Legal / Privacy Policy
Last updated: October 10, 2026
AI Chat Media LLC, a New Jersey limited liability company (“we,” “us,” or “our”), operates MirrorChats at https://www.mirrorchats.com (the “Service”). We are the controller of personal information described in this policy. Our contact details and our European Union and United Kingdom representatives appear in section 15.
MirrorChats offers fictional AI characters, private text chats, and AI-generated images and videos for adults who are at least 18 and meet any higher minimum age where they live. Where available, the video-call feature uses typed messages and AI-generated video; it is not a live connection to a person and never accesses your camera or microphone. Generated clips may include synthetic audio. This policy also covers visitors, people who contact us, and people identified in reports or retained records. Some records remain from retired creator, human-messaging, community, and voice features.
Private chats can contain real personal information. AI model providers receive conversation content; rendering providers receive filtered prompts and fictional character images as described in section 4. Advertising tools can connect activity on this adult service with identifiers. Account deletion does not automatically erase every generated item or provider record. Sections 4, 7, and 8 explain these practices.
This policy explains our practices. Accepting our Terms of Service, enabling adult content, or continuing to use the Service does not replace a separate consent that privacy law requires.
We collect information you provide, information generated when you use the Service, and information supplied by the providers and other sources identified below. The categories also include information collected during the past 12 months through features that have since closed.
| Category | Examples and sources |
|---|---|
| Account and profile information | Email address, account identifier, password credentials, date of birth entered at signup, preferences, privacy choices, and subscription status. Optional Google sign-in supplies your name, email address, and profile picture. Some earlier profile avatars remain stored. |
| Conversations and character information | Ordinary chat messages, separate video-call transcripts, typed character descriptions and preferences, generated replies, photos and clips, and media associated with conversations. Video calls never access your camera or microphone. Retained historical records include earlier voice transcripts and quarantined uploads; current user uploads, human messaging, and voice calls are disabled. |
| Memory and other inferences | AI summaries of permitted conversation context, your name if provided, personal details such as job or location, preferences, shared moments, conversational tone, and moderation or crisis-related flags. Health details are excluded from long-term memory through instructions and filtering; underlying messages and necessary safety records may still contain them. Inferences can be inaccurate. |
| Age and verification information | Your declared date of birth; age-check status, method, time, jurisdiction, session reference, and deletion records. Didit directly collects an identity document and selfie for an ID check, or a facial scan for age estimation, depending on the required method. Section 5 explains what we receive. |
| Payments and commercial activity | Customer and transaction identifiers, subscription and credit purchases, amounts, refunds, trial eligibility, a card fingerprint used to prevent repeat trials, and pricing-test records. Full card details are submitted directly to Stripe. |
| Device, location, and usage information | IP address, approximate location derived from it, browser and device information, page URLs and referrers, timestamps, account and conversation identifiers, cookies, click and browser identifiers, and signup, checkout, purchase, and chat-engagement events. |
| Support, reports, and legal records | Contact details, correspondence, request reasons, location and statements supplied through our reporting form, reported content, moderation decisions, appeals, verification of requests, and records preserved for investigations, disputes, or legal duties. Sources include you, complainants, affected people, our reviewers, authorities, and advisers. |
Messages, memory, and other content can reveal real health information, sex life, sexual orientation, ethnicity, religion, or other sensitive information. Age checks can involve facial information. A fictional character’s traits do not necessarily describe a real person, but information about a real person remains personal information even in a fictional chat.
You choose what to include in a chat. Avoid another person’s private information and details you do not need to share. Account credentials and age information are required to register; an age check may be required for access; payment information is required for purchases. Google login, advertising, and marketing email are optional. Declining them does not prevent ordinary account use.
We use account information to register and authenticate you, apply your settings, deliver features, manage subscriptions and credits, process payments, prevent repeat trials, and send verification messages, receipts, and service notices. We use IP-derived location to apply access and age-check requirements. Location checks are refreshed during use; they do not require GPS access.
We use messages, character information, media, and permitted memory to generate and personalize replies, find relevant media, and create requested images and clips. Video-call transcripts are stored separately from ordinary chat messages and feed the same conversation memory. Memory summarizes conversation context for later replies and may include personal details you provide. We instruct the summarizer not to record health details and apply a filter to each memory update; existing memories have also been filtered. These measures do not remove health information from the underlying messages or necessary safety records, and automated filtering can miss information. You can request access, correction, or deletion under section 12.
We use content, flags, and technical records to enforce our rules, detect prohibited content and suspected underage use, investigate abuse, protect accounts and systems, respond to support requests and reports, and handle legal claims and duties. Automated checks can block content or freeze an account. A crisis-related flag can reflect a real concern about mental health or self-harm; the Service is not an emergency monitoring service, and review is not continuous.
