Privacy Policy
Last updated
AutoPeaches is not open yet. Today we process only the data of visitors to autopeaches.com and of people who join our waitlist. The parts of this policy about accounts, workspaces, billing, content and fans apply from launch.
This policy explains what personal data AutoPeaches processes, why, with whom it is shared, how long it is kept and what rights you have. It covers our customers and their teams, visitors to autopeaches.com, people who join our waitlist, and the fans who talk to our customers' AI characters on connected platforms.
1. Who is responsible
1.1 The controller is FROZEN FLAME TECH LTD, a Cyprus private limited company, registration HE 499255, registered office Strovolou 77, Strovolos Center, Office 301, 2018 Strovolos, Nicosia, Cyprus ("we", "us").
1.2 Privacy requests, questions and legal matters: [email protected]. Support: [email protected].
1.3 We have not appointed a data protection officer. You can reach the person responsible for data protection at [email protected].
2. Our role
2.1 Customers, team members and visitors. We are the controller for the data of the people who sign up, the people they invite, visitors to our websites, and people who join our waitlist.
2.2 Fans. Our customers ("creators") connect accounts on fan subscription platforms to AutoPeaches, so that an AI character ("Peach") can reply to the fans who write to them, remember past conversations, and send offers and content. For fans' personal data, we and the creator are joint controllers. The essence of our arrangement:
(a) the creator decides to connect their account and to use AutoPeaches with their fans, and is responsible for having a lawful basis for that and for telling fans what the platform requires;
(b) we are responsible for how the service processes the data, its security, our providers, and this notice;
(c) fans can exercise their rights with us or with the creator; we answer requests sent to us and involve the creator where needed (section 7).
3. What data we process
3.1 Account data: name, email address, login identifiers, password (handled by our authentication provider; we never see it), sign-in times, language, time zone and interface preferences.
3.2 Workspace and team data: workspaces you belong to, your role (owner or editor), invitations you send and receive (including invitees' email addresses), and an audit trail of membership and account events (who did what, when).
3.3 Billing data: plan, subscription status, purchases, credit balance and history, invoices, billing name and address, VAT number if given, and the last four digits, brand and expiry of your card. Full card details are collected and held by our payment processor, not by us.
3.4 Content: the Peaches you create, reference images and other files you upload, prompts, captions, settings, generated images and videos, chat personas, schedules and offers. Prompts, reference material and generated media may also be used to improve the Service and train our models (section 5.3), and generated media to promote the Service (section 4). Uploaded images can show people; see the Acceptable Use Policy on consent.
3.5 Connected-account data: the access credentials for accounts you connect (stored encrypted), and the events those platforms send us.
3.6 Fan data (section 7): the fan's platform identifier, handle, display name and avatar; the messages, attachments and media exchanged with the creator's Peach; purchases, tips and subscription status reported by the platform; and the notes the AI keeps about the fan to stay consistent ("fan memory").
3.7 Technical data: IP address, browser and device details, request and error logs, and security events.
3.8 Analytics data (section 9): before you consent, anonymous page views and a few anonymous product events, with nothing stored in your browser. After you consent to analytics, a browser identifier, your account id (never your name or email), product events, and session recordings in which form fields, names, emails, fan handles, private-studio media and chat media are masked or blanked.
3.9 Marketing attribution (after marketing consent only): the campaign tags of your first visit (utm parameters, ad click identifiers), attached to your account at sign-up.
3.10 Communications: emails we send you (and whether they were delivered), including product news and offers sent to customers, and messages you send to support.
3.11 Waitlist: if you join the waitlist, your name, your email address, your language, and the time you signed up and the time you confirmed your address (the record of your double opt-in). We store a sign-up only once you click the link in our confirmation email; until then your details exist only in that email.
