Home / Privacy Policy

Poppy AI legal

Privacy Policy

This policy explains, in plain language, what Poppy AI collects when you use poppy-ai.com, why we collect it, who we share it with and how you can take control of it.

Last updated: 2026-08-06 · Applies to poppy-ai.com and all Poppy AI pages · Written for members aged 18 and over.

1. Who we arePoppy AI operates the website at poppy-ai.com and the companion showcase published on it. This policy explains what we collect, why we collect it and what you can ask us to do about it.
2. Scope of this policyThis policy covers poppy-ai.com and every page linked from its main navigation. It does not cover independent websites you reach from an outbound link.
3. Adults onlyPoppy AI is intended exclusively for people aged 18 or over. We do not knowingly collect information from minors, and accounts found to belong to minors are removed.
4. Information you give usThis includes an email address, a display name, billing details where a paid tier is chosen, and any message content you send inside a companion chat.
5. Information collected automaticallyOur servers record standard technical data such as IP address, browser type, device category, referring page, language preference and timestamps of requests.
6. Cookies and similar technologiesWe use cookies to keep you signed in, remember display preferences and measure aggregate traffic. Blocking them in your browser is possible, but parts of the site may stop working.
7. How we use your informationTo operate the site, deliver conversations, maintain continuity between sessions, process payments, prevent abuse, answer support requests and improve the product.
8. Conversation contentChat content is stored so a companion can remember earlier context. It is tied to your account, is not published anywhere on the site, and is not shared with other members.
9. Legal grounds for processingWe rely on contract performance for account and billing data, legitimate interest for security and analytics, consent for optional marketing, and legal obligation where a law requires retention.
10. Payment handlingCard details are entered with our payment processors and are never stored on our own servers. We retain only the transaction reference, amount, currency and status.
11. Service providersWe share limited data with hosting, email delivery, analytics and payment partners who act on our instructions and are bound by confidentiality obligations.
12. No sale of personal dataWe do not sell, rent or trade personal information, and we do not disclose conversation content to advertisers or data brokers.
13. International transfersData may be processed in countries other than yours. Where that happens we use recognised safeguards such as standard contractual clauses.
14. Data retentionAccount data is kept while your account is active. After closure, most records are deleted within ninety days except where a financial or legal obligation requires longer.
15. Security measuresWe use encryption in transit, restricted internal access, audit logging and regular review of our infrastructure. No online service can promise absolute security.
16. Your access rightsYou may request a copy of the personal data we hold about you, together with an explanation of how it was obtained.
17. Correction and deletionYou may ask us to correct inaccurate details or delete your account and its associated data, subject to legal retention limits.
18. Objection and restrictionYou may object to processing based on legitimate interest and ask us to restrict processing while a dispute over accuracy is being resolved.
19. Data portabilityWhere technically feasible, you can request your data in a structured, commonly used machine-readable format.
20. Withdrawing consentConsent for optional messages can be withdrawn at any time using the unsubscribe link or by writing to our support address.
21. Marketing communicationsWe send product updates only to members who opted in. Transactional messages such as receipts and security notices are not marketing and continue regardless.
22. Automated decision-makingWe do not use automated processing to make decisions that produce legal effects or otherwise significantly affect you.
23. Third-party linksOutbound links lead to websites with their own policies. We are not responsible for how those operators handle your data.
24. Do Not Track signalsBrowser Do Not Track standards remain inconsistent, so we do not currently respond to them. Cookie controls in your browser remain effective.
25. Breach notificationIf a breach is likely to create a significant risk to you, we will notify affected members and the relevant supervisory authority without undue delay.
26. Regional rightsResidents of the EEA, the United Kingdom, California and other regions with dedicated privacy statutes may have additional rights and may lodge a complaint with their local regulator.
27. Changes to this policyMaterial changes are announced on this page with an updated revision date. Continued use after that date means the revised policy applies.
28. Contacting usPrivacy questions and rights requests can be sent to privacy@poppy-ai.com and are answered within thirty days.