AIDOLVERSE PRIVACY POLICY

1. About this Privacy Policy

This Privacy Policy explains how Aidolverse LLC (“Aidolverse”, “we”, “us” or “our”) collects, uses, stores, shares and otherwise processes personal data when you access or use Aidolverse.

It also explains the rights available to you under applicable privacy and data-protection laws, including the General Data Protection Regulation (“GDPR”) where applicable.

This Policy applies to the Aidolverse website, web application, accounts, subscriptions, Creator services, moderation systems, reporting mechanisms and related services (collectively, the “Service”).

2. Data controller

The data controller responsible for the processing described in this Privacy Policy is:

Aidolverse LLC
30 N Gould St, STE R
Sheridan, WY 82801
United States

Privacy and legal enquiries: legal@aidolverse.com

General support: support@aidolverse.com

Aidolverse LLC is a Wyoming limited liability company.

3. European legal representative

For purposes of Article 13 of the Digital Services Act, Aidolverse has appointed its European legal representative as identified in the DSA & Legal Information page.

The publicly designated representative is:

Tommaso Semeraro
Email: legal@aidolverse.com

The DSA representative performs the functions required under the Digital Services Act. This appointment does not change the identity of Aidolverse LLC as controller of personal data under this Privacy Policy.

4. Categories of personal data we process

Depending on how you use Aidolverse, we may process the following categories of data.

4.1 Account and identity data

This may include:

• name;
• username;
• email address;
• date of birth;
• account identifier;
• authentication information;
• email-verification status;
• account role;
• profile settings;
• profile image;
• account creation and modification dates; and
• information provided through supported authentication providers.

A date of birth is required for account eligibility and age-based functionality. Aidolverse allows accounts from age 16, while purchasing, Creator activity, monetization and Sensitive Content are restricted to users aged 18 or over.

4.2 Profile and social-interaction data

Depending on the functionality you use, this may include:

• public profile information;
• Aidols followed;
• likes;
• saved content;
• comments;
• interaction history;
• content preferences;
• blocked or hidden Aidols;
• notifications; and
• other social features available through the Service.

4.3 Creator data

If you become a Creator, we may process:

• Creator-account status;
• Aidols owned or managed by you;
• Creator profile information;
• Creator plan;
• monetization status;
• Creator Share records;
• transaction history;
• internal accounting records;
• declarations made in connection with Creator eligibility;
• acceptance of the Creator Agreement;
• professional-purpose declarations;
• real-person declarations made for individual Aidols;
• dates on which such declarations are made or reconfirmed; and
• payment-account identifiers and status information.

Where the Creator uses a Stripe Connect Express account, identity verification, bank information and certain tax or compliance information may be collected directly by Stripe rather than by Aidolverse.

4.4 Aidol and User Content

We process content and information you upload, create or make available through Aidolverse, which may include:

• text;
• images;
• videos;
• audio;
• comments;
• profile descriptions;
• Aidol names;
• Aidol profile, cover and showcase images;
• character information;
• posts;
• metadata associated with uploaded content; and
• other material you choose to publish or submit.

Some User Content may contain personal data relating to you or to other individuals.

Creators are responsible for ensuring that they have the rights and authorizations required to provide personal data concerning another person.

4.5 Real-person declarations

When an Aidol is created or relevant identity images are changed, Aidolverse may process a declaration indicating whether the Aidol:

• does not depict or resemble a real person;
• depicts or resembles the Creator; or
• depicts or resembles a third party for whom documented authorization is held.

We also process the date and time on which the relevant declaration or reconfirmation was made.

Aidolverse does not routinely obtain the underlying third-party release itself; the Creator is required to retain the relevant authorization and may be asked to provide evidence where necessary. The product records and reconfirms the declaration when identifying imagery changes.

4.6 Subscription and transaction data

When you purchase or receive a subscription, we may process:

• subscription type;
• applicable tier;
• price;
• discount or promotional conditions;
• billing period;
• subscription status;
• payment session identifier;
• transaction identifier;
• gross amount;
• applicable taxes;
• net amount;
• refunds;
• chargebacks;
• disputes;
• subscription changes;
• cancellation status; and
• withdrawal requests where applicable.

Aidolverse does not need to store full payment-card details where those details are collected and handled by the payment provider.

4.7 Contract and consent evidence

Where Aidolverse requires an acceptance, declaration or consent to be evidenced, we may retain:

• your account identifier;
• the document or declaration involved;
• version identifier;
• language;
• date and time;
• context in which acceptance occurred;
• full text shown to you;
• declarations or checkboxes selected;
• payment-session linkage where relevant; and
• termination date of the related contract where required for retention purposes.