4. Why we process it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account and workspaces, provide the features you use | 3.1–3.5 | Contract (Art. 6(1)(b)) |
| Run AI generation and chat replies you request, send and post on connected platforms on your instruction | 3.4–3.6 | Contract with the creator; for fan data, our and the creator's legitimate interest in operating the service the creator chose (Art. 6(1)(f)) |
| Take payments, issue invoices, keep accounting and tax records | 3.3 | Contract; legal obligation (Art. 6(1)(c)) |
| Send service emails (sign-up, invitations, receipts, payment problems, deletion notices) | 3.1, 3.3, 3.10 | Contract |
| Keep the service secure, prevent fraud and abuse, enforce our Terms and Acceptable Use Policy, handle likeness and content complaints | 3.1–3.7 | Legitimate interests (Art. 6(1)(f)) |
| Keep audit records of team changes and of outbound actions on connected platforms | 3.2, 3.5 | Legitimate interests; legal obligation where applicable |
| Count anonymous visits and product events without storing anything in your browser | 3.8 (anonymous) | Legitimate interests |
| Product analytics and session recordings | 3.8 (identified) | Consent (Art. 6(1)(a)) |
| Measure which campaigns bring sign-ups | 3.9 | Consent |
| Improve the Service and train our models on customer content and Outputs (prompts, reference material, generated media; not fan conversations) | 3.4 | Legitimate interests (Art. 6(1)(f)); you can object (section 13) |
| Promote the Service with examples of generated media (website, examples, advertising), in a form that does not identify the customer, unless agreed otherwise in writing | 3.4 (generated media) | Legitimate interests (Art. 6(1)(f)); you can object (section 13). Any real person depicted must have consented to this use (Acceptable Use Policy, section 3.3) |
| Send customers product news and offers by email, with an unsubscribe link in every email | 3.1, 3.10 | Legitimate interests (existing customers); you can opt out at any time with the link or at [email protected] |
| Tell people on the waitlist when AutoPeaches opens and send them early offers | 3.11 | Consent (Art. 6(1)(a)); you can withdraw it at any time with the unsubscribe link in every email |
| Answer support requests | 3.10 | Contract; legitimate interests |
| Comply with law, court orders and authorities, establish or defend legal claims | any | Legal obligation; legitimate interests |
4.1 Where we rely on legitimate interests, you can object (section 13). Where we rely on consent, you can withdraw it at any time, without affecting what happened before.
4.2 We do not sell personal data and do not use it for third-party advertising.
5. AI processing
5.1 Generation and chat features run on third-party AI technology. To perform an action, we send the necessary input (prompt, reference images, conversation context, fan memory) to the provider that runs the chosen engine, and store the result with us.
5.2 Automated replies. When a creator switches on automatic answering, a Peach replies to fans automatically. These replies are messages, not decisions with legal or similarly significant effects on anyone. We do not make such decisions about you by automated means.
5.3 Training. We may use customer content and Outputs — prompts, reference material and generated media — to train and improve our models and systems, on the basis of our legitimate interest in improving the Service. You can object at [email protected]; we will then stop using your content for training from that point, unless we have compelling legitimate grounds. We do not use conversations with fans for training.
6. Sensitive information
6.1 Conversations between fans and adult creators may reveal information about a person's sex life or sexual orientation. We process fan conversations only to provide the service the creator and the fan chose: to let the creator's Peach reply, remember the conversation and send the offers and content the creator chose. We never use them to infer, profile or act on anyone's sexual orientation or sex life; we keep them access-controlled; and we exclude them from training. The creator is responsible for the disclosure to fans that the platform requires. Uploaded images may show people's faces; their use for training is described in section 5.3, and the consent the creator must hold in the Acceptable Use Policy.
7. Information for fans
7.1 If you message a creator on a fan subscription platform and that creator uses AutoPeaches, the replies you receive may be written by an AI character on the creator's behalf, and the conversation passes through our systems.
7.2 We receive your data from the platform the creator connected, not from you directly. We process the data listed in 3.6 to let the creator's AI character reply to you, remember your conversation, and send you offers and content the creator chose.
7.3 You can ask us to access, correct or erase your data, or object to its processing, by writing to [email protected]. Tell us the platform, your handle, and the creator you were talking to. We will answer within one month and tell the creator where needed. You can also ask the creator.
7.4 Your relationship with the platform itself (your account, payments, the platform's own records) is governed by that platform's privacy policy.
8. Who receives the data
8.1 Our service providers (processors), under data processing agreements, only to provide their part of the service:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt, Germany) |
| Hetzner Online | Servers | EU (Germany) |
| Cloudflare | DNS, network protection, file storage (R2), access control for our staff tools | Global network; file storage in the EU (EU jurisdiction) |
| AI generation and text providers | Running the image, video and chat engines. We list them by category; the list of providers is available on request at [email protected] | EU and outside the EU (section 10) |
| Resend | Sending service emails; keeping the waitlist list and sending its emails | EU; the waitlist list may be stored in the US (section 10) |
| Zoho | Our mailboxes (support and other addresses) | EU |
| PostHog | Product analytics, only as described in 3.8 | EU |
| Grafana Labs (Grafana Cloud) | Server logs for running and debugging the service | EU (Ireland) |
8.2 Independent controllers. Stripe processes payment data as our payment processor and, for fraud prevention and its legal duties, as a controller in its own right under its own privacy policy. Connected platforms (fan subscription platforms, and Instagram where available) receive what we send on the creator's instruction and process it under their own policies.
