Age Assurance and Biometric Privacy Notice

MirrorChats is for adults only. This notice explains our age checks, location restrictions, facial processing, retained records, and your choices before a check begins.

AI Chat Media LLC, a New Jersey limited liability company (“we,” “us,” or “our”), operates MirrorChats at https://www.mirrorchats.com. We are the controller responsible for deciding why and how personal information is used for our age and access checks. Read this notice with our Terms of Service and Privacy Policy. Your mandatory legal rights and more favorable commitments you already have take priority over a conflicting restriction.

1. Eligibility and sensitive content

You must be at least 18, have reached the age of majority where you live, and meet the other eligibility requirements in the Terms of Service. You must give accurate age information and must not let a minor use your account, use another person’s identity, or bypass an age or location restriction. We do not offer a permitted minor tier.

Signup collects your declared date of birth. Sensitive images and videos are filtered by default for ordinary new accounts. Depending on location, access requires adult confirmation or a successful age check, or is unavailable. The same restrictions apply to video-call media. Explicit text is gated separately where required. A declaration, payment, paid plan, or filter setting does not replace stronger age assurance where required. A check confirming 18 or older does not establish a higher local age of majority or authorize prohibited content.

2. Where access is restricted

Verification locations. Our current settings require an age check for sensitive images and videos in Alabama, Arizona, Arkansas, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Mississippi, Missouri, Montana, Nebraska, North Carolina, North Dakota, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, West Virginia, and Wyoming, and in the United Kingdom, Australia, and Brazil. Explicit text remains available to eligible adults without that check in the United Kingdom, North Carolina, South Carolina, and Wyoming. In the other listed verification locations, including Indiana and Iowa, explicit text is gated as well. These distinctions do not permit use by minors.

Locations where explicit media is blocked. Our current settings block sensitive images and videos in Florida, Ohio, Germany, France, Italy, South Korea, and Poland, and in Afghanistan, Bahrain, Bangladesh, Belarus, Bhutan, Botswana, Brunei, Burkina Faso, Cambodia, China, Egypt, Equatorial Guinea, Eritrea, Ethiopia, India, Indonesia, Iraq, Jordan, Kazakhstan, Kuwait, Laos, Lebanon, Libya, Malaysia, Maldives, Myanmar, Nepal, Oman, Pakistan, the Philippines, Qatar, Saudi Arabia, Somalia, Sudan, Tanzania, Thailand, Turkmenistan, Uganda, the United Arab Emirates, Uzbekistan, Vietnam, and Yemen. Explicit text remains available to eligible adults in Italy; the other listed blocks also cover explicit text. A pass obtained elsewhere does not override these restrictions.

Whole-site restrictions. Access to the whole website is currently blocked from Cuba, Iran, North Korea, and Syria. This differs from keeping the sensitive-content filter on. Availability can change, and an unlisted location does not guarantee access.

Location is inferred from your IP address and refreshed periodically, ordinarily hourly. It is approximate, can be wrong, and is not GPS or continuous proof of your physical location. Applicable restrictions are applied when content loads and after a recorded location change. Direct-media access controls are enforced. We will apply required restrictions before access, including when location or authorization cannot reliably be established. A reachable file does not authorize bypassing a restriction. Report an incorrect location or failed control through section 8.

3. How the checks work

Didit runs the checks on its hosted pages. Our provider is Didit Identity, Inc., with support from its affiliate Didit Identity Spain, S.L. We send Didit an account reference and the selected method; Didit collects the document and facial material directly.

ID and selfie check. You use your camera to capture a valid government-issued identity document and a live selfie or short selfie video. Didit checks the document, tests whether a live person is present, compares your face with the document photograph, and reads age information. Accepted documents depend on the location and check. The current camera flow does not accept uploaded files. Face matching can create measurements of facial geometry and a numerical representation of facial features used for comparison, often called a biometric template. This can be protected biometric processing even when the template is deleted afterward.

Face-only age estimation. This option is currently offered in the United Kingdom, Australia, Alabama, Georgia, South Dakota, and Wyoming. Didit uses AI to analyze a live facial scan, estimate age, and check liveness, without comparing it with an ID photograph. Our service accepts this route only when the estimate is at least 25; a younger estimate or unsuccessful scan leads to the separate ID check. The 25 threshold is a confidence buffer, not a change to the minimum eligibility age. It does not prove your exact age. Face-only estimation is not offered as a substitute in every location, and both methods process facial information.

