Legal

Privacy Policy

Aura Digital B.V. (“we”, “us”, “our”) respects your privacy. This Privacy Policy explains how we collect, use, share, and protect personal data when you use FlirtVault at flirtvault.com (the “Service”), in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Dutch GDPR Implementation Act (UAVG).

1. Who we are

Aura Digital B.V., De Entree 201, 1101 HG Amsterdam, The Netherlands (KVK 53180712), is the data controller for personal data processed through the Service. Contact us at help@flirtvault.com.

2. Data we collect

Account data: your email address and any subscription or access identifiers created through our authentication method.
Usage data: chat messages and prompts you submit, your interactions with AI Companions, credit balance, and purchase history.
Technical data: IP address, browser and device information, and cookies (see our Cookie Policy).
Payment data: transaction references and amounts. We do not store full card details. Card payments are processed on our behalf by a PCI DSS (Payment Card Industry Data Security Standard) compliant payment service provider.
Moderation and safety data: flags, reports, and review notes generated by our content moderation systems (see our Content Moderation & Monitoring Policy).

3. How we use your data and our legal bases

Purpose	Legal basis (GDPR Art. 6)
Providing and operating the Service, authenticating you, processing purchases	Performance of a contract
Preventing fraud, abuse, and underage access; enforcing our Policies; content moderation and safety review	Legitimate interests, and legal obligation where applicable
Complying with law enforcement or regulatory requests	Legal obligation
Non-essential cookies and similar technologies	Consent
Service communications (e.g. security notices, purchase confirmations)	Performance of a contract / legitimate interests

We do not sell your personal data.

4. AI processing

Your messages may be transmitted to third-party AI infrastructure providers solely to generate responses. These providers are contractually bound to process data only to deliver the Service and are not permitted to use your data to train their own models unless we have specifically agreed otherwise and disclosed this to you. Please do not share sensitive personal data (e.g. government ID numbers, passwords, financial or health details) in chat.

5. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, applying the following retention periods as a general rule:

Data type	Retention period
Account information	Until account deletion, plus any legally required retention period thereafter
Purchase/transaction records	7 years (Dutch tax and accounting law)
Customer support communications	3 years from the date of the last communication
Moderation logs (flags, reports, review notes)	2 years, unless a longer period is required for an active investigation or legal proceedings
Fraud-prevention records	As long as necessary for fraud prevention and any related legal obligations

These periods may be extended where necessary to establish, exercise, or defend legal claims (including chargeback disputes), or where a longer period is required by applicable law.

6. Sharing

We may share personal data with: hosting and cloud infrastructure providers; payment processors; AI service providers; authentication partners; professional advisers; and law enforcement or regulators where legally required. All processors are bound by data processing agreements consistent with Art. 28 GDPR.

7. International transfers

Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, and we take supplementary measures where necessary.

8. Your rights

Subject to conditions under the GDPR, you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). To exercise these rights, contact help@flirtvault.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in your EU country of residence.

9. Security

We use technical and organisational measures, including encryption in transit, access controls, and secure session handling, to protect your data. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Children

FlirtVault is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has used the Service or that we hold data about a minor, contact us immediately at help@flirtvault.com so we can investigate and delete the relevant data.

11. Automated decision-making

AI-generated chat responses are produced by automated systems but do not involve automated decision-making that produces legal or similarly significant effects on you within the meaning of Art. 22 GDPR. Our moderation systems may automatically flag or restrict content; significant enforcement actions (such as account termination) are subject to human review on request — see our Complaints Policy.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date.

13. Contact and data protection

Data controller: Aura Digital B.V.. Contact: help@flirtvault.com.