Privacy Policy

1. Introduction

JLHL MANAGEMENT LTD (Registration Number HE 484306), a company incorporated in the Republic of Cyprus with its registered office at Georgiou Karaiskaki, 11-13, Carisa Salonica Court, Office 102, 7560, Pervolia, Larnaca, Cyprus, is the data controller for personal data processed through shefeels.ai ("Platform", "Service", "we", "us", or "our").

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our Service. We are committed to processing your data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Cyprus Law 125(I)/2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data, and the California Consumer Privacy Act ("CCPA").

By accessing or using shefeels.ai, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not use the Service.

2. Data We Collect

2.1 Data You Provide to Us

When you register, use the Service, or contact us, we may collect the following data directly from you:

• Email address
• Username
• Password (stored in hashed form only)
• Date of birth
• Payment data (processed and stored by third-party payment processors; we do not store full payment details on our servers)
• Support messages and communications
• Chat messages you send to AI companions

2.2 Data Collected Automatically

When you access or use the Service, we automatically collect certain technical and usage data:

• IP address
• Browser type and version
• Operating system
• Device information
• Usage data (pages visited, features used, interaction patterns)
• Cookies and similar tracking technologies
• Referral URL

2.3 Service-Generated Data

Through your use of the Service, the following data may be generated:

• AI memory data (encrypted at rest and in transit)
• Preference data derived from your interactions
• AI-generated content (text, images, and video produced during your sessions)

3. Legal Bases for Processing

In accordance with GDPR Article 6, we process your personal data on the following legal bases:

• Performance of a Contract (Art. 6(1)(b)): Processing necessary to provide the Service, manage your account, process payments, and deliver AI companion features.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary for fraud prevention, security, service improvement, and analytics, where our interests do not override your fundamental rights and freedoms.
• Consent (Art. 6(1)(a)): Processing based on your explicit consent, including marketing communications and non-essential cookies. You may withdraw consent at any time.
• Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with applicable legal requirements, including tax obligations, fraud reporting, and law enforcement requests.

4. How We Use Your Data

We use the personal data we collect for the following purposes:

• Providing, operating, and maintaining the Service
• Creating and managing your account
• Processing payments and subscriptions
• Powering AI companion features, including conversation, memory, and personalized interactions
• Personalizing your experience and improving the Service
• Communicating with you about your account, support requests, and service updates
• Detecting, preventing, and addressing fraud, abuse, and security issues
• Complying with legal obligations and regulatory requirements
• Sending marketing communications (only with your explicit consent; you may opt out at any time)

5. Data Sharing

We do NOT sell your personal data to third parties.

We may share your data with the following categories of recipients, strictly as necessary:

• Payment Processors: CCBill and BTCPay Server, for processing subscription and one-time payments.
• Cloud Infrastructure: Amazon Web Services (AWS), for hosting, storage, and computing services.
• Email Services: Resend.com, for transactional and service-related email communications.
• Analytics: Privacy-focused analytics tools only. We do not use Google Analytics or any analytics service that tracks users across third-party websites.
• Legal Authorities: Law enforcement or regulatory bodies when required by applicable law or to protect our legal rights.
• Professional Advisors: Legal, accounting, and other professional advisors as necessary for our business operations.

All third-party service providers are bound by data processing agreements in compliance with GDPR Article 28 and are required to process your data only for the purposes we specify.

6. International Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States (for AWS cloud infrastructure). When such transfers occur, we ensure appropriate safeguards are in place, including:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements (DPAs) with all service providers

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law:

• Account Data: Retained for the duration of your account plus 12 months after account deletion.
• Payment Records: Retained for 7 years in compliance with Cyprus tax law.
• Conversations and AI Memory: Retained for the duration of your account. Deleted within 30 days of account deletion.
• Server Logs: Retained for 12 months.
• Marketing Consent Records: Retained for the duration of consent validity plus 3 years.

8. Your Rights Under GDPR

Under the GDPR (Articles 15–21 and Article 7(3)), you have the following rights regarding your personal data:

• Right of Access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and to request a copy of that data.
• Right to Rectification (Art. 16): You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): You have the right to request deletion of your personal data, subject to applicable legal retention requirements.
• Right to Restriction (Art. 18): You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Cyprus Commissioner for the Protection of Personal Data at www.dataprotection.gov.cy.

To exercise any of these rights, please contact us at privacy@shefeels.ai. We will respond to your request within 30 days.

9. Your Rights Under CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know: You have the right to request information about the categories and specific pieces of personal data we have collected, the purposes of collection, and the categories of third parties with whom we share your data.
• Right to Delete: You have the right to request deletion of your personal data, subject to certain legal exceptions.
• Right to Opt-Out of Sale: We do not sell your personal data. As such, there is no need to opt out of the sale of your data.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your CCPA rights, please contact us at privacy@shefeels.ai.

10. Children's Privacy

shefeels.ai is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have collected personal data from a person under 18, we will take immediate steps to delete that data and terminate the associated account.

If you believe that a minor has provided us with personal data, please contact us at privacy@shefeels.ai so we can take appropriate action.

11. Security Measures

We implement robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Hashed and salted password storage
• Role-based access control (RBAC) for internal systems
• Regular security audits and vulnerability assessments
• Secure, certified data centers with physical access controls

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to implementing industry best practices.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. For material changes, we will provide you with at least 30 days' prior notice via email to the address associated with your account and/or via a prominent notice within the Service.

Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated policy, you must stop using the Service and close your account.

13. Contact Information

For any questions or concerns about this Privacy Policy or our data practices, or to exercise your data protection rights, please contact our Data Protection Officer:

Supervisory Authority: