Privacy Policy

1. Commitment to User Confidentiality

Candy AI ("we," "our," or "the Platform") provides conversational artificial intelligence character instances. We consider user anonymity, data privacy, and conversational security fundamental to our platform design. This Privacy Policy details the technical and organizational policies governing our collection, storage, encryption, and deletion of personal data.

2. Data Collection and Usage Practices

We process information only to the minimal extent necessary to provision services:

• Account Identifiers: Your account profile consists of an email address, an encrypted password hash (derived via bcrypt or Argon2), and optional client-selected pseudonyms.
• Conversational Payloads: Dialogue text entered within chat buffers is parsed in real time to generate contextual inferences and character responses. Dialogue data is processed in isolated volatile memory buffers.
• Technical Metadata: Standard, non-identifying telemetry including browser user-agent tokens, performance latency numbers, and broad geographic IP regions is analyzed solely for load mitigation and cyber-defense auditing.

3. Cryptographic Protections & Zero-Log Architecture

All ingress and egress data streams operate under strict Transport Layer Security (TLS 1.3) protocols. Vectorized dialogue embeddings required to sustain ongoing character memory are encrypted at rest with AES-256-GCM algorithms. We enforce a zero-sale policy: user dialogue and personal data will never be marketed, brokered, or leased to third-party ad networks or data brokers.

4. Vector Cache and Self-Sovereign Data Deletion

Users maintain complete ownership of their conversational memory graphs. Through the portal settings dashboard, you can trigger:

• Selective Topic Erasure: Purge distinct memories or turn sequences from an individual companion's active recall vector.
• Complete Workspace Purge: Execute an irreversible cryptographic wipe of all conversation histories, custom-created personas, and stored memory keys across all models.

5. Third-Party Payment Processing

All subscription transactions are fulfilled through tier-1 PCI-DSS compliant payment gateways. The Platform does not ingest, store, or view raw debit or credit card credentials on local or distributed databases.

6. Age Verification Safeguards

Candy AI is strictly provisioned for consenting adults aged 18 and older. We deploy automated guardrails to reject and terminate accounts created by minors, promptly erasing associated network artifacts.

7. Contact and Inquiries

For data inquiries or to exercise your rights under GDPR or CCPA, contact our privacy compliance team at [email protected].