Privacy Notice

1. Controller. The controller of your personal data is Petr Fojtách (IČO 74125770), sole trader with registered seat at Dlouhá 3403/2b, 702 00 Ostrava-Moravská Ostrava, registered under Czech law, contact for all data protection matters: hello@dearmyai.com.

2. What we process and why (GDPR Art. 5, 6). The Provider applies strict data minimisation. The Service is designed so that, for its core function, only the following data is processed:

• Conversation content: the messages you exchange with the AI characters, stored to operate the Service (chat history), to provide the conversation function, and to detect violations of the Terms. Legal basis: performance of the contract (Art. 6(1)(b)) and the legitimate interest in a safe service (Art. 6(1)(f)).
• Age statement: your confirmation that you are 18 or older. Legal basis: legal obligation (protection of minors, Art. 6(1)(c)) and contract performance (Art. 6(1)(b)).
• Technical and account data: the minimum account identifiers necessary to operate the Service (for example a session or platform account reference).

We do not require and do not store in the core function: your full date of birth, home address, telephone number, photographs, documents, or payment card details. Payments, where offered, are processed by a payment provider; the Provider does not receive or store your card data.

3. Age assurance, self-declaration. Age is established by self-declaration (your confirmation of being 18 or older). Because this service is intended for adults, no processing of the personal data of persons under 18 takes place: if a person is under 18, or refuses to confirm the age statement, the Service neither saves any conversation of that person nor processes any of that person's data, and access is denied.

4. Voluntary identity verification via Stripe. Optionally, where offered in the application, you may choose to verify your identity or age through Stripe Identity, operated by Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.). This verification is entirely voluntary and is not a condition of access. If you use it: the document images and verification data are processed by Stripe under its own privacy policy (https://stripe.com/privacy); the Provider receives only a verification result (pass or not pass) and does not receive or store your identity document images. Legal basis, where used: your consent (Art. 6(1)(a)), which you may withdraw at any time without effect on the lawfulness of processing carried out before the withdrawal.

5. Recipients and processors. Personal data is processed by the Provider and by the following categories of recipients: the provider of the AI inference service (processing of conversation content to generate responses, contractually bound not to use the content for training), the hosting provider, and, if you use it, Stripe as the verification provider. Agreements under GDPR Art. 28 (data processing agreements) are in place. Transfers outside the EEA take place only with appropriate safeguards, in particular the EU Standard Contractual Clauses; information on them is available on request.

6. Retention. Conversation history is retained while your account is active. Inactive conversations are deleted no later than 12 months after the last activity, unless you request earlier deletion. Security and moderation logs are retained for up to 12 months. Verification results, where you use the voluntary Stripe verification, are retained for as long as the verification remains relevant, at most 24 months.

7. Your rights (GDPR Art. 15 to 22). You have the right of access, rectification, erasure, restriction of processing, data portability, and objection. You can delete your account and all associated data at any time in your account settings on dearmyai.com, including deleting your character with one click (GDPR erase). You may also exercise your rights by emailing the Provider at hello@dearmyai.com, stating which right you are exercising and from which account. Withdrawing consent to the processing of conversation content has the effect of ending the Service and the deletion of your data.

8. Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority, in particular the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz), or with the authority of your place of residence.

9. Automated decision-making. No decision producing legal effects for you is made solely by automated means. Moderation flags are subject to human review so far as technically possible.

10. Changes. Changes to this Notice will be announced in the Service. The version current at the time of processing applies.

11. Contact. hello@dearmyai.com

12. Web account (email login). If you create a web account on dearmyai.com, we process your email address and a password; the password is stored only as a one-way cryptographic hash (Argon2), never in plain text. If you use the "forgot password" function, a single-use reset link valid for at most 1 hour is generated. Password reset request logs are kept for security purposes for at most 12 months. If you delete your web account, all associated authentication data is anonymized or deleted within 30 days.

13. Sign-in with Google. If you choose to sign in with Google, we receive from Google only the OpenID Connect ("openid, email, profile") identifiers: your Google email address, name, and a Google account identifier (Google ID). Google LLC is the provider of the sign-in service and acts as an independent controller for that service; see Google's Privacy Policy (policies.google.com/privacy). We use these identifiers only to create or match your Dear my... account (matched by your verified email address), to maintain your session, and for service security. We never receive or store your Google password. You can revoke dearmyai.com's access at any time in your Google account settings (myaccount.google.com/permissions).

14. Website and email language. To show dearmyai.com in your language, we use the language of your browser and, only if it is not one of the languages we offer, the country of your IP address. The country is looked up on our own server in a local database (IP Geolocation by DB-IP, https://db-ip.com, CC BY 4.0); your IP address is not sent to anyone for this and is not stored for this purpose. The website language you use when you sign up, sign in or open your account is saved with your account, so that our emails reach you in the same language. Legal basis: legitimate interest in providing the Service in a language you understand (Art. 6(1)(f)).

15. Partner program. Some visitors come to us through a partner (for example a creator who recommends Dear my…). If you open a partner's link or enter a partner code when signing up, we record which partner referred you, the code, an optional campaign label, the time, the page, your country and device type, and a one-way hash of your IP address and browser made with a key that changes every day (your IP address is not stored in readable form). When you create an account, the referral is linked to it so that we can calculate the partner's commission from your payments. Partners never receive your name, email address, Telegram account or conversations; they only see an anonymous overview (date, country, plan, amount). Legal basis: legitimate interest in paying our partners correctly and preventing fraud (Art. 6(1)(f)). Click records are kept for 90 days and then only as daily totals; the referral is kept while commission can arise and then for the periods required by accounting law. If you delete your account, your email address in these records is replaced by an irreversible hash.

Account data: your email address, a hashed password or (if you sign in with Google) your Google identifier and name, and a reference to your Telegram account.

Our payment processor Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.) processes payments; we do not receive or store your card data. You use the Service through Telegram, a messaging platform operated by Telegram, which processes messages under its own privacy policy.

You may share sensitive information (for example about health, sexuality or beliefs) in your conversations. We process such information only on the basis of your explicit consent (Art. 9(2)(a) GDPR), given at registration. You can withdraw consent at any time by deleting your account; withdrawing consent ends the Service.

Dear my… is a companionship and entertainment service. It is not a medical, psychological or therapeutic service and is not a substitute for professional help. If you are in crisis or thinking about harming yourself, contact your local emergency number (112 in the EU) or a local crisis line.

When you delete your character in your account settings, the following data is erased without undue delay: your chat history, your character profile and persona configuration, and the memory of your conversations. Security and moderation audit logs are anonymized (detached from your account) within 30 days and retained only in anonymized form; security and moderation logs referenced in Article 6 are retained for up to 12 months as described there.