Privacy Policy

Depending on how you use Fiara, Fiara and its service providers may collect or otherwise process the following categories of personal data.

2.1 Account and profile data
email address and authentication information;
display name, username and language;
country, region, time zone and preferred currency;
account creation, login and security events;
Fiara Credit balance, purchase history and feature settings;
if you sign in with Google or X: your account identifier from that provider, your email address (if provided), your name or username and your profile picture;
optional profile information and preferences.

2.2 Age and identity-assurance data
Every user must complete age assurance through Incode before accessing any content. Digital Twin creators and Creators must also complete identity verification. During verification you provide to Incode a facial image or selfie and liveness information and, where age estimation is inconclusive or full verification is required, a government-issued identity document. This data is submitted directly to Incode, which acts as our processor. Fiara does not receive or store your identity document or the images submitted to Incode. Fiara receives only the result (pass or fail), the method used, the date and time, and a provider reference.

2.3 Content and interaction data
prompts, messages and conversations with AI Companions;
generated text, images, audio, video and related metadata;
character settings, preferences and saved scenarios;
uploads, references and instructions supplied to create or modify content;
reports, appeals and moderation history;
information indicating whether content was generated, displayed, downloaded, shared, removed or blocked.

2.4 Digital Twin data
Where an individual uses the Digital Twin feature, Fiara and its service providers may process: photographs, facial images, videos and voice recordings are personal data. Where they are processed with technical means that allow or confirm the unique identification of a person, they are biometric data, a special category of personal data. Fiara processes biometric data in two ways: (a) Face comparison. Each photo you upload for your Digital Twin is compared with the selfie you submitted to Incode, using Amazon Rekognition. We keep the result of the comparison; the face data created for the comparison is deleted immediately afterwards. (b) Digital Twin model. Fiara and its providers create a user-specific model, embedding or profile from your materials in order to generate your Digital Twin. Both are done only with your explicit consent (Section 3.13). Identity and age verification by Incode is described in Section 2.2.

2.5 Payment and transaction data

Payment providers may process full payment credentials. Fiara may receive:

customer and billing identifiers;
payment method type, card brand and last four digits;
billing country and currency;
amount, date, status and transaction reference;
Fiara Credit package, delivery, refund and payment-dispute status;
bank or alternative-payment details where applicable;
card-statement descriptor and chargeback information;
fraud, authentication and issuer-response signals.

Fiara does not receive or store complete card numbers or card security codes.

2.6 Device, network and usage data
IP address, device and browser type, operating system and language;
cookie and consent identifiers;
pages, features, clicks and session activity;
referral, campaign and affiliate identifiers;
diagnostic, performance, crash and security logs;
approximate location inferred from the IP address.

2.7 Communications and support data
messages sent to Fiara’s support, legal, privacy, complaints or copyright teams;
attachments and evidence supplied with a request;
email, communication and case history;
survey responses and feedback.

2.8 Affiliate data

Where an individual or organisation participates in Fiara’s affiliate programme, Fiara may process:

contact, company and tax details;
referral links, traffic sources and campaign information;
conversion, commission, invoice and payout information;
fraud, compliance and quality-review records.

2.9 Creator Program data If you join the Creator Program: your identity-verification result, payout and tax details, the content you publish and its performance (views, purchases, earnings), and review and moderation records. Content you publish, together with your display name, is visible to other age-verified adult users of the Service.

We use personal data for the following purposes.

3.1 To create and manage accounts
We use account, authentication and security data to register users, maintain sessions, secure accounts and provide settings. Legal basis: performance of a contract and legitimate interests in operating a secure service.

3.2 To provide AI Companion and content-generation features
We process prompts, settings, Content and technical data to generate requested responses and media, preserve conversation context, deliver saved features and troubleshoot failures. Legal basis: performance of a contract and, where applicable, consent for optional processing.

3.3 To create and operate Digital Twins
We process source material, consent records, identity and age signals, generation settings and output metadata to create, restrict, maintain or remove a Digital Twin. Legal basis: performance of a contract with the creator, consent where required, legitimate interests in preventing impersonation and abuse, and compliance with legal obligations.

3.4 To protect adults and prevent access by minors
We use age-assurance results, account behaviour, device and payment signals to assess eligibility, detect evasion and investigate reports of underage access. Legal basis: legal obligations, performance of a contract and substantial legitimate interests in child protection and platform safety.

