Privacy Policy - Sara's AI Twin Friends

1. Introduction

At Sara's AI Twin Friends ("we," "our," or "us"), your privacy is paramount. This Privacy Policy explains how we collect, use, protect, and share your information when you use our AI Twin platform and video call services.

Privacy First: We use end-to-end encryption, secure storage, and never share your personal data with third parties for marketing purposes.

This policy applies to all users of our platform, including both clients who interact with AI Twins and creators who build their AI representations.

2. Information We Collect

Account Information

For All Users:

• Email address and username
• Encrypted password
• Profile preferences and settings
• Platform usage analytics

For Creators (Additional KYC Data):

• Government-issued photo ID (passport, driver's license)
• Face verification photos
• Legal name and date of birth
• Residential address (for verification only)
• Phone number for security

AI Training Data

Creator Content (Voluntarily Provided):

• Profile photos for AI Twin generation
• Personality descriptions and communication style
• Sample conversations for AI training
• Voice samples (if provided)

Communication Data

• Chat messages between users and AI Twins (encrypted)
• AI-generated photo requests and descriptions
• Video call scheduling and metadata
• Customer support communications

Technical Information

• IP address and device information
• Browser type and operating system
• MetaMask wallet address (creators only, when set)
• Platform usage patterns and preferences
• Cookies and similar tracking technologies

Payment Information

Cryptocurrency Only: We never store credit card or banking information. All payments are processed through blockchain networks via MetaMask. We only record transaction hashes for verification purposes.

3. How We Use Your Information

Primary Platform Functions

AI Twin Operations

• Generate AI responses in creator's style
• Create personalized AI photos
• Maintain conversation context
• Improve AI accuracy over time

Video Call Services

• Schedule and connect video calls
• Send meeting links and reminders
• Users may record calls using platform controls
• Process payments and confirmations

Security and Compliance

• Verify creator identities (KYC compliance)
• Prevent fraud and unauthorized access
• Monitor for prohibited content or behavior
• Comply with legal and regulatory requirements
• Investigate and resolve disputes

Platform Improvement

• Analyze usage patterns to improve user experience
• Develop new features and services
• Optimize platform performance and reliability
• Conduct A/B testing for interface improvements

Communications

• Send transaction confirmations and receipts
• Deliver video call invitations and reminders
• Notify about account security issues
• Provide customer support responses
• Share important platform updates (with opt-out option)

4. Data Security and Protection

Encryption and Storage

Multi-Layer Security:

• End-to-end encryption for all chat messages
• AES-256 encryption for stored data
• Secure document storage via Cloudflare R2
• Encrypted video call recordings
• Regular security audits and updates

Access Controls

• Multi-factor authentication available for all accounts
• Role-based access for staff members
• Regular access reviews and credential rotation
• Automatic logout after periods of inactivity

KYC Document Security

• Government IDs are encrypted immediately upon upload
• Face verification photos are processed and then deleted
• KYC data is stored separately from platform user data
• Access limited to authorized verification personnel only
• Compliance with data retention regulations

Video Call Privacy

• All video calls use end-to-end encryption
• Users control their own recording options
• Meeting links expire after use
• Platform does not store user recordings

5. Information Sharing and Disclosure

We DO NOT Share Your Data With:

• Advertisers or marketing companies
• Data brokers or analytics firms
• Social media platforms
• Other users (beyond intended platform functions)
• Anyone for commercial gain

Limited Sharing for Platform Function

Within Platform Only:

• AI Twin responses to users who chat with that Twin
• AI-generated photos to users who purchase them
• Creator availability to users booking video calls
• Public profiles (only information creators choose to display)

Required Legal Disclosures

We may disclose information when required by law or to protect our platform:

• Valid court orders or subpoenas
• Law enforcement investigations of illegal activity
• Preventing harm to users or the public
• Enforcing our Terms of Service
• Business transfers (with user notification)

Service Providers

We work with trusted service providers under strict confidentiality agreements:

• Cloud storage providers (Cloudflare R2) - encrypted data only
• Video call infrastructure (Jitsi) - encrypted communications
• KYC verification services - identity documents only
• Payment processors (blockchain networks) - transaction data only

6. Data Retention and Deletion

Retention Periods

Data Type	Retention Period	Reason
Chat Messages	Session only (not stored)	Real-time communication
KYC Documents	No longer than necessary (as per GDPR Article 5)	Legal compliance
Video Call Records	User-controlled	Platform does not store recordings
Platform Subscriptions	As required for tax compliance	Business accounting
Profile Photos	Until creator removes	AI Twin functionality

Account Deletion

Your Right to Delete: You can request complete account deletion at any time.

