Privacy Notice

Controller: {{LEGAL_ENTITY}} ("we", "us"), {{REGISTERED_ADDRESS}}, Chamber of Commerce (KvK) no. {{KVK_NUMBER}}. Contact for privacy matters: {{DPO_EMAIL}}.

This notice explains what personal data {{APP_NAME}} collects, why, on what legal basis, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. What we collect

| Data | When | Why | |---|---|---| | Email address | Registration, waitlist | Account identity, login, verification, transactional email | | Spoken/UI language, country/nationality | Registration, waitlist | Localisation; VAT country for billing | | Date of birth / age confirmation | Registration | Age assurance (18+ access) | | Password (hashed) | Registration | Authentication — stored only as a salted hash, never in clear text | | Consent records | Registration, waitlist, settings | Proof of the consents you gave, with timestamps | | Generated images/videos and the prompts you write | When you use the generator / play a story | Providing the service; the prompts you type are stored with the result | | Roleplay sessions, stories, characters | When you play / create | Providing the roleplay feature | | Billing details (name, address, country), invoices, payments | If you purchase | Legal accounting/tax obligations | | Technical data: hashed IP address, user agent, approximate country | On certain actions | Security, fraud/abuse prevention, audit trail |

We do not sell your personal data.

2. Special-category and adult data

Adult ("18+") content is optional and off by default. If you opt in, that preference is a record of a choice you made; we do not require you to disclose sensitive personal data to use the service. Character and reference images are created only by accounts with creator permissions, not by general users.

3. Legal bases

• Contract (GDPR Art. 6(1)(b)) — operating your account and providing the service.
• Legal obligation (Art. 6(1)(c)) — keeping invoices/accounting records.
• Consent (Art. 6(1)(a)) — optional marketing email and the optional adult-content opt-in. You may withdraw consent at any time in Settings.
• Legitimate interests (Art. 6(1)(f)) — security, abuse prevention and keeping our service working, balanced against your rights.

4. AI processing

Text and image/video generation is performed via our AI provider (see the Sub-processor list). The prompts you write and, for image editing, the images you provide are sent to that provider to produce a result. We do not use your content to train our own models. See the AI Transparency Statement.

5. Who we share data with (sub-processors)

We use a small number of processors that handle data on our behalf under contract — AI generation, email delivery, hosting, and the waitlist site. The current list, including where each one processes data, is published and kept up to date at {{APP_URL}}/legal/subprocessors. Where a provider processes data outside the EEA, transfers are covered by an appropriate safeguard (e.g. Standard Contractual Clauses); {{REVIEW: confirm the Atlas/AI provider's jurisdiction and transfer mechanism with counsel}}.

6. How long we keep data

• Account data: while your account exists, then deleted (see §8).
• Invoices and accounting records: retained for the statutory period (in the Netherlands generally 7 years) even after account deletion, but stripped of directly-identifying details (name/address/email replaced) where the law allows.
• Security/audit logs: a limited period proportionate to the purpose.
• Waitlist entries that are never converted: removed after they expire.

7. Security

Passwords are stored only as salted hashes. Secrets are encrypted at rest. Access to generated media is authenticated. IP addresses in logs are hashed/redacted. We apply technical and organisational measures appropriate to the risk (GDPR Art. 32).

8. Your rights

You have the right to access, rectify, erase ("right to be forgotten"), restrict, port, and object to the processing of your data (GDPR Art. 15–21). You can exercise the main ones yourself:

• Export — download a copy of your data from Settings → My data.
• Delete — request account deletion from Settings; it is disabled immediately and permanently erased after a 30-day grace period (invoices are kept anonymised as the law requires).

You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

9. Children

The service is for adults only and not directed at children. You must be at least 18.

10. Changes

We may update this notice. Material changes will be notified and, where required, will ask for renewed acceptance. The effective date is shown above.

11. Contact

Questions or requests: {{DPO_EMAIL}}.