Privacy Policy
This policy explains what we collect when you use https://lustai.chat, why we collect it, who else sees it, and what you can ask us to do about it. It applies whether you are browsing anonymously or signed in. Two things in it deserve reading before the rest: your card details never reach our servers, and the text you type into a chat is sent to third-party model providers in order to produce a reply.
Who is responsible for your data
The controller of the data described in this policy — the company that decides what is collected and why — is:
- Operator
- [LEGAL ENTITY NAME]
- Registered address
- [REGISTERED ADDRESS]
- Registration number
- [COMPANY REGISTRATION NUMBER]
- Data requests and privacy questions
- [email protected]
- Account and billing help
- [email protected]
If the law where you live gives you a right against a data controller, [LEGAL ENTITY NAME] is who you have it against. This policy is governed by [GOVERNING LAW], and disputes about it are heard by [COURTS WITH JURISDICTION], on the terms set out in the Terms of Service.
It covers this website, the accounts created through it, the chats and media produced on it, and the purchases made in it. It does not cover a third-party site you reach by following a link out of ours.
What we collect
Four sources: what you tell us, what your browser sends with every request, what you create by using the service, and what our payment provider reports back about a purchase. In full:
- Account data
- An email address, if you register with email or with Google Sign-In. If you set a password we store it only as a hash, never in a readable form. Google Sign-In gives us your Google account identifier, the email address on that account and the name on it — never your Google password — and that name is written into your display name only while the display name is still the default one.
- Profile data
- A display name, a nickname, an age, a gender and a profile picture, if you set them. None of it is required, and none of it is checked against anything: an age typed into a profile is your own statement about yourself and is not used to verify anything.
- Device and session identifiers
- A device_id your browser generates for itself on first use and keeps in its own storage, the anonymous guest identifier held in a cookie, the guest token that ties this browser to that anonymous account, and the tokens that keep you signed in. The device_id is a random value: it is not derived from your hardware and describes nothing about you or your device. This website never sends it to us at all — it stays in your browser's storage, and it is the guest cookie and token, not that value, that we recognise an account by. Our mobile applications do send a device identifier of their own, and an account created by one carries it. A visitor becomes an anonymous guest account automatically, before any registration, so these exist even if you never give us an email address.
- Technical data
- Your IP address, your browser's user agent, and the time and outcome of each request, as written to our server logs. These arrive with every HTTP request; there is no way to use a website without sending them.
- Conversation content
- Everything you write to a companion — messages, generation prompts, voice and gift requests — together with the replies generated for you, and the short summaries a companion keeps as its memory of you.
- Uploaded images
- Images you upload, for example to generate a picture based on your own photo, or to set a profile picture.
- Characters you create
- If you build your own companion: its name, age, gender and category, the biography, opening line, scenario and personality notes you write for it, and the picture and chat background you give it. If you publish one to the public catalogue, it is reviewed by our moderators before it appears there, the decision is recorded, and what you wrote in it becomes visible to other users. A character you keep private is not published and not reviewed.
- Generated media
- The images, video and voice clips generated for you. They are stored in object storage and linked to your account.
- Purchase data
- The order you created, the amount in US dollars (USD), the subscription plan or gem pack it was for, the status our payment provider reported, and the identifiers that provider uses for the payment and for a recurring subscription. Also your gem balance and the record of what gems were spent on.
- Age confirmation
- The fact that you confirmed you are 18 or older, the date you did, and which edition of these documents you confirmed.
- Cookie choices
- Which optional categories you accepted or refused, and when. Stored in your browser and, once you have a session, against your account — so that a choice made on one visit is not asked about again on the next.
- Advertising click identifier
- Only if you arrived by clicking an advert: the identifier the advertising network gave that click, the campaign labels that came with it in the address, the page you landed on and the site you came from. It is an opaque value issued by the network — it says nothing about you — and it exists so that the network can be told its advert led to a registration or a purchase, and be paid for it. It is collected unless you have switched advertising measurement off, and switching it off deletes it both from your browser and from our records.
- Correspondence
- Messages you send to support or to our legal address, and whatever you choose to put in them.
The 18+ confirmation is a self-declaration and nothing more. We do not ask for your date of birth, and we do not check your age against a document, a selfie, a payment record or any third-party verification service. We have no such check, and we collect no data for one.
We also store identifiers and preferences in your browser: cookies, localStorage and sessionStorage keys, a cache of voice clips you have already paid for, and a service worker. Every item is listed with its purpose and its lifetime in the Cookie Policy. Two of them — the analytics cookies and the advertising click identifier described below — are optional: they start switched on, the cookie banner says so and lets you switch either off, and doing so deletes what it stored. Your answer to that banner is itself recorded in a cookie.
One thing we ask of you: do not type into a chat what you would not want stored. Card numbers, passwords, government identifiers and another person's private details have no use here, and conversation content is stored and sent to model providers as described in the next section.
Why we process it, and on what legal basis
Each purpose below rests on one basis. Where the law that applies to you uses the wording of the GDPR, these are the bases we rely on; where it uses different wording, the purposes are the same.
