Privacy Policy

Last modified: October 2, 2026

Interest based advertising: to learn more about data disclosure click here
Opt-out options: DO NOT USE MY DATA

I. INTRODUCTION. REGIONAL PATTERNS (CALIFORNIA)

myAIChat (“we,” “us” or “our”) takes your privacy seriously. This Privacy policy (“Privacy policy”) explains our data protection policy and describes the types of information we may process when you install and/or use “myAIChat” software application for mobile devices (the “App”, “our App”).

When we refer to personal data (or personal information) we mean any information of any kind relating to a natural person who can be identified, directly or indirectly, in particular by reference to such data.

It is a natural person who can be identified directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social status.

Our Privacy policy applies to all users, and others who access the App (“Users”).

PLEASE READ THE FOLLOWING PRIVACY POLICY, FOR INFORMATION REGARDING THE WAYS YOUR PERSONAL INFORMATION MAY BE PROCESSED, CAREFULLY. WHEN YOU USE THE APP YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THESE TERMS.

IF YOU ARE A CALIFORNIA RESIDENT PLEASE READ THE FOLLOWING IMPORTANT NOTICE

Under the California Consumer Privacy Act of 2018 (CCPA) California residents shall have the right to request:

• the categories of personal information that is processed;


• the categories of sources from which personal information is obtained;


• the purpose for processing of user personal data;


• the list and categories of third parties with whom we may share your personal information;


• the specific pieces of personal information that we might have obtained about a particular user provided that the data provided in the request is reliable enough and allows to identify the user.

Please use the navigation links through this Privacy policy:

PERSONAL INFORMATION

All about the categories of information, its sources and purposes of processing >>

Please mind that according to CCPA personal information does not include de-identified or aggregated consumer information.

SHARING

How your information can be shared >>

Please note that all third parties that are engaged in processing user data are service providers that use such information on the basis of agreement and pursuant to business purpose.

OPT-OUT OPTIONS

If you don’t want us to process your personal information any more please contact us through the contact form. In most cases there is no way to maintain the App’s further operating without functional data therefore you will be advised to remove the App from your device.

If you don’t want us to share device identifiers and geolocation data with service providers please check your device settings to opt out as described below >>

REQUESTS

To submit a verifiable consumer request for access, portability or deletion of personal data please contact us through the contact form. Please include in the text of your appeal the wording "Your rights to maintain confidentiality in the state of California”.

When submitting a verifiable request, you should be ready to:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include: name, address, city, state, and zip code and email address. We may use this information to surface a series of security questions to you to verify your identity. If you are making a request through an authorized agent acting on your behalf, such authorized agent must provide written authorization confirming or a power of attorney, signed by you.


• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We will not be able to respond to your request or provide you with personal information if we cannot: (i) verify your identity or authority to make the request; or (ii) confirm that the personal information relates to you. We may ask you for additional information or documents to verify your identity. We may also carry out checks, including with third party identity verification services, to verify your identity before taking any action with your personal information. This is regarded as a safeguard measure to prevent disclosure of your personal information under a fake or scam request.

We ensure that personal information provided in a verifiable consumer request will be used only to verify the requestor’s identity or authority to make the request and not for any other purpose. We will keep it for the adequate term reasonably needed for the purpose described above and delete after the purpose is fulfilled.

We try to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. Please note that we are only required to respond to two requests per customer each year.

EQUAL RIGHTS

Nothing in the way we deal with your request shall be interpreted as discrimination, which means that we will not set up different pricing or products, or different level or quality of services for you, if you choose to exercise your rights. However, in some circumstances, we may not be able to provide services if you choose to delete your personal information from our records.

SALE OF DATA

We do not sell any of your personal data to third parties.

II. INFORMATION WE PROCESS

There are several categories of information that can be processed.

Functional Information

We ask for and process the following information when you use the App. This information is necessary for the adequate performance of the contract between you and us. Without such information it is impossible to provide complete functionality of the App and perform the requested services.

• Your Email Address is recorded if you purchased a subscription on the App’s Website and want to use the premium features of the App. In this case you have to sign in into your myAIChat account if you already have one or create a new account within the App.

  We also record your email address if you create a myAIChat account by providing your email address (“enter your email” option on the Account page) and going through a verification process. You may also choose to sign in to the App with your Apple or Google account using the “Continue with Apple” or “Continue with Google” button on the Account page. In this case the information related to your Apple ID/Google account credentials shall be used to sign in to your myAIChat account.

  Please note that we DO NOT access, use, store or share your Google user data. Authorization is performed via OAuth 2.0 which is a safe protocol implemented by Google to access Google API and obtain access tokens for users. Google API allows you to sign in to our App using your Google Account. If you have any inquiries regarding how your user data is used via Google API, you should address Google directly (please check Section IV for contact details).

