Who Controls Your Data
The controller of personal data collected through Lewdly is [COMPANY LEGAL NAME], registered at [REGISTERED ADDRESS]. Our representative for data protection matters in the European Union is [EU REPRESENTATIVE].
Privacy questions and requests about your data go to legal@lewdly.ai.
What We Collect
We try to collect as little as the service can run on. An adult platform that hoards data is a liability to the people using it, and the less we hold the less there is to lose.
- Account data. Your email address, your username, your password in hashed form, and your account settings.
- Content data. The prompts you write, the images and video you generate, the conversations you have with characters, and anything you upload as a reference.
- Billing data. Which plan you are on, when it renews, and a record of your transactions. Our payment processor handles the card itself, and we never receive or store your full card number.
- Moderation data. Flags raised against your prompts or output, and the outcome of any review, kept so that enforcement is consistent and appealable.
- Technical and usage data. Device and browser type, pages viewed, features used, session length, and error diagnostics.
- Acquisition data. Which link or campaign first brought you to the site, which we hold so that affiliates get paid for referrals they actually made. Our Cookie Policy explains how that is stored.
Why We Are Allowed to Hold It
Under GDPR and UK GDPR every use of personal data needs a lawful basis. Ours are as follows, in plain terms.
- To perform our contract with you. Running your account, generating what you ask for, taking payment and providing support.
- Because we have a legitimate interest. Keeping the platform secure, preventing fraud and abuse, moderating content, understanding aggregate usage, and defending legal claims. We balance this against your interests and use the least intrusive option that works.
- Because the law requires it. Tax and accounting records, and responding to lawful requests.
- Because you consented. Optional analytics cookies, and marketing email if you asked for it. You can withdraw consent at any time and it is as easy to withdraw as it was to give.
Adult Content and Sensitive Information
Using an adult service can reveal things about a person that are sensitive, including things that may indicate sexual orientation. We treat that seriously rather than as an afterthought.
We do not build advertising profiles from what you generate. We do not sell, rent or trade personal data, and we have never done so. We do not disclose that you hold an account except where we are legally compelled to. We do not require your legal name, and we do not ask for identity documents unless a specific legal obligation makes it unavoidable.
We also do not use your private generations or conversations to train base models without your explicit consent.
Who Else Processes It
We use a small number of service providers to run the platform. Each is bound by a contract that limits them to acting on our instructions, and none of them is permitted to use your data for their own purposes.
- Payment processing, currently handled by [PAYMENT PROCESSOR], which receives what it needs to take the payment and holds the card details we never see.
- Cloud hosting and GPU compute, which run the application and the generation models.
- Object storage and content delivery, which hold and serve generated images and video.
- Analytics, which tells us in aggregate which parts of the product are used.
- Transactional email delivery, for receipts, password resets and service notices.
When We Disclose Data to Others
Outside those providers we disclose personal data only where we are legally required to, where it is necessary to establish or defend a legal claim, or where there is an urgent risk of serious harm to someone.
Our Law Enforcement Guidelines set out what process we require before we produce anything, and our practice of telling the affected user unless we are prohibited from doing so.
If the business is ever sold or reorganised, data may transfer as part of it, and it stays subject to a policy at least as protective as this one.
How Long We Keep It
We keep data for as long as it is needed for the purpose it was collected for, and then delete it.
- Account data, for as long as the account is open. On deletion it is removed within 30 days, apart from anything we must retain.
- Generated content and conversations, until you delete them or the account closes.
- Billing records, for the period tax law requires, which is longer than the account may last and is not something we can shorten on request.
- Moderation records relating to a serious breach, for as long as we need them to enforce against evasion and to defend a challenge.
- Technical logs, for a short operational period measured in weeks, then discarded or aggregated.
- Support correspondence, for one year after the last message.
Your Rights
If you are in the European Economic Area or the United Kingdom, GDPR and UK GDPR give you the rights below. We extend the same rights to everyone else rather than run two standards.
- Access. Get a copy of the personal data we hold about you.
- Rectification. Have inaccurate or incomplete data corrected.
- Erasure. Have your data deleted, subject to anything we must legally keep.
- Portability. Receive your data in a machine-readable format.
- Restriction and objection. Require us to pause a use, or object to a use we base on legitimate interests.
- Withdraw consent. For anything we do on the basis of consent, at any time.
- Complain. Raise a complaint with the data protection authority where you live.
California Residents
Under the CCPA as amended, California residents can ask what categories of personal information we collect and why, ask for a copy, ask for deletion, ask for correction, and opt out of the sale or sharing of personal information.
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We will not discriminate against you for exercising any of these rights.
Send requests to legal@lewdly.ai. We aim to respond within 30 days and will tell you if we need longer. We may need to verify that the request comes from you, and we will ask for the least information that makes that possible.
International Transfers
Our providers may process data outside the country you live in. Where data leaves the European Economic Area or the United Kingdom we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses together with any additional measures the transfer needs.
Security
We encrypt data in transit, encrypt stored content, hash passwords, restrict internal access to the people whose job needs it, and log administrative access.
No platform can promise perfect security and we are not going to pretend otherwise. If a breach happens that is likely to put your rights at risk, we will notify the relevant authority and you, within the timescales the law sets.
People Under 18
Lewdly is for adults and we do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor we close it and delete the data. If you believe a minor has an account, tell us at removals@lewdly.ai and see our Underage Content Policy.
Changes to This Policy
We may update this policy. Material changes will be notified by email or in the product before they take effect, and the date at the top of this page will change.