Privacy

1.1 This Privacy Policy of ai-rp.ai (hereby known as AiRP) describes how we might collect, store and use your information when you visit our website or software application. Reading this privacy policy will help you understand your privacy choices. If you don’t agree with our policies, please do not use our services. If you still have any questions, please contact us by emailing [email protected]. This privacy policy is an integral part of our Terms of Service. By using the app, you confirm your full acceptance of those terms and acknowledge the contents of this policy.

1.2 The purpose of this privacy policy (this “Privacy Policy”) is to inform users of AiRP of the following:

• The personal data we will collect;
• Use of collected data;
• Who has access to the data collected;
• The rights of Site users; and
• The Site’s cookie policy.

1.3 This Privacy Policy applies in addition to the terms and conditions of our Site.

2.1 For users in the European Union, we adhere to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the General Data Protection Regulation (the “GDPR”). For users in the United Kingdom, we adhere to the GDPR as enshrined in the Data Protection Act 2018.

2.2 Under the GDPR, you have the following rights:

• Right to be informed;
• Right of access;
• Right to rectification;
• Right to erasure;
• Right to restrict processing;
• Right to data portability; and
• Right to object.

2.3 We have not appointed a Data Protection Officer as we do not fall within the categories of controllers and processors required to appoint a Data Protection Officer under Article 37 of the GDPR.

2.4 Most of these you can exercise yourself without asking us: your work exports from each story, your details are in the Profile section, and deletion is a button in settings. For anything else, write to [email protected] and we will do it.

3.1 By using our Site users agree that they consent to:

• The conditions set out in this Privacy Policy.

4.1 We collect and process personal data about users in the EU only when we have a legal basis for doing so under Article 6 of the GDPR.

4.2 We rely on the following legal basis to collect and process the personal data of users in the EU:

• Processing of user personal data is necessary for us to take, at the request of a user, steps before entering a contract or for the performance of a contract to which a user is a party. If a user does not provide the personal data necessary to perform a contract the consequences are as follows: they can’t use AiRP.

5.1 We only collect data that helps us achieve the purpose set out in this Privacy Policy. We will not collect any additional data beyond the data listed below without notifying you first.

5.2 Account data. An account is made with an email address and a password, or by signing in with Google or Discord. We process your email address, a display name, and the essential information associated with the selected account necessary to create your profile. A password is hashed with bcrypt and is never stored in a form anyone can read, us included. Account information can be updated at any time in the Profile section.

5.3 What you make. Stories, cast, lorebooks, Stars, your roster, favourites and bookmarks; an avatar if you upload one; and your display preferences — theme, chat text size, whether replies stream, and whether gore is shown.

5.4 Your chats. Every message in them, including the AI’s replies and the summaries it keeps to remember earlier scenes.

5.5 Data collected automatically. When you visit and use AiRP, we may automatically collect and store the following information:

• Email addresses (when you provide them).
• Device and connection information — your IP address, and what your browser sends with an ordinary request.
• Usage data — which stories were viewed, and per day, replies generated and tokens used.
• Records of errors.
• Payment records, if you buy anything — what was bought, what it cost and when. Card details never reach AiRP; see 7.2.

5.6 Moderation records, if there are any — reports you send, notices you receive, appeals you make &mdash.

5.7 One-time identity verification. At signup, Didit processes the government-issued identity document, selfie or liveness capture, biometric data derived from those submissions, and device, IP, location, and anti-fraud information needed to perform the check. AiRP stores the account identifier, verification session identifier, consent timestamp, status, timestamps, and webhook receipts. AiRP does not copy document images, biometric captures, or extracted identity fields into its own database.

6.1 Data collected on AiRP will only be used for the purposes specified in this Privacy Policy or indicated on the relevant pages of our AiRP. We will not use your data beyond what we disclose in this Privacy Policy.

6.2 The data we collect is used for the following purposes:

• Create an account. Lawful basis: Art. 6(1)(b) GDPR / UK GDPR.
• Use of AiRP, which includes sending what you write to the model that plays it. Lawful basis: Art. 6(1)(b) GDPR / UK GDPR.
• Communicate with you about our services. Lawful basis: Art. 6(1)(a) and Art. 6(1)(f) GDPR / UK GDPR.
• Ensure security and prevent fraud and abuse, which is what the hashed records in 5.6 are for. Lawful basis: Art. 6(1)(f) GDPR / UK GDPR.
• Determine approximate location from your IP address (country and, where required, state or region) to comply with legal obligations. Lawful basis: Art. 6(1)(c) GDPR / UK GDPR.
• Perform the one-time identity check required to finish signup and prevent identity fraud and confirm signup eligibility. Lawful basis: Art. 6(1)(b), 6(1)(c), and 6(1)(f), and explicit consent under Art. 9(2)(a) GDPR / UK GDPR where required, as applicable.
• AiRP offers paid subscription plans. For paid plans, we process data necessary to manage the subscription. Lawful basis: Art. 6(1)(b) GDPR / UK GDPR.