  We use your email address to identify your subscription purchases and send you invoices for them. Your email address may also be used for a different purpose, please check the subsection “Email Communications” of this Privacy policy.

• User Content (i. e. the text you enter into the message field, PDF-files you attach and send to the App, as well as any text, other content generated by AI via the App). Subject to your compliance with certain rules and restrictions outlined in our Terms of Use, you may dispose of, use, share, otherwise exploit your User Content for your own purposes. However, any use of User Content is at your sole risk, i. e. you assume and bear all risks and responsibility associated with your use of User Content. It is your sole responsibility to ensure compliance with the applicable laws while using the User Content. Please note that our AI chat, image understanding, document analysis and image-generation features send such User Content through OpenRouter, Inc. to the AI model providers that we select for the respective feature (currently, for example, OpenAI, Anthropic, Google, Krea AI and Perplexity; image generation uses AI image models, currently, for example, Krea AI and Google Gemini). If OpenRouter is not available, your User Content is processed by Microsoft Azure OpenAI Service, our fallback provider, instead. Please check Section IV to learn more about the privacy practices of these providers.


• AI Service Provider Data Transfer and Your Choices. When you voluntarily use an AI feature in the App, including by typing a prompt, continuing a conversation, uploading an image or document, or requesting image generation, we transmit the minimum data needed to fulfill your request to the relevant third-party AI service provider. This data may include: (i) your Input Content; (ii) files, images or documents that you choose to upload; (iii) limited conversation history needed to generate a coherent response; (iv) your selected AI model or feature; and (v) technical request metadata such as conversation, message, thread or request identifiers that are used to route, secure and process your request. We send this data to OpenRouter, Inc., which forwards it to the provider of the AI model that answers your request; if OpenRouter is not available, Microsoft Corporation (Microsoft Azure OpenAI Service) processes it instead. By entering content and tapping the relevant send, upload or generate control in the App, you direct us to transfer that data for the sole purpose of generating the requested AI output. If you do not want your content shared with a third-party AI service, do not submit content through the AI features and do not upload files or images for AI processing.


• AI processing. To answer your messages and generate images, the content you send (texts, photos, documents, image prompts) is transmitted to OpenRouter, Inc., USA, which forwards it to the AI model providers and cloud platforms that we select for the respective feature, located in the USA (currently, for example: OpenAI, Anthropic, Google, Krea AI and Perplexity, and cloud platforms that run these models, such as Microsoft Azure, Amazon Bedrock and Google Cloud Vertex AI). The providers we use can change; you can request the current list at any time at privacy@myaichat.app. OpenRouter acts as our processor under a data processing agreement (Art. 28 GDPR); the model providers act as its sub-processors. Our OpenRouter account only routes requests to providers that do not store the content after the response is generated (zero data retention) and do not use it to train AI models. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); where a model provider is certified under the EU-U.S. Data Privacy Framework, the transfer to that provider is additionally covered by the adequacy decision (Art. 45 GDPR). A copy of the Standard Contractual Clauses can be requested at privacy@myaichat.app. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Please do not enter sensitive data (e.g. health data) in the chat.


• Contact Information (name, e-mail address, as well as any other content included in the email) which you may fill in by yourself when you contact us via email, support form. We collect, store and process it by our cloud storage provider (Amazon.com, Inc.). Messages sent through the contact form on our website are delivered to us by our email delivery provider (Resend, Inc.). We use such information to respond effectively to your inquiry, fulfill your requests, send you communications that you request and perform the requested services.

Information That Is Processed Automatically

On the basis of your permission we use third-party automatic data processing technologies (advertising or analytics tools) to analyze certain information sent by your device via our App (Identity For Advertisers). Some integrated advertising or analytics tools (check Section IV to see the list of them) launch automated processing of your personal data, including profiling, which means any form of automated processing of personal data used to evaluate certain personal aspects relating to you, in particular to analyze or predict aspects concerning your personal preferences, interests, behavior, location or movements (see the list of data described below). Google Analytics for Firebase only starts collecting data after you have given your consent in the App. Marketing attribution through AppsFlyer starts when the App starts, on the basis of our legitimate interest in measuring our marketing. Crash reporting through Firebase Crashlytics runs from the first launch of the App on the basis of our legitimate interest in a stable, working App and does not depend on your consent. Measurement of our ads on Facebook and Instagram through the Meta SDK (Meta Platforms Ireland Limited) only starts after you have given your consent in the App’s privacy dialog. On iOS, your device’s advertising identifier (IDFA) is only used if you allow our App to track your activity in Apple’s App Tracking Transparency (ATT) prompt. You can withdraw your permission or object at any time - please check opt-out options in Section VIII below. The services we use, the data they process and the legal basis for each are described in Section IV (“Details on the services we use”).