3.5 To moderate content and enforce policies
Automated systems may assess uploads, prompts, generated outputs, account activity and reports against our policies. Flagged cases may be reviewed by authorised personnel or service providers. We may block requests, remove content, disable Digital Twins, restrict features, suspend accounts, prevent re-registration or report suspected illegal content. Legal basis: legal obligations, performance of a contract and legitimate interests in safety, rights protection, fraud prevention and policy enforcement.

3.6 To process payments and Fiara Credit purchases
We use billing and transaction data to complete one-time purchases, deliver Fiara Credits, provide receipts, reconcile payments, prevent fraud, respond to disputes and issue refunds. Legal basis: performance of a contract, legal obligations and legitimate interests in payment security.

3.7 To provide support and handle complaints
We use contact, account, Content, transaction and evidence data to answer requests, investigate complaints, process appeals, verify removal claims and protect legal rights. Legal basis: performance of a contract, legal obligations and legitimate interests in resolving disputes.

3.8 To maintain, debug and secure the Service
We use technical logs, account events and limited Content samples where necessary to detect errors, abuse, attacks, outages and model failures. Legal basis: legitimate interests in security, reliability and product integrity.

3.9 To analyse and improve the Service
We may use aggregated, de-identified or appropriately minimised data to measure performance, understand feature use and improve safety and quality.

3.10 AI MODEL TRAINING AND DIGITAL TWIN CREATION

Fiara does not use private conversations, Digital Twin source materials or private generated Content to train general-purpose or shared AI models.

Fiara operates models used to generate fictional AI Companions that do not represent real individuals. Users’ private Digital Twin data is not used to train or improve those models.

Where a user chooses to create a Digital Twin, the photographs, videos, audio, voice recordings, prompts and other materials provided by the user may be processed to create, configure, train or fine-tune a user-specific model, embedding or profile solely for the purpose of creating and operating that user’s Digital Twin.

The resulting Digital Twin model, embedding or profile is associated with that user and is not used to train models made available to other users. The user must have all rights, permissions and lawful bases necessary to provide and authorise the processing of the relevant materials.

Fiara may use aggregated, de-identified or appropriately minimised data to measure performance, understand feature use and improve the safety, reliability and quality of the Service. Fiara may also process limited technical logs, moderation signals and user feedback for those purposes.

Fiara will not use private user Content for broader or general model training unless the user has provided separate, specific and informed consent through a clear opt-in mechanism. Any such consent may be withdrawn in accordance with the Privacy Policy.

3.11 To communicate with users
We send essential emails about security, purchases, billing, cancellation, policy enforcement and service changes. We send marketing only where permitted and provide an unsubscribe mechanism. Legal basis: performance of a contract, legitimate interests for similar-service communications where permitted, or consent.

3.12 To comply with law and defend rights
We may preserve and disclose data to respond to lawful requests, regulatory duties, child-safety reporting, litigation, audits, tax obligations and the establishment or defence of claims. Legal basis: legal obligation and legitimate interests in protecting legal rights.

3.13 Sensitive data and explicit consent
Your conversations and content may reveal information about your sexual preferences and sex life, and Digital Twin processing involves biometric data. These are special categories of personal data. We process them only on the basis of your explicit consent, which we ask for separately when you register (sexual-life data) and when you create a Digital Twin (biometric data). You can withdraw consent at any time in Account > Settings > Privacy & Data. Withdrawal deletes the associated data (for sexual-life data, your chat history and memory) and may prevent you from using affected features. It does not affect processing carried out before withdrawal. We keep a record of your consent, including its version and date.

3.14 To run the Creator Program We use Creator data to verify Creators, review and publish content, calculate and pay earnings, and meet tax and anti-fraud obligations. Legal basis: performance of a contract, legal obligations and legitimate interests in preventing fraud. Content you publish is not used to train general-purpose or shared AI models.

Fiara uses automated tools to generate Content, identify suspected policy violations, detect fraud, estimate risk and support age or identity assurance. These tools may cause a prompt to be refused, Content to be blocked or an account to be referred for review.

Where a decision has a legal or similarly significant effect and applicable law grants a right to human intervention, you may request review through legal@fiara.ai. Fiara does not rely solely on automated decision-making in circumstances where doing so is prohibited.

We collect data:
- directly from you;
- from you, including the materials you upload to create your Digital Twin;
- automatically from devices and use of the Service;
- from payment, age-assurance, identity-verification and fraud-prevention providers;
- from authentication, analytics, advertising and affiliate providers;
- from reports submitted by users, rights holders or affected persons;
- from Google or X, if you choose to sign in with your Google or X account;
- from public sources where necessary to evaluate impersonation, rights or safety complaints.