This includes, where applicable:

• Terms of Service acceptance;
• Creator Agreement acceptance;
• consumer checkout declarations;
• professional-purpose declarations; and
• voluntary promotional-use consent.

The implemented evidence system records the version, language, timestamp and complete text accepted by the user.

4.8 Withdrawal requests

Where you exercise an applicable statutory right of withdrawal, we may process:

• account identifier;
• relevant subscription;
• date and time the request was received;
• refund amount;
• portion of the service already used;
• subscription termination information; and
• evidence that confirmation was sent.

4.9 Reports and moderation data

If content or conduct is reported, reviewed or restricted, we may process:

• identifiers of the affected content, account or Aidol;
• the applicable rule;
• reason for the decision;
• restriction imposed;
• date and time;
• whether automated systems were involved;
• whether the issue concerned platform rules or alleged illegality;
• automated moderation scores;
• related reports;
• appeal information;
• appeal outcome;
• reversal information;
• decision-maker information; and
• dates on which decisions and outcomes were communicated.

4.10 Illegal-content notices

A person may submit a notice concerning allegedly illegal content without having an Aidolverse account.

Depending on the notice, we may collect:

• notifier name;
• notifier email address;
• content identifier;
• content location or URL;
• explanation of alleged illegality;
• good-faith declaration;
• notice status;
• date received;
• date receipt was acknowledged;
• date the case was closed;
• outcome; and
• date the outcome was communicated.

Because the explanation may be entered as free text, it may contain additional personal data voluntarily included by the notifier.

The system records receipt confirmation, closure and communication of the outcome as separate events.

4.11 Support and legal communications

If you contact Aidolverse, we may process:

• your name;
• email address;
• account information;
• content of your message;
• attachments;
• information necessary to investigate your request; and
• our response and related correspondence.

4.12 Email-delivery diagnostic data

For operational, security and delivery-diagnostic purposes, Aidolverse maintains limited records concerning transactional emails.

These logs may contain:

• recipient email address;
• type of message;
• delivery result; and
• technical references.

These diagnostic records do not contain the body of the email and are automatically retained for 30 days.

4.13 Technical and security data

When you use the Service, technical systems may process information such as:

• IP address;
• browser and device information;
• session identifiers;
• authentication events;
• request timestamps;
• security events;
• error information;
• abuse-prevention information; and
• server and application logs.

We process only the technical information reasonably necessary to operate, secure and troubleshoot the Service.

5. Where we obtain personal data

We obtain personal data:

• directly from you;
• from your activity on Aidolverse;
• from Creators where they provide information concerning an Aidol;
• from people submitting reports or legal notices;
• from payment providers;
• from supported authentication providers;
• from technical service providers;
• from automated moderation systems; and
• where lawful, from authorities or other parties involved in legal or rights-related matters.

6. Why we process personal data and our legal bases

Where the GDPR applies, Aidolverse relies on one or more of the following legal bases.

6.1 Performance of a contract — Article 6(1)(b) GDPR

We process personal data where necessary to enter into or perform our contract with you, including to:

• create and maintain your account;
• authenticate you;
• provide Aidolverse functionality;
• provide subscriptions;
• process subscription changes;
• administer Creator accounts;
• calculate Creator Shares;
• provide paid functionality;
• process cancellations and withdrawal requests;
• provide support; and
• enforce access rights associated with subscriptions.

6.2 Compliance with legal obligations — Article 6(1)(c) GDPR

We process data where necessary to comply with legal obligations, including obligations relating to:

• accounting;
• taxation;
• consumer protection;
• regulatory requests;
• illegal-content notices;
• platform transparency;
• copyright procedures;
• litigation;
• fraud prevention where legally mandated; and
• preservation or disclosure required by law.

6.3 Legitimate interests — Article 6(1)(f) GDPR

We may process personal data where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and freedoms.

These interests may include:

• operating and securing Aidolverse;
• preventing fraud and abuse;
• detecting violations of our rules;
• protecting users and Creators;
• moderating content;
• defending legal claims;
• maintaining evidence of transactions and disputes;
• diagnosing email delivery;
• protecting intellectual-property and personality rights;
• improving operational reliability; and
• preventing circumvention of age, access or security controls.

6.4 Consent — Article 6(1)(a) GDPR

Where we specifically ask for consent as the legal basis for processing, you may withdraw that consent at any time.

