Privacy Policy

1. Who we are (controller) and how to reach us

Data controller: [COMPANY LEGAL NAME] s.r.o., registered seat [REGISTERED SEAT ADDRESS, SLOVAKIA], company ID (IČO) [IČO], VAT ID (IČ DPH) [IČ DPH].

For any privacy or data-protection request, contact privacy@paksionline.com. For general legal enquiries, contact legal@paksionline.com.

You have the right to lodge a complaint with the Slovak supervisory authority, the Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), https://dataprotection.gov.sk.

2. Personal data we collect

We collect the following categories of personal data, most of which you provide directly or which is generated by your use of the Service:

• Account data: your email address and a securely hashed password (we never store passwords in plain text). Optionally a display name.
• Age-verification data: where age assurance is required, we process the data needed to confirm you are an adult. Where age is estimated, the underlying input (for example an image) is processed transiently and discarded — we retain the verification result, not the biometric input.
• Content data: the prompts and inputs you submit, the AI characters you create, the training inputs used to build a character model, the images and other content the Service generates for you, and your interactions with the Service's AI features.
• Payment metadata: subscription and top-up records, plan, amount, currency, and status. Payments are handled by our payment service provider; we do not receive or store your full card number.
• Credit-ledger data: your credit balance and the history of credit grants and spends (an audit trail).
• Technical and usage data: IP address, device/browser information, request identifiers, log and diagnostic data, and job/processing status.
• Communications: messages you send us (for example support or data-protection requests).

3. Why we use your data and our legal bases

We process personal data for the following purposes and on the following GDPR legal bases:

• To provide the Service — create your account, train characters, generate images and other content, provide the Service's AI features, maintain your credit balance and private gallery. Basis: performance of our contract with you (Art. 6(1)(b)).
• Age assurance and keeping minors off an adult platform. Basis: legal obligation (Art. 6(1)(c)) and our legitimate interest in operating a lawful adult service (Art. 6(1)(f)).
• Safety, moderation, and detection and reporting of illegal content (in particular CSAM). Basis: legal obligation (Art. 6(1)(c)) and legitimate interest in a safe, lawful Service (Art. 6(1)(f)).
• Payments, billing, accounting, and tax. Basis: performance of contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
• Security, fraud prevention, debugging, and service improvement. Basis: legitimate interest (Art. 6(1)(f)).
• Sending you service and transactional emails (verification, password reset, security and account notices, receipts) and notices about changes to our Terms or this Policy. Basis: performance of contract (Art. 6(1)(b)) and legal obligation. Separately, if you opt in, we may send optional product news or a newsletter; basis: consent (Art. 6(1)(a)), which you can withdraw at any time. We do not send marketing email without your consent.
• Where we ask for your consent (Art. 6(1)(a)), you may withdraw it at any time without affecting prior processing.

Given the nature of the Service, content you generate may reveal data concerning your sex life or sexual orientation. We process it to provide the Service you have requested and to meet our legal obligations; we apply additional safeguards and do not use it for advertising or profiling.

4. Who we share data with (recipients)

We do not sell your personal data. We share personal data with vetted service providers that process it on our behalf, under data-processing agreements, only to the extent needed to run the Service. Rather than naming each provider here (the specific providers may change), we describe the categories of recipients we use:

• Hosting, database, and content-delivery providers — to run the application and store your account data, credit ledger, generated images, and character assets.
• Compute and AI-inference providers — to train character models, generate images from your prompts, and run the Service's AI features. A separate, non-explicit base-image step may use general-purpose image providers; explicit content is not sent to those providers.
• Email-delivery providers — to send service and transactional emails (verification, security and account notices, receipts), notices about changes to our Terms or this Policy, and — only if you have opted in — optional product news or newsletters.
• Payment service providers — to process subscription and top-up payments; they receive payment data directly.
• Error-monitoring, logging, job-orchestration, and infrastructure providers — for diagnostics, reliability, and security.

Some of these providers are located outside the EEA (see section 5). We keep an up-to-date internal record of the specific sub-processors we use and the personal data each one processes; you can request the current list by contacting us at the address in section 1. We may publish a dedicated sub-processor list once our providers are finalised.

We may also disclose data where required by law, to competent authorities (including reporting of illegal content as described in section 6), or to protect our rights, users, or the public.

5. International transfers

Some providers (for example certain compute and base-generation providers) are located outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, and we take additional measures where needed. You can contact us for more information about these safeguards.

6. How long we keep data, and illegal-content handling

We keep personal data for as long as your account is active and as needed to provide the Service, then for any period required to meet legal, accounting, tax, or dispute-resolution obligations. Credit and billing records are kept for the statutory retention periods.

Top-up credits and related records follow the 12-month account-inactivity rule described in our Terms. Age-verification inputs that are only used to estimate age are processed transiently and discarded; we keep the verification result.

Where we detect content that is, or appears to be, illegal — in particular CSAM — we may preserve the relevant data and associated account information for the purpose of, and for as long as necessary for, reporting to and cooperating with the competent Slovak authorities, even after you delete content or close your account. This processing is based on our legal obligations.

7. Your rights

Subject to the conditions and exceptions in the GDPR, you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate or incomplete data;
• erase your data (right to be forgotten), subject to our legal-retention and illegal-content-reporting obligations;
• restrict or object to certain processing, including processing based on legitimate interest;
• data portability for data you provided, where applicable;
• withdraw consent at any time where processing is based on consent.

To exercise these rights, contact privacy@paksionline.com. We may need to verify your identity. We aim to respond within the statutory time limit (generally one month). You also have the right to complain to the Slovak supervisory authority (section 1).

8. Age verification

Because the Service is adult-only, we operate age assurance. Depending on the method, this may involve a third-party check or an age estimation. Where age is estimated from an image, that image is used only to produce an age signal and is then discarded (estimate-and-discard); we retain the outcome (verified / not verified) bound to your account, not the underlying biometric input. We do not use age-verification data for any unrelated purpose.

9. Cookies and similar technologies

We use strictly necessary cookies and similar technologies to operate the Service — principally to keep you signed in (session/authentication) and to maintain security and request integrity. These are required for the Service to function. If we introduce any non-essential cookies (for example analytics), we will ask for your consent first and update this Policy.

10. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, access controls, and isolation of sensitive content. No system is perfectly secure, but we work to protect your data and to respond appropriately to any incident, including notifying you and the authorities where the law requires.

11. Children

The Service is strictly for adults (18+). We do not knowingly allow anyone under 18 to use the Service or to provide personal data. If we learn that a minor has used the Service, we will terminate the account and delete the data, except where retention is required to comply with our legal obligations (including illegal-content reporting).

12. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will take reasonable steps to notify you. The effective date at the top shows when this version took effect.

13. Contact

Privacy and data-protection requests: privacy@paksionline.com. General legal enquiries: legal@paksionline.com.