We may process some information about your device and your user behavior on the ground of our legitimate interest. This information falls within categories of data described above in Subsection “Information That Is Processed Automatically”, it is generally non-personal, i.e. it does not, on its own, permit direct association with any specific individual, and we may access it only in aggregated form. We use this information for improving our App and giving our users the best experience.

• Device Details. When you use a mobile device to access our App, some of the details about your device are reported, including “device identifiers”. Device identifiers are small data files or similar data structures stored on or associated with your mobile device, which uniquely identify your mobile device (but not your personality). Device identifier enables generalized reporting or personalized content and ads by the third parties.

  What data can be processed:

  • Information about the device itself: type of your device, type of operating system and its version, model and manufacturer, screen size, screen density, orientation, audio volume and battery, battery life, loading time, latency, framerate, device memory usage.
  
  
  • Information about the Internet connection: mobile carrier, network provider, network type, IP address, timestamp and duration of sessions, speed, browser.
  
  
  • Location-related information: IP address, the country code/ region/ state/ city associated with your SIM card or your device, language setting, time zone, neighboring commercial points of interest (eg. “coffee shop”).
  
  
  • Other device identifiers: e.g. user identifiers (if they are set up by the App’s developer).
  
  
• Information about the applications. Name, API key (identifier for application), version, properties of our App can be reported for automated processing and analysis. Some services also record the list of applications and/or processes which are installed or run on your device.


• Cookies and similar technologies. When you use the App, cookies and similar technologies may be used (pixels, web beacons, scripts). A cookie is a text file containing small amounts of information which is downloaded to your device when you access the App. The text file is then sent back to the server each time you use the App. This enables us to operate the App more effectively. For example, we will know how many users access specific areas or features within our App and which links or ads they clicked on. We use this aggregated information to understand and optimize how our App is used, improve our marketing efforts, and provide content and features that are of interest to you. We may ask advertisers or other partners to serve ads or services to the App, which may use cookies or similar technologies. On our website (myaichat.app) we only set cookies that are strictly necessary to run the web chat: a session token that keeps you signed in, a signature of that token, and a random identifier for your browser. We do not use analytics or advertising cookies on the website. If you choose “Continue with Google” on the website’s sign-in page, Google’s sign-in script is loaded from Google LLC and Google’s privacy policy applies to it.


• Log file information. Log file information is automatically reported each time you make a request to access the App. It can also be provided when the App is installed on your device. When you use our App, analytics tools automatically record certain log file information, including time and date when you start and stop using the App, and how you interact with the App.


• Ad-related information. The following data might be reported about the ads you can view: the date and time a particular ad is served; a record if that ad was “clicked” or if it was shown as a “conversion” event; what the ad offer is about; what type of ad it is (e.g., text, image, or video); which ad placement is involved (where the ad offer is displayed within the App); whether you respond to the ad.


• In-App events. When you use our App, analytics tools automatically record in-App information (tutorial steps, leveling up, payments, in-app purchases, custom events, progression events, method of limiting the processing of user data).

Information provided automatically to advertising or analytics tools does not generally come to our control, therefore we cannot be responsible for processing such information. Please mind that some services are engaged in personal data profiling and may obtain information related to your personality and/or your device by using technologies that do not belong to our scope of responsibility. In case when your user ID is linked to your Facebook account, Facebook may use your device information in association with categorized data that were already recorded in its databases (eg. your age, gender or other demographic indication). We do not control, supervise or stand surety for how the third parties process your personal data, that might be collected by their own means (not through our App). Any information request regarding the disclosure of your personal information should be directed to such third parties (see Section IV).

Payment Information

In-app purchases are sold and charged by the app store you use: the Apple App Store on iOS and Google Play on Android. The app store is responsible for billing, processing and charging for in-app purchases and handles your payment information. This information is processed as part of the performance of the contract between you and us. We cannot access or use your credit or debit card information.

We use RevenueCat, Inc. to process and manage subscriptions and purchases across the app stores. RevenueCat receives the store receipt or purchase token and transaction details of your purchase (product, price, currency, store country, purchase and renewal dates) together with the user ID that our App assigns to you, and tells our App and our servers whether your subscription is active. Please see “Details on the services we use” in Section IV for more information, including Apple Ads attribution on iOS.

You may access the applicable “in-app” purchase rules and policies directly from the app stores.

Email Communications

If you purchased a subscription on the App’s Website and activated it via “Sign In with Apple” in the App, we may use your email address to send you communications (newsletters) regarding special subscription offers, new features and functionalities and other news related to the App on the grounds of our legitimate interest. Sending you newsletters will allow you to stay up to date and receive the latest news about the App, including about the best price offers. You also hereby acknowledge and accept the treatment of some categories of your personal data (i. e. the information about your name that you provide us, subscription purchase date, geolocation data, activity information, etc.) for market analysis activities, particularly for the purpose of delivering you targeted communications (newsletters) that most align with your needs and interests. You may also unsubscribe, opt-out of receiving communications to your email address at any time by using the resignation link provided in each email you receive from us. Your unsubscribe request shall be honored within a reasonable period of time.

III. THE PURPOSES OF PROCESSING YOUR PERSONAL DATA

Our mission is to constantly improve our App and provide you with new experiences. As part of this mission, we use your information for the following purposes:

(a) To make our service available. We use functional information and information that is processed automatically to provide you with all requested services.

(b) To improve, test and monitor the effectiveness of our App. We use information that is processed automatically to better understand user behavior and trends, detect potential outages and technical issues, to operate, protect, improve, and optimize our App.

(c) To provide you with interest-based (behavioral) advertising or other targeted content. We may use information that is processed automatically for marketing purposes (to show ads that may be of interest to you based on your preferences). We provide personalized content and information to you, which can include online ads or other forms of marketing.

(d) To communicate with you. We use the contact information we have to communicate with you through newsletters, i.e. to send you marketing notifications, receive your feedback about our App experience, and let you know about our policies and terms. We also use your information to respond to you when you contact us.

(e) To prevent fraud and spam, to enforce the law. We really want our App to be free of spam and fraudulent content so that you feel safe and free. We may use your information to prevent, detect, and investigate fraud, security breaches, potentially prohibited or illegal activities, protect our trademarks and enforce our Terms of Use.

If any new purposes for processing your personal data arise we will let you know we start to process information on that other purpose by introducing the corresponding changes to this Privacy policy.

Legal bases for processing (GDPR)

If you are located in the European Union or the European Economic Area, we process your personal data on the following legal bases under Article 6(1) of the General Data Protection Regulation (GDPR):

• Consent (Art. 6(1)(a) GDPR) for analytics (Google Analytics for Firebase) and for measuring our ads on Facebook and Instagram (Meta SDK), both of which start only after your consent in the App, and, on iOS, for the use of your advertising identifier (IDFA), which you allow or refuse in Apple’s App Tracking Transparency prompt. You can withdraw your consent at any time with effect for the future; see Section VIII.


• Performance of a contract (Art. 6(1)(b) GDPR) for providing the App and its core service: your account and sign-in, the AI features you use, push notifications you enabled, and the processing of purchases and subscriptions (app stores and RevenueCat).


• Legitimate interests (Art. 6(1)(f) GDPR) for crash reports and stability monitoring (Firebase Crashlytics), for protecting our services against abuse and fraud (Firebase App Check), for the security of the App, and for measuring our marketing (attribution through AppsFlyer, and Apple Ads attribution through RevenueCat). Our legitimate interests are to offer a stable, secure App and to understand which of our marketing campaigns work. You may object to this processing on grounds relating to your particular situation (see Section VII).

IV. SHARING OF YOUR INFORMATION

We will share your information with third parties only in the ways that are described in this Privacy policy. We adhere to the U.S. Digital Advertising Alliance’s Self-Regulatory Principles for the Mobile Environment.

Please note that while integrating external services we choose third parties that can assure they apply all necessary technical and organizational measures to protect user personal data. However, we cannot guarantee the security of any information transmitted from us to any such third party. We are not responsible for any accidental loss or unauthorized access to your personal data through a fault of third parties.

Where we share personal data with a third-party AI service provider, we do so only to provide the AI feature you requested. For our AI features, the recipients are OpenRouter, Inc. and, through OpenRouter, the AI model providers and cloud platforms that we select for the respective feature, located in the USA (currently, for example, OpenAI, Anthropic, Google, Krea AI and Perplexity, and cloud platforms that run these models), and Microsoft Corporation (Microsoft Azure OpenAI Service) as our fallback provider. The categories of data we may share for that purpose are your prompt text, uploaded files or images, limited conversation context, selected AI model or feature, and technical request identifiers necessary to process and secure the request. We require our third-party AI service providers to provide privacy and security protections that are the same as or substantially similar to those described in this Privacy policy and required by applicable law.

We will not rent or sell your personal data to any third parties, but we may share your information from tools like cookies, log files, and device identifiers and location data, with third-party organizations that provide automatic data processing technologies for the App. We do not control or influence these third parties’ tracking technologies or how they may be used.

We may also share certain information such as cookie data with third-party advertising partners. This information allows third-party ad networks, inter alia, to deliver targeted advertisements that they believe will be of most interest to you.

We may engage the following third-party service providers in order to provide us with necessary infrastructure for delivery and improvement of our services:

In case you want to learn more about the services and privacy options (including opt-out) please consult the correspondent websites and privacy policies.

