Privacy Policy

This Privacy Policy explains what personal information Katchers Inc ("KissVeil", "we", "us") collects when you use the KissVeil website at kissveil.com and the KissVeil apps (the "Service"), how we use it, who we share it with, how long we keep it, and the choices and rights you have. For people in the European Economic Area and the United Kingdom, we are the controller of your personal information.

KissVeil is only for adults aged 18 or older. Words like "Terms" have the meaning given in our Terms of Service.

1. The short version

• You sign in with Google or Apple. We never see or store a password, and we keep your email address only as a keyed hash that cannot be read back.
• Your conversations are private to you. They are sent to AI providers to generate replies, and new conversation content is encrypted before it is stored.
• We do not ask for your date of birth. If you verify your age, our provider Persona handles your ID and selfie; we do not receive them.
• We do not sell your personal information for money, we do not show ads inside KissVeil, and we do not use your conversations to train AI models.
• We advertise KissVeil on other services. To measure and improve those ads, we record how you arrived and, in the countries where advertising measurement is switched on, share limited information about your visits, sign-ups and purchases with the advertising platforms we use, such as Meta. That includes which pages and works you view. We do not share your conversations, personas, calls, name or email address for this, and you can opt out (sections 2, 5 and 9).
• Where we have switched it on, we use analytics tools, such as Google Analytics, to understand how KissVeil is used. They are not used for advertising, and they are not told which works you view. If you are signed in, they can recognize you as the same person on your different devices through a code that only we can link to your account. In the European Economic Area, the United Kingdom and Switzerland, or if we cannot tell where you are, they store nothing on your device unless you agree when we ask (section 2).
• We send you marketing emails or notifications only if you choose to receive them, and you can stop them at any time.
• The companies that receive information for the purposes above are listed by name at kissveil.com/privacy-partners. We add a company there, in a kind this Policy already describes, before it receives anything, and we announce it in advance (section 11).
• What you say on a call is kept as text so you can read it back, encrypted with a key unique to that call. You can delete it whenever you like, and nothing deletes it for you.
• What you say on a call run by ElevenLabs is also remembered: a few short notes are kept and used in your later calls with the same character. Deleting a call deletes its notes too.
• You can delete conversations and close your account in the app. We keep information only as long as we need it, as explained in section 7.

2. Information we collect

Account information

When you sign in with Google or Apple, we receive an account identifier from that provider and the email address on that account. We use the email address to confirm who you are, to keep one email address from creating duplicate accounts, and to give welcome coins only once per address. We do not store the address in readable form: we store a keyed hash of it. If you use Apple's "Hide My Email", the address we receive is the relay address Apple gives us. We do not receive or store a password.

We create a handle and display name for your account, and you can change them. We also keep your avatar if you upload one, your language setting, when you signed up, and your account status.

Personas

A persona describes who you play in conversations. It can include a name, an age, an occupation, a gender and a description. The description is encrypted before it is stored; the other persona fields are not.

Conversations

We store the messages you send, the replies the AI generates, alternative replies you ask for, memory notes summarized from your conversations, and the settings you choose for a conversation, such as the AI model. New conversation content and memory notes are encrypted with a key unique to each conversation before they are stored.

Your conversations may include sensitive information, including about your sexuality or sex life, your health or your beliefs, if you choose to write it. Only include what you are comfortable sharing. We use it only to provide the Service to you and for the safety purposes described in section 3.

If you create scene images or videos from a conversation, we store them privately so that only you can see them.

Calls

When you make a call, your microphone audio is streamed from your device directly to the voice service that runs the conversation. Which service that is depends on the character: ElevenLabs runs every English call and some Korean ones, and Google runs the other Korean calls. KissVeil does not record or store the audio.

We store what was said on the call, as text. You can read your past calls with a character in the app, and delete any call, or all of them, whenever you like. We keep them until you delete them; we do not delete them on a schedule. What was said is encrypted with a key unique to each call before it is stored, and deleting a call's words also destroys that key.

When you start a call that ElevenLabs runs, we also give ElevenLabs a few details so the character can talk with you naturally: the name on your default persona, if you have given it one; your local date and time, with the name of your time zone; the city we estimate you are in, from your connection or from your time zone; the memories kept from your earlier calls with that character; and how many calls you have had with that character and when the last one was. The city is only an estimate, and we do not store it. Calls run by Google are not given these details.

