Privacy Policy

Last Updated: September 4, 2026

Kissandra ("we", "us", or "our") operates kissandra.ai and the Kissandra platform (the "Services"). This Privacy Policy describes how we collect, use, share, and protect your personal information when you access or use our Services.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

This Privacy Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms of Service.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide when you:

• Register an account: email address, username, password, and any profile details (display name, avatar, bio, and preferences);
• Use the Services: prompts, messages, character descriptions, scenarios, locations, actions, gallery images, imported URLs or reference material, voice settings, and any other content you create or input (collectively "User Content"). User Content may include intimate or sexual roleplay that you choose to enter;
• Make a purchase: payments are processed by Stripe; we do not store payment information on our servers;
• Contact us: the content of your support requests, complaints, or other communications with us.

1.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect:

• Usage data: pages visited, features used, time spent on the platform, click patterns, search queries, and interaction data, collected as first-party operational analytics;
• Device and browser data: IP address, browser type and version, operating system, device type, screen resolution, and unique device identifiers;
• Approximate location: derived from your IP address (country or city level);
• Log data: server logs recording requests made to the Services, including timestamps, referring URLs, and system activity.

1.3 Information from Third Parties

If you choose to sign in using a third-party service (Google or Discord), we receive certain profile information from that service (such as your name and email address) as authorized by you. We use this information solely to create and manage your account. You can revoke this access at any time through the third-party platform's settings.

We do not use advertising networks, ad partners, or third-party analytics providers for user profiling.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing and Operating the Services

• Creating and managing your account;
• Processing transactions and managing subscriptions;
• Delivering AI-generated text, images, voice, and video based on your inputs;
• Personalizing your experience and content recommendations;
• Storing private chats and creations so you can continue them, and listing public characters or scenarios you choose to publish.

2.2 Safety, Security, and Moderation

• Enforcing our Terms of Service and content policies;
• Detecting, investigating, and preventing fraud, abuse, and security incidents;
• Reviewing content that is flagged, reported, or otherwise suspected of violating our Terms, including private chats when needed for safety;
• Protecting our rights, property, and safety, and those of our users and the public.

2.3 Improving Our Services

• Analyzing product performance and reliability to improve user experience;
• Evaluating model quality and response quality using operational and de-identified metrics;
• Generating aggregated, de-identified insights about platform usage.

We do not use User Content to train or fine-tune our own AI models. To generate the response or media you requested, we send only the prompts and context needed for that request to third-party inference providers (see Section 3). Where the routing control exists, we configure inference toward providers and endpoints that do not use prompts to train their models. If you select a model, or use your own OpenRouter API key, whose provider retains prompts or trains on them, that provider's terms apply to that request.

2.4 Communications

• Responding to your inquiries and providing customer support;
• Sending service-related notices, security alerts, and administrative messages;
• With your consent, sending promotional communications about new features or services (you may opt out at any time — see Section 7).

2.5 Legal and Regulatory Compliance

• Complying with applicable laws, regulations, legal processes, and governmental requests;
• Establishing, exercising, or defending legal claims.

3. How We Share Your Information

We do not sell your personal information. We do not share your personal information with advertisers or data brokers. We disclose data to the processors below so the Services can run, and in the other limited circumstances in this section.

3.1 Core Infrastructure and Processing Services

We use the following processors to operate the Services:

• Cloudflare: infrastructure, edge delivery, security, and speech-to-text (Workers AI);
• Supabase: database, authentication, and backend data services;
• Stripe: payment processing and billing operations;
• OpenRouter: routing chat requests to language model providers you select in real time on the Hangout chat page. If you supply your own OpenRouter API key, requests made with that key are also billed and governed under your OpenRouter account;
• ElevenLabs and xAI: text-to-speech for character voices;
• Salad and other image and video generation providers: creating images and video you request through the Services. Providers may be added or replaced over time;
• Google and Discord: account sign-in when you choose those login methods.

We do not maintain a fixed list of language model providers. You can select providers during chats, and available providers may be added or removed over time based on quality and testing. Content sent for model inference, voice synthesis, or image/video generation is limited to what is needed to generate the requested output.

3.2 Legal Requirements

We may disclose your information when we believe in good faith that disclosure is necessary to: (a) comply with applicable laws, regulations, legal processes, or governmental requests; (b) enforce our Terms of Service or other agreements; (c) protect our rights, property, or safety, or those of our users or others; or (d) detect, prevent, or address fraud, security, or technical issues.

3.3 Business Transfers

In connection with any merger, acquisition, reorganization, sale of assets, or similar corporate event, your information may be transferred to a successor operator. We will notify you of any such change and any choices you may have regarding your information.

3.4 With Your Consent

We may share your information for other purposes when you have given us your explicit consent to do so.

3.5 Public and Private Content

If you choose to make characters, scenarios, locations, actions, images, or other User Content publicly available on the platform, that content will be visible to other users and to the public, and other users may use those public listings in-product (for example in Hangout). Private chats and unpublished creations are stored so the product can work for you; they are not listed in the public catalog. Please consider carefully what you make public.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal grounds:

• Contract performance: processing necessary to provide our Services and fulfill our contractual obligations to you (e.g., account management, delivering content);
• Legitimate interests: processing necessary for our legitimate business interests, such as improving our Services, ensuring security, and preventing fraud, where these interests are not overridden by your rights;
• Legal obligation: processing necessary to comply with applicable laws and regulations;
• Consent: processing based on your explicit consent (e.g., marketing emails), which you may withdraw at any time.

