Legal
Last updated: 1 September 2026
Flirtly is operated by Kindled AI Inc. That company is the data controller for the purposes of the UK and EU GDPR, and the business for the purposes of United States state privacy law. Its registered office is 30 N Gould St, Ste R, Sheridan, WY 82801, United States.
This is an 18+ service. We do not knowingly process the personal data of anyone under 18. Privacy questions and data-rights requests go to privacy@flirtly.co.
Flirtly is designed so that we hold as little real identity as possible:
Using Flirtly reveals data about your sex life and sexual orientation, which is a special category of personal data under the GDPR and sensitive personal information under United States state law. We process it on the basis of your explicit consent, which we ask for at signup as a separate, unticked choice — separate from accepting the Terms, because it is a separate legal act and bundling the two would make neither of them valid.
If you start anonymously, we ask for the same consent before your first message, for the same reason.
You may withdraw that consent at any time, from account settings or by emailing privacy@flirtly.co. Withdrawal does not affect processing already carried out, and because this consent is the basis on which the service can function at all, withdrawing it means closing your account. We will tell you that before you do it, not after.
We set four cookies. Three are strictly necessary — your sign-in session, your age attestation, and the record of your cookie choice — and they are set without asking, because the service cannot work without them and the law does not require consent for them.
One is not necessary: the partner attribution cookie, which records that you arrived through an affiliate link. It is not set unless you agree, and if your browser sends a Global Privacy Control signal we treat that as a refusal and do not set it regardless of any earlier choice. There is no advertising cookie, no analytics vendor, and no third-party cookie of any kind on this service. Full detail, including lifetimes and how to change your mind, is in the Cookie Policy.
We use the following processors. Each receives only what it needs to do its job, under contract, and none of them is permitted to use your data for its own purposes.
| Processor | What it does | Where |
|---|---|---|
| Alibaba Cloud (DashScope) | Generates chat replies, images, video and synthesised speech, and transcribes voice recordings. Two separate accounts are used so that non-explicit and explicit workloads never share credentials. | Singapore |
| Inworld | Designs and synthesises a voice when a companion is created. | United States |
| Cloudflare | Hosting, database, media storage, caching and bot protection. Effectively all of our infrastructure. | Global edge, United States |
| Resend or Mailgun | Sends your one-time sign-in codes and account email. Which one is in use depends on configuration. | United States |
| Payment processor | Will handle payments and hold payment identity when paid plans open. None is connected today. | To be named before launch |
| Age-verification vendor | Verifies age where the law requires it, and returns a yes-or-no result. We never receive the documents. | To be named before launch |
We also disclose data to professional advisers where necessary, to an acquirer in the event of a merger or sale of assets, and to authorities where the law requires — including reports to the National Center for Missing & Exploited Children of apparent child sexual abuse material. See Law Enforcement Guidelines for what we require before disclosing anything.
We do not sell personal data. Ever. In the language of United States state privacy law: we do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months.
We are a United States company and our processors sit in the United States and Singapore, so if you are in the UK or the EEA your data is transferred outside it. Those transfers are made under the European Commission’s Standard Contractual Clauses, with the UK Addendum where the UK GDPR applies, together with the technical measures described in section 13 — principally that content is encrypted at rest with per-user keys. You may request a copy of the safeguards from privacy@flirtly.co.
Safety classification is automated, and it makes decisions that affect you: a request can be refused, an asset can be withheld from you, and an account can be restricted, suspended or terminated. The logic is a set of classifiers run over your prompt before generation and over the result before it is served; where a classifier errors, times out or is uncertain, it refuses. It is deliberately built to fail closed, so it will sometimes refuse something harmless.
You have the right to a human review of any decision that significantly affects you. Appeal through the report form or report@flirtly.co: one appeal per decision, decided within 10 business days, with a written reason. The one exception is minor-safety removal, which is never reinstated — the account suspension may be appealed, the content does not come back.
Backups roll off on a fixed schedule of about 35 days. Backups cannot be surgically edited, so deletion of your data is complete when the last backup containing it expires; a restored backup re-applies deletions before returning to service. We state this plainly rather than pretending deletion is instantaneous.
When the safety system refuses content that appears to involve minors, or a report concerns such content, we preserve the prompt, verdicts, hashes and related account references in a segregated, encrypted store for the statutory preservation period — currently understood to be one year, extended as the law requires. These records are exempt from deletion requests, and they may be reported to NCMEC or to law enforcement as the law requires. This is a legal obligation and it survives account deletion.
