Privacy Policy

The data controller for personal data collected through lovora.ai is the operator of Lovora ("Company," "we," "us").

Contact: info@lovora.ai

For all privacy-related enquiries, including data subject rights requests, please use the email above with subject line "PRIVACY REQUEST."

2.1 Account Data - When you register:

• Email address
• Display name
• Profile photo (only if you sign in with Google and Google provides one)
• Authentication provider (email/password or Google)
• Account creation date

Legal basis: Contract performance (Art. 6(1)(b) GDPR) - necessary to provide your account and access the Service.

2.2 Subscription and Transaction Data

• Subscription plan and status, start and end dates
• Credit balance and transaction history
• Payment processor transaction IDs (we do not store card numbers)

Legal basis: Contract performance and legal obligation (Art. 6(1)(b)(c)).

2.3 Usage Data

• Number of messages sent (counted for the free tier limit)
• Features accessed
• Log data: IP address, browser type, pages visited, timestamps

Legal basis: Legitimate interests (Art. 6(1)(f)) - security, fraud prevention, service improvement.

2.4 Analytics Data (with your consent)

• If you accept analytics cookies: Firebase Analytics / Google Analytics collects aggregated usage data including page views, session duration, and device type.

Legal basis: Consent (Art. 6(1)(a)). You may withdraw consent at any time via our cookie settings.

2.5 Affiliate Data

• Referral code, referral relationships (who referred whom), and commission calculations.

2.6 AI Conversation Data (Chats)

When you chat with an AI companion, your messages and the companion's replies are stored on our servers linked to your account, so you can continue conversations where you left off and the companion can remember context. Because our companions are adult in nature, these conversations may reveal information about your sexual preferences or activity — a special category of personal data under Art. 9 GDPR.

• Legal basis (service): Contract performance (Art. 6(1)(b)) — storing your conversation history is necessary to provide the chat feature.
• Explicit consent (special category): By creating an account and using the adult chat, voice, image and video features you give your explicit consent (Art. 9(2)(a)) to our processing of the sexual or erotic content of those interactions for the purposes described in this Policy. You may withdraw consent at any time by deleting your account.
• Safety & moderation: Conversations and generated media may be reviewed — by automated systems and, where necessary, by authorised staff — to detect and prevent prohibited content (in particular child sexual abuse material, and non-consensual or violent content), enforce our Terms, and comply with legal obligations (Art. 6(1)(c)/(f)). Staff access is limited to these purposes.

We do not sell your conversations and we do not use their content for advertising or marketing. Aggregated, anonymised data may be used to improve AI safety and quality. You can erase your conversations at any time by deleting your account (see Section 6).

• Providing, operating, and maintaining the Service;
• Processing payments and managing subscriptions;
• Sending transactional emails (account confirmation, password reset, billing receipts);
• Enforcing our Terms of Service and content policies;
• Detecting and preventing fraud, abuse, and illegal activity;
• Complying with legal obligations, including mandatory reporting of CSAM to law enforcement;
• Improving the Service based on aggregated analytics (with consent);
• Communicating service-related updates and changes.

We do not sell your personal data to third parties. We do not use your data for automated individual decision-making or profiling that produces legal or similarly significant effects.

We share your personal data only with:

• Firebase / Google (USA): Authentication, database hosting, and analytics. Governed by Google's Standard Contractual Clauses and Data Processing Agreement.
• Payment Processors (CCBill / Epoch / SegPay): To process subscriptions and purchases. They receive only the data necessary for payment processing and are bound by their own PCI-DSS compliant privacy policies.
• Law Enforcement: We will disclose data as required by law or court order, and will proactively report CSAM and child exploitation material to the relevant national authority and NCMEC without prior notice.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity, subject to the same privacy protections.

Our infrastructure uses Firebase (Google Cloud), which processes data in data centres that may be located outside the European Economic Area (EEA), including the United States. These transfers are protected by:

• Google LLC's Standard Contractual Clauses (SCCs) approved by the European Commission;
• Google's compliance with applicable data transfer frameworks.