In particular, promotional use of eligible public Creator Content is disabled by default. Where such promotional use involves processing personal data and you voluntarily enable it, Aidolverse relies on your affirmative choice for future promotional processing.

Withdrawal does not affect processing lawfully carried out before withdrawal.

6.5 Legal claims

Where processing is necessary to establish, exercise or defend legal claims, we may retain and use relevant information for that purpose and may place the affected records under a legal hold.

7. Age information

Aidolverse uses the date of birth you provide to determine whether you meet age requirements for different features.

Age is initially based on your declaration.

Users under 16 may not create an account.

Users aged 16 or 17 may use eligible non-sensitive portions of the Service but may not purchase subscriptions, become Creators, monetize Aidols, receive Creator payments or access Sensitive Content.

Where additional verification is required for payment services, the payment provider may independently conduct identity and eligibility checks.

Aidolverse does not describe the self-declared date of birth as documentary age verification.

8. Sensitive Content preference

Eligible users aged 18 or over may choose whether to enable access to content classified by Aidolverse as Sensitive.

Sensitive Content access is disabled unless the user affirmatively enables it.

Aidolverse uses age and preference information to determine which content may be retrieved and displayed to the user.

Users under 18 cannot enable Sensitive Content.

9. Automated moderation

Aidolverse uses automated systems to assess certain text, images and video frames for potential violations of platform rules.

These systems may assist in:

• blocking publication;
• classifying content as Sensitive;
• restricting content; or
• identifying material for further review.

Automated systems may generate moderation scores and decision information that is retained as part of the moderation record.

Where a moderation decision is eligible for appeal, a user may request human review through:

appeals@aidolverse.com

Aidolverse does not claim that automated systems can identify every violation. In particular, some categories such as unauthorized face swaps or voice cloning may require reports or subsequent human assessment. The current system performs automated analysis of text, images and video frames, while some identity-related violations remain reactive.

10. Public information

Certain information you choose to publish may be visible to other users or publicly accessible, depending on the relevant feature and privacy settings.

This may include:

• profile information;
• Aidol information;
• Aidol images;
• public posts;
• comments;
• Creator information; and
• links to permitted external services.

If you make information public, it may be viewed, copied or otherwise processed by people outside Aidolverse.

Creators should avoid publishing personal data that they do not intend to make public.

11. Creator real name

Where the Service allows a Creator’s real name to be displayed in connection with an Aidol, the relevant visibility setting controls whether that name is shown publicly.

Aidolverse processes the underlying account identity independently of whether the public display option is enabled.

12. Payments and Stripe

Aidolverse uses Stripe for payment processing and Stripe Connect Express for Creator payment accounts.

Stripe may act as an independent controller or processor depending on the particular processing activity and applicable relationship.

Stripe may independently collect or process:

• payment-card information;
• banking information;
• identity documents;
• business information;
• tax information;
• fraud-prevention information; and
• verification data.

Aidolverse receives the payment and account-status information necessary to administer subscriptions, transactions, refunds, disputes and Creator transfers.

Creator onboarding, identity verification and collection of payment-account compliance information are performed by the payment provider rather than by Aidolverse itself.

13. Authentication providers

Where you choose to sign in through a supported third-party authentication service, that provider may send Aidolverse information necessary to authenticate you, such as an account identifier, email address and basic profile information made available through the login process.

The provider separately processes information under its own privacy terms.

If the authentication provider does not supply information Aidolverse requires, such as your date of birth, Aidolverse may ask you to provide it directly before using the Service.

14. Service providers and recipients

We may disclose personal data where reasonably necessary to categories of recipients including:

• payment processors and payment-account providers;
• hosting and infrastructure providers;
• database and storage providers;
• email-delivery providers;
• authentication providers;
• security and fraud-prevention providers;
• technical contractors acting on our instructions;
• accountants, legal advisers and professional advisers;
• courts, law-enforcement bodies and competent authorities where legally required; and
• parties involved in a corporate transaction such as a merger, acquisition or sale of relevant assets.

We do not authorize service providers to use personal data for unrelated purposes where they act as processors on our behalf.

15. We do not sell personal data

Aidolverse does not sell personal data to advertisers.

Aidolverse does not permit third-party advertisers to access private user conversations or private account information merely because advertising or promotional activity exists elsewhere.

If Aidolverse introduces materially different advertising or data-sharing practices in the future, this Privacy Policy will be updated as required before those practices begin.

16. International processing

Aidolverse LLC is established in the United States, and personal data may therefore be processed in the United States as part of providing the Service.

Some service providers may also process information in other countries.