7.1 Employees. We may disclose user data to any member of our organization who reasonably needs access to user data to achieve the purposes set out in this Privacy Policy.

7.2 Other disclosures. Beyond 7.2, we will not sell or share your data with other third parties, except in the following cases:

• With Didit, our identity-verification processor, for the one-time signup check. Didit receives the material described in 5.7 and returns a verification decision. Its dedicated Verification Privacy Notice explains its processing.
• With OpenAI, to measure our advertising, and only if you agree to advertising cookies (see 12.3). A script from OpenAI then runs on our web pages and sends it information about your visit, such as the pages you view, actions you take on the Site, your browser and device, and cookie or similar identifiers, so we can tell whether our ads on OpenAI’s services led people here. OpenAI’s Privacy Policy explains its processing.
• If the law requires it;
• If it is required for any legal proceeding;
• To prove or protect our legal rights; and
• To buyers or potential buyers of this company in the event that we seek to sell the company.

7.3 If you follow hyperlinks from AiRP to another Site, please note that we are not responsible for and have no control over their privacy policies and practices.

8.1 User data will be stored until the purpose the data was collected for has been achieved. Data collected through your use of AiRP will not be processed for longer than necessary to achieve the purposes described above, and not exceeding the duration of the account. A longer retention period may be necessary to enable AiRP to defend and enforce its rights in legal proceedings or to comply with applicable laws.

8.2 Chat messages and conversation history are stored until deleted by the user. This includes:

• Message content and timestamps;
• Associated metadata like chat context; and
• Any images shared during conversations.

8.3 Everything else ages out on its own schedule:

• Your account and everything in it: until you delete it, or we close it under the terms.
• Sign-in sessions: thirty days after your last visit, and immediately when you sign out.
• Password reset links: one hour, single use. Completing a reset signs out every other session on the account.
• Records of errors the site threw: thirty days.
• Per-address request counts: thirty days.
• Which address each sign-in came from: ninety days.
• AiRP's identity-verification status and webhook receipts: for the life of the account, unless a longer period is required by law or needed to resolve a dispute. Didit retains the verification material under its own Verification Privacy Notice linked in 7.2.

8.4 If you delete your account, all of your messages and chat data will be permanently deleted. We maintain regular backups of our systems, and your deleted data may remain in these backups for about a fortnight before being permanently removed.

9.1 While we take all reasonable precautions to ensure that user data is secure and that users are protected, there always remains the risk of harm. The Internet as a whole can be insecure at times and therefore we are unable to guarantee the security of user data beyond what is reasonably practical.

10.1 You need to be at least 18 to have an account here, and old enough to enter a contract where you live. We do not knowingly collect or use personal data from individuals under that age.

10.2 If an account here turns out to belong to someone under 18, they or their parent or guardian may write to [email protected] and we will delete the account and everything in it. We don’t knowingly keep accounts below the age floor, and we remove one as soon as we know.

11.1 Do Not Track (“DNT”) is a privacy preference that you can set in certain web browsers. Apart from the advertising measurement described in 7.2, which happens only if you agree to it, we do not track the users of AiRP over time and across third party websites. We do not currently respond to browser-initiated DNT signals. We are not responsible for and cannot guarantee how any third parties who interact with AiRP and your data will respond to DNT signals.

12.1 A cookie is a small file, stored on a user’s hard drive by a website. Its purpose is to collect data relating to the user’s browsing habits. You can choose to be notified each time a cookie is transmitted. Most browsers allow you to control cookie settings. You can delete or block cookies, but this may impact the functionality of our services.

12.2 We use essential cookies to:

• Maintain your login session;
• Ensure secure browsing;
• Prevent fraud and abuse; and
• Remember your answer to our cookie banner.

12.3 With your agreement, we also let OpenAI set and read cookies and similar identifiers on the Site to measure our advertising, as described in 7.2. These are not essential and are off by default: the Site asks you the first time you visit, and nothing from OpenAI loads unless you choose Accept. Declining does not affect how the Site works. You can change your answer at any time from “Cookie settings” at the bottom of every page, and you can also block or delete cookies in your browser settings. We remember your answer in an essential cookie for six months, then ask again.

13.1 This Privacy Policy may be amended from time to time in order to maintain compliance with the law and to reflect any changes to our data collection process. When we amend this Privacy Policy we will update the “Effective Date” at the top of this Privacy Policy. We recommend that our users periodically review our Privacy Policy to ensure that they are notified of any updates. If necessary, we may notify users by email of changes to this Privacy Policy.

14.1 For privacy-related questions or to exercise your privacy rights, contact us at [email protected]. If it is about copyright, there is a separate process.