The record that you accepted a particular version of the Terms, and gave or refused the consent in section 4, is the evidence that this agreement exists. If we deleted it with everything else, neither of us could later show what was agreed. So when you delete your account we keep the acceptance record and sever it from your identity: the account reference is unlinked, leaving the document, the version, the timestamp and the method with nothing pointing back at you. The same applies to a request to opt out of the arbitration agreement. This is the treatment we already give partner commission records, and it is disclosed here rather than done quietly.
We do not use your chats, your characters or your generated media to train, fine-tune or evaluate machine-learning models. We do not sell, license or otherwise supply that content to third-party model providers for their own training. Your content is sent to a generation provider only to produce the response you asked for, at the moment you asked for it. If that ever changes, we will ask you for a new consent — not edit this page.
Note one consequence we would rather state than hide: our generation providers operate their own systems, and their handling of a request in transit is governed by their contracts with us, not by our word alone.
In transit, all connections use TLS 1.3. At rest, your messages and the memories drawn from them are encrypted with per-user keys, so a stolen database alone does not yield readable content. Generated images and video are not encrypted at rest: they are held in private object storage and served only to the account that made them. Neither is end-to-end encryption: the application must read content to moderate it and to generate responses, so a compromised application server could see plaintext. We say so plainly rather than overclaim.
If the UK or EU GDPR applies to you, you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. To exercise any of them, email privacy@flirtly.co. We answer within 30 days, and we do not charge.
You also have the right to lodge a complaint with your data protection supervisory authority — in the UK the Information Commissioner’s Office, and in the EEA the authority in the country where you live or work. You do not have to come to us first, though we would rather you did.
These rights do not extend to the child-safety records in section 10, and the acceptance records in section 11 are retained in unlinked form.
Representatives. GDPR Article 27 requires a controller outside the EU that offers services to people in the EU to appoint a representative there, and the UK GDPR requires the equivalent. We have not yet appointed either. We are saying so rather than printing a placeholder, and it is on the list of things that must close before paid plans open. Until then, address everything to privacy@flirtly.co, which is read.
If you live in California, Colorado, Connecticut, Delaware, Montana, Oregon, Texas, Utah, Virginia or another state with a comprehensive privacy law, you have the right to know what we collect and why, to access it, to correct it, to delete it, to obtain a portable copy, and to be free from discrimination for exercising any of them. Email privacy@flirtly.co, or have an authorised agent do it for you with proof of authorisation. We verify a request against your account email before acting on it.
In the twelve months before the date at the top of this page, we collected: identifiers (email address, account and session identifiers, IP address); commercial information (plan, credit balance and ledger); internet activity (device and user-agent information, in-product events); coarse geolocation derived from IP, at country and region level only; audio and visual information (voice recordings you submit for transcription, and the media generated for you); and sensitive personal information — the content of your conversations, which reveals sex life and sexual orientation.
California law gives you the right to limit the use and disclosure of sensitive personal information. We already limit it further than that right requires: we use it only to provide the service you asked for, to keep it safe, and to comply with the law — never to infer characteristics about you, never for advertising, and never for model training. There is no secondary use to opt out of. If you want it to stop entirely, withdraw the consent in section 4, which closes the account.
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no “Do Not Sell or Share” process to run. We nevertheless honour the Global Privacy Control signal: if your browser sends it, we treat it as a refusal of the partner attribution cookie, and it overrides any earlier consent you gave.
Delete your account in settings or by request. We hard-delete within 30 days across our stores, subject to the backup-expiry note in section 9, the child-safety carve-out in section 10 and the acceptance-record carve-out in section 11.
You can also export a machine-readable copy of your account data, chats, characters, credit ledger and acceptance history from settings, at any time, without asking us.
The service is for adults. We do not knowingly collect personal data from anyone under 18, and we do not direct any part of the service at children. If we learn that an account belongs to a minor we terminate it and delete the data, except where the child-safety carve-out in section 10 requires preservation. If you believe a minor is using the service, tell us at report@flirtly.co — no identity required. See Child Safety Standards.
If personal data is breached, we notify the relevant supervisory authority within 72 hours where the GDPR requires, notify affected users where the law requires or where the risk to them is real, and comply with United States state breach-notification law. Report a suspected vulnerability to abuse@flirtly.co; we will not pursue anyone who reports one in good faith and does not exploit it.
When our practices change, this page changes with a new “Last updated” date. Material changes are announced on the service, and where the change alters what you consented to we ask you again rather than assuming.
Privacy and data rights: privacy@flirtly.co. Reports and takedowns: report@flirtly.co or the report form. Legal notices: legal@flirtly.co. See Complaints & Contact.