Privacy Policy

1. Introduction

Sweetz Digital Ltd ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Sweetz platform ("Service"). This policy applies to all users worldwide, including those in the United Kingdom (UK), the European Economic Area (EEA), the United States (including residents of California, Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws), and all other jurisdictions.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.

2. Data Controller

The data controller for the personal data processed through the Service is:

• Sweetz Digital Ltd
• Registered in England & Wales
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

For any privacy-related inquiries, contact us at: privacy@sweetz.ai

3. Information We Collect

3.1 Information You Provide

• Account data: Email address, display name, and password hash when you register
• Profile data: Optional avatar image and display preferences
• Payment data: Billing information processed by our licensed payment processors (card processor, cryptocurrency payment provider). We do not store credit card numbers or wallet credentials — these are handled entirely by the payment processor
• Chat data: Messages you send to AI characters and AI responses
• Generated content: Images and videos you generate through the Service
• Characters: Custom characters you create, including descriptions and personality data
• Support communications: Emails and messages you send to our support team

3.2 Information Collected Automatically

• Usage data: Pages visited, features used, session duration, and interaction patterns
• Device data: Browser type, operating system, screen resolution, and device type
• Network data: IP address (anonymized for analytics), approximate geolocation (country/region level)
• Cookies: Essential cookies for authentication and preferences. See our Cookie Policy for details

3.3 Information We Do NOT Collect

• We do not collect real names unless you choose to provide one as a display name
• We do not store credit card numbers or cryptocurrency wallet credentials (handled entirely by our payment processors)
• We do not collect biometric data
• We do not access your device contacts, camera, or microphone beyond voice input you explicitly initiate

4. Legal Basis for Processing (UK GDPR / EU GDPR)

For users in the UK and EEA, we process personal data on the following legal bases under the UK GDPR and EU GDPR:

5. How We Use Your Data

• Provide the Service: Authenticate your account, process messages, generate AI content, and manage subscriptions
• Improve the Service: Analyze usage patterns to identify bugs, improve features, and optimize performance
• Safety & moderation: Detect and prevent abuse, enforce community guidelines, and comply with legal obligations
• Communications: Send account-related notifications, security alerts, and (with your consent) promotional updates
• Payment processing: Process subscriptions and credit purchases through our payment processor

We do not sell your personal data to third parties. We do not use your conversations or generated content to train AI models.

6. Data Sharing & Third-Party Processors

We share data only with service providers necessary to operate the platform:

All third-party processors are contractually bound to process data only as instructed by us and to maintain appropriate security measures. For AI processing, we strip account identifiers — your messages are sent without your email, name, or user ID attached.

We may also disclose data if required by law, court order, or to protect our rights, safety, or the safety of others.

7. International Data Transfers

Your data may be processed in countries outside your own, including the United States and other jurisdictions where our service providers operate. Where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place, including:

• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where transferring from the UK
• European Commission-approved Standard Contractual Clauses (SCCs), where transferring from the EEA
• Transfers made in reliance on UK or EU adequacy decisions, where applicable
• Data Processing Agreements with all sub-processors
• Encryption in transit (TLS 1.2+) and at rest (AES-256)

You may request a copy of the relevant transfer safeguards by contacting privacy@sweetz.ai.

8. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion
• Chat messages: Retained while your account is active. Deleted with your account
• Generated content: Retained while your account is active. Deleted with your account
• Payment records: Retained for 7 years as required by tax and financial regulations
• Server logs: Automatically purged after 90 days
• Analytics data: Aggregated and anonymized — individual records purged after 12 months

9. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Passwords are hashed using bcrypt — we never store plaintext passwords
• Database access is restricted and uses row-level security (RLS) policies
• Payment data is handled by PCI DSS-compliant payment processors — card numbers and wallet credentials never touch our servers
• Regular security reviews and dependency audits
• Rate limiting and abuse detection to prevent unauthorized access

No system is 100% secure. If we become aware of a data breach affecting your personal data, we will notify you and the relevant supervisory authority as required by applicable law.

10. Your Rights

10.1 Rights for All Users

• Access: Request a copy of the personal data we hold about you
• Deletion: Delete your account and all associated data through the profile settings page or by contacting support
• Correction: Update your profile information at any time through the profile settings
• Opt-out: Unsubscribe from marketing emails at any time

10.2 Additional Rights for UK & EEA Residents (UK GDPR / EU GDPR)

• Data portability: Receive your data in a structured, machine-readable format
• Restriction: Request that we restrict processing of your data in certain circumstances
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent, you may withdraw at any time
• Supervisory authority: Lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EEA, this is the data protection authority of your country of residence

10.3 Additional Rights for US Residents

If you reside in a US state with a comprehensive privacy law (including but not limited to California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Tennessee, Indiana, New Jersey, New Hampshire, Kentucky, Minnesota, Maryland, and Rhode Island), you have the following rights:

• Right to know / access: Request disclosure of the categories and specific pieces of personal information collected about you
• Right to delete: Request deletion of your personal information
• Right to correct: Request correction of inaccurate personal information
• Right to portability: Request a copy of your personal information in a portable format
• Right to opt-out of sale or sharing: We do not sell or share personal information for cross-context behavioral advertising, so no opt-out is necessary
• Right to limit use of sensitive personal information: We do not use sensitive personal information for purposes beyond those permitted without opt-out
• Non-discrimination: We will not discriminate against you for exercising your privacy rights

California "Shine the Light" disclosure: California residents may request a list of third parties to which we have disclosed personal information for direct marketing purposes. We do not disclose personal information for third-party direct marketing.

To exercise any of these rights, contact us at privacy@sweetz.ai. We will respond within 30 days (or sooner as required by applicable law).

11. Children's Privacy

The Service is not intended for anyone under 18 years of age. We do not knowingly collect personal data from minors. If we learn that we have collected personal data from a user under 18, we will promptly delete the account and all associated data. If you believe a minor is using our Service, please contact us immediately at privacy@sweetz.ai.

12. Cookies

We use cookies and similar technologies to operate the Service. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notice at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact

For privacy-related questions, data requests, or complaints, contact us at:

• Email: privacy@sweetz.ai
• General support: support@sweetz.ai