Draft for review by counsel. Not legal advice. Placeholders in {braces} must be filled before publishing.
This policy explains how [Legal entity name], [Registered address] ("we", "us"), handles personal data when you use AI Smut Generator (the "Service"). For a plain-English summary, see our Privacy Promise.
1. Who is responsible
[Legal entity name] is the controller of your personal data. Contact: support@example.com.
- Data protection officer: {DPO name and contact, or statement that none is required}
- EU representative (Art. 27 GDPR): {EU representative name and address}
- UK representative: {UK representative name and address}
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, sign-in method, account settings | You |
| Age-check result | Pass or fail, and a timestamp | Our verification partner |
| Story content | Prompts, character sheets, memory notes, generated chapters | You and the Service |
| Usage data | Generation counts, plan limits, feature use, error logs | The Service |
| Billing data | Plan, payment dates and amounts, transaction reference | Our payment processor |
| Technical data | IP address, approximate country, browser type | Your device |
| Support data | Messages you send us | You |
What we do not collect: ID documents, selfies or face scans (these stay with the verification partner), full card numbers (these stay with the payment processor), or story content from sessions where no-log mode is on (we record only that a generation took place).
3. Story content and special category data
Your stories may reveal information about your sexual life or sexual orientation, which is special category data under Art. 9 GDPR. We process it only with your explicit consent, which you give when you create an account and can withdraw at any time by deleting your stories or your account. We use story content only to provide the Service to you and to enforce our Content Policy. We never use it to profile you for advertising, and we never use it to train or fine-tune AI models.
4. Why we use your data and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, generating and storing stories | Contract (Art. 6(1)(b)); explicit consent for story content (Art. 9(2)(a)) |
| Age verification | Legal obligation (Art. 6(1)(c)) where age assurance is required by law; otherwise legitimate interests (Art. 6(1)(f)) in keeping the Service adults-only |
| Content moderation and safety review | Legitimate interests in operating a lawful, safe service; legal obligation where applicable |
| Billing, tax and accounting records | Contract and legal obligation |
| Security, fraud and abuse prevention | Legitimate interests |
| Aggregated, cookieless analytics | Legitimate interests in understanding how the site is used |
| Service emails (sign-in links, receipts, important notices) | Contract |
| Responding to legal requests, takedowns and DMCA notices | Legal obligation and legitimate interests |
We do not sell personal data, and we do not share it for cross-context behavioral advertising.
5. Automated decisions
Automated checks screen prompts and outputs against our Content Policy, and may block a generation. Decisions that affect your account, such as restrictions or bans, involve human review. You can contest any decision by writing to support@example.com.
6. Who we share data with
We use service providers (processors) that act only on our instructions under written agreements:
- Hosting and infrastructure: {provider categories and locations}
- AI text generation: {model hosting provider or self-hosted}, bound not to retain or train on your content
- Age verification: {verification partner}, which returns only a pass or fail to us
- Payment processing: {payment processor(s)}, including a cryptocurrency payment option
- Email delivery: {email provider}, which receives your address and neutral message content only
- Analytics: {analytics provider}, cookieless and with no access to prompts or story text
We may also disclose data where required by law, to protect the rights and safety of users or others, or as part of a merger or acquisition, in which case this policy continues to apply.
7. International transfers
Where personal data is transferred outside the EEA or UK, we rely on an adequacy decision or on Standard Contractual Clauses (and the UK Addendum), with additional safeguards where needed. {List transfer destinations.} You can request a copy of the safeguards from support@example.com.
8. How we protect data
- Stories are encrypted at rest with AES-256-GCM, using a separate key for each story.
- Data is encrypted in transit with TLS.
- Staff cannot browse stories. Access to flagged content is limited to trained reviewers and logged.
- Emails and billing descriptors are neutral and do not reveal story content.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data and stories | Until you delete them or your account |
| Deleted data in backups | Cleared within 30 days |
| No-log sessions | Story content is not stored; a generation count is kept with your usage data |
| Age-check result | For the life of the account, unless re-verification is required |
| Billing records | {period required by tax law, e.g. 7 years} |
| Security logs | {e.g. 90 days} |
| Moderation records for banned accounts | {period}, to prevent re-registration and meet legal duties |
10. Your rights
Depending on where you live, you have the right to:
- access a copy of your data
- correct inaccurate data
- delete your data
- export your data in a portable format (TXT or Markdown for stories)
- restrict or object to certain processing
- withdraw consent at any time, without affecting earlier processing
- not be subject to solely automated decisions with significant effects
Many of these you can do yourself in Settings: export your stories, delete stories, or delete your account in two clicks. For anything else, email support@example.com. We reply within one month, and may need to confirm your identity first.
You can complain to your local data protection authority. {Lead supervisory authority, if any.}
US residents: depending on your state, you may have similar rights to know, delete, correct and opt out. We do not sell or share personal data as those laws define it.
11. Children
The Service is for adults 18 and over only. We use age verification to keep minors out. If we learn that an account belongs to someone under 18, we close it and delete its data, except where we must keep records by law.
12. Cookies
We use strictly necessary cookies only, and no advertising cookies. See our Cookie Policy.
13. Changes
We will post updates here and change the date above. For material changes, we will email you before they take effect.
14. Contact
[Legal entity name], [Registered address]. Email: support@example.com.