- Running the service
- Performance of a contract. Creating and keeping your account, keeping you signed in, showing the catalogue, generating chat replies, images, video and voice, keeping your gem balance, and keeping the history of a relationship with a companion so it continues where it stopped.
- Taking payment
- Performance of a contract. Creating an order, verifying the provider's signed webhook, granting what you bought, renewing a subscription you have not cancelled, and answering a billing question or a dispute under the Refund & Cancellation Policy.
- Account email
- Performance of a contract. Confirming an email address and resetting a password. We do not send marketing email on this basis, and there is no newsletter.
- Safety and abuse prevention
- Legitimate interests, and legal obligation where the content is illegal. Prompts are screened automatically before generation and generated images pass an automated nudity and safety classifier; accounts that break the Acceptable Use Policy are investigated and blocked.
- Keeping the service working
- Legitimate interests. Server logs, error reports and performance traces used to find and fix failures, and rate limits used to stop automated abuse of the API.
- Understanding how the paid part is used
- Legitimate interests. Purchases and movements of your gem balance are analysed to see which packs, plans and paid features are actually used and where a payment flow fails. This works on transaction records — amounts, balances, what was bought or spent and when — and not on the content of your chats.
- Recording the 18+ confirmation
- Legal obligation, and legitimate interests. An adult service must be able to show that a user was asked and answered, which is why the answer is stored against the account and not only in your browser.
- Features you choose to switch on
- Consent. Signing in with Google, uploading your own image, having a reply read aloud. You can stop using any of them at any time, and withdrawing consent does not affect what was already done with it.
- Analytics
- Legitimate interests — understanding which parts of our own service are used and where people give up — measured through Google Analytics, together with your right to object. The objection is not a form to fill in: it is the "Necessary only" button on the cookie banner and the switch in Settings, either of which takes the script off the page and deletes its cookies immediately. We do not wait for you to accept before it loads, and the Cookie Policy says so plainly rather than leaving you to discover it.
- Advertising measurement
- Legitimate interests — being able to pay the advertising network that brought you here, and to know which adverts are worth buying — with the same right to object, exercised the same way and with the same immediate effect. This is measurement of an advert, not of you: it produces no profile, no audience list and no targeting, and nothing about your activity here is passed to the network beyond the fact that its click converted.
- Legal claims and requests
- Legal obligation, or legitimate interests where we need to keep a record to defend a claim, answer a content-removal notice, or respond to a lawful request from an authority.
We do not sell your data. We do not use your conversations to advertise to you, and we do not build a profile of you for anyone else's marketing. The advertising measurement described above is the one place an advertising network hears from us at all, and what it hears is that a click it identified converted — never who you are, never what you did here, and never anything from a conversation.
What happens to your messages, prompts and uploads
Concretely, and by step:
- chat replies and the memory a companion keeps about you are generated by models running at Novita;
- short helper steps — intent checks and the triage of a support request — run at OpenAI;
- images and video are produced by our generation service, which writes its output to S3-compatible object storage;
- a spoken reply is synthesised by Inworld, which receives the text of that reply in order to return an audio clip.
What is sent is what the step needs: your message, enough of the recent conversation and of the companion's profile for the answer to make sense, and — for an image — the prompt assembled from your request plus any picture you uploaded. Your email address and your payment data are not part of it.
Prompts and generated images are also screened by machine: a prompt is moderated before generation runs, and a generated image passes an automated nudity and safety classifier before it reaches you. That screening is automatic. It is not a person reading your chat.
A person at [LEGAL ENTITY NAME] reads conversation content only when there is a specific reason: you sent it to us yourself in a support request, an abuse report or a notice under Content Removal & DMCA points at it, a payment dispute cannot be answered without it, or the law requires it. Separately, model calls may be traced through Langfuse, where the prompt, the reply and the token counts are visible to the engineers who debug the pipeline.
How long a provider keeps a prompt on its own side is set by our agreement with that provider and by its terms, not by this page. We will not print a retention promise here that we do not control.
How long we keep it
- While the account exists
- Account data, chats, companion memory, uploads, generated media and gem history are kept for as long as the account exists. They are not a by-product of the service; they are the service.
- Server logs
- About 30 days.
- Performance traces
- About 15 days.
- Database backups
- Backups are not deleted by hand; they expire on the storage bucket's own lifecycle policy, which is set in the order of a month. Data deleted from the live database can therefore still exist in a backup until the backup holding it expires.
- Payment and accounting records
- Kept for as long as tax and accounting law requires, which is longer than the account itself. Deleting an account does not delete the record that a payment happened; that record is what lets us answer a chargeback and file a return.
- Abuse and enforcement records
- Where an account was blocked, the fact of the block, its reason and the identifiers needed to keep it in force survive deletion. Otherwise a banned account would be one deletion away from coming back.
- Correspondence
- Support and legal correspondence is kept while it may still be needed to answer a follow-up, resolve a complaint or defend a claim.
Where no fixed period is given above, the rule is the same: we keep the data until the purpose it was collected for is finished, and then delete it or stop being able to connect it to you.