What you say on a call run by ElevenLabs is remembered for your later calls with the same character. After such a call ends, its transcript is sent to OpenAI, which picks out a few short notes about what you talked about, such as your plans or preferences. It is instructed to leave out sensitive information, such as health, sexuality, religion, politics, payment details and precise addresses. The notes are kept, encrypted, and are the memories given to the character at the start of your later calls with it, as described above. You are not asked to approve each note. The transcript itself is not given to the character. Transcripts of calls run by Google are not sent for notes.

From the same notes, the character may also prepare one short question about something you mentioned, to open your next English call with it. The question is spoken by the character, so its text goes to ElevenLabs, which runs that call. It is kept for at most 14 days, used for one call only, and deleted whenever the notes it came from are deleted.

If you delete a call, a character's calls, or all of your calls in Past calls, the notes taken from those calls are deleted too. Calls you made before you agreed to this version of the Policy are not used to make notes.

We also store call records (when calls started and ended and how long they lasted), your relationship level with the character, and your time zone, which we use to apply daily limits and quiet hours.

If you allow notifications for incoming calls, we store your browser's push subscription (an address at your browser's push service and the keys needed to send to it), your language and your time zone.

Content you publish and share

If you create characters or stories, we store them, including their text and images. We also store comments you post and pictures you attach to them, the works you like, the authors you follow, the reports you make and the people and conversations you block.

Support messages

When you contact us through Help, we store your messages, their category and our replies. If you tell us why you are closing your account, we store that reason.

Age information

We do not ask for or store your date of birth.

When you answer the agreement on your first visit, your answer is stored only on your device, in your browser's storage. When your account confirms that you are 18 or older, we record that confirmation, the version of the policy it applied to, when it happened, how it was declared, and a country code if your device sends one. We also keep an age record for your account that says whether you have self-declared or been verified as an adult.

If you verify your age, Persona collects and processes a photo of your government-issued ID and a selfie, under its own privacy policy. We send Persona only a random reference that is not linked to your email or name. We receive the status and result of the verification, Persona's identifiers for it, and the time it happened. We do not receive your ID images, your selfie, your name or your date of birth.

Purchases, coins and rewards

When you buy coins, the payment is handled by Stripe or PayPal, which collect your payment details directly. We receive and keep an order record: what you bought, the amount and currency, the payment provider's reference numbers and the status, including any refund or dispute. We keep a ledger of the coins added to and spent from your account.

If you take part in an invitation program, we store who invited whom, the rewards given, and a hash derived from each person's email hash, used to stop the same person from being rewarded twice.

How you use KissVeil

When you are signed in and have agreed to our Terms, we record how you use the app, linked to your account: which works were shown to you and which you opened, swiped, liked, shared, commented on, reported or blocked; when you start conversations and use chat features; and how long the app was in the foreground. We do not record the text of your messages, your search terms, your IP address or a device fingerprint in these records.

How you arrived

When you arrive at KissVeil, we note how you got here, and we keep this for your first visit and for your most recent visit that came from a campaign: campaign tags in the link you followed (the `utm_source`, `utm_medium`, `utm_campaign`, `utm_content` and `utm_term` parameters), the site that referred you (its scheme and host only, never the page or its query), the path of the page you landed on (without its query), your browser's language and the time. If the link came from an ad, it may also carry an advertising click identifier set by the ad platform (Meta's `fbclid`, Google's `gclid`, `gbraid` or `wbraid`, TikTok's `ttclid`, X's `twclid`, Microsoft's `msclkid`, Reddit's `rdt_cid` or Snap's `ScCid`), and a link from a partner who sends people to KissVeil carries that partner's code.

We keep this in your browser's storage on our own domain. When you create an account, your browser sends it to us once and we store it with that account, so we can tell which campaigns lead to sign-ups, conversations and purchases. We keep it while your account exists and remove it when the account is closed, as described in section 7. This record is ours and is not itself sent to any advertising platform, and opting out of advertising measurement does not remove it. Where advertising measurement is on for you, the click identifier of a platform's ad you followed does reach that platform, through the measurement described below.

