Privacy Policy
Last updated: 8 June 2026
Postal address available on request. Uptek is established in Norway (EEA); GDPR applies directly.
1. Who we are
GirlFriAI ("we", "us") operates the girlfriai.com AI companion chat service. This policy explains what personal data we process, why, the legal basis, and the rights you have under the EU/UK General Data Protection Regulation (GDPR).
2. Data we process
- Account data: email address, display name, hashed password, account dates, premium status.
- Content data: the messages you send and receive in chats, and message/usage counters.
- Payment data: handled by Stripe. We receive your subscription status but never store full card details.
- Technical data: IP address, device/browser type, and cookies or similar identifiers.
- Advertising data: if you consent, our advertising partner may set cookies/identifiers to show and measure ads.
3. Purposes & legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Provide the chat service and your account | Contract (Art. 6(1)(b)) |
| Process payments & manage subscriptions | Contract (Art. 6(1)(b)) |
| Advertising & advertising cookies | Consent (Art. 6(1)(a)) — EU/UK visitors opt in via the cookie banner |
| Security, abuse/fraud prevention, service improvement | Legitimate interests (Art. 6(1)(f)) |
| Age assurance (18+), legal/tax/record-keeping | Legal obligation (Art. 6(1)(c)) |
4. Recipients & processors
- Hetzner Online GmbH — hosting (Germany, EU).
- Stripe — payment processing.
- AI inference providers (e.g. Groq / RunPod) — process your chat messages to generate replies. These may be located in the United States.
- ExoClick — advertising (only where you have consented).
- Self-hosted analytics — privacy-friendly, cookieless usage statistics; no advertising profiles.
We do not sell your personal data.
5. International transfers
Where data is transferred outside the EU/EEA (for example to AI providers in the United States), we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
6. Retention
Account and chat data are kept while your account is active. You can delete your account and data at any time via Your data; we then erase your personal data, except where we must retain limited records to meet legal obligations. Backups are rotated and overwritten on a regular cycle.
7. Your rights
Under the GDPR you have the right to: access, rectification, erasure ("right to be forgotten"), restriction, data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
- Exercise access, export and erasure yourself at girlfriai.com/my-data.
- Manage advertising cookie consent any time via the Cookie Policy.
- Or email privacy@girlfriai.com; we respond within one month.
You also have the right to lodge a complaint with your local data protection supervisory authority.
8. Cookies
See our Cookie Policy for details on the cookies we use and how to control them.
9. Security
Passwords are hashed, traffic is encrypted in transit (HTTPS), and access to systems is restricted. No method of transmission is 100% secure, but we take appropriate technical and organisational measures.
10. Children
GirlFriAI is strictly for adults aged 18 or older. All characters are AI-generated and depict adults. We do not knowingly process data of minors.
11. Changes & contact
We may update this policy; the "last updated" date will change. Questions or requests: privacy@girlfriai.com.