We use technical, usage, and purchase records to diagnose problems, assess features, conduct pricing tests, and measure advertising. Email and advertising choices are described in section 7. Section 4 explains AI provider safeguards, retention, and their limits.
AI model providers process chats, conversation context, selected character images, memory summaries, and typed character information to generate replies, summarize permitted context, and perform safety checks. The chat provider processes public-endpoint requests in locations that can vary among the United States, European Union, and United Kingdom. Zero-data-retention settings cover supported chat-completion inputs and outputs, including image inputs. Separate account, usage, security, and legal records may have different retention.
The chat provider acts as our processor under a data-processing agreement that includes a service-specific annex and provisions for covered EEA, UK, and Swiss transfers. A model’s development origin is different from the location of the provider processing your request. The public endpoint does not guarantee EU-only processing. Section 10 explains international transfers.
Image and video generation providers receive filtered scene prompts, fictional character image links, and rendering settings. Requests pass through a pattern filter and a second model-based check designed to remove real-user details. A request is not sent if that second check fails or times out. Image links use random file names without internal account, conversation, or call identifiers. We do not send user account identifiers, user IP addresses, chat transcripts, or user-uploaded images through this route. Filters can miss information; these measures do not guarantee that every request is anonymous. Provider retention, training restrictions, and processing locations for this route have not all been contractually confirmed.
Embedding services process scene text and character image links to create numerical representations used to find relevant media. The available no-training and immediate content-deletion settings have been enabled for covered requests since October 4, 2026. These settings do not erase prior submissions or reverse prior uses.
Moderation services process material flagged by our minor-safety controls and typed character information, including relevant surrounding messages where needed. The separate moderation endpoint we use excludes training and retention for abuse monitoring or application state under its published controls. Checks of typed fields and memory summaries also run through the chat provider. These protections apply to the particular services and settings described, not every AI service.
Private chats and private characters are not listed in discovery areas. Staff and providers can access information to operate, secure, moderate, or support the Service and handle legal matters. Generated photos and clips from chats and video calls remain in the character’s media library after account deletion. Shared platform-character media may be reused; private character media is not thereby authorized for other users. Our Terms do not authorize publishing private chats, private characters, or identifying private content. Contact us under section 12 to request removal of a retained item that reveals that material.
Provider change on October 8, 2026. Between September 6 and October 7, 2026, chat messages, conversation memory, and recent character images were sent directly to a provider in China. We stopped that route on October 8 and requested deletion of the previously transmitted data. We have not confirmed completed deletion. The previous route lacked a confirmed fixed API retention period, contractual no-training protection, and an EEA or UK transfer arrangement. The current safeguards do not apply retroactively. You can request information about the recipients and earlier processing through section 12.
Where an age check is required, we send Didit our account reference and the verification method. You complete the check on Didit’s page. An ID check uses a camera capture of your identity document, a selfie and liveness check, and a comparison of your face with the document photograph. A facial age-estimation check estimates age from a facial scan. Our current face-only route requires an estimate of at least 25; a younger estimate is referred to a separate ID check. A failed check can prevent access. Duplicate-face searching is disabled in our current workflows.
Our current ID workflow returns document type, issuing state, date of birth, and age. We use birth date and age briefly to decide whether you pass, without storing the returned payload. A face-only check returns an age estimate. These workflows do not return names, document numbers, addresses, or identity images. An earlier built-in ID fallback was disabled on October 4, 2026, so these limits do not describe every earlier check. The birth date entered at signup is separately collected account information.
We retain an account’s verification status, method, and time, and related access-control flags. We also retain verification audit records, including session reference, jurisdiction, method, status, reason, and deletion receipt, for seven years under our current schedule. These records can still be personal information even when a direct account link has been removed.
Didit’s primary hosting for our checks is in Ireland. Our application requests session deletion before recording a successful pass. The current console setting provides a one-month fallback, with biometric templates deleted with the session. Separate provider security, fraud, or legal records may remain. Didit acts as our processor for verification and may act independently for certain derived security and fraud information under its terms. Its training opt-out is enabled for our service, but does not reverse earlier training.
We present a separate consent choice before the age check. It concerns verification, not sensitive chat information, advertising, or unrelated model training. You can decline the check, but access requiring verified age will be unavailable. Contact us under section 12 about withdrawal, access, or deletion, subject to applicable retention duties.
We disclose information to the recipients below for the stated purposes. AI and rendering providers are described by category. We maintain records of their identities and will provide specific recipient information where required in response to an access request. Some payment, login, advertising, and fraud providers also use information for their own purposes; not every recipient acts only on our instructions.
| Recipient | Information and purpose |
|---|---|
| AI and verification services | Chat-model, image and video generation, embedding, and moderation providers receive the information described in section 4. Didit receives verification information as described in section 5. Provider categories do not imply identical locations, retention, contractual safeguards, or independent-use rights. |
| Hosting, storage, and infrastructure | Vercel hosts requests, runtime logs, analytics, and some legacy media; Neon stores accounts, conversations, memory, flags, and payment records; Cloudflare stores and delivers media and restricted evidence and processes viewer IP addresses; Upstash handles short-lived reply locks and counters using account or conversation references rather than chat text. |
| Payments, login, and email | Stripe processes payment, customer, transaction, and fraud information; Google provides optional sign-in information; Resend sends transactional and character emails using email addresses and message content. |
| Advertising and measurement | Meta receives pixel and server events, linked identifiers, and related technical and commercial information. Taboola receives browser and server advertising events, click identifiers, and related technical and commercial information. Taboola’s browser tools can contact LiveIntent to match advertising identifiers. Vercel Web Analytics receives page and technical usage information when enabled; Vercel Speed Insights separately receives page URLs, performance measurements, and related technical information. Section 7 and the Cookie and Advertising Notice describe these tools and their controls. |
| Representatives, advisers, and authorities | Prighter receives relevant privacy correspondence as our EU and UK representative. Professional advisers and competent authorities can receive information needed for advice, claims, investigations, lawful requests, or required reports. |
We may disclose relevant account information, content, identifiers, and evidence when legally required or necessary to investigate unlawful conduct, enforce our rules, establish or defend legal claims, or protect a person’s safety. This can include lawful reports to child-protection authorities such as NCMEC or to law enforcement. We assess the need and legal basis for a disclosure; this is not permission to disclose every conversation.
A copyright counter-notice may be forwarded to the complainant with the contact information the law requires. Other reports and appeals can require disclosure of relevant allegations or evidence to affected people. Do not include unrelated private information in a report. Records retained from closed community features include information that users previously chose to share; current private chats are not a public community feed.
Personal information may be reviewed or transferred in a merger, acquisition, financing, reorganization, insolvency, or sale of the business where permitted by law. Appropriate confidentiality, purpose, and notice requirements continue to apply. A business transaction does not itself authorize a new incompatible use.
We use cookies and similar tools for login, security, settings, and privacy choices. When enabled, Meta Pixel and Conversions API, Taboola’s pixel and server tools, Vercel Web Analytics, and Vercel Speed Insights also collect or receive activity information. Taboola’s browser tools can contact LiveIntent for advertising-identifier matching. The Cookie and Advertising Notice explains the tools, information, storage periods, and controls in more detail. Advertising providers may combine it with information from other websites or services to measure campaigns, build interests, or personalize advertising across services.
Events include page views, signup, checkout, purchases and their value, and a Meta chat-engagement event at the fifteenth user message. Data can include page URLs and referrers, browser or click identifiers, IP address, device information, order or event references, purchase type, and currency. Meta advanced matching and some server events include hashed email and account identifiers. Hashing helps match records; it does not make them anonymous. Page URLs can contain conversation or character references, and Meta automatic event collection is enabled.
Our configured events do not send raw chat text, memory, crisis flags, or health inferences to advertisers. Linked events and page context can still reveal use of an adult AI-companion service. Meta and Taboola receive identifiers, device and internet activity, approximate location, and purchase or engagement information for measurement and advertising. Where California’s CCPA applies, these advertising disclosures are treated as sales and sharing for advertising across services. Other state laws may classify the disclosures as sales or targeted advertising. We do not receive cash for personal information.
Regional choice. For visitors in the EEA, UK, and Switzerland, advertising pixels, analytics, and the corresponding server events are disabled until acceptance. Declining keeps them disabled. Elsewhere, these tools currently operate unless you opt out. Essential login, security, and privacy-choice tools are not controlled by the advertising choice.
Do Not Sell or Share My Personal Information. Use this choice in the footer or Settings → Privacy to stop advertising pixels, Vercel Web Analytics, and Vercel Speed Insights in that browser. The footer choice reloads the page. After changing the choice in Settings, reload the page: optional scripts already running may continue sending advertising and analytics requests until it reloads. When you are signed in, the explicit choice also stops the associated server advertising events for your account. An account choice does not automatically turn off browser tools on another browser or device, even while signed in; make the browser choice there as well. Clearing cookies, changing browsers, or using another device can require a new browser choice. These technical limits do not reduce an applicable right to withdraw consent or opt out.