If you are in the European Economic Area, the United Kingdom or Switzerland, if we cannot tell which country you are in, or if your browser sends a Global Privacy Control signal, we keep this only for your browser session and we do not keep or store advertising click identifiers at all.

Advertising measurement

Advertising measurement is switched on country by country. It is never on for visitors in the European Economic Area, the United Kingdom or Switzerland, or where we cannot tell which country you are in. This section applies to you only while it is on for you and you have not opted out, and you can opt out before it is switched on.

When it is on, KissVeil uses the measurement tools of the advertising platforms where we advertise, through their tools in your browser (such as the Meta Pixel) and from our servers (such as Meta's Conversions API). We use them to learn whether our ads lead people to visit, sign up and buy, and to let those platforms show our ads to people likely to be interested in KissVeil, including people who have visited KissVeil before. Today that platform is Meta (Facebook and Instagram). We may add others of the same kind, such as Google, TikTok, X, Reddit, Microsoft or Snap; the platforms in use are listed at kissveil.com/privacy-partners, and a platform is added there before it receives anything (section 11). When you visit a page, sign up, begin a purchase or complete one, a platform in use receives:

• the kind of event and when it happened, with a random identifier we give the event so it is not counted twice
• the address of the page you were on, without its query, and the site that referred you (its scheme and host only). On a story page the address is rewritten to carry only a code for the work, never its title, so the platform can tell one work from another but is not told what it is
• your IP address, your browser's user agent and the technical details a browser sends with any request, such as its language and screen size
• that platform's own browser identifiers (such as Meta's `_fbp` and `_fbc` cookies described below) and the advertising click identifier from that platform's ad, if any
• on our apps, if you allow it, your device's advertising identifier (on iOS only after you agree in Apple's prompt)
• for a purchase, which coin pack it was, the amount and the currency

We send a platform only the items listed above. We do not send a work's title, tags, description or images, which works you like, follow or talk to, the content of your conversations, personas or calls, what you search for, your name, your handle, your email address in any form, your account identifier, your payment details or your age information, and we keep the platforms' automatic matching features switched off. Each platform uses what it receives under its own terms and data policy, including to match the event to an account you have with it.

You can turn this off for yourself at any time, for every platform at once (section 9). When you do, or when your browser sends a Global Privacy Control signal, we do not load the platforms' tools for you, we do not send them your events from our servers either, and we remove their cookies from your browser. What a platform received before then is not recalled.

Analytics

KissVeil uses analytics tools to understand how KissVeil is used. Today that is Google Analytics, loaded through Google Tag Manager. We may add other analytics tools of the same kind, such as product analytics or session measurement; the tools in use are listed at kissveil.com/privacy-partners, and a tool is added there before it receives anything (section 11). We use them for analytics only: we do not use them to measure or deliver ads, and we keep their advertising features (such as Google signals and ad personalization) switched off. This section calls them "analytics", and everything it says applies to each of them.

We may also show different versions of a screen to different people, to learn which works better. Which version you saw is recorded with your usage records and the analytics events below.

When it is on, analytics receives the following events from your browser:

• a page view, with the path of the page you were on. A story, character or section page is reported only as the kind of page (for example `/story/*`), never which work it was, and any area about you or your conversations (such as a chat, your profile or your settings) only as the area. Campaign tags are kept only when they are one of the fixed values we use in our own links, and nothing else in the address's query is sent
• that you signed up, and whether with Google or Apple
• that you sent your first message, and that you reached 10 or 30 messages (never the messages)
• that you began a purchase, and that you completed one, with the amount, the currency and the order number
• which version of a screen you saw, when we are comparing versions

Recognizing you across devices. If you are signed in, we also give analytics a code for your account, so it can count your visits on your phone and your computer as one person rather than two. The code is made from your account by a secret only we hold: it is not your account identifier, it is different from any code we give anyone else, and analytics cannot turn it back into your account. We give it only to analytics, only while analytics is allowed for you, and only if you have agreed to this version of the Policy or a later one. When you sign out, we stop sending it.

We do not send analytics the content of your conversations, personas or calls, the titles of works or which works you view, what you search for, your name, your handle, your email address or your account identifier itself. Analytics also receives your IP address and the technical details a browser sends with any request, and sets its own cookies on our domain. The analytics providers process this for us as our service providers (section 5).