We may share data with:
- cloud hosting, storage, security and content-delivery providers;
- AI model, generation and inference providers;
- content moderation and Trust & Safety providers;
- age-estimation, age-verification, identity and liveness providers;
- payment processors, payment orchestrators, banks and fraud services;
- email, customer-support and communications providers;
- analytics, consent-management and advertising providers, subject to cookie choices;
- affiliate tracking and payout providers and Creator payout providers;
- professional advisers, auditors and insurers;
- law-enforcement, courts, regulators and child-protection bodies where required or appropriate;
- buyers, investors or successors in a corporate transaction, subject to appropriate safeguards.

SERVICE PROVIDERS
Amazon Web Services: hosting, email (Amazon SES), face comparison (Amazon Rekognition). Region: eu-west-3 (Paris)
Incode (United States): age assurance and identity verification
oh.xyz
Unlimit: payment processing; also an independent controller for its payment-compliance purposes
Google (United States): sign-in with your Google account, if you choose it; analytics and tag management, only with your consent
X (United States): sign-in with your X account, if you choose it

Service providers may process data only under contract and for authorised purposes. Some third parties, such as payment providers, may act as independent controllers for their own legal and compliance purposes.

Personal data may be processed outside your country. For transfers from the EEA, United Kingdom or Switzerland to countries without an adequacy decision, we will use an approved mechanism such as Standard Contractual Clauses, the UK Addendum, an applicable certification framework or another lawful safeguard, together with supplementary measures where appropriate.
Data is primarily hosted on Amazon Web Services (AWS) infrastructure in the eu-west-3 region (Paris, France), within the European Economic Area (EEA). Our transactional email service (Amazon SES) also operates within eu-west-3, so no international data transfer occurs for these core hosting and email functions.
For identity verification, we use Incode, a U.S.-based provider. Transfers of personal data to Incode are safeguarded through Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary measures, including encryption in transit and at rest and data minimisation (Fiara receives only the verification result).

We retain data only for as long as needed for the purposes described, taking account of account status, safety, disputes, tax and legal requirements.

- account and profile data: 30 days after deletion request (recovery window), then deleted;
- private conversations and generated Content: user-controlled; deleted on account deletion (30 days);
- Digital Twin source files: retained for 90 days after the model/embedding is created, to allow regeneration if technically required, then permanently deleted. Deleted immediately on valid withdrawal of consent;
- Digital Twin consent and verification evidence: retained for the duration the Digital Twin is active, and for 6 years after deletion or withdrawal of consent, to evidence lawful basis in the event of a dispute or regulatory inquiry;
- age and identity-verification metadata: duration of the account + 12 months;
- security and access logs: 12 months;
- moderation and appeal records: 24 months; records relating to suspected illegal content retained as required by law;
- support and complaints: 24 months;
- payment and accounting records: 6 years from the end of the relevant tax year, in accordance with Cyprus tax and companies law;
- marketing preferences: until you withdraw consent; a minimal suppression record (email address and opt-out date) is kept so that the opt-out is honoured;
- affiliate and tax records: same as payment and accounting records;
- face data created for the Digital Twin face comparison: deleted immediately after the comparison;
- Digital Twin model, embedding and profile: while the Digital Twin is active; deleted on deletion of the Digital Twin or withdrawal of consent;
- sign-in identifiers from Google or X: while your account exists, deleted with it; for accounts closed for a serious violation, a minimal suppression record is kept for 24 months to prevent re-registration;
- Creator payout and tax records: same as payment and accounting records.

When data is no longer required, we delete, anonymise or securely isolate it. Deletion of an account does not require deletion of data that must be retained for law, fraud prevention, child safety, disputes, chargebacks, accounting or the defence of claims.

You can delete your account online via Account > Settings > Privacy & Data > Delete account, or by emailing legal@fiara.ai. Account deletion does not automatically refund a completed purchase and may permanently remove unused Fiara Credits.

A represented person may request restriction or removal of a Digital Twin or related output under the Content Removal & Likeness Policy. We may need to verify the requester’s identity and preserve a limited suppression record to prevent the same likeness from being re-uploaded.

Identity and age verification, including any biometric matching performed within Incode's platform, is carried out by Incode. Fiara's own biometric processing is limited to the face comparison and Digital Twin model described in Section 2.4. When a Digital Twin is deleted, its model, embedding and profile are deleted with it.

