Privacy Policy

Last updated: 2026-04-20

This Privacy Policy explains how gfchat.space (the “Service”) collects, uses, stores, and shares your personal data. The data controller is the gfchat.space operator, whose current public information is published in the Impressum and who is reachable for privacy inquiries at hello@gfchat.space.

1. Legal bases (Art. 6 GDPR)

• Contract (Art. 6(1)(b)): creating and operating your account, running the chat, sending cron messages, processing your subscription.
• Legitimate interests (Art. 6(1)(f)): security, moderation, fraud prevention, rate limiting, abuse investigation.
• Consent (Art. 6(1)(a)): optional analytics / session replay (off by default).

2. What we store

• Identity: email, bcrypt password hash, Telegram handle, timezone, age-verification timestamp.
• AI Companion Data:
  • Character customization attributes and generated portrait images (stored in AWS S3, Frankfurt region).
  • Personality configuration (soul.md) stored in our primary database (never displayed to users).
  • Conversation facts and long-term memory stored in a self-hosted LightRAG graph database.
  • Telegram chat_id stored upon account binding; deleted immediately upon unlinking or account deletion.
• Conversation: full message history with your companion, rolling AI-generated summaries, per-message moderation metadata (never the original input if blocked).
• Billing: Stripe customer ID and subscription state (payment details stay with Stripe).
• Operational: IP address and request logs (kept 30 days for security).

3. Who processes your data (sub-processors)

• Amazon Web Services (Frankfurt, eu-central-1) — primary hosting and image storage.
• Cloudflare — DNS (EU edge).
• Stripe Payments Europe, Ltd — payments.
• Resend — transactional email delivery.
• Google Gemini — AI image generation (subject to Google's AI Terms).
• Telegram Bot API — message delivery between you and the Service.
• LightRAG — self-hosted AI graph memory (processed on our infrastructure).
• OpenAI — moderation API only (input and output snippets, scored only).
• The operator's own premises — LLM inference (Germany, on-premise).
• Sentry — error reporting (scrubbed of message content).

All sub-processors are covered by a Data Processing Agreement. Where transfers outside the EU/EEA occur, we rely on Standard Contractual Clauses.

4. Retention

• Account and conversation data: until you delete the account.
• Rolling summary: regenerated periodically; superseded copies are discarded.
• Backups: encrypted daily snapshots, retained 90 days, then purged automatically.
• Operational logs: 30 days.

5. Your rights (Art. 15–22 GDPR)

• Access: Settings → Download data (one-click JSON export).
• Rectification: edit your profile in settings. Premium users may regenerate their character.
• Erasure: Settings → Delete account. All user data is removed or anonymised within 30 days (immutable audit logs may persist in scrubbed form).
• Portability: the data export is provided in a machine-readable JSON format.
• Objection / restriction: email us.
• Complaint: you may lodge a complaint with the supervisory authority of your residence (in Germany, your state DPA).

6. Moderation of intimate content

We apply classifiers to detect illegal content (child sexual exploitation, imminent violence, etc.). Detected events are logged and, where legally required, reported to competent authorities. We do not use your messages to train any AI model.

7. Cookies

We set a strictly-necessary session cookie on login and a preference cookie to remember your consent choice. Analytics/replay cookies are only set if you explicitly accept them in the banner.

8. Children

The Service is not directed at children and requires 18+. If you believe a minor has created an account, email us immediately.

9. Changes

Material changes will be announced in-app 14 days before they take effect.

10. Contact

hello@gfchat.space. Current operator information: Impressum.

11. AI Disclosure

Compliance Notice (California SB 243 / NY AI Companion Law)

• All responses from the bot are generated by Artificial Intelligence. You are interacting with an AI, not a real person.
• Do not rely on the AI companion for medical, legal, financial, or emergency advice.
• If you are in crisis, please use the following resources:
  • Germany: 116 123 (Telefonseelsorge)
  • United States: 988 (Suicide & Crisis Lifeline)
  • International: findahelpline.com