Details on the services we use

The following services are integrated into the App. For each of them we describe the purpose, the data processed, the legal basis (see also Section III) and where the data is processed. Transfers outside the European Union / European Economic Area are described in Section V.

• Google Analytics for Firebase (Google LLC). Purpose: understanding how the App is used (for example which screens are opened, onboarding and paywall steps, subscription status as a segment) so that we can improve it. Data: app events and screen views, the user ID that our App assigns to you (never your name or email address), app version, language, device and operating system information, approximate location derived from the IP address, and the app instance identifier. Analytics only starts after you have given your consent in the App; before that, collection is switched off. Advertising features are disabled: the signals for ad storage, ad user data and ad personalisation are always denied, and we do not use Analytics data for advertising. Legal basis: consent (Art. 6(1)(a) GDPR). Location: U.S.A. Privacy policy: https://firebase.google.com/support/privacy?hl=en


• Firebase Crashlytics (Google LLC). Purpose: keeping the App stable and fixing errors. When the App crashes or hits a serious error, Crashlytics collects a crash report. Data: technical data about your device and the App (for example device model, operating system version, app version, language setting, available memory and disk space, the time of the crash and a pseudonymous installation identifier) and the crash trace (stack trace and technical log entries leading up to the error). Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in providing a stable, working App; crash reporting therefore runs from the first launch of the App and does not depend on your consent. Crash reports are not used for advertising or marketing or to build user profiles. We link a crash report to the user ID that our App assigns to your myAIChat account, and to your subscription status, only after you have given your consent in the App’s privacy dialog. Retention: Google keeps crash reports for 90 days and then deletes them. You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR) by contacting us at privacy@myaichat.app or through the contact form. Location: U.S.A. Privacy policy: https://firebase.google.com/support/privacy?hl=en


• Firebase Cloud Messaging (Google LLC). Purpose: delivering push notifications if you allow them on your device. Data: a push token for your device (on iOS together with Apple’s push notification service) and the content of the notification. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). You can turn notifications off at any time in your device settings. Location: U.S.A. Privacy policy: https://firebase.google.com/support/privacy?hl=en


• Firebase App Check (Google LLC). Purpose: confirming that requests to our servers come from a genuine copy of the App, to protect our services against abuse and fraud. App Check uses Apple App Attest / DeviceCheck on iOS and Google Play Integrity on Android. Data: attestation tokens and information about the integrity of the App and the device. Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in the security of our services. Location: U.S.A. Privacy policy: https://firebase.google.com/support/privacy?hl=en


• RevenueCat (RevenueCat, Inc.). Purpose: processing and managing in-app purchases and subscriptions across the Apple App Store and Google Play, and telling our App and our servers whether your subscription is active. Data: the user ID that our App assigns to you (or an anonymous RevenueCat ID), store receipts or purchase tokens, transaction and subscription details (product, price, currency, store country, purchase, renewal and expiry dates), app version, device and operating system information, and the IP address. For marketing attribution RevenueCat also receives your AppsFlyer ID and, where available, device identifiers (on iOS the IDFA only if you allowed tracking, and the IDFV). On iOS, RevenueCat also collects Apple’s AdServices attribution token and sends it to Apple, so that a subscription can be attributed to an Apple Ads campaign (see Apple’s privacy information for Apple Ads: https://ads.apple.com/app-store/privacy). Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for processing your purchases; legitimate interests (Art. 6(1)(f) GDPR) in measuring our marketing for the attribution data, and, for the IDFA, your consent in Apple’s App Tracking Transparency prompt. Location: U.S.A. Privacy policy: https://www.revenuecat.com/privacy/


• Apple App Store and Google Play. Purpose: selling and charging for in-app purchases and subscriptions. The app store processes your payment details; we never receive your credit or debit card information. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Location: U.S.A. Privacy policies: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy


• AppsFlyer (AppsFlyer Inc.). Purpose: measuring which marketing campaigns lead to installs, subscriptions and uninstalls (attribution), and handling links that open the App. AppsFlyer starts when the App starts. Data: the AppsFlyer ID, IP address, device and operating system information, install and in-app events (for example paywall views, trial starts and subscriptions, including revenue), campaign and link data, the push token (to measure uninstalls) and device identifiers:
  • on iOS, the IDFV and, only if you allow tracking in Apple’s App Tracking Transparency prompt, the IDFA. If you do not allow tracking, attribution relies on Apple’s SKAdNetwork, which reports campaign results to advertisers in aggregated form without identifying you, and on other signals that do not identify you;
  • on Android, the advertising ID (which you can reset or delete in your Android settings, see Section VIII) and the Google Play Install Referrer, which tells us which campaign or link led to the install.
  Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in measuring our marketing, and, for the IDFA on iOS, your consent in Apple’s App Tracking Transparency prompt. You can object at any time, see Section VIII. Location: U.S.A. Privacy policy: https://www.appsflyer.com/legal/services-privacy-policy/


