Privacy Policy

The data controller for personal data collected through lovora.ai is Eagle Technology, a business registered in Ontario, Canada (Ontario Business Identification Number 1001775787), 255 Richmond St. East, Toronto, Ontario, Canada, the operator of Lovora ("Company," "we," "us").

Contact: info@lovora.ai

For all privacy-related enquiries, including data subject rights requests, please use the email above with subject line "PRIVACY REQUEST."

2.1 Account Data - When you register:

• Email address
• Display name
• Profile photo (only if you sign in with Google and Google provides one)
• Authentication provider (email/password or Google)
• Account creation date

Legal basis: Contract performance (Art. 6(1)(b) GDPR) - necessary to provide your account and access the Service.

2.2 Plan and Transaction Data

• Plan bought and its status, start and end dates
• Credit balance and transaction history
• Payment processor transaction IDs (we do not store card numbers)

Legal basis: Contract performance and legal obligation (Art. 6(1)(b)(c)).

2.3 Usage Data

• Number of messages sent (counted for the free tier limit)
• Features accessed
• Log data: IP address, browser type, pages visited, timestamps

Legal basis: Legitimate interests (Art. 6(1)(f)) - security, fraud prevention, service improvement.

2.4 Analytics Data (with your consent)

• If you accept analytics cookies: Firebase Analytics / Google Analytics collects aggregated usage data including page views, session duration, and device type.

Legal basis: Consent (Art. 6(1)(a)). You may withdraw consent at any time via our cookie settings.

2.5 Affiliate Data

• Referral code, referral relationships (who referred whom), and commission calculations.

2.6 AI Conversation Data (Chats)

When you chat with an AI companion, your messages and the companion's replies are stored on our servers linked to your account, so you can continue conversations where you left off and the companion can remember context. Because our companions are adult in nature, these conversations may reveal information about your sexual preferences or activity — a special category of personal data under Art. 9 GDPR.

• Legal basis (service): Contract performance (Art. 6(1)(b)) — storing your conversation history is necessary to provide the chat feature.
• Explicit consent (special category): By creating an account and using the adult chat, voice, image and video features you give your explicit consent (Art. 9(2)(a)) to our processing of the sexual or erotic content of those interactions for the purposes described in this Policy. You may withdraw consent at any time by deleting your account.
• Safety & moderation: Conversations and generated media may be reviewed — by automated systems and, where necessary, by authorised staff — to detect and prevent prohibited content (in particular child sexual abuse material, and non-consensual or violent content), enforce our Terms, and comply with legal obligations (Art. 6(1)(c)/(f)). Staff access is limited to these purposes.

We do not sell your conversations and we do not use their content for advertising or marketing. Aggregated, anonymised data may be used to improve AI safety and quality. You can erase your conversations at any time by deleting your account (see Section 6).

• Providing, operating, and maintaining the Service;
• Processing payments and managing the plans you buy;
• Sending transactional emails (account confirmation, password reset, billing receipts);
• Enforcing our Terms of Service and content policies;
• Detecting and preventing fraud, abuse, and illegal activity;
• Complying with legal obligations, including mandatory reporting of CSAM to law enforcement;
• Improving the Service based on aggregated analytics (with consent);
• Communicating service-related updates and changes.

We do not sell your personal data to third parties. We do not use your data for automated individual decision-making or profiling that produces legal or similarly significant effects.