We use cookies and similar technologies as described in the Cookies Notice. Non-essential analytics or advertising technologies are used only according to applicable consent requirements. Preferences can be changed through https://fiara.ai/cookies .

We use organisational and technical measures intended to protect personal data, including access controls, encryption in transit, secrets management, monitoring, logging, role separation, provider due diligence and incident-response procedures. No method of storage or transmission is completely secure.

If a personal-data breach creates a risk requiring notification, we will notify the competent authority and affected individuals as required by law.

Depending on location, you may have rights to:
- receive information about processing;
- access personal data;
- correct inaccurate data;
- request deletion;
- restrict processing;
- object to processing based on legitimate interests;
- withdraw consent without affecting earlier lawful processing;
- receive portable data;
- request human review of certain automated decisions;
- opt out of direct marketing;
- complain to a data-protection authority.

Submit requests to legal@fiara.ai. We may verify identity and authority before acting.
We respond within one month of receipt. For complex requests this may be extended by up to two further months, in which case we will tell you why.

Fiara is not directed to minors and does not knowingly permit anyone under 18 or below the local age of majority to use the Service. If we learn that an underage person has accessed Fiara, we may block the account, delete data where appropriate, preserve evidence and make reports required by law. Contact legal@fiara.ai if you believe a minor has accessed the Service.

External websites and services have their own privacy practices. We are not responsible for their processing and recommend reviewing their notices.

We may update this Policy to reflect legal, technical or operational changes. The revision date will be updated, and material changes will be communicated where required.

United Kingdom. You may complain to the Information Commissioner's Office (ico.org.uk). Transfers from the UK use the UK Addendum to the Standard Contractual Clauses or another lawful safeguard.

Australia. We handle personal information in line with the Privacy Act 1988 and the Australian Privacy Principles. Your information may be disclosed to providers in the European Economic Area and the United States listed in Section 6. You may ask to access or correct your information at legal@fiara.ai. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Chile. Under Ley N° 19.628, as amended by Ley N° 21.719 (in force from 1 December 2026), you have the rights of acceso, rectificación, supresión, oposición, portabilidad and bloqueo temporal. Submit requests to legal@fiara.ai. You may complain to the Agencia de Protección de Datos Personales.

If you choose to sign in to Fiara with your Google account, Fiara accesses the following Google user data through Google Sign-In, and only with your permission on Google's consent screen: your email address, your name and your profile picture. We do not request access to your Gmail, Google Drive, Calendar, Contacts or any other Google service.

How we use it. We use this data only to create and secure your Fiara account, to sign you in, to send you essential messages about your account and purchases, and to recognise you when you return.

How we share it. We do not sell Google user data and do not use it for advertising. We do not transfer it to third parties, except to service providers that process it for us under contract to run the Service (such as hosting and email, listed in Section 6), where the law requires it, or in a corporate transaction.

Limited Use. Fiara's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models.

How we protect it. We protect Google user data with encryption in transit, access controls and monitoring, as described in Section 11.

Retention and deletion. We keep Google user data for as long as your account exists and delete it when your account is deleted (see Section 8). You can delete your account in Account > Settings > Privacy & Data > Delete account, or by emailing legal@fiara.ai. You can also withdraw Fiara's access at any time at myaccount.google.com/permissions; this does not delete your Fiara account.

If you choose to sign in to Fiara with your X account, Fiara receives from X, with your permission on X's authorisation screen: your X user ID, username, display name, profile picture and, if you allow it and X has one for you, your email address. Fiara does not read, store or use your posts, messages, followers or other X content, and does not post on your behalf.

How we use it. We use this data only to create and secure your Fiara account, to sign you in, to send you essential messages about your account and purchases, and to recognise you when you return.

How we share it. We do not sell this data and do not use it for advertising. We do not transfer it to third parties, except to service providers that process it for us under contract to run the Service (listed in Section 6), where the law requires it, or in a corporate transaction.

Protection, retention and deletion. We protect it as described in Section 11 and keep it as described in Section 8. You can delete your account in Account > Settings > Privacy & Data > Delete account, or by emailing legal@fiara.ai. You can also withdraw Fiara's access at any time in X under Settings > Security and account access > Apps and sessions > Connected apps; this does not delete your Fiara account.

Controller: Catalyx Partners Cyprus LTD
Registered address: Agapinoros & Makariou III, 1076 Nicosia, Cyprus
Privacy email: legal@fiara.ai

You may also lodge a complaint with the data-protection authority in your country. We welcome the opportunity to address concerns directly, but contacting us is not a prerequisite to exercising regulatory rights.