Tennessee. Our ID route requires a valid driver’s license or identification card issued by a US state and a live capture on the device used for access; it does not accept a passport or foreign ID for this route. The current pass has a 60-minute limit. We shall also require a fresh check when the age-verified session ends, if that occurs sooner.

Other passes currently have no fixed expiry. We may require a new check when the applicable location rule, verification status, safety concern, or law requires it. A pass under one method may not satisfy another location’s requirements. In the United Kingdom, these methods are used for access to pornographic images and video, including generated media. We shall assess their accuracy, robustness, reliability, fairness, and privacy safeguards and keep the records required for that use.

4. Information collected and returned

Didit processes document images and details for the ID route, facial images or video, liveness and matching or estimation information, and related technical information such as IP address, browser or device information, timestamps, and security signals. A document can contain your name, photograph, document number, birth date, and other details even if those details are not returned to us. Didit’s wider product offers other checks that are not necessarily part of our selected methods.

Our current ID workflow returns document type, issuing state, date of birth, and age. The face-only route returns an age estimate, with the check’s status and related result information. For current checks, we reduce the returned age information to a pass/fail decision in memory and do not log or store the returned document details, birth date, age, or estimate. The current routes do not return names, document numbers, addresses, document images, or selfies to us. These limits describe current checks: an earlier built-in ID fallback returned unrestricted information before it was disabled on October 4, 2026. The date of birth you enter at signup is separately stored account information.

We retain account and audit records described in section 6. Removing a direct account link does not necessarily make a session reference, timestamp, or deletion record anonymous.

5. Purposes, consent, and declining a check

We use the check to assess adult eligibility, apply access restrictions, detect attempts to manipulate the check, and document the result and deletion. We do not use age-check documents or facial material to personalize characters or for advertising. Duplicate-face searching is disabled in our current workflows, and we have not enabled a separate retained facial template or face blocklist.

A separate, unchecked consent choice appears before a check. We shall explain the selected method, including any AI facial analysis, information collected, purposes, recipients, retention, and destruction before collection, and obtain the consent required for that processing. Where law requires an informed written release or electronic signature, we shall obtain it before collecting or arranging collection of covered biometrics. Reading this notice, accepting general terms, or continuing to use the service does not supply that release or a required separate consent.

You can decline or stop before completing the check. Access requiring a pass will remain unavailable. We do not offer an ID-free or nonbiometric alternative in every location, or a manual override of a required check. Where law requires an alternative method, we shall provide one before requiring covered processing. Contact support if you cannot use an offered method, need accessibility assistance, or want to ask about a lawful alternative.

Declining, failing, or withdrawing from a check does not automatically cancel your subscription or waive your billing or refund rights. You can cancel renewal without completing a check, including by emailing support@mirrorchats.com if you cannot sign in. See the Subscription, Cancellation, Refund, and Credits Policy for cancellation, renewal, and other billing terms.

For EEA and UK users, ordinary age and location information is processed to meet an applicable EEA or UK legal obligation, or otherwise for our legitimate interests in keeping an adult service from underage use and enforcing access restrictions, balanced against your rights. Biometrics used to uniquely identify you also require a separate special-category condition; we shall obtain explicit consent unless another applicable condition is established. Age estimation and identity matching have different purposes and may be treated differently by law. A foreign age-check law does not itself supply an EEA or UK legal basis. The Privacy Policy explains the bases and your right to object or withdraw consent.

6. Retention and destruction

The table describes our current records. A shorter deletion requirement takes priority over a stated retention period. We shall collect and retain only information necessary for a lawful purpose; a general audit schedule does not justify keeping identifying verification data where retention is prohibited.

Permanent biometric destruction. We shall arrange permanent destruction of age-check documents, facial captures, and covered biometric identifiers or information when the check’s purpose is satisfied, including a failed check. Our setting does not retain a reusable template separately from the session. For Illinois-covered processing, destruction is due when the initial collection purpose is satisfied or within three years of your last interaction with the entity holding the information, whichever is earlier, unless a valid warrant or subpoena requires otherwise. Our shorter completion and unfinished-session rules still apply.

We shall confirm completed deletion, including facial data, and give necessary directions for recovery copies and other provider stores. A deletion request is not completed erasure. While remaining copies are removed, we shall require legally permitted handling that prevents further use. Separate provider security, fraud, legal, or recovery records may remain only where retention is lawful and necessary.

We shall not retain identifying verification data, or permit our provider to retain it, where the applicable age-verification rule prohibits doing so. Retained evidence shall be limited to what that rule permits. A lawful preservation requirement covers only the necessary information and time; it does not authorize unnecessary facial retention or continued matching.