8.3 Others, only when needed: our accountants, auditors and legal advisers; courts, police and authorities where the law requires it; and a buyer or successor if our business is transferred, under the same protections.
8.4 Within a workspace, members can see the content and conversations of that workspace according to their role.
8.5 To test changes safely we may use a copy of service data in a separate environment run by us with the same providers and access restricted to our team; in that copy, email addresses are replaced, connected-account credentials removed, and nothing can be sent to fans or customers.
9. Cookies and analytics
9.1 We use necessary cookies and similar storage to run the service, and analytics and marketing storage only with your consent. Our cookie banner offers "Reject non-essential" as prominently as "Accept all", and you can change your choice at any time. Details: Cookie Policy.
10. Transfers outside the EU
10.1 We host the service in the EU. Some providers, or their support staff, are located outside the European Economic Area. Where personal data leaves the EEA, we rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask for a copy of the relevant safeguards at [email protected].
10.2 Our email-delivery provider may store the waitlist list in the United States. Where data is processed outside the EEA, we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
11. How long we keep data
| Data | How long |
|---|---|
| Account and profile | Until you delete your account. On deletion your login and profile are removed at once and your address is anonymised in our email logs. We keep a minimal record that the account was deleted, and a suppression list of addresses that must not be emailed. |
| Workspace content (Peaches, uploads, generated media, conversations, fan data) | While the workspace exists. A deleted workspace (or Peach) is unreachable at once; it can be restored for 30 days and is then permanently deleted. |
| Billing, purchases, invoices, credit ledger, subscription and usage records, audit events | Kept after deletion, for as long as we need them for accounting, tax, fraud prevention and legal claims, and at least 6 years, as Cyprus law requires (Companies Law, section 141, and the VAT law). |
| Records of payment events received from Stripe | 30 days. |
| Files uploaded as input to a single request (for example a swap scene photo, an image to describe, a source or motion clip) | 30 days. Reference images of a Peach stay with the workspace content. |
| Platform events received from connected platforms (raw) | 7 days, or sooner when the workspace or Peach is deleted. |
| Server logs | 14 days. |
| Analytics events and session recordings | 12 months. |
| Support emails | 2 years after the last message in the conversation. |
| Waitlist sign-ups | Until you unsubscribe; after that we keep your entry (name and email address) marked as unsubscribed, so we never email you again. Sign-ups that were never confirmed are not stored. |
| Email delivery records | Kept by our email provider for a short period to check delivery. |
| Backups | Taken daily and kept for 7 days. Data deleted from the live service stays in backups until they expire; it is put beyond use and not restored except to recover the whole service. |
11.1 We may keep specific data longer when it is needed for a complaint, investigation or legal claim (a legal hold). While a legal hold applies, the workspace cannot be purged or the account deleted; we tell you to contact us.
11.2 Deleting your account also deletes workspaces where you are the only member. You cannot delete your account while you are the only owner of a workspace that has other members.
12. Security
12.1 We protect data with encryption in transit, encryption at rest for connected-account credentials and secrets, access control by workspace role, short-lived signed links for media, a fresh sign-in for destructive actions, restricted staff access to internal tools, and logging of sensitive actions. No system is perfectly secure; if a breach puts your data at risk we will notify you and the authority as the law requires.
13. Your rights
13.1 You have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent at any time.
13.2 How to exercise them. You can correct your profile and delete your account or workspace yourself in the settings. For anything else, including a copy of your data, write to [email protected]. Until a self-service download exists, data exports are prepared by hand: send your request to [email protected] and we deliver it within one month.
13.3 We answer within one month. If a request is complex we may extend this by up to two more months and will tell you why. We may need to confirm your identity first.
13.4 Some data cannot be erased on request, for example invoices and accounting records we must keep by law, or data under a legal hold.
13.5 You have the right to complain to a data protection authority, in particular in your country of residence or where an infringement happened. In Cyprus this is the Commissioner for Personal Data Protection ([email protected], +357 22 818 456, www.dataprotection.gov.cy). We would appreciate the chance to resolve your concern first.
14. Children
14.1 AutoPeaches is for people aged 18 and over. We do not knowingly process data of children. If you believe a child has used the service, write to [email protected] and we will delete the account.
15. Changes
15.1 We will update this policy when our processing changes. The date at the top shows the version. For significant changes we will tell you by email or in the app before they apply.