data

Lust Legends is the controller of the personal data described here. You can reach us about anything on this page, including a request to exercise the rights below, at legal@lust-legends.example.

PLACEHOLDER pending counsel: our registered company name and address, whether we are required to appoint a data protection officer, and — if we have no establishment in the EU — the representative appointed under Article 27 of the GDPR, will be named here before launch. Until then, write to the address above and it will reach the right person.

What we process, why, and on what legal basis

We keep what the service needs to work and nothing we have no use for. Each category below says what it is for and the legal ground we rely on.

• Your account. The sign-in identity your account is linked to, and the record that you confirmed you are 18 or older and accepted the terms. We need this to give you an account at all, and to show that the age confirmation happened. Legal basis: performance of our contract with you, and our legal obligations.
• Your membership and purchases. Subscription status, payments and refunds. Card details are handled by our payment provider and never reach us. Legal basis: performance of our contract with you, and our legal obligations for tax and accounting records.
• What you do in the app. Your conversations, the characters you have matched with, and how those relationships have progressed. This is the service itself — it is what makes the app remember you between visits. Legal basis: performance of our contract with you. PLACEHOLDER pending counsel: because of what this service is, some of this is likely to reveal information about your sex life or sexual orientation, which the law treats as a special category. Where that is so, we rely on your explicit consent under Article 9(2)(a) of the GDPR, given when you create an account, and you can withdraw it at any time by deleting your account.
• Safety and abuse signals. Records created when something is reported, blocked or acted on. We keep these to protect people using the service and to meet legal obligations, including reports about illegal content. Legal basis: our legal obligations, and our legitimate interest in keeping the service safe.
• Basic technical data. Information every website receives when you connect, such as the country your connection appears to come from, used to keep the service secure and available where it is permitted. Legal basis: our legitimate interest in a secure and lawfully operated service.

Cookies and storage on your device

We use only what the service needs to function, and we set no advertising or analytics cookies. That means a sign-in cookie, which keeps you signed in and is set by our sign-in provider; and a small amount of storage in your own browser, which remembers things like whether you have already seen the notice telling you that the characters are AI, so we do not show it to you every time.

Clearing your browser storage removes those; it will sign you out and you may see the AI notice again. Nothing you delete there deletes anything from your account.

How long we keep it

We do not state fixed retention periods, and the criteria we use instead are set out in full below, in the same words the file you can download carries.

We show you exactly which records apply to your own account before you confirm a deletion. That list is specific to you, so it lives in your account rather than on this page — you will see it in the deletion step in your profile, and nothing is deleted until you confirm.

Your rights

Depending on where you live, you can ask us to do a number of things with your data — they are set out in full below, in the same words the file you can download carries. What follows is how you exercise them here today.

You can start deleting your account yourself from your profile, at any time, without asking us first. If a legal obligation requires us to keep something — a legal hold — we will tell you so before anything is deleted, and we will tell you again if it stops us at the point you confirm.

Getting a copy of your data. You can download a copy of your data yourself, from your profile, at any time and without asking us first. It comes as one file. Some things are left out — safety records, and the logs of who has looked at your data — and the file itself lists what was left out and why.

How to exercise the rest of them today. Getting a copy and deleting your account are the two you can do yourself from inside the app right now; there is no self-service tool for the others yet. For any of them, write to us at the address above and we will handle it by hand. We would rather tell you that plainly than offer you a button that does not work.

What we tell you when you ask for a copy of your data

You can download a copy of your data from your profile at any time. The file carries the statements below in its own right, and they are reproduced here word for word so you can read them without downloading anything.

PLACEHOLDER — pending counsel sign-off. The statements below describe how this service handles personal data; the binding language will be finalized by legal counsel before launch.

What we use your data for

• Giving you an account, and keeping the record that you confirmed you are 18 or older and accepted the terms.
• Running the service itself: your conversations, the characters you have matched with, and how those relationships have progressed.
• Taking payment, and keeping the records that tax law and card-network rules require.
• Keeping the service safe: acting on reports, blocks and abuse signals, and meeting obligations about illegal content.
• Keeping the service secure and available only where it is lawfully permitted.

The kinds of data we hold

• Account data: the address you sign in with, when the account was created, and the record that you confirmed you are 18 or older and accepted the terms.
• Conversation data: everything you have written to a character and everything they have written back, plus the running summary each character keeps.
• Relationship data: which characters you have matched with, and how each relationship has progressed.
• Payment and balance data: what you were charged, what was refunded or disputed, and how your Gold and daily allowance moved.
• Safety and moderation data: reports, blocks and the outcome of automated checks on what is written.
• Technical data: the country your connection appears to come from, and the records of when your data was accessed.

Who else receives it

• The provider of the AI models the characters run on — every message in this file was sent to that provider in order to be answered.
• The provider that runs our sign-in, which holds your email address and password.
• Our payment processor, which holds your card details; we never receive them.
• Hosting, content delivery and security providers that keep the service running.
• Providers that screen content for safety, and, where the law requires it, the authorities such reports go to.
• Anyone we are legally obliged to disclose to, in response to a valid legal request.

Some of the providers above operate outside the country you live in, so your data may be transferred internationally. Where that happens we rely on the safeguards the law requires for such transfers — standard contractual terms approved for the purpose, or a decision by the relevant authority that the destination offers adequate protection — and you can ask us for the details of the ones that apply.

How we decide how long to keep it

• Anything kept only to run the service is kept for the life of your account, and removed when you delete it.
• Anything kept beyond that is kept because a specific obligation requires it — tax and accounting records, evidence a payment dispute may need, and safety records the law requires us to preserve — and only for as long as that obligation lasts.
• We do not state fixed periods, because they differ by country and by record, and a number we could not stand behind would be worse than the criterion.

Where it came from

• Nearly everything in this file came from you: what you wrote, what you chose, and what you did in the service.
• What did not come from you came from our payment processor (whether a charge succeeded, was refunded or was disputed) and from the provider that runs our sign-in (that a sign-in happened, and the address you used).
• We do not buy data about you, and we do not receive data about you from data brokers or advertisers.

What you can ask us to do

• You can ask us to correct anything about you that is wrong.
• You can delete your account and the data we hold about you. You can start that yourself from your profile, at any time, without asking us first — and you will be shown exactly what is removed and what has to be kept before anything happens.
• You can ask us to restrict how we use your data, or object to us using it, where the law gives you that right.
• You can withdraw consent you have given, without affecting what happened before you withdrew it.
• Apart from getting a copy and deleting your account, these are handled by hand rather than by a button, and the contact address is in our privacy notice.

Automated decisions

We use automated systems to check messages for safety and to apply restrictions when our rules are broken, so a message can be blocked or an account limited without a person reviewing it first. We do not use automated processing alone to make decisions that produce legal effects about you, we do not build advertising profiles, and we do not sell your data.

Complaining to a regulator

You have the right to complain to your local data protection authority, and you can do that whether or not you have contacted us first. In the EU that is the supervisory authority in the country where you live or work.

If you disagree with us

If you think we have handled your data wrongly, tell us first and we will look at it. You do not have to go through us — the right to complain to a regulator is set out above, and it applies whether or not you have contacted us.

Reporting illegal content

If you want to report content on this service that you believe is illegal, that is a different channel and it is open to anyone, with or without an account: report illegal content. You can also read our terms and acceptable use policy.