Global Privacy Control (GPC). GPC is a browser signal asking websites to stop covered advertising disclosures. Our browser controls check for GPC when the page initializes and keep advertising, Vercel Web Analytics, and Vercel Speed Insights off when the signal is detected. Reload after changing a browser signal. Server handling currently checks GPC only at signup. For an existing account, GPC alone does not stop every later server event. Also use the signed-in “Do Not Sell or Share” choice for your account. This technical limitation does not reduce a legal right to have the signal honored. For other “Do Not Track” settings, use the choices described here; they do not automatically replace those choices.
Withdrawing consent or opting out applies to future events covered by the choice, subject to the current control limitations above. The choice does not automatically recall information already received by Meta, Taboola, or other providers. Where withdrawal requires erasure and recipient notification, we shall carry out those duties without a separate deletion request, subject to applicable lawful retention exceptions. Withdrawal does not affect earlier lawful processing. A sale or sharing opt-out does not by itself require every earlier record to be erased. You can also submit a broader statutory deletion request under section 12. You can also manage cookies in your browser, although blocking essential cookies can interfere with login or features.
Marketing and character emails have a separate account toggle and, where provided, an unsubscribe link. EEA, UK, and Swiss marketing email is opt-in. Turning marketing email off does not stop necessary account, billing, security, or legal notices.
We retain information for the periods and purposes below. If there is no fixed period, the criteria include continued account or feature use, fraud and dispute handling, and an applicable preservation or legal duty. Replacing or removing an account reference does not necessarily make the remaining information anonymous.
| Information | Current period or criterion |
|---|---|
| Accounts, chats, and memory | Accounts, ordinary chats, separate video-call transcripts, and permitted memory are generally held while the account exists and removed through account deletion, subject to lawful holds. Earlier voice transcripts are treated as messages; audio from the retired voice feature was not retained. Sensitive-chat consent withdrawal has the separate deletion requirements in section 9. |
| Generated and earlier media | Generated photos and clips from chats and video calls remain in character media libraries after account deletion, with no fixed current library retention period. Quarantined historical uploads and case material are held in restricted storage for rights, moderation, and evidence matters pending resolution. Retention does not authorize sharing private or identifying content. |
| Verification records | Account pass information is kept with the account. Verification audit records have a current seven-year schedule. Didit session deletion and its one-month fallback are described in section 5; provider security or legal records can have separate retention. |
| Payments, trials, and pricing tests | Transaction and accounting records are retained for reconciliation, tax, disputes, and legally required records. Stripe has its own retention. A card fingerprint is retained for repeat-trial prevention without the direct account link; pricing-test rows can retain the original account identifier and amounts after deletion. |
| Moderation, requests, and evidence | Reports, decisions, search logs, and evidence are retained while needed for moderation, requests, claims, or preservation. Some moderation and search records remain after account deletion with the account reference replaced by “deleted.” Case evidence is kept for the applicable hold period, which can be extended or released according to the case and law. |
| Short-lived records and provider copies | Vercel runtime logs: one day; analytics visitor hash: 24 hours. Meta advertising click identifiers: 30 days in a cookie and account. Resend email content and logs: 30 days. Neon database recovery: six hours, without snapshots. Upstash counters and locks: short-lived. AI and verification provider content: sections 4 and 5. Advertisers apply their own retention; account deletion does not recall their copies. These limits do not establish one period for all providers, media, backups, or legal records. |
Ordinary account deletion removes the account, profile, ordinary chat messages, separate video-call transcripts, and conversation memory, deletes your uploaded media, cancels the subscription, deletes the Stripe customer entry, and requests deletion of an unfinished Didit session. Stripe can retain transaction records for its own legal and fraud purposes. Generated media libraries, the retained records described above, and copies already sent to other providers are not all reached by that process.
Ordinary account deletion does not automatically send erasure requests to every AI, rendering, embedding, moderation, email, or advertising provider, including former recipients. To request broader statutory deletion or removal of private or identifying generated media, contact us under section 12. We will assess required recipient notifications and deletion directions. This does not postpone any deletion duty that arises when consent is withdrawn.
An evidence case or legal hold can currently prevent self-service account deletion. Contact us for review. A lawful retention exception covers only the information and time needed for its purpose; it does not remove your rights concerning unrelated information.