Whether it runs for you:

• In the European Economic Area, the United Kingdom and Switzerland, or where we cannot tell which country you are in, it is off. We ask you, with "Accept" and "Reject" side by side, and until you agree, no analytics tool is loaded, nothing is stored on your device and none of these events are sent. You can change your answer at any time from "Your Privacy Choices" (section 9).
• Elsewhere, it is on, and you can turn it off at any time from "Your Privacy Choices". Turning off advertising measurement there does not turn off analytics, and turning off analytics does not turn off advertising measurement; each is its own switch.

If you turn it off while it is running, we stop sending events at once and tell the analytics tools. If that cannot be done, we reload the page with it off.

Marketing messages

We send you marketing messages only if you choose to receive them, separately from agreeing to this Policy: emails or notifications about new works and characters, features, offers, and reminders about things you started. Every marketing email has a link to stop them, and you can stop marketing notifications in Settings or in your device's settings. Messages about your account, your purchases, your security or changes to our Terms and this Policy are not marketing, and you receive them either way.

Your account keeps your email address only as a keyed hash that cannot be read back (section 2), so it cannot be used to email you. If you choose to receive marketing emails, we keep the address you give us for that in readable form, separately from your account's hash, together with when and how you agreed. We use it only to send you those emails and to record that you stopped, and we delete it when you unsubscribe or close your account. To send marketing emails we may use an email delivery provider, listed at kissveil.com/privacy-partners, which receives the address and the message. We record whether an email was delivered, and may record whether it was opened or a link in it was clicked, to learn which messages are useful.

Partners who send people to KissVeil

We may work with affiliates, creators and other partners who share links to KissVeil. When someone arrives through such a link, the link carries the partner's code, which we keep with how you arrived (above). We may tell a partner how many people signed up or bought through their links, and the amounts, so we can pay them. We do not tell them who you are, and we do not give them your account identifier, your activity in KissVeil or anything you wrote.

On our apps, we may use a mobile measurement provider to learn which ad or link led to an app being installed and opened. It receives your device's advertising identifier, if you allow it, the advertising click identifier, and technical details about your device and the app. It processes these for us as our service provider, and only where advertising measurement is on for you.

Technical information

Your IP address and browser information reach our network and hosting providers, Cloudflare and Amazon Web Services, because that is how internet traffic works, and they may keep them in their own logs. In our own database we keep only a keyed hash of your IP address, used to limit how often actions can be repeated. There is one exception, and it applies only where advertising measurement is on for you and you have not opted out: an event waiting to be sent to an advertising platform is held with the IP address, user agent and platform browser identifiers it will carry, until it has been sent and for no longer than seven days, after which we erase them from the event. Our server logs record your account identifier, the page or API path you requested (without its query), the result and how long it took.

If an AI request fails and our diagnostics store is turned on, we may keep an encrypted copy of that request, including the conversation it contained, for a limited time so we can investigate the failure.

Cookies and similar technologies

We use cookies and your browser's storage to run the Service and, where advertising measurement or analytics is on for you, to measure our advertising and how KissVeil is used, as described above.

• sable_reader keeps you signed in (30 days).
• sable_reader_renewed marks that we have already refreshed your sign-in today, so we do not do it again until tomorrow (1 day).
• sable_reader_holder remembers which account last signed in on this browser, so a late refresh cannot bring back a sign-in you ended (up to 400 days).
• sable_signin protects a sign-in while it is in progress (up to 12 hours).
• sable_social_oauth protects connecting a social account to an account already signed in (10 minutes).
• Cookies whose names begin with sable_referral carry an invitation code until you sign up (up to 30 days).
• CloudFront-Policy, CloudFront-Signature and CloudFront-Key-Pair-Id let your browser load images (session).
• sable_age_gate_declined records an answer that you are under 18, so that answer survives (up to 10 years), and sable_age_gate_declaration keeps a Yes answer when your browser's local storage cannot (up to 10 years).
• Cookies whose names begin with sable_unsettled_purchase remember a purchase that is still being confirmed (7 days).
• _fbp and _fbc are Meta's advertising measurement cookies. `_fbp` identifies your browser to Meta, and `_fbc` holds the click identifier of a Meta ad you followed (up to 90 days each, subject to your browser's settings). They are set only where advertising measurement is on for you, and not when you have opted out or your browser sends a Global Privacy Control signal.
• Cookies whose names begin with _ga are set by Google Analytics, only where it is on for you as described above (up to 2 years, subject to your browser's settings).
• Other advertising platforms and analytics tools we add set their own cookies of the same kinds, under the same conditions. Their names and how long they last are listed with each company at kissveil.com/privacy-partners.