• Meta SDK (Meta Platforms Ireland Limited). Purpose: measuring the effectiveness of our ads on Facebook and Instagram, i.e. campaign attribution (which of our ads led to an install, a trial or a subscription) and Meta’s Aggregated Event Measurement (AEM). We do not use Meta to show ads inside our App. Data: app events (App opened, paywall viewed, trial started, subscription started; the App does not send purchase amounts to Meta), device and app information, and your device’s advertising identifier only if you have allowed it:
  • on iOS, the IDFA only if you allow tracking in Apple’s App Tracking Transparency prompt;
  • on Android, the advertising ID (AAID) only if you allow its use in your device settings (see Section VIII).
  Automatic event logging of the Meta SDK is disabled. Legal basis: consent (Art. 6(1)(a) GDPR), which you give in the App’s privacy dialog. The Meta SDK only starts after you have given your consent; on iOS, the advertising identifier is only used after you allow tracking in Apple’s App Tracking Transparency prompt. You can withdraw your consent at any time with effect for the future, see Section VIII. Retention: Meta keeps this data in accordance with its own terms and privacy policy. Location: Ireland; data may be transferred to Meta Platforms, Inc. in the U.S.A. (see Section V). Privacy policy: https://www.facebook.com/privacy/policy/


• OpenRouter (OpenRouter, Inc.). Purpose: routing your AI requests (AI chat, image understanding, document analysis and image generation) to the provider of the AI model you selected. OpenRouter forwards the content of your request (your messages and the limited conversation history, the images and documents you attach, and the prompt for an image you ask the App to create) to that model provider and returns the answer to us. Image generation uses AI image models (currently, for example, Krea AI and Google Gemini). Data: the data described in “AI Service Provider Data Transfer and Your Choices” in Section II. OpenRouter acts as our processor under a data processing agreement (Art. 28 GDPR); the model providers act as its sub-processors. Settings: we have configured OpenRouter so that our requests are only routed to model providers that, according to their terms, do not use the data for training (OpenRouter’s data collection setting “deny”), and only to zero-data-retention endpoints, so the content is not stored after the response is generated. According to OpenRouter’s terms, OpenRouter does not store the content of prompts and answers unless the customer turns on prompt logging, which we have not done; OpenRouter keeps metadata about each request (for example the model, the number of tokens, latency and cost) without its content, and may categorise a small sample of prompts anonymously, without linking them to our account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Location: U.S.A. (see Section V). Privacy policy: https://openrouter.ai/privacy


• AI model providers and cloud platforms (through OpenRouter). Purpose: generating the AI replies, image analysis, document analysis and images you request. Recipients: the AI model providers and cloud platforms that we select for the respective feature, located in the USA, reached through OpenRouter, Inc. (currently, for example: OpenAI, Anthropic, Google, Krea AI and Perplexity, and cloud platforms that run these models, such as Microsoft Azure, Amazon Bedrock and Google Cloud Vertex AI). The providers we use can change; you can request the current list at any time at privacy@myaichat.app. If the selected model is not available, OpenRouter may answer with one of our backup models. Our OpenRouter account only routes requests to providers that do not store the content after the response is generated (zero data retention) and do not use it to train AI models. Data: the data described in “AI Service Provider Data Transfer and Your Choices” in Section II. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Location: U.S.A. (see Section V). Privacy policies: the providers’ own privacy policies apply; we send you the links on request.


• Microsoft Azure OpenAI Service (Microsoft Corporation). Purpose: our fallback provider for the AI features. If OpenRouter is not available, your AI request is processed by Microsoft Azure OpenAI Service instead. Data: the data described in “AI Service Provider Data Transfer and Your Choices” in Section II. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Location: U.S.A. Privacy policy: https://privacy.microsoft.com/en-us/privacystatement

Our App may contain links to third-party websites/services or you may access the App from a third-party site. We are not responsible for the privacy practices of these third-party sites or services linked to or from our App, including the information or content contained within them.

We may disclose your personal information if it is needed for objective reasons, due to the public interest or in other unforeseen circumstances:

• as required by law;


• when we believe, in good faith, that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;


• if we are involved in a merger, acquisition, or sale of all or a portion of our assets, you will be notified via prominent notice in our App of any change in ownership or your personal information usage, as well as any choices you may have regarding your personal information.

V. INTERNATIONAL DATA TRANSFERS

We work in the cross-border area and provide our App to our Users around the world.

We and third-party organizations that provide automatic data processing technologies for the App or our third-party advertising partners may transfer the automatically processed information across borders and from your country or jurisdiction to other countries or jurisdictions around the world.

If you are located in the European Union or other regions with laws governing data processing that may differ from U.S. law, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as in your jurisdiction.