Where the GDPR or another applicable law requires safeguards for an international transfer of personal data, Aidolverse will use an available lawful transfer mechanism as appropriate, which may include:

• an adequacy decision;
• the European Commission’s Standard Contractual Clauses;
• another legally recognized transfer mechanism; or
• a specific statutory derogation where lawfully applicable.

Where appropriate, Aidolverse will also assess supplementary technical or organizational safeguards.

17. Data security

Aidolverse uses technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, destruction, alteration or disclosure.

Measures may include, depending on the system involved:

• access controls;
• authentication;
• server-side authorization checks;
• separation of data by function;
• restricted administrative access;
• audit and operational records;
• secure communications;
• automated retention routines;
• monitoring;
• backup procedures; and
• security controls provided by infrastructure and payment providers.

No online system can be guaranteed to be completely secure.

18. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the relevant purpose, subject to the specific periods below and any applicable legal hold.

18.1 Active account data

Ordinary account and profile information is retained while your Aidolverse account remains active and is deleted through the account-deletion process when no separate lawful retention requirement applies.

18.2 Contractual and transaction evidence

Evidence relating to contracts, purchase consents and related contractual records may be retained for:

the duration of the relevant contract plus 10 years following its definitive termination.

Where the termination date required to start the retention period is unexpectedly unavailable, the record is placed in a monitored retention-exception process rather than silently assigned an artificial expiry date. The final implementation explicitly removed the previous fallback and places such records into a monitored exception queue.

Accounting, tax or transaction records may be retained for any period independently required by applicable financial or tax law.

18.3 Moderation decisions

Moderation decision records are retained for:

• 12 months from the decision, for ordinary moderation decisions;
• 12 months from reversal, where a decision is reversed; or
• 24 months from closure, where the decision arose from an illegal-content notice.

These periods are implemented through automated retention routines.

18.4 Appeals

Appeal records follow the applicable moderation retention framework.

If an account is deleted before that period ends, moderation and appeal identifiers are replaced with a pseudonymous value designed to preserve the ability to associate related moderation records without retaining the ordinary account identifier.

The final implementation intentionally treats moderation evidence differently from contractual evidence.

18.5 Removed posts and comments

Where Aidolverse retains a removed post or a comment that existed before moderation, the content and associated files are normally deleted 90 days after removal.

If an appeal is pending, the retention clock is suspended.

Once the appeal is decided, a new 90-day period begins.

A legal hold may suspend deletion where necessary.

The 90-day rule applies to both removed posts and qualifying removed comments.

18.6 Illegal-content notices

Illegal-content notices are retained:

• in identifiable form for 6 months from closure of the case;
• after six months, in a structured de-identified form for up to 24 months from closure; and
• deleted after the applicable final retention period.

At the six-month point, Aidolverse removes:

• the notifier’s name;
• notifier email;
• account linkage, if any; and
• the notifier’s original free-text explanation.

The remaining structured case information does not retain the original free-text description.

18.7 Email-delivery diagnostic logs

Email-delivery diagnostic logs are automatically deleted after 30 days.

They contain delivery information but not the body of the relevant message.

18.8 Legal holds

Where information is reasonably necessary for actual or anticipated litigation, an investigation, a legal claim or another legally justified preservation requirement, Aidolverse may temporarily suspend its ordinary deletion schedule.

A legal hold must be associated with a reason and is removed when the preservation need ends.

The system monitors records retained under legal hold rather than treating legal hold as permanent retention.

19. Account deletion

You may request deletion of your Aidolverse account through the functionality provided by the Service.

Deletion removes ordinary account data and related content where no continuing lawful purpose requires retention.

The deletion process may remove information using both the account identifier and, where necessary, the email address so that records which are not directly linked to the account table are also identified for deletion. The original privacy design expressly requires deletion through both references where applicable.

Some records are treated differently because they must survive ordinary account deletion for a defined period.

These include, where applicable:

• transaction records;
• contractual evidence;
• withdrawal evidence;
• moderation records;
• appeal records;
• illegal-content notices; and
• records subject to legal hold.

Retention after account deletion does not mean that the account remains active.

20. Pseudonymization after deletion

Aidolverse does not apply a single rule to every retained record.

For moderation and appeal records, the ordinary user identifier is replaced with a pseudonymous derived value that preserves the ability to recognize that multiple decisions concerned the same former account without retaining the normal account identity.

For contractual evidence, the identifying reference is retained for the applicable evidence period because the purpose of that record is to establish who accepted the relevant contract or declaration.

This distinction is deliberate and implemented in the product.