We share your personal data only with:

• Firebase / Google (USA): Authentication, database hosting, and analytics. Governed by Google's Standard Contractual Clauses and Data Processing Agreement.
• Hosting (Hetzner, Germany): The servers that run the website, store your account data processed by us and send the pages you see.
• AI computing providers (vast.ai and RunPod): Rented GPU servers that generate your companion's replies, voice, photos and videos. They process the conversation (including what you have told your companion about yourself), voice messages and image requests needed to produce each reply.
• Media storage and delivery (Backblaze B2 and Bunny CDN): Storage of generated photos, videos and voice audio, and their delivery through signed links that expire.
• Email delivery (Amazon Web Services SES): Sending account, receipt and service emails to your address.
• Card payment provider: Payments by card, Apple Pay or Google Pay are completed on the secure checkout page of a third-party payment provider. We pass it your account email so the checkout can be completed; the provider collects the card or wallet details you enter there and returns to us only the confirmation of the payment, the amount and a transaction reference.
• Telegram: If you pay with Telegram Stars, the purchase takes place inside Telegram under Telegram's own terms and privacy policy. We receive the confirmation of the payment, the amount, the transaction identifiers and your Telegram user ID, which we use only to credit your account.
• Payment Processor (PayRam): To process purchases in cryptocurrency. It receives only the data necessary to process the payment.
• No card data at Lovora: Whatever the method, card numbers and bank details are never collected, transmitted or stored by us or on our behalf.
• Age verification provider (Didit): Only where the law of the place you connect from requires an age check, and only when you start one. See "Age Verification" below.
• Law Enforcement: We will disclose data as required by law or court order, and will proactively report CSAM and child exploitation material to the relevant national authority and NCMEC without prior notice.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity, subject to the same privacy protections.

Where the law of the place you connect from requires it — currently the United Kingdom, France, Italy, Germany, Australia, Brazil and the US states with an age-verification law — we ask you to confirm that you are an adult before showing you explicit content. You are asked only when you try to open such content, never just for visiting.

The check is carried out by Didit (didit.me), an independent identity-verification provider established in Spain, on its own pages. Depending on your location it uses either a selfie, from which your age is estimated with a liveness check, or a photo of an identity document matched to a selfie.

• What we receive and keep: only the outcome (adult confirmed or not), the method used, the date, and for a selfie check a rounded age estimate. Your selfie, your document, your name and your date of birth are never stored on our systems.
• What Didit processes: your selfie and, where requested, your document, solely to estimate or confirm your age and to detect fraud. We have switched off Didit's face search, so your face is not compared with other people or kept as a biometric template for that purpose. Didit's own privacy policy describes how long it keeps verification data.
• Legal basis: a legal obligation (Art. 6(1)(c) GDPR) where the check is required by law; for the biometric data used in the selfie, your explicit consent, given when you choose to start the check (Art. 9(2)(a) GDPR). You can decline: the rest of the Service stays available without explicit content.
• Retention: the outcome is kept with your account and erased when you delete it.
• Where you connect from: whether a check applies is decided from your IP address (country, and in the United States the state), using IP Geolocation by DB-IP (licensed CC BY 4.0). The location is not stored for this purpose.

Our infrastructure uses Firebase (Google Cloud), which processes data in data centres that may be located outside the European Economic Area (EEA), including the United States. These transfers are protected by:

• Google LLC's Standard Contractual Clauses (SCCs) approved by the European Commission;
• Google's compliance with applicable data transfer frameworks.

Lovora is operated from Canada (Ontario). The other providers listed in section 4 process data where their services run: the website servers in Germany (Hetzner); the AI computing in the European Union (Belgium and the Netherlands at the time of writing; vast.ai and RunPod); email delivery in the European Union (Amazon Web Services SES, Frankfurt); generated media storage in the United States (Backblaze B2), delivered through a content network with servers worldwide (Bunny CDN).

You may request a copy of the relevant safeguards by contacting us at info@lovora.ai.

