Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account data: name, email address, and password (stored as a salted hash, never in plain text)
• OAuth profile data: when you sign in with Discord or Google, we receive your provider ID, display name, avatar, and the email address your provider shares with us
• Companion application data: age, nationality, languages, game ranks, verification documents (ID, selfie, rank proof), and voice sample, submitted when you apply to become a Companion
• Booking and transaction data: sessions booked, amounts paid, order status, reviews, and messages exchanged through the order page
• Payment data: Stripe processes your card details directly; we receive and store only the resulting transaction identifiers and amounts, not your card number
• Communications: a record that a transactional email was sent to you (a one-way hash of your email address plus delivery status), used to confirm delivery without storing a readable copy of your address in that log
• Technical data: IP address and request metadata used for rate-limiting and abuse prevention

2. How We Use Your Information

We use the information above to:

• Create and secure your account, and keep you signed in
• Process bookings, payments, refunds, and Companion payouts
• Verify Companion applications and prevent fraudulent listings
• Send transactional emails: registration confirmation, booking confirmation, cancellation notices, password resets, and support-request updates
• Investigate safety reports and enforce our Terms of Service
• Improve and secure the Platform

3. What We Do Not Do

We do not sell your personal data. We do not use your data for third-party advertising, and we do not use tracking or advertising cookies.

4. Third Parties We Share Data With

We share the minimum data necessary with the following service providers to operate the Platform:

• Stripe — payment processing, Companion payouts, and fraud prevention
• Resend — delivery of transactional email
• Discord and Google — authentication, if you choose to sign in with those providers
• Neon (PostgreSQL) — our database host
• Vercel — application hosting

5. Data Storage and Security

Your data is stored in a PostgreSQL database hosted by Neon. We use encryption in transit (HTTPS/TLS) for all traffic to the Platform, and passwords are hashed before storage.

[Counsel/engineering to confirm and state the actual hosting region(s) and any additional security certifications before this is finalized.]

6. Data Retention

We retain account and transaction data for as long as your account is active and as needed to meet our legal, tax, and accounting obligations after that. Companion verification documents are deleted once an application reaches a final decision (approved or rejected), other than what a decision requires us to keep on file.

When your account is deleted, we delete your profile, sign-in details, messages, community posts, uploads and AI Coach history. Records of payments you made or received — orders, purchases, subscriptions, refunds and payouts — are kept for as long as the law requires, anonymized so they no longer show your name, email or linked accounts. Deleting an account does not prevent you from creating a new one later with the same email address.

7. Your Rights

You may request a copy of the personal data we hold about you, request that we correct it, or request deletion of your account and associated data, by contacting us through the contact page.

[Counsel to add jurisdiction-specific rights language here — for example GDPR data-subject rights for EU/UK users, or CCPA/CPRA rights for California residents — including response timelines and any required verification process.]

8. Children's Privacy

The Platform is not directed at children and is not intended for use by anyone under our minimum account age (see our Terms of Service). [Counsel to confirm whether additional children's-privacy compliance, such as COPPA, applies given the minimum age ultimately chosen.]

9. Cookies

We use a small number of essential cookies: one to keep you signed in (session authentication) and one to remember your selected display language. We do not use advertising or cross-site tracking cookies.

10. International Data Transfers

[Counsel to add if the Platform serves users outside the country where its infrastructure is hosted — this typically requires a statement about transfer mechanisms such as Standard Contractual Clauses.]

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will post the updated policy with a new effective date.

12. Contact

Privacy enquiries may be submitted via our contact page. See also our Terms of Service.