21. Creator account deletion and connected payment accounts

Deletion of an Aidolverse Creator account is distinct from closure of a Creator’s connected payment account with the payment provider.

A non-zero balance at the payment provider will not cause Aidolverse to retain the Creator’s ordinary account data indefinitely solely because the external payment account cannot yet be closed.

Where necessary after deletion, Aidolverse may retain a minimal operational record consisting of the connected-account identifier and information needed to complete the closure process, without retaining the ordinary user profile solely for that purpose.

22. Your GDPR rights

Where the GDPR applies, and subject to the conditions and exceptions provided by law, you may have the right to:

• access your personal data;
• obtain rectification of inaccurate personal data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain data in a portable format;
• withdraw consent at any time where processing is based on consent;
• object to certain direct marketing; and
• lodge a complaint with a competent data-protection supervisory authority.

These rights are not absolute. For example, Aidolverse may lawfully retain particular records despite an erasure request where retention remains necessary to comply with a legal obligation, establish or defend legal claims or preserve contract or transaction evidence.

23. Exercising your rights

To exercise a privacy right or ask a question about this Policy, contact:

legal@aidolverse.com

We may need to verify your identity before responding to a request, particularly where disclosure or deletion of account information is involved.

We will respond within the timeframe required by applicable law.

Requests are normally free of charge, although applicable law may permit us to refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive.

24. Right to object

Where processing is based on our legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation.

We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

25. Withdrawal of consent

Where Aidolverse relies on your consent, you may withdraw it at any time.

For example, if you have voluntarily enabled the optional Promotional Licence, you may disable it through the relevant account setting.

Withdrawal applies prospectively and does not make prior lawful processing unlawful.

Where promotional material has already been lawfully published or distributed before withdrawal, the separate contractual rules governing previously completed promotional uses may also apply.

26. Complaints to a supervisory authority

If the GDPR applies to you, you have the right to lodge a complaint with a competent data-protection supervisory authority, including the authority in the EU or EEA Member State of your habitual residence, place of work or place of the alleged infringement, where the GDPR provides for that jurisdiction.

We encourage you to contact legal@aidolverse.com first if you believe we can resolve the issue directly, but doing so is not a condition for exercising your right to complain to an authority.

27. Children and younger users

Aidolverse is not intended for children under 16.

We do not knowingly permit a person under 16 to maintain an Aidolverse account.

Users aged 16 or 17 are subject to additional restrictions designed to prevent access to:

• paid purchases;
• Creator activity;
• monetization; and
• Sensitive Content.

If we reasonably determine that an account was created in violation of the minimum-age requirement, we may restrict or delete it as appropriate.

28. Personal data relating to third parties

Do not provide personal data concerning another individual unless you have a lawful basis or other valid authorization to do so.

This is particularly important where Creator Content uses:

• a real person’s face;
• likeness;
• voice;
• identity;
• personal information; or
• other protected attributes.

Creators remain responsible for the documented permissions required under the Creator Agreement and applicable law.

29. Illegal-content notices submitted by non-users

You do not need an Aidolverse account to submit an illegal-content notice.

This means Aidolverse may process personal data concerning a notifier who has no other relationship with Aidolverse.

The information is used to:

• receive and assess the notice;
• communicate acknowledgement and outcome;
• comply with platform-law obligations;
• maintain evidence of handling; and
• protect against legal or regulatory claims.

The notifier’s identifying information and free-text explanation are removed after the identifiable retention phase described above.

30. Copyright and legal notices

Where you submit a copyright, DMCA or other legal notice, Aidolverse may process the information contained in that notice to:

• identify the complainant;
• investigate the claim;
• identify affected content;
• contact relevant parties;
• comply with applicable law;
• prevent fraud or misuse of the notice system; and
• establish, exercise or defend legal claims.

Copyright notices may also be processed by or communicated to Aidolverse’s designated DMCA agent.

31. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• changes to the Service;
• new processing activities;
• changes in law;
• changes in service providers;
• security developments; or
• changes to our business operations.

The version number and effective date will be displayed at the top of the Policy.

Where required by applicable law, we will provide appropriate notice before a material change takes effect.

A change to this Privacy Policy does not itself create a new consent where consent is legally required for a particular processing activity.

32. Contact

For privacy questions, data-protection requests and legal communications:

Aidolverse LLC
30 N Gould St, STE R
Sheridan, WY 82801
United States

Email: legal@aidolverse.com

For ordinary customer support:

support@aidolverse.com

For appeals concerning moderation decisions:

appeals@aidolverse.com