• Account data: Retained for the duration of your account. On deletion it is erased from our active databases (see below).
• Conversation & generated-media data: Retained while your account is active so you can continue your chats; erased when you delete your account.
• Content-moderation records: Logs of blocked prohibited-content attempts and related metadata are retained as abuse/CSAM evidence under Art. 17(3)(b)/(e) GDPR, even after account deletion.
• Transaction/billing data: Retained for 6 years from the end of the tax year to which they relate, as Canadian tax law requires of a business operating from Ontario (Income Tax Act, section 230).
• Incident case files: Where an enforcement decision affected a paying customer, we keep an internal case file holding the account identifier, references to the billing and moderation records above, and our own dated notes and decision. It contains no conversation content, media or contact details. Kept for as long as the transaction it concerns, under Art. 6(1)(f) GDPR (handling refunds, defending legal claims, and reviewing automated decisions).
• Analytics data: Retained for up to 14 months in Firebase Analytics, then automatically deleted.
• Log data: Retained for up to 90 days for security purposes.

When you delete your account, we erase your profile, your conversations (chats), your generated images, videos and characters, your usage and plan records and your affiliate data from our active databases — immediately, and in any case within 30 days. We retain only (a) a limited set of content-moderation records as evidence, as described above, and (b) transaction/billing data for the fiscal period required by law.

As an EU/EEA resident, you have the following rights under the GDPR:

• Right of access (Art. 15): Request a copy of your personal data.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten"). You can also delete your account directly from your dashboard.
• Right to restrict processing (Art. 18): Request that we limit how we use your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Withdraw analytics consent at any time via cookie settings, without affecting the lawfulness of prior processing.
• Right not to be subject to automated decisions (Art. 22): We do not make legally significant automated decisions about you.

To exercise any of these rights, email info@lovora.ai with subject "GDPR REQUEST." We will respond within 30 days.

Right to lodge a complaint: If you believe your data has been processed unlawfully, you have the right to lodge a complaint with your national supervisory authority. In the European Union, this is the data protection authority of the country where you live; in Canada, the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

This section applies to residents of California and supplements the rest of this Policy, as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA").

8.1 Categories of personal information we collect

• Identifiers: email address, display name, IP address, account/device identifiers.
• Commercial information: plan bought, credit balance, transaction history, payment-processor transaction IDs (we do not store card numbers).
• Internet/network activity: pages visited, features used, message counts, log data.
• Sensitive personal information: the content of your adult chats, voice, image and video interactions, which may reveal data about your sex life or sexual orientation. We use this information only to provide the Service you request and for safety, moderation and legal-compliance purposes — never to infer characteristics about you for advertising.

8.2 We do not sell or share your personal information

We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months, including with respect to the personal information of consumers under 16.

8.3 Your California rights

• Right to know / access: request the categories and specific pieces of personal information we have collected about you.
• Right to delete: request deletion of your personal information (subject to legal exceptions such as fraud prevention and our retention of moderation and billing records).
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale/sharing: because we do not sell or share your personal information, there is nothing to opt out of; no "Do Not Sell or Share My Personal Information" mechanism is required.
• Right to limit use of sensitive personal information: we already limit our use of sensitive personal information to the purposes permitted under the CCPA/CPRA (providing the Service, safety and legal compliance), so no separate limitation request is necessary.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email info@lovora.ai with subject "CCPA REQUEST." We will verify your request using the email address associated with your account and respond within 45 days. You may use an authorized agent to submit a request; we may require proof of the agent's authorization. Submitting a request will not change your access to or the price of the Service.

This Service is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has provided us with personal data, we will immediately delete that account and all associated data. If you believe a minor has registered, contact us immediately at info@lovora.ai.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include encrypted data transmission (HTTPS/TLS), Firebase Security Rules restricting database access, and server-side token verification for all authenticated API calls. However, no system is 100% secure, and we cannot guarantee absolute security.

For detailed information about the cookies we use, see our Cookie Policy.

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Service at least 15 days before taking effect. The "Last updated" date at the top will always reflect the current version.

Data Controller contact for all privacy matters:
Eagle Technology, 255 Richmond St. East, Toronto, Ontario, Canada
📧 info@lovora.ai
📞 Show phone number (Monday to Friday, 10:00–18:00 Eastern Time)
Subject line: "PRIVACY REQUEST", "GDPR REQUEST" or "CCPA REQUEST"