How we protect it
- the site and the API are served over HTTPS;
- passwords are stored as hashes, so a password cannot be read back out of our database;
- the guest session cookie is HttpOnly, which keeps page scripts from reading it;
- payment webhooks are accepted only with a valid signature and a fresh timestamp, so a payment cannot be forged into your account;
- access to production systems and to stored media is limited to the people who need it to operate the service.
No system is perfectly secure, and we will not claim otherwise. What we commit to is the response: if a breach affects your data, we will notify you and the relevant authority wherever the law requires it, and we will say what happened rather than what sounds best.
Your rights, and how to use them
Depending on where you live, you can ask us to give you a copy of the data we hold about you, correct it, delete it, hand it to you in a portable form, restrict or stop a particular use of it, or withdraw a consent you gave earlier. You can exercise any of these two ways:
- in the app: sign in, open Account settings, and use Delete account. The next section sets out exactly what that does and what it does not do;
- for the cookie categories, immediately and without asking us: open Settings and change your cookie choices. Switching one off takes effect at once and deletes what it had stored;
- by email: write to [email protected] from the address on your account and say what you want. We answer within 30 days, and there is no charge for a first request.
We have to be satisfied that the request comes from the account it concerns, and this is where honesty matters more than reassurance. For a registered account, writing from the email address on it is enough. An anonymous guest account has no email address and nothing else tying it to a person, so we can act only on a request that comes from that same browser session — if the cookie is gone, we have no way to find the account, and we will tell you that instead of guessing at one.
We keep the current answers, not a history of them. That means the current 18+ confirmation with its date and the document edition it was given against, and the current cookie choices with the date they were made — not a journal of every earlier one. If you ask what you agreed to and when, that is the answer we can give.
If we refuse a request we will say why. If our answer does not satisfy you, escalate it through the Complaints Policy, and if the law where you live provides a data protection authority, you may complain to it as well. Using the complaints route first is not a condition of doing so.
Deleting your account
Deletion runs from Account settings while you are signed in. It takes effect immediately, and it does the following:
- signs you out and disables sign-in to that account, permanently;
- deactivates the account, so it can no longer chat, generate or be used at all;
- releases the email address and any Google connection on it, so you are free to register again — as a new account, not as that one;
- withdraws from the public catalogue any character you had published there;
- forfeits any unused gems and any remaining paid subscription time, without a refund;
- starts you again as a new anonymous visitor, so nothing stops a fresh account being created in the same browser.
What it does not do, on its own:
- it does not erase the messages, uploads and generated media already stored. Those stay in our database and in object storage, unreachable from the closed account but not gone, until an erasure is carried out — which is what the request below asks for;
- it does not remove payment and accounting records, which we are required to keep;
- it does not stop a recurring subscription charge held at the payment provider — that is cancelled with the provider's mandate, not with the account;
- it does not lift a block imposed for breaking the Acceptable Use Policy;
- it does not reach into backups that have not yet expired.
So if you want the content erased and not merely the account closed, ask for it in writing at [email protected]. We carry that out within 30 days, except for what we must keep by law and the minimum needed to keep an enforcement decision in force.
Deleting an account is not the way to cancel a subscription. Cancel the subscription first, as described in the Refund & Cancellation Policy, and delete afterwards.
Where your data goes
We and our providers are not all in one country. The companies named above sit in several jurisdictions, and some of them are outside the country you are in and outside the European Economic Area. Sending a prompt to a model provider, storing a generated image, or having an error report delivered can therefore each move data across a border.
Where a transfer requires a legal safeguard, we rely on the terms of our agreement with that provider, including standard contractual clauses where they apply. If you want to know which provider handles a particular category of your data, ask at [email protected] and we will answer within the same 30 days.
The service is not for anyone under 18
This is an adult service. You may not use it, and may not hold an account on it, unless you are at least 18 years old — or older, where the age of majority where you live is higher. We do not knowingly collect data about anyone below that age, and we do not direct any part of the service at them.
The age gate is a self-declaration, which means we cannot detect a false answer to it. What we can do is act on the cases we learn about, and that is what we commit to here.
If we learn that an account belongs to someone under 18, we block it, stop generating anything for it, and delete the data held about it, keeping only what is needed to keep the block in force or to answer a lawful request. A report of this kind is handled outside the ordinary queue and acted on within 24 hours.
If you are a parent or guardian and believe a child has used the service, write to [email protected] with whatever identifies the account — the email address on it, or the approximate dates it was used. You do not need to prove who you are for us to act. Reports about content that depicts a minor go through the same priority route, described in Content Removal & DMCA.
Changes to this policy, and how to reach us
When we change this policy materially we raise its edition — the date shown as "Last updated" at the top of this page — and the 18+ confirmation is asked again on your next visit. That prompt is the mechanism that tells you the documents have changed, and it is worth being clear about what it is not: we do not email users when a document changes, and we do not keep earlier editions on the site. If the current wording matters to you, save a copy.
For anything in this policy:
- Data requests, privacy and legal
- [email protected] — answered within 30 days.
- Account, billing and everything else
- [email protected] — first human reply within 48 hours.
- By post
- [LEGAL ENTITY NAME], [REGISTERED ADDRESS]