This means that your personal information can be transferred to a third country, a territory or one or more specified sectors within that third country, or to the international organization where data protection and confidentiality regulations may not provide the same level of protection of personal data as your country does.

Our own servers and databases are hosted by Hetzner Online GmbH in data centres in the European Union. Several of the service providers listed in Section IV (for example Google, Microsoft, OpenRouter and the AI model providers reached through it, RevenueCat, AppsFlyer, Apple, Meta and Resend) process data in the U.S.A. or other countries outside the European Union / European Economic Area. Where we transfer personal data from the European Union / European Economic Area to such a country, we rely on an adequacy decision of the European Commission (Art. 45 GDPR), in particular the EU-U.S. Data Privacy Framework for recipients that are certified under it, or on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

Data processed through the Meta SDK is received by Meta Platforms Ireland Limited, Dublin, Ireland, and may be transferred to Meta Platforms, Inc. in the U.S.A. For such transfers Meta relies on the EU-U.S. Data Privacy Framework or on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

When you use our AI features, your request is transferred to OpenRouter, Inc. in the U.S.A., which forwards it to the AI model providers and cloud platforms that we select for the respective feature, located in the U.S.A. (see Section IV). The transfer to the U.S.A. is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); where a model provider is certified under the EU-U.S. Data Privacy Framework, the transfer to that provider is additionally covered by the adequacy decision (Art. 45 GDPR). A copy of the Standard Contractual Clauses can be requested at privacy@myaichat.app.

We try to make sure that the recipient of any personal data provides a proper protection of the personal data received, in accordance with the current legislation on the protection of such information. By using the App, you agree that we may transfer your personal data to any third country, a territory or one or more specified sectors within that third country, or to the international organization.

For the purposes of data storage, we recourse to the services of the hosting organizations. We take your privacy seriously and, therefore, encrypt your personal data - if possible - before sending it to the hosting organizations for the purposes of its storage. Please note that we cooperate only with those hosting organizations that have passed our security and reliability check.

VI. HOW LONG WE USE YOUR PERSONAL DATA

We generally retain your personal information for as long as is necessary for performing the functional service of the App and to comply with our legal obligations. If you no longer want us to use your information that we physically access and store, you can request that we erase your personal information and close your account.

However, some data may still be stored for a certain time period (but no longer than the storage purpose requires) if information is necessary to comply with legal obligation (taxation, accounting, audit) or in order to maintain safety and data backup settings, prevent fraud or other malicious acts.

Crash reports collected through Firebase Crashlytics are kept by Google for 90 days and then deleted.

Data received by Meta through the Meta SDK is kept by Meta in accordance with Meta’s own terms and privacy policy (https://www.facebook.com/privacy/policy/).

The content of your AI requests and answers is not stored by OpenRouter or the AI model providers after the response is generated (zero data retention) and is not used to train AI models; OpenRouter keeps only request metadata without the content.

VII. EXERCISING YOUR RIGHTS

Applicable data protection laws give you certain rights regarding your personal information. You have the following options in relation to your personal information that was collected:

• Data Access and Portability. You can request copies of your personal information.


• Change or Correct Data. Where you cannot update data by yourself through your account, you have the right to ask to correct, change, update or rectify your data.


• Data Retention and Deletion. The user data is generally retained for as long as your user profile is in existence or as it is needed to provide the relevant services. However, specific retention times can vary based on context of the processing performed. You have the right to ask to delete all or some of the personal data that is held about you.


• Restriction of Processing. Under certain circumstances, you may have the right to limit the ways in which your personal information is used.


• Exercising the right to know about data sharing. You have the right to know whether your data is shared with third parties. Detailed information on this issue is contained in section IV of the present Privacy policy, however, if you have further questions in this regard, you can contact us at any time.

To exercise any of the rights described above, you can contact us through contact form. Please bear in mind that we ensure the above mentioned rights only with respect to the information that we physically access and store.

You also have the right to lodge a complaint with your local data protection or a supervisory authority if you reasonably believe that your rights under applicable data protection laws have been breached. Please note that when you exercise your right to lodge a complaint with your local data protection or a supervisory authority, you may be required to provide additional information and support your complaint with sufficient objective evidence. By lodging a complaint you agree to provide sufficient explanation as to what you believe impaired your rights. Additionally, in some cases prior to lodging a complaint with your local data protection or a supervisory authority, you may be required to send your initial claim directly to us and ask for clarifications if necessary.

When your personal information is processed automatically you may object to such processing in some circumstances. Where your personal information is processed for direct marketing purposes, you may ask to cease processing your data for these direct marketing purposes. In order to exercise your right please contact the third party services listed in the Section IV of this Privacy policy to learn how you can object to processing your data. Most of them have clear instructions on their privacy pages, functional API or other options.

