Privacy Policy

1. Data controller

The data controller is Karol Labuda, a sole trader doing business as Nielogiczny Karol Labuda, Luzińska 2, 84-217 Zęblewo, Poland, tax identification number (NIP): 5882505100, REGON: 526924027. Contact for privacy matters: support@kisslater.com.

This document is effective from: October 16, 2026.

2. What data we process

• Account data: email address, hashed password, verification status, the state of your message pack and 24-hour access, and your consent to marketing emails with the date it was given.
• Conversation data: the content of messages sent to AI personas, conversation history, the chosen persona, the model used and basic usage statistics.
• Technical data: IP address, session identifiers, the guest token for the free demo, security logs and device data.
• Payment and billing data: the transaction identifier at the payment operator, the pack bought, the amount, the payment status and method, and the necessary accounting data. We do not store bank account or card details.
• Analytics and operational data: basic information about use of the service, errors, performance and abuse.

3. Why we process data

The legal basis is most often performance of a contract, statutory obligations and our legitimate interest in protecting and developing the service.

We send marketing emails only on the basis of your consent (Article 6(1)(a) GDPR, Article 398 of the Polish Electronic Communications Law), given when creating the account or in the settings. Consent is voluntary. You can withdraw it at any time with the "Unsubscribe" link in an email or in the account settings, without affecting the lawfulness of emails sent before the withdrawal.

• To create and maintain the user account and enable logging in.
• To run conversations with AI personas, save conversation history and restore conversations assigned to a browser or an account.
• To provide the free guest demo and enforce message limits.
• To handle payments, complaints and billing.
• To send account emails: a welcome after sign-up, login codes and links, purchase confirmations.
• If you consent to it: to send emails with news and promotions, including messages from the characters.
• To prevent abuse, protect the service and improve how the product works.

4. Processing by language models

The content of conversations is passed to the language model providers needed to generate a reply. In the MVP we use OpenRouter as the integration layer and models offered by the providers available in that ecosystem.

We pass on only the data needed to generate a reply and keep the product running. We do not use your conversations to train our own models.

If an infrastructure or model provider operates outside the EEA, the transfer takes place using the appropriate legal mechanisms required by law.

Photos you send in a conversation are passed, reduced in size, to an image-reading AI model through OpenRouter, so that the persona can respond to them. Voice messages you send are transcribed to text on our own server and are not sent to an outside speech provider.

Persona replies sent as voice notes are recorded by the speech synthesis provider ElevenLabs, which receives only the text of that reply.

5. Companion personas and product limits

Some personas are companion or motivational in nature. They are not people, do not replace human relationships and should not be treated as a source of professional medical, legal, psychotherapeutic or financial help.

We may use the content of conversations operationally for moderation, responding to reports and preventing abuse or circumvention of safeguards.

6. Recipients of data

• The payment operator shown at checkout: we pass it your email address, the amount and the order number.
• OpenRouter and any LLM providers available in its ecosystem, if they are needed to generate a reply or to read a photo you sent.
• ElevenLabs, the speech synthesis provider: it receives the text of persona replies that are sent as voice notes.
• Providers of hosting, infrastructure, error logging, analytics and email delivery.
• Entities supporting us with accounting, legal or technical matters, if this is necessary for the service to operate.

7. How long we keep data

We keep conversations on a user account until the account is deleted, the service is closed, or further storage is no longer needed operationally or legally.

Photos and voice messages you send are stored with the conversation and deleted together with it or with the account. You can ask us to delete them earlier at any time.

We keep guest demo data for a shorter time and may delete it earlier, especially if it is inactive.

We keep billing and accounting data for the period required by law.

8. Your rights

• The right to access your data and receive a copy.
• The right to have your data corrected.
• The right to have your data erased, if there are no grounds for further processing.
• The right to restriction of processing and to data portability, where applicable.
• The right to object to processing based on legitimate interest.
• The right to lodge a complaint with the President of the Personal Data Protection Office in Poland (UODO) or another competent supervisory authority.

8a. Age verification and data of minors

To verify the age of the user, the service uses a cookie named age_verified. The cookie is stored locally in the browser for 30 days and contains only the value 1. It contains no personal data and is not linked to a user account.

kisslater.com does not collect or process personal data of people under 18. If we find that data concerns a minor, it is deleted without delay.

8b. Browser notifications

If you allow notifications, your browser gives us a subscription address and encryption keys. We store them with your account or the guest identifier, the site version and the browser name, so we can let you know when a persona writes to you after a break.

The notification is delivered by your browser's push service (for example Google, Mozilla, Apple or Microsoft). Its content is encrypted and holds only the persona's name and a short generic line, never the conversation.

You turn notifications off in your browser settings. A subscription the browser no longer accepts is no longer used, and deleting your account deletes its subscriptions too.

9. Contact

For matters of privacy, personal data or a request to delete your data, write to support@kisslater.com.