Privacy Policy
This translation is provided for convenience. The legally binding version is the German one.
1. Data Controller
The party responsible for data processing on this website and in the chat service chat.emiliaiva.com is:
Foth Group GmbH
Seehofstraße 137, 14167 Berlin, Germany
E-Mail: kontakt@fothgroup.de
2. What Data We Process
We process only the data necessary for the operation of the service:
- Email address and (optionally) display name when registering for the chat
- Content of your chat messages and the responses generated by Emilia
- Uploaded attachments: images, PDFs, voice and video files. Voice and video recordings are automatically transcribed (Whisper) and analysed for non-biometric voice features (e.g. tempo, pitch range, loudness); for videos, a single still frame is also extracted. Images and still frames are described by a language model so that Emilia can respond. No facial recognition and no creation of biometric profiles takes place.
- Onboarding inputs (e.g. name, chosen relationship stage, optional context details) that you provide yourself during onboarding
- Memory layer: notes about you derived from the chat history (e.g. stated preferences, recollections) used to keep the persona consistent — you can delete this memory at any time from your account
- Billing data on a paid plan: email address, Stripe customer ID, subscription ID, invoice and payment status (card and banking data are processed exclusively by Stripe, never by us)
- If enabled: web push subscription (your browser/device endpoint URL and cryptographic keys) for delivering optional notifications
- If you connect to the chat via WhatsApp: your WhatsApp ID (phone number hash from the Meta API)
- Server access logs (IP address, date, time, resource accessed) — stored for 14 days for protection against attacks
- Authentication token in your browser's localStorage (technically necessary)
3. Purpose of Processing
The data is used exclusively to provide the service: delivery of the AI companion chat with the persona "Emilia", processing of your attachments to enable Emilia's reply, account and session management, ensuring secure operation, as well as contract processing and billing for paid plans. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) as well as Art. 6(1)(f) GDPR (legitimate interest in secure operation and abuse prevention).
4. No Public Gallery, No AI Training
Your chat messages are visible exclusively to you and the operators. There is no public visibility. Your messages are not used for training AI models — neither by us nor by our data processors.
5. Data Processors and Third-Country Transfers
We share data only to the extent necessary for the operation of the service. Data processing agreements in accordance with Art. 28 GDPR are in place with all listed data processors. Transfers of data to the United States only take place to providers certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, C(2023) 4745) or on the basis of Standard Contractual Clauses (Art. 46(2)(c) GDPR).
5.1 Hetzner Online GmbH (Hosting, Germany)
Our servers and databases are operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. All user data — including accounts, chat history and uploaded attachments — is stored on Hetzner servers in Germany (Falkenstein/Saxony location). The Postgres database runs locally on the same dedicated server; daily backups are stored encrypted in the same location.
5.2 Anthropic, PBC (AI Language Model, USA)
To generate Emilia's chat responses and to describe uploaded images and still frames, your messages and image content are transmitted to the Claude API of Anthropic, PBC (548 Market St, PMB 90375, San Francisco, CA 94104, USA). Anthropic is certified under the EU-US Data Privacy Framework. The use of your inputs for training AI models is contractually excluded (Anthropic Commercial Terms). Anthropic stores API requests in accordance with their standard data policy for a maximum of 30 days for abuse detection; content is deleted thereafter. For users with the Web-Search tool enabled, search queries are additionally forwarded by Anthropic's own Web-Search feature to search engines.
5.3 Audio Transcription (local, no third-party)
Transcription of your voice messages and the audio track of uploaded videos is performed entirely locally on our server in Germany (Hetzner Falkenstein) using the open-source software whisper.cpp. No audio content is transmitted to external providers.
5.4 Stripe Payments Europe Ltd. (Payment Processing, Ireland/USA)
When you book a paid plan, payments are processed by Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) and its US parent Stripe, Inc. We receive a customer ID, subscription ID, payment status and invoice metadata from Stripe — never card or banking data. Transfer to the USA is based on the EU-US Data Privacy Framework. Details: stripe.com/privacy.
5.5 Resend, Inc. (Transactional Email, USA)
Magic-link and transactional system emails are sent via Resend, Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA). Resend processes your email address, the message body and delivery metadata. Resend is certified under the EU-US Data Privacy Framework. Details: resend.com/legal/privacy-policy.