Kissandra acts as the data controller (or equivalent responsible entity under applicable law) for personal data collected through the Services. Intimate or sexual roleplay you enter is processed to provide the Services you requested, not for advertising and not to train our own models.

5. Cookies and Tracking Technologies

We use strictly necessary cookies (including HttpOnly authentication and session cookies) so you can stay signed in and so the Services can function. We do not use advertising cookies, advertising pixels, or similar technologies for ads or cross-site tracking.

We do not use third-party analytics providers (such as Google Analytics) and we do not profile users for advertising. We collect first-party operational analytics (pages visited, features used, and similar product events) on our own infrastructure for reliability, abuse prevention, and product quality. We also process server-side operational logs (such as request timestamps, IP address, and error diagnostics) for security and service reliability.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Factors affecting retention include:

• The duration of your account and active use of our Services;
• Our legal obligations to retain data for specific periods;
• The necessity of retaining data to resolve disputes or enforce our agreements;
• Legitimate business needs, such as security and fraud prevention.

When your data is no longer needed, we will securely delete or anonymize it. You may request deletion of your account and associated data at any time (see Section 7).

Please note that some information may be retained even after account deletion where required by law or for legitimate business purposes such as preventing fraud or enforcing our Terms of Service. Stripe retains payment records. We may retain subscription status (tier, period, and whether the account was paid), not card or billing data.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

7.1 Access and Portability

You may request a copy of the personal data we hold about you, and in some cases receive it in a structured, machine-readable format.

7.2 Correction

You may request correction of inaccurate or incomplete personal data we hold about you.

7.3 Deletion

You may request deletion of your personal data and account. You can initiate account deletion through your account settings. Please note that some data may be retained as required by law or for legitimate business purposes.

7.4 Restriction and Objection

You may request that we restrict the processing of your personal data, or object to certain processing based on our legitimate interests.

7.5 Withdraw Consent

Where we process your data based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7.6 Marketing Communications

You may opt out of receiving promotional emails at any time by following the unsubscribe instructions in those emails or by adjusting your account settings. Even if you opt out of marketing communications, we may still send you non-promotional messages, such as service-related notices or security alerts.

7.7 Exercising Your Rights

To exercise any of the above rights, contact us at customer.kissandraai@gmail.com with the subject line "Privacy Request". We will respond within the timeframe required by applicable law. We may need to verify your identity before processing your request.

8. Regional Privacy Rights

8.1 European Economic Area and United Kingdom (GDPR)

If you are located in the EEA or UK, you have rights under the General Data Protection Regulation (GDPR) and applicable national data protection laws, including the rights described in Section 7 above. You also have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data violates applicable law.

The data controller (or equivalent responsible entity under applicable law) for your personal data is Kissandra. Contact for data protection matters: customer.kissandraai@gmail.com.

8.2 California (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• Right to Know: the right to know what personal data we collect, use, disclose, and the purposes for which it is used;
• Right to Delete: the right to request deletion of your personal data, subject to certain exceptions;
• Right to Correct: the right to request correction of inaccurate personal data;
• Right to Opt Out: the right to opt out of the sale or sharing of your personal data for cross-context behavioral advertising;
• Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights.

We do not sell your personal data as defined under the CCPA/CPRA. We do not share personal data for cross-context behavioral advertising. We do disclose personal data to the service providers listed in Section 3.1 so they can generate responses, process payments, host data, and authenticate your account. To exercise your California privacy rights, contact us at customer.kissandraai@gmail.com with the subject line "California Privacy Request".

8.3 Other Jurisdictions

If you are located outside the EEA, UK, or California, applicable local privacy laws may grant you additional rights. We are committed to respecting your privacy rights under applicable law. Contact us with any questions or requests.

9. International Data Transfers

Depending on your usage, your data may be processed by our service providers (including Cloudflare, Supabase, Stripe, OpenRouter, ElevenLabs, xAI, Salad, and other image/video generation providers) in multiple jurisdictions, including jurisdictions outside your country or region.

For chat inference, user inputs are sent through OpenRouter to the model provider selected by the user in real time on the Hangout page. If you use your own OpenRouter API key, that request also runs under your OpenRouter account. Voice, image, and video requests are sent to the provider used for that feature (currently including Salad for image and video generation). Because provider availability changes over time and users may choose providers dynamically, processing locations may vary.

When personal data is transferred outside the EEA or UK, we implement appropriate safeguards designed to protect your data, including contractual protections and other legally recognized transfer mechanisms where required. If you have questions about international transfers, contact us at customer.kissandraai@gmail.com.

10. Children's Privacy

The Services are not intended for, and may not be used by, individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from a user under 18, we will promptly delete that information and terminate the account. If you believe we have inadvertently collected data from a minor, please contact us immediately at customer.kissandraai@gmail.com.

11. Data Security

We implement appropriate technical and organizational measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, secure development practices, and regular security reviews.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security. Chats are stored so the Services can function; they are not end-to-end encrypted. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account. If you believe your account has been compromised, notify us immediately at customer.kissandraai@gmail.com.

12. Third-Party Links and Services

The Services may contain links to third-party websites, applications, or services not operated by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through the Services. We are not responsible for the content, privacy policies, or practices of third parties.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated Privacy Policy on the Services with a new effective date, and where required by law, by sending a notification to your registered email address.

Your continued use of the Services after changes take effect constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Kissandra
Email: customer.kissandraai@gmail.com
Subject line: "Privacy Request"

We will make every effort to respond to your inquiry within a reasonable timeframe and in accordance with applicable law.