Where analytics is switched on, in your browser's own storage we also keep your answer about analytics (asked again after about six months or when what we ask changes) and, while analytics is allowed, a count of your messages and a note of which purchases were already reported, so that each event is sent once. We also keep your first-visit answer, your appearance settings, your recent searches, which tips you have seen, pending purchase and media states, where you had scrolled to, a queue of usage events waiting to be sent, and — while a reply is being written — the message you typed and any rewrite instruction you gave. These stay on your device. We also keep there how you arrived and your advertising measurement choice; unlike the rest, these are sent to us as described above, when you create an account or are signed in.

Some pages load resources from other companies, which receive your IP address and may set their own cookies: Google Fonts, Sign in with Apple, PayPal on the purchase screen, Persona on the age verification screen, the advertising platforms in use where advertising measurement is on, and Google Tag Manager with the analytics tools in use where analytics is on for you.

3. How we use your information

We use personal information to:

• provide the Service: sign you in, run conversations, remember context, show and publish works, process purchases and coins, and deliver notifications
• generate AI replies, suggestions, memories, images, videos and calls, which requires sending the relevant content to our AI providers
• keep KissVeil safe and within our Terms: review works before they are published, including with the help of AI models; handle reports; investigate abuse; enforce content rules; protect minors; and prevent fraud and duplicate rewards
• apply age assurance and decide which works you can access
• answer your support requests
• understand how KissVeil is used so we can improve it, using the usage records and the analytics described above
• measure and improve our advertising, using how you arrived and the advertising measurement described above, and pay partners who send people to KissVeil
• send you marketing messages you chose to receive
• secure the Service, prevent misuse and debug problems
• comply with the law, respond to lawful requests, and establish or defend legal claims

Who can see your conversations. Your conversations are not visible to other users. Authorized KissVeil staff can access conversation data, including conversation lists, messages and memory notes, when needed to investigate a report or a safety concern, to answer a support request you make, to investigate a failure, or to comply with the law. Only accounts with a moderation role can reach that data, and we limit their use of it to those purposes.

AI training. KissVeil does not use your conversations, personas or voice data to train AI models. Our AI providers process this content to provide the Service to us under the agreements and plans we hold with them.

Advertising and sales. We do not sell your personal information for money, and we do not show other companies' ads inside KissVeil. We do share the limited information described under "Advertising measurement" with the advertising platforms we use, to measure and deliver our own ads. Under some privacy laws, including several United States state laws, this can be a "sale" or "sharing" of personal information or "targeted advertising" even though we receive no money for it, and you have the right to opt out (section 9).

Automated decisions. AI models help review works submitted for publication, but decisions to publish or reject a work are made by people.

4. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the Service you signed up for, including conversations, purchases, coins and support, and calls, including the notes that let a character remember your earlier calls with it, as it remembers your conversations.
• Legitimate interests: to keep KissVeil safe and secure, prevent fraud and abuse, review content, understand usage and improve the Service, and measure which campaigns bring people to KissVeil using campaign tags kept for your browser session, where those interests are not overridden by your rights. We do not use advertising platforms' measurement tools or store advertising click identifiers for people in the European Economic Area or the United Kingdom, or in Switzerland.
• Consent: where we ask for it, including for sensitive information you choose to include in conversations, for notifications, for analytics cookies and storage and the code that recognizes you across devices, and for marketing messages. You can withdraw consent at any time, which does not affect processing before you withdrew it.
• Legal obligation: to keep financial records, meet age assurance requirements and respond to lawful requests.

5. Who we share information with

We share personal information only as described here.