If you are located in the European Union, you may address our representative when you have questions on privacy issues: privacy@myaichat.app.

VIII. HOW TO OPT OUT

Opt-out of marketing tracking

You can manage your activity tracking permissions. Inter alia, if you do not want third-party service providers to use the personalized ads on the basis of your interests please follow the instructions below:

• Go to Settings > Privacy & Security (or “Privacy” in earlier versions of iOS) > Tracking, then tap to turn off or turn on permission to track for a specific app. You can also control whether apps can ask for permission to track your activity. If you do not want to be asked for your permission, or do not want apps to access your device’s Advertising Identifier, go to Settings > Privacy & Security (or “Privacy” in earlier versions of iOS) > Tracking and then disable the “Allow Apps to Request to Track” switch. If you turn off "Allow Apps to Request to Track", you will not get prompts from apps that want to track your activity. Each app that asks for permission to track while this setting is turned off will be treated as if you tapped “Ask App Not to Track”. Please find additional information here: https://support.apple.com/en-us/HT212025 or in the Settings > Privacy & Security (or “Privacy” in earlier versions of iOS) > Tracking section on your device. If you want to disable Apple’s ad targeting, go to Settings > Privacy & Security (or “Privacy” in earlier versions of iOS) > Apple Advertising, then set the “Personalized Ads” switch to the “off” position. Please find additional information here: https://support.apple.com/en-us/HT202074


• Android: go to Settings > Google > Ads (or Settings > Privacy > Ads on some devices) and tap “Reset advertising ID” or “Delete advertising ID”. After deleting it, apps can no longer use your advertising ID for attribution or personalised ads.


• Analytics and attribution in the App: you can withdraw the consent you gave in the App for analytics and for measuring our ads on Facebook and Instagram (Meta SDK), and object to marketing attribution and crash reporting, at any time with effect for the future by contacting us at privacy@myaichat.app or through the contact form. You can also limit the use of your advertising identifier by Meta and our other attribution partners in your device settings (App Tracking Transparency on iOS, advertising ID on Android), as described above. Uninstalling the App stops all further collection through the App.


• Push notifications: you can turn them off at any time in your device’s notification settings for the App.

You can also visit https://youradchoices.com for the same purpose.

Please mind that when you opt out of certain interest based advertising, you may still continue to receive contextual ads based on other non-personal information, such as ads related to the content of other digital products you are using.

Opt-out of Location Data Processing

If you do not want third-party service providers to use your precise location data, or street-level location information about you please follow the instructions below:

• iOS 11 or later: turn Location Services off for the applicable Product via the menu “Settings > Privacy > Location Services”. Then select the applicable App and set the “Share My Location” status to “Never”. Please see additional information here: https://support.apple.com/en-us/HT203033.

IX. SECURITY

The security of your personal information is highly important to us. We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. We take reasonable and appropriate measures to protect personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into account the risks involved in the processing and the nature of the personal information.

We implement appropriate technical and organizational measures, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the processing. We seek your personal data to be encrypted with proper and strong encryption algorithms, including hashing where possible.

Unfortunately, no method of transmission over the Internet, or method of electronic storage, is 100% secure. We do our best to protect your personal data, nevertheless, we cannot guarantee its absolute security. In the event that your personal information is compromised as a breach of security, we will promptly notify you in compliance with applicable law.

If you have any questions about the security of our App, you can contact us through the contact form displayed below.

X. CHILDREN’S PRIVACY

Our App is not intended for children. Therefore, we do not knowingly or intentionally collect or solicit any personal information from children. For the purposes of this Section X the terms “child” and/or “children” in the context of data processing activities may be interpreted on a case-by-case basis as prescribed by applicable data protection laws. No one who is considered a “child” under applicable data protection laws is allowed to directly provide any personal information to the App.

As a general rule we consider a person under the age of 16 to be regarded as “a child” until we have legal grounds to conclude that a person under 16 should be treated as an adult as per provisions of local data protection rules or based on the parent authorization provided to us directly.

Solely the holders of parental responsibility are liable for preventing their children from providing personal information via the App without relevant verifiable parental consent. If we learn that we have collected personal information from a child without verification of the holder of parental responsibility for a child, we will erase that information as quickly as possible. If you reasonably believe that we might have any information from or about a child, or a child has directly provided us with personal information via the App without verifiable parental consent, please contact us.

XI. CHANGES TO THE PRIVACY POLICY

This Privacy policy is updated regularly.

Whenever we change this Privacy policy, we will post those changes to this Privacy policy and other places that we consider appropriate. Additional forms of notice of modifications or updates as appropriate under the circumstances may be provided to you.

XII. HOW TO CONTACT US

If you have any questions about this Privacy policy, please feel free to contact us via support form.