The GDPR and UK GDPR require a legal basis for using personal information. The table explains the basis for each purpose. Contract means information objectively needed for the service you request. Legitimate interests means a stated business or safety interest, balanced against your rights. You can object to uses based on legitimate interests. The table does not supply any separate consent or permission that is still required.
| Purpose and information | Article 6 basis | Interest or limitation |
|---|---|---|
| Provide accounts, requested chats, memory, media, subscriptions, and billing. | Contract — Article 6(1)(b). | Only what is objectively needed for the requested service; sensitive-chat information also requires the Article 9 condition described below. Optional advertising and unrelated training are excluded. |
| Apply age and location restrictions. | Legal obligation — Article 6(1)(c), for an applicable EU or UK duty; otherwise legitimate interests — Article 6(1)(f). | Meet access requirements and keep an adult service from underage use. Identifying biometrics can also require Article 9 consent. |
| Protect accounts, prevent fraud, moderate content, and investigate reports. | Legitimate interests — Article 6(1)(f); legal obligation — Article 6(1)(c), for a specific EU or UK duty. | Protect people and the Service. Sensitive content also needs an Article 9 condition. |
| Provide support and necessary account notices. | Contract — Article 6(1)(b), for service requests; legitimate interests — Article 6(1)(f), for other administration. | Answer requests and administer the Service. |
| Diagnose failures and conduct limited performance or pricing analysis. | Legitimate interests — Article 6(1)(f); consent — Article 6(1)(a), for optional analytics requiring it. | Maintain reliability and assess features. This does not authorize sensitive-content reuse or unrelated training. |
| Advertising tracking, linked events, and optional analytics. | Consent — Article 6(1)(a). | EEA and UK browser and server tools require acceptance. You can withdraw consent. |
| Send optional marketing and character emails. | Consent — Article 6(1)(a). | Separate opt-in and withdrawal for EEA and UK recipients. |
| Keep required records, respond to authorities, and handle legal claims. | Legal obligation — Article 6(1)(c), for an EU or UK duty; otherwise justified legitimate interests — Article 6(1)(f). | An overseas law is not automatically an EU or UK legal-obligation basis. Article 9(2)(f) can cover sensitive information needed for an actual legal claim. |
Real health, sex-life, sexual-orientation, and other special-category information needs an Article 9 condition as well as an Article 6 basis. The same applies to biometrics used to identify someone. For sensitive-chat processing, we rely on separate explicit consent under Article 9(2)(a), alongside the applicable Article 6 basis in the table. Our adult-content confirmation is not that consent; the age-check choice covers only verification. Contract or legitimate interests alone does not satisfy Article 9. Any exception, such as information necessary for an actual legal claim, applies only within its legal limits.
For users in the EEA, United Kingdom, and Switzerland, we require separate explicit consent before processing sensitive information that chats contain or reveal to provide and store conversations, maintain their context, and apply safety checks. The consent is separate from account terms, advertising choices, and age verification. Without it, chat replies, video-call turns, memory updates, and background follow-ups do not run. Account administration, billing, cancellation, and privacy requests remain available.
You can withdraw sensitive-chat consent in Settings → Privacy. Withdrawal stops the processing that depends on that consent and deletes long-term conversation memory. We will also delete affected transcripts and other sensitive information without undue delay where no separate lawful ground permits retention, and give necessary deletion directions to recipients. A separate deletion request is not required for these duties to arise. Limited records may be retained only under an applicable legal exception. Withdrawal does not affect earlier lawful processing or automatically cancel a subscription; cancellation remains available in Settings → Billing or through support.
We operate in the United States, and our database is hosted in Virginia. The public chat-model endpoint can process requests in the United States, European Union, or United Kingdom, with the location changing between requests. Other AI, embedding, and moderation services may process outside your home country; all rendering-provider and downstream locations have not been confirmed. Didit’s primary verification hosting is in Ireland, Prighter operates in the EU and UK, Taboola has US and Israeli operations, and Cloudflare delivers content through a worldwide network. Legal protections can differ between countries.
A disclosure to a separate recipient abroad can require a transfer arrangement under the GDPR, UK GDPR, or Swiss law, including an onward transfer from the United States. The current chat provider’s agreement incorporates standard contractual clauses and the applicable UK and Swiss provisions for covered transfers where required. Other routes may rely on applicable adequacy decisions or contractual safeguards with additional measures where needed. Verification-provider arrangements apply to their covered processing and do not establish safeguards for other recipients. We have not confirmed all required contractual arrangements for every rendering route.
Accepting this policy, our Terms, or adult content does not provide consent to an otherwise unsupported international transfer. Sensitive-chat consent does not waive transfer requirements. You can ask about specific recipients, processing locations, and the safeguards that apply and request a copy of applicable safeguards, with necessary confidential information removed. The historical provider change in section 4 does not establish that earlier transfers had the current safeguards.
AI models generate replies, summarize memory, infer preferences, and match media to a scene. These processes can be wrong. They are used to shape an interaction, rather than to establish facts about you. Our age checks estimate age or verify it from an ID and use liveness and matching results; a failed or uncertain result can restrict access or require another check. Location and age status also determine feature availability.
Keyword and minor-related guards examine messages, memory, and character fields. Flagged material can be sent for moderation, blocked, or cause an account freeze. Payment and card-fingerprint rules can determine trial eligibility. These rules can affect access or charges without a person first reviewing each event. Human review of flags and reports occurs separately; generated content is not individually reviewed before every delivery.