Service providers that process it on our behalf:

• Amazon Web Services (United States): hosting, database, storage, encryption keys and logs.
• Cloudflare: network delivery and protection for all traffic to KissVeil.
• Google: AI models that generate conversation replies, memories and suggested replies, help creators draft, tag and illustrate works, translate works, and review videos in submitted works; the Korean calls it runs (section 2); scene video generation; Sign in with Google; and Google Analytics, loaded through Google Tag Manager, where analytics is on for you (section 2).
• ElevenLabs (United States): the voice service that runs English calls and some Korean ones, including the speech it hears and the speech it speaks, and the details we give it when a call starts, listed under "Calls" in section 2.
• OpenAI: scene image generation from your recent conversation, notes taken from call transcripts so they can be remembered in later calls, and background images for works.
• Anthropic: AI review of the text and images of works submitted for publication, and matching backgrounds to works.
• Persona: age verification.
• Stripe and PayPal: payments.
• Apple: Sign in with Apple.
• Your browser's push service (such as those run by Google, Mozilla or Apple): delivering notifications you allow, sent encrypted.
• Analytics, email delivery and mobile measurement providers: the analytics, the delivery of marketing emails you chose to receive, and the app measurement described in section 2.

We may replace a provider above, or add one, to do a job this section already describes. Each one in use, with the country it processes in, is listed at kissveil.com/privacy-partners.

Advertising partners. The advertising platforms we use receive the information described under "Advertising measurement" in section 2, for visitors for whom it is on and who have not opted out. Today that is Meta Platforms (United States); the platforms in use are listed at kissveil.com/privacy-partners. They are not our service providers for this: each processes what it receives under its own terms and data policy, and its role depends on the advertising service used.

Partners who send people to KissVeil. Affiliates, creators and other partners whose links bring people to KissVeil receive only the counts and amounts described in section 2, never information that identifies you.

Other users. Your handle, display name, avatar, published works, comments and the fact that you like or follow something may be visible to other users.

Legal and safety. We may disclose information if we believe in good faith that it is required by law or legal process, or needed to protect the rights, property or safety of KissVeil, our users or the public, including reporting child sexual abuse material to the appropriate authorities.

Business transfers. If KissVeil is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

With your consent. In any other case, only when you ask us to or agree to it.

6. International transfers

KissVeil is hosted in the United States, and our service providers may process information in other countries. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we use safeguards recognized by law, such as the European Commission's Standard Contractual Clauses.

7. How long we keep information

In general. We keep personal information for as long as we need it for the purposes described in this Policy, or as otherwise described when we collect it, unless the law requires a shorter period. How long that is depends on what the information is, why we collected it and the choices you make. When we no longer need it, we may delete it, de-identify it or aggregate it. We may also keep information for as long as necessary to comply with legal obligations, such as tax and accounting rules, to keep KissVeil and its users safe, to prevent fraud and abuse, to resolve disputes and to enforce our agreements. Copies may remain in backups for a period after they are removed from our live systems.

Deleting conversations. Deleting a conversation removes it from your account. A copy may remain in our systems until it is removed under the rule above.

What was said on your calls. We keep it until you delete it. There is no schedule that removes it for you. Deleting a call's words in the app removes them and the notes taken from them, and destroys the key that could read them; a copy may remain in backups until those are removed under the rule above.

Closing your account. You can close your account in Settings. Closing starts a 7-day window in which you can cancel. After it ends, your account is closed and your information is handled as described above.

What you shared with others. Content you shared with other people may remain after you close your account. Works you published are made private rather than deleted, and comments you posted may remain with your name removed. If you plan to publish a character or story, do not include personal information about yourself in it.

How you arrived. We keep it while your account exists and remove it when the account is closed, under the general rule above (a copy may remain in backups for a period). What an advertising platform has already received is kept under that platform's own retention practices, which we do not control.

Advertising measurement events waiting to be sent. Where advertising measurement is on for you, an event is held until it has been sent to the advertising platform. The IP address, user agent and platform browser identifiers held with it are erased once it is sent, and in any case within seven days.

Analytics. We set Google Analytics to keep the events it receives for 2 months, the shortest period it offers, after which only totals that do not identify you remain. Any other analytics tool we add is set to keep events for no longer than 14 months, and its period is listed at kissveil.com/privacy-partners.