Account deletion initiates deletion of any unfinished Didit session. Deleted account records may remain in our database recovery copies for at most six hours under the current configuration. Account deletion does not automatically erase every audit record or independent provider record; request broader deletion under section 8.

7. Provider use, disclosures, and safeguards

Didit acts as our processor for the selected verification. Under its terms, it may act independently for limited derived security, fraud-prevention, legal, or audit information. Those roles do not authorize uses or retention prohibited for a particular check. Its model-training opt-out is enabled for MirrorChats: historical and new verification records are excluded from future covered training and improvement uses after activation. This does not reverse updates already incorporated into models or itself delete records. We do not train our own AI models on age-check data. Verification consent is not consent for unrelated training or advertising.

Didit group entities, authorized personnel, and providers supporting hosting, security, and the check may process relevant information. Our account and audit records also use our hosting and database providers. Disclosures for legal requests, claims, or a business transaction remain subject to the Privacy Policy and applicable restrictions. We shall not sell, lease, trade, or otherwise profit from covered biometric identifiers or information, or disclose them except with legally effective consent where sufficient or another specifically permitted legal ground. A general privacy-policy exception does not override a stricter biometric disclosure rule.

We shall use reasonable care to protect covered biometric information, at least as protective as our handling of other confidential and sensitive information, and require appropriate safeguards from providers, including restricted access and secure transmission and storage. No system is completely secure; report suspected exposure through section 8.

Didit’s primary hosting for our checks is in Ireland. We operate in the United States, and Didit has US and Spanish entities and may involve providers or support outside Ireland. Its Data Processing Addendum addresses covered onward transfers using applicable contractual or other recognized safeguards where required. You can ask us for information about a particular transfer or a copy of applicable safeguards, with necessary confidential information removed. See Didit’s Verification Privacy Notice, Didit’s Business Terms and Data Processing Addendum, and our Privacy Policy.

8. Errors, review, and privacy rights

Estimates, document checks, liveness checks, matching, and location decisions can be wrong. An automated failure or uncertain result can leave access restricted or require another check; it is not proof of fraud. You can retry from Settings and use the other method where offered. Contact support@mirrorchats.com or our public request form if a decision appears wrong, you cannot access Settings, or you need assistance. You do not need an account to use the form.

You may ask for a human review, explain your position, supply relevant information, and challenge an incorrect result. Identify the decision and approximate time or case reference if available. Do not email your full ID, selfie, password, or unnecessary sensitive information; we shall explain any proportionate information or secure resubmission needed. Review does not guarantee a pass or permit us to override an applicable access restriction.

You may appeal an age or location access decision free of charge within six months after notification through the form or email above. A human reviewer will provide a written response with reasons; the appeal outcome will not be based solely on automation. We aim to respond within seven days, with urgent risks and legal deadlines taking priority, and shall correct a mistaken decision without undue delay. Other content and account appeals follow the Terms and Content Standards and Moderation Policy. Privacy requests and privacy appeals follow the separate process and response periods in the Privacy Policy.

You can request access, correction, deletion, restriction, applicable portability, withdrawal of consent, or review of significant automated decisions through the same channels, subject to the rights and lawful exceptions described in the Privacy Policy. You can also object to processing based on legitimate interests or request a limit on eligible sensitive-information uses. Withdrawal does not affect earlier lawful processing. Where consent is required, we shall stop further covered processing after withdrawal and assess required erasure and directions to recipients. We shall not penalize you for exercising a privacy right, although verified access can depend on necessary verification records. We shall explain any lawful retention exception.

You may complain to an applicable privacy, consumer-protection, or online-safety authority or use other lawful remedies without first exhausting our review process. You can also contact our EU and UK privacy representatives through the Prighter contact portal; their details are in the Privacy Policy. Report suspected underage access or a failed safeguard through our form or email. If we learn or reasonably believe that a user is underage, we shall restrict access, review the information, and apply the protections required by law.

9. Changes and contact

We may update this notice as methods, location rules, or processing change. For material changes, we shall notify you, summarize the changes, give their effective date, and obtain the affirmative acceptance required by the Terms before applying them to continued account use. We shall obtain any required new or renewed consent before changed processing. Posting a revision or continued use alone does not supply separate consent, authorize an incompatible purpose, or remove accrued rights.

AI Chat Media LLC, 971 US Highway 202N Ste N, Branchburg, NJ 08876, USA

Support, privacy requests, and appeals: support@mirrorchats.com

Public request form: https://www.mirrorchats.com/legal/takedown