You can email us or use the reporting form to contest a result, explain your position, request correction, or request human review. If a solely automated decision has a legal or similarly significant effect, the GDPR provides additional protections, including restrictions on making that decision without an applicable exception. The UK GDPR has a different framework for significant automated decisions, but still requires safeguards, including an opportunity to make representations, contest the decision, and obtain human intervention. Special-category information has additional protection. These rules do not apply to every AI-generated reply merely because it is automated.
Use account settings for available profile, email, advertising, export, consent, and deletion controls. You can also email support@mirrorchats.com or use https://www.mirrorchats.com/legal/takedown to request access, correction, deletion, review of a memory inference, or help with a privacy choice. The account export lists unpaid media offers and their dates and prices but omits the media files themselves. This does not limit a statutory right of access to personal information in those records. Self-service export and deletion do not reach every provider or retained record; see section 8.
Where the GDPR or UK GDPR applies, you have the following rights, subject to the legal conditions and exceptions for each right. Use the request methods below or contact our representatives in section 15.
| Right | What you can request |
|---|---|
| Access and a copy | Find out whether we use your personal information, receive a copy, and obtain information about how we use it. |
| Correction | Correct inaccurate personal information and complete information that is incomplete. |
| Deletion | Ask us to delete personal information where the legal conditions are met. Necessary legal retention and other lawful exceptions can apply. |
| Restriction | Ask us to limit use of your information in specified circumstances, such as while we check its accuracy or assess an objection. |
| Portability | Receive information you provided in a usable electronic format and, where technically feasible, have it sent to another provider. This generally applies to automated processing based on consent or contract. |
| Objection | Object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing, including related profiling, at any time; we must stop that use. |
| Withdrawal of consent | Withdraw consent at any time where processing relies on it. Withdrawal does not affect earlier lawful processing. |
| Automated decisions | Request applicable information and safeguards for significant automated decisions, including human review and an opportunity to explain your position and challenge the result. Section 11 explains the separate EU and UK rules. |
| Complaints | Complain to the appropriate data-protection authority. You do not have to contact us first. The contact links appear below. |
For authority contact details, see the EDPB authority directory or the UK Information Commissioner. You may also contact our representatives directly; see section 15.
Switzerland. Where Swiss law applies, you can request information about processing, correction, and applicable deletion, restriction, or portability. You can raise a concern with the Federal Data Protection and Information Commissioner.
We accept privacy requests from all US users, including when a particular state privacy law does not apply. You can request access, correction, deletion, a usable copy of your information, or help with an advertising choice through the methods below. We will review your request and explain the action we can take. Additional legal rights depend on where you live and the information and processing involved. The table describes common requests and additional state rights.
| Right | What you can request |
|---|---|
| Access and a copy | Ask whether we process your information, request access, and obtain a usable copy. State law may provide additional portability rights. |
| Correction and deletion | Ask us to correct inaccurate information or delete personal information, subject to lawful retention and other applicable exceptions. Section 8 explains current account-deletion limits. |
| Recipient information | Obtain categories of recipients or a list of specific third parties where your state provides that right. |
| Advertising and sales | Use the choices in section 7 to stop the advertising events covered by your choice. State law may also give rights to opt out of sales, targeted advertising, or California sharing across services. Section 7 explains the GPC limitation. |
| Significant profiling | Opt out of covered profiling that produces legal or similarly significant effects. Where provided, question a profiling result, obtain an explanation, correct the information used, and request reconsideration. |
| Sensitive information | Withdraw consent to processing that requires it, or limit eligible uses and disclosures where California law provides that right. |
| Agents and appeals | Have an authorized person submit a request and ask us to review a denied request through the appeal process below. State law may provide additional agent and appeal requirements. |
We will not penalize you for making a privacy request. A feature may still need information necessary to provide it. Verification, the scope of a legal right, and lawful exceptions depend on the request and applicable law.
Sensitive information. Our adult-content choice does not establish consent for every sensitive-data use. Where required, separate consent must cover the particular processing and can be withdrawn. Some laws also restrict processing to what is necessary for the requested service or prohibit sensitive-data sales; consent does not override those restrictions. Contact us to withdraw consent or request a limit. Deleting an account does not reach every recipient; see section 8.
Nevada residents can email support@mirrorchats.com, our designated request address, with “Nevada Sale Opt-Out” to direct us not to sell covered information we have collected or will collect about them under Nevada’s online privacy law. A sale under that law generally means exchanging covered information for money, subject to statutory exceptions. We may need to reasonably verify your identity and the authenticity of the request. The advertising choices in section 7 remain available even where a disclosure falls outside that definition. Nevada’s separate consumer-health rights are described below.