Marketing emails. We keep the email address you gave for marketing emails until you unsubscribe or close your account, and a record that you agreed and when you stopped for as long as we may need to show it.

Age verification. Persona keeps the information it collects for verification under its own retention policy.

8. Security

We use technical and organizational measures to protect personal information. New conversation content, memory notes, persona descriptions and what was said on your calls are encrypted with keys managed in AWS Key Management Service. Our database and storage are encrypted at rest, connections to KissVeil use TLS, and database access controls restrict each account's private records to that account and to authorized staff. We store email addresses only as keyed hashes, and IP addresses only as keyed hashes apart from the one held for up to seven days with an advertising measurement event waiting to be sent, as described under "Technical information" in section 2. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your choices and rights

In the app. You can edit your profile and personas, delete conversations, delete what was said on any call or on all of them, manage blocks and notification settings, and close your account in Settings.

Advertising measurement. You can turn off advertising measurement at any time at kissveil.com/privacy-choices, which is linked as "Your Privacy Choices" from Settings > Privacy & safety. You do not need an account. The choice is saved in your browser, and with your account when you are signed in, so that it also applies on your other devices and to events sent from our servers. We also treat a Global Privacy Control signal from your browser as that choice.

Marketing messages. You can stop marketing emails with the link in any of them, and marketing notifications in Settings or your device's settings.

Analytics. Once analytics is switched on, you can turn it off, or on if you were asked and said no, at any time from "Your Privacy Choices". In the European Economic Area, the United Kingdom and Switzerland, and where we cannot tell where you are, it stays off unless you turn it on.

Requests. You can ask for a copy of your personal information, or ask us to correct, delete or restrict it, through Help or by emailing [email protected]. We prepare copies by hand, and we may need to confirm that the request comes from the account holder. We respond within the time the law requires.

EEA and UK. You have the right to access, rectify, erase, restrict and port your personal information, to object to processing based on legitimate interests, and to withdraw consent. You can also complain to your local data protection authority.

United States. Depending on the state you live in, you may have the right to know what personal information we collect and how we use and disclose it, to access and receive a copy of it, to correct it, and to delete it. You have the right to opt out of the "sale" or "sharing" of personal information and of targeted advertising: the advertising measurement described in section 2, with every advertising platform we use, is the only such sharing we do, and you can opt out at kissveil.com/privacy-choices ("Your Privacy Choices") or with a Global Privacy Control signal. We do not sell personal information for money. We do not knowingly sell or share the personal information of anyone under 18. We do not use or disclose for advertising what you write in conversations, personas or calls. Which works you view is shared with the advertising platforms as described in section 2, and because that can say something about your interests, including sensitive ones, you can stop it at any time with "Your Privacy Choices". You can use an authorized agent to make a request, and if we deny a request you may appeal by replying to our decision. We will not discriminate against you for exercising your rights.

10. Children

KissVeil is not for anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we close it and take steps to delete its information, subject to section 7. If you believe a minor is using KissVeil, tell us through Help or at [email protected].

11. Changes to this Policy

Every version of this Policy has a version name. If we make a change that collects a new kind of information, uses it for a new purpose, gives it to a new kind of recipient, keeps it longer or narrows your rights, we publish a new version and ask you to agree before you continue using features that need your agreement.

The list of partners. The companies that do a job this Policy already describes (the service providers, advertising platforms, analytics tools and other partners named in sections 2 and 5) are listed at kissveil.com/privacy-partners, with what each does and where. Adding or replacing a company there is not a new version: it receives only what this Policy already says that kind of company receives, for the same purposes. We add a company to the list, and announce it in the app, at least 14 days before it receives any personal information, unless we must change a provider sooner for security or legal reasons, in which case we update the list as soon as we can. Removing a company from the list happens without notice. The page shows the date it last changed, and we keep every earlier state of the list, which you can ask us for (section 9).

We may correct typos and improve wording without changing any of the things above; such corrections update the current version without asking you again.

The current version is always at kissveil.com/privacy, and every earlier version stays available at kissveil.com/privacy/ followed by its version name.

12. Contact

• Katchers Inc
• 16192 Coastal Highway, Lewes, Delaware 19958-3608, United States
• Privacy questions and requests: [email protected]

You can also reach us through Help in the app.