• Most data deleted within 30 days
• Some data retained for legal compliance (anonymized when possible)
• AI Twins deactivated immediately
• Chat history and AI-generated content removed

7. Your Privacy Rights

Access and Control

Your Rights Include:

• View all data we have about you
• Correct inaccurate information
• Delete your account and data
• Export your data
• Opt out of non-essential communications

How to Exercise Rights:

• Account settings for basic changes
• Email privacy@[DOMAIN] for requests
• Support ticket for complex issues
• Response within 30 days

Regional Privacy Rights

GDPR (EU), CCPA (California), and Similar Laws:

If you're covered by these privacy laws, you have additional rights including:

• Right to know what data we collect and why
• Right to restrict processing of your data
• Right to data portability
• Right to object to automated decision-making
• Right to file complaints with supervisory authorities

Creator-Specific Rights

• Control over AI Twin training data
• Right to update personality models
• Option to make profile private/public
• Ability to deactivate AI Twin temporarily
• Control over AI-generated content licensing

8. Cookies and Tracking Technologies

What We Use

Cookie Type	Purpose	Duration
Essential	Login, security, platform function	Session/30 days
Preference	Remember your settings	1 year
Analytics	Platform improvement (anonymous)	2 years

Your Cookie Choices

• Essential cookies cannot be disabled (required for platform function)
• Preference and analytics cookies can be controlled in settings
• Browser settings allow cookie blocking (may affect functionality)
• We provide a cookie preference center for easy management

What We DON'T Use

• No advertising or marketing cookies
• No social media tracking pixels
• No cross-site tracking or fingerprinting
• No sale of cookie data to third parties

9. Third-Party Services and Integrations

External Services We Use

MetaMask Wallet Integration

• Handles cryptocurrency payments
• We only receive transaction confirmations
• No access to your private keys or wallet contents
• Subject to MetaMask's own privacy policy

Jitsi Video Platform

• Powers our video call system
• End-to-end encrypted communications
• No data shared beyond technical requirements
• Open-source, privacy-focused solution

Cloudflare R2 Storage

• Secure, encrypted file storage
• Houses KYC documents and media
• EU data residency options available
• Enterprise-grade security standards

External Links

Our platform may contain links to external websites. We are not responsible for the privacy practices of these sites and encourage you to read their privacy policies.

10. Children's Privacy (COPPA Compliance)

18+ Only Platform

Our platform is exclusively for adults 18 years and older. We do not knowingly collect information from anyone under 18.

• Age verification required during registration
• KYC verification confirms age for creators
• Immediate account termination if under-age use discovered
• Parents can report suspected underage accounts

11. International Data Transfers

Sara's AI Twin Friends operates globally. Your data may be processed in countries with different data protection laws than your home country.

Transfer Safeguards

• EU Standard Contractual Clauses for GDPR compliance
• Data Processing Agreements with all service providers
• Encryption in transit and at rest
• Regular security audits of international operations

Regional Data Residency

Where legally required, we offer data residency options to keep your information within specific geographic regions.

12. Policy Updates and Changes

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or platform features.

How We Notify You

• Email notification for material changes
• Platform notification banner
• Updated date at the top of this policy
• 30-day notice period for significant changes

Your Continued Use: Continuing to use our platform after changes take effect means you accept the updated policy. If you don't agree with changes, you can delete your account before they take effect.

13. Contact Information and Complaints

Privacy Questions and Requests

General Privacy Matters:

📧 privacy@blpagency.org

Response time: Within 30 days

Data Protection Officer:

📧 dpo@blpagency.org

For GDPR and complex privacy issues

Emergency Contacts

• Security incidents: security@blpagency.org
• KYC data concerns: verification@blpagency.org
• Legal compliance: legal@blpagency.org

Filing Complaints

If you believe we've mishandled your personal data, you can file complaints with relevant supervisory authorities in addition to contacting us directly.

Mailing Address:

BLP Agency
Attn: Privacy Department
World Trade Center Bucharest, Romania