You may request a copy of the relevant safeguards by contacting us at info@lovora.ai.

• Account data: Retained for the duration of your account. On deletion it is erased from our active databases (see below).
• Conversation & generated-media data: Retained while your account is active so you can continue your chats; erased when you delete your account.
• Content-moderation records: Logs of blocked prohibited-content attempts and related metadata are retained as abuse/CSAM evidence under Art. 17(3)(b)/(e) GDPR, even after account deletion.
• Transaction/billing data: Retained for 10 years to comply with Italian fiscal and accounting law (D.P.R. 600/1973).
• Analytics data: Retained for up to 14 months in Firebase Analytics, then automatically deleted.
• Log data: Retained for up to 90 days for security purposes.

When you delete your account, we erase your profile, your conversations (chats), your generated images, videos and characters, your usage and subscription records and your affiliate data from our active databases — immediately, and in any case within 30 days. We retain only (a) a limited set of content-moderation records as evidence, as described above, and (b) transaction/billing data for the fiscal period required by law.

As an EU/EEA resident, you have the following rights under the GDPR:

• Right of access (Art. 15): Request a copy of your personal data.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten"). You can also delete your account directly from your dashboard.
• Right to restrict processing (Art. 18): Request that we limit how we use your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Withdraw analytics consent at any time via cookie settings, without affecting the lawfulness of prior processing.
• Right not to be subject to automated decisions (Art. 22): We do not make legally significant automated decisions about you.

To exercise any of these rights, email info@lovora.ai with subject "GDPR REQUEST." We will respond within 30 days.

Right to lodge a complaint: If you believe your data has been processed unlawfully, you have the right to lodge a complaint with your national supervisory authority. In Italy: Garante per la protezione dei dati personali (www.garanteprivacy.it).

This section applies to residents of California and supplements the rest of this Policy, as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA").

8.1 Categories of personal information we collect

• Identifiers: email address, display name, IP address, account/device identifiers.
• Commercial information: subscription plan, credit balance, transaction history, payment-processor transaction IDs (we do not store card numbers).
• Internet/network activity: pages visited, features used, message counts, log data.
• Sensitive personal information: the content of your adult chats, voice, image and video interactions, which may reveal data about your sex life or sexual orientation. We use this information only to provide the Service you request and for safety, moderation and legal-compliance purposes — never to infer characteristics about you for advertising.

8.2 We do not sell or share your personal information

We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months, including with respect to the personal information of consumers under 16.

8.3 Your California rights

• Right to know / access: request the categories and specific pieces of personal information we have collected about you.
• Right to delete: request deletion of your personal information (subject to legal exceptions such as fraud prevention and our retention of moderation and billing records).
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale/sharing: because we do not sell or share your personal information, there is nothing to opt out of; no "Do Not Sell or Share My Personal Information" mechanism is required.
• Right to limit use of sensitive personal information: we already limit our use of sensitive personal information to the purposes permitted under the CCPA/CPRA (providing the Service, safety and legal compliance), so no separate limitation request is necessary.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email info@lovora.ai with subject "CCPA REQUEST." We will verify your request using the email address associated with your account and respond within 45 days. You may use an authorized agent to submit a request; we may require proof of the agent's authorization. Submitting a request will not change your access to or the price of the Service.

This Service is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has provided us with personal data, we will immediately delete that account and all associated data. If you believe a minor has registered, contact us immediately at info@lovora.ai.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include encrypted data transmission (HTTPS/TLS), Firebase Security Rules restricting database access, and server-side token verification for all authenticated API calls. However, no system is 100% secure, and we cannot guarantee absolute security.

For detailed information about the cookies we use, see our Cookie Policy.

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Service at least 15 days before taking effect. The "Last updated" date at the top will always reflect the current version.

Data Controller contact for all privacy matters:
📧 info@lovora.ai
Subject line: "PRIVACY REQUEST", "GDPR REQUEST" or "CCPA REQUEST"