5.6 Browser Push Services (optional)
If you enable push notifications, your browser/device transmits an endpoint URL of the relevant push service (Mozilla autopush, Apple Push Notification service, Google FCM, Microsoft WNS) to us. Notification delivery is handled by that push service. The contents of push messages are signed on our server (VAPID); the push service relays them only as opaque payloads.
5.7 Meta Platforms Ireland Ltd. (optional, only when using WhatsApp integration)
If you contact Emilia via WhatsApp Business, message delivery is routed through the WhatsApp Cloud API of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Processing takes place within the framework of the WhatsApp Business Terms of Service. Only the metadata required for message exchange is processed.
5.8 Google Fonts
This website loads fonts via Google Fonts (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Your IP address is transmitted to Google in the process. Legal basis: Art. 6(1)(f) GDPR (display of content).
5.9 BytePlus Pte. Ltd. (Image Generation, Singapore)
If Emilia generates a selfie at the user's explicit request, the image prompt and persona reference images required for this are transmitted to the Seedream image-generation API of BytePlus Pte. Ltd. (a subsidiary of ByteDance Ltd., 152 Beach Road, Gateway East #20-04, Singapore 189721). Processing takes place in BytePlus' data centre in Singapore. As no adequacy decision exists for Singapore, this third-country transfer relies on Standard Contractual Clauses (Art. 46(2)(c) GDPR) (see BytePlus Data Processing Addendum, Exhibit A Part A – EEA Annex). BytePlus processes only the image prompt and persona refs for generation; use for model training is contractually excluded. No message or account data of users is transmitted to BytePlus.
6. Retention Periods
Your data is stored for as long as your account is active. Upon account deletion, the following applies:
- Chat histories and display name: immediate and irreversible deletion
- Email address (without a billing relationship): immediate deletion
- Email address (where a billing relationship exists): retained for 10 years in accordance with § 257 HGB / § 147 AO and on the basis of legitimate interest (Art. 6 Abs. 1 lit. f DSGVO (GDPR)) for fraud prevention and enforcement of the terms of use
- Payment and invoice data: 10 years in accordance with § 257 HGB / § 147 AO
- Server logs: 14 days
- Moderation logs: 3 years (statutory documentation obligation)
The right to erasure (Art. 17 DSGVO (GDPR)) applies subject to the statutory retention obligations set out above.
7. Your Rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) under the DSGVO (GDPR). You also have the right to lodge a complaint with a supervisory authority — the competent authority includes, among others, the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information). Please direct enquiries to: kontakt@fothgroup.de
8. Cookies, Local Storage and Terminal-Equipment Access (§ 25 TDDDG)
This website uses no tracking cookies and no marketing services, advertising trackers, or analytics tools. Only technically necessary values are stored in your browser to operate the chat: the authentication token (session cookie / localStorage) and language preference. This processing is exempt from consent under § 25(2)(2) TDDDG (Telecommunications-Digital-Services-Data-Protection Act, in force since 14 May 2024 as the successor to TTDSG), as it is strictly necessary to provide the telemedia service the user has expressly requested.
9. Automated Decisions and AI Transparency (Art. 22 GDPR, EU AI Act)
Emilia's responses are generated entirely by a Large Language Model. Under Regulation (EU) 2024/1689 (AI Act) this is an AI system with transparency obligations (Art. 50 AI Act): you are not interacting with a human but with a fictional AI persona. We make this clear in the chat. No automated individual decision producing legal effects within the meaning of Art. 22 GDPR takes place. No credit or profiling scores are generated. The optional subtext detection serves solely to make Emilia's reply more empathetic — it does not generate a profile that is used outside the session.
10. Right to Data Export and Erasure
You can export or delete your data at any time — via the buttons in the account area or the endpoints /api/me/export and /api/me/delete. Deletion covers your account, chat history, attachments, memory layer and push subscriptions. Statutory retention obligations (Section 6) remain unaffected.
11. Age Restriction
The service is intended exclusively for persons aged 18 and over. By registering, you confirm that you are of legal age. We reserve the right to verify age statements on a random-sample basis.
12. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy to reflect changes in the legal situation or changes to the service. The current version is available at this URL at all times. Material changes will be announced to your registered email address before they take effect.