This subsection gives additional disclosures for California residents where the California Consumer Privacy Act, as amended (CCPA), applies. Sections 2–8 describe the sources, purposes, recipients, and retention periods or criteria. The table maps the information collected during the preceding 12 months, including retained information from closed features, to California’s categories.
| California category | Examples | Disclosures |
|---|---|---|
| Identifiers and customer records | Name if supplied, email, account and online identifiers, IP address, login information, and verification information. Didit handles identity documents; Stripe handles full card details. | Service: relevant verification, hosting, login, payment, and email providers. Advertising: linked identifiers to Meta and Taboola and, through Taboola’s tools, to LiveIntent for identifier matching. |
| Protected characteristics | Age and birth date; real ethnicity, religion, sex, or sexual orientation disclosed in content or records. | Service: Didit for verification; relevant AI, hosting, or moderation providers for submitted content. Linked adult-service activity can imply sensitive traits to advertisers. |
| Commercial information | Subscriptions, credit purchases, payment references, purchase amounts, refunds, and trial records. | Service: Stripe, hosting, and email providers. Advertising: purchase or engagement events to Meta and Taboola. |
| Biometric information | Facial information and, for face-to-ID checks, identifying biometric templates handled by Didit. | Service: Didit for verification. Our configured advertising fields do not include these records. |
| Internet activity and geolocation | Pages, referrers, browser and click IDs, device information, usage events, and approximate IP-based location. | Service: hosting, infrastructure, fraud, and analytics providers. Advertising: activity and technical information to Meta and Taboola. |
| Audio, visual, and similar information | Generated photos and clips, video-call transcripts, earlier uploads and voice transcripts; Didit identity-document images and selfies. | Service: relevant AI, verification, storage, and moderation providers. Our configured advertising fields do not include this content. |
| Professional information | Real job details voluntarily included in chats, memory, or support records. | Service: relevant AI, storage, or moderation providers. Our configured advertising fields do not include these details. |
| Inferences | Memory summaries, preferences, inferred personal facts, and moderation or crisis-related flags. | Service: relevant AI, storage, or moderation providers. Advertisers can infer interests from linked activity; our configured fields omit memory and crisis flags. |
| Sensitive personal information | Account credentials; government ID information handled during verification; identifying biometrics; real health, sex-life, sexual-orientation, ethnicity, or religious information. | Service: relevant providers for the purposes described in sections 3–6. Advertising events can reveal sensitive adult-service context; raw chats, ID images, and verification templates are not configured advertising fields. |
Sources include you, your device, Google login, Didit and Stripe, AI-generated memory or flags, advertising tools, and people who send reports or legal correspondence. We use the categories for the purposes in section 3. Service and business disclosures also include information needed by advisers, authorities, or parties to a lawful business transaction, as described in section 6. Recipient roles depend on the actual arrangements; this table does not claim that every provider qualifies as a CCPA service provider or contractor.
Sales and sharing. The advertising disclosures are identifiers, online activity, approximate location, purchase and engagement information, and related context or inferences, including sensitive context where revealed. The advertising recipients include Meta and Taboola for advertising and measurement and, through Taboola’s tools, LiveIntent for identifier matching. We treat those advertising disclosures as CCPA sales and sharing where that law applies, even though we receive no cash for personal information. Other disclosures for requested services and legal or business purposes are described above; they are not blanket permission to sell private content.
California rights include knowing the categories and specific pieces collected, sources and purposes, the categories sold or shared and their recipients, and categories disclosed for business purposes; correction; deletion; and opting out of sale or sharing. You can request these through the methods below. You can also request a limit on eligible sensitive-information uses or disclosures beyond those California law permits without a limit option. Email us with “Limit Sensitive Information.” Necessary service, security, and other legally permitted uses can remain; we will explain the scope of any exception.
The Service is for adults. We do not offer a minor consent option for advertising. If we learn that information disclosed to advertisers concerns a person under 16, we will stop those disclosures and review the account and information under section 13. An age declaration or adult-content choice is not authorization to sell or share a child’s information.
A real disclosure or inference about mental health or self-harm can be consumer health information even on an entertainment service. Fictional roleplay alone does not establish a health condition. Where Washington, Nevada, or Connecticut health-data law applies, rights can include confirmation, access or recipient information as provided by that law, withdrawal or stopping collection and sharing, deletion, and an appeal. Collection and sharing can require distinct consents unless a specific exception applies; a sale can require separate signed authorization. Contact us through the methods below. Our Washington Consumer Health Data Privacy Policy and Nevada and Connecticut Consumer Health Data Privacy Notice explain the applicable protections, request procedures, and deadlines. Their more specific health-data protections and any shorter applicable deadlines take priority over a conflicting general provision in this policy. These notices do not replace any separate consent required before covered processing.
Age estimation and face-to-ID matching also have different purposes and legal requirements. Section 5 and our Age Assurance and Biometric Privacy Notice explain the current checks, information received, retention, and destruction. A general acknowledgment of this policy does not replace a biometric notice or consent that applies to a particular check.
Email support@mirrorchats.com or submit https://www.mirrorchats.com/legal/takedown. Identify the right you want to exercise and enough information to locate the records. You do not need to create an account. We may verify access, correction, or deletion requests through your registered email or another proportionate method. Do not send a full identity document unless we explain why it is necessary. We do not require identity verification to use our advertising controls or to make an opt-out or sensitive-information limit request where the law prohibits verification. We may need enough information to apply a choice to your account. Nevada’s general-law sale requests must be reasonably verified.
An agent can use the same methods. Where permitted, we may request proof of your authorization and ask you to verify your identity or confirm the agent’s authority directly. A valid power of attorney is handled under applicable law. We will not require agent authorization for a browser opt-out signal where the law requires us to accept the signal.
| Request | Response standard or applicable legal deadline |
|---|---|
| GDPR or UK GDPR rights | Normally one month. A permitted extension or pause requires the notice and explanation the law requires. |
| CCPA access, correction, or deletion | Where the CCPA applies, acknowledge within 10 business days and respond within 45 calendar days. A permitted extension requires notice within the initial period. |
| CCPA sale/sharing opt-out or sensitive-information limit | Where the CCPA applies, act as soon as feasible and within 15 business days. Apply the choice sooner when possible. |
| Nevada online-privacy sale opt-out | Respond within 60 calendar days after receipt. A reasonably necessary extension of up to 30 days requires notice to you. Shorter periods for other opt-out rights still apply. |
| US requests not listed above | Our general response standard is 45 calendar days, including where a state privacy law does not apply. A shorter required deadline governs. Any legally permitted extension requires timely notice and reasons. Nevada health-data deletion is due within 30 days after authentication. |
| US privacy appeal | Our response standard is 45 calendar days, or a shorter required period. A permitted extension will follow the applicable law. |
| UK privacy complaint | Acknowledge within 30 days; investigate, keep you informed, and provide the outcome without undue delay. |
If a request is denied or limited, we will explain the reason and available appeal or complaint route unless disclosure is prohibited. Rights can be subject to lawful exceptions protecting other people, required records, security, or necessary legal claims. A technical inability to delete is not itself a legal exception. We will address recipient notifications and deletion directions where required; ordinary account deletion currently has the limits described in section 8.
Appeals. Email us with “Privacy Appeal,” identify the request, and explain why you disagree. We will review the decision and give the outcome and reasons. Where state law provides a formal appeal right, we will follow its requirements and, if the appeal is denied, provide the required route to the relevant attorney general or other authority. A content-moderation appeal under the Terms is separate.
Privacy complaints. You can complain about our handling of personal information through the same email or form, or through the representatives in section 15. You can also approach the relevant authority. We will investigate and keep you informed as applicable law requires.
We use technical and organizational measures to protect information, including access restrictions, signed media links, and encryption for restricted evidence storage. No system or transmission is completely secure. Private does not mean end-to-end encrypted or inaccessible to staff and providers. We enforce access restrictions on direct media links. Avoid sharing private links and report suspected exposure through section 15.
The Service is not intended for anyone under 18 or below a higher applicable minimum age. If you believe a minor has supplied personal information or gained access, report it. We review the account and restrict access as appropriate, and assess removal or limited preservation where required for safety, reporting, or a legal matter. We do not treat a minor’s acceptance or a failed age check as consent for unrelated use.
We update the date above when this policy changes. For material changes, we provide an appropriate notice through the Service or email before the changed processing where required. If a change requires consent, we request that consent separately before the covered use. Posting a revised policy or continued use does not retroactively authorize a new incompatible purpose, training use, sensitive-data use, or international transfer.
AI Chat Media LLC
971 US Highway 202 N, Ste N
Branchburg, NJ 08876, USA
Email: support@mirrorchats.com
Privacy requests and reports: https://www.mirrorchats.com/legal/takedown
You can contact our EU or UK representative directly about our processing or to exercise privacy rights. You can also contact us or complain to a data-protection authority.
European Union representative: Prighter EU Rep GmbH
Schellinggasse 3/10, 1010 Vienna, Austria
United Kingdom representative: Prighter Ltd
20 Mortlake, Mortlake High Street, London SW14 8JN, United Kingdom
Representative contact portal: https://app.prighter.com/portal/14399668980
Other MirrorChats legal documents