Privacy Policy v2.0 (EN — International Version, with EEA/UK Rights)

• Effective Date: 2026-08-31
• Data Controller: MYCREAM CYP LTD (Reg. No. HE482361)
• Address: Chrysanthou Mylona 1, PANAYIDES BUILDING, 2nd Floor, Flat/Office 1, 3030 Limassol, Cyprus
• Contact (Privacy): social@mycream.ai
• Privacy Officer (CPO): Shinhyung Cho (Director/CEO) — contact: social@mycream.ai
• Data Protection Officer (DPO): Not appointed

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our 18+ AI-driven 1:1 chat service (the “Service”). This Policy applies to all users, including fans, creators, and influencers.

1. Personal Data We Collect

We may collect the following categories of personal data:

• Account Information: email address, username/nickname, password hash, (optional) phone number, and a social sign-in provider's unique account identifier and email verification status.

• Verification Data (KYC/Age Verification, where required): verification data processed by our identity verification provider, which may include government ID details, selfie/liveness checks, date of birth/age, and address-related information.

• We generally do not store raw images of ID documents or selfies. We retain limited verification outcomes/metadata (e.g., pass/fail status, verification reference IDs, and timestamps).

• KYC Provider: ComplyCube (may change).

• Payment and Transaction Data: tokenized payment identifiers, transaction amounts/currencies, payment status, refunds/chargebacks, and tax-related information (e.g., VAT/GST where applicable). Payment card numbers and sensitive payment details are typically processed by payment processors and not stored by us. For recurring subscriptions, a tokenized payment credential may be retained to process renewal charges until you cancel.

• Content and Metadata: content you upload or submit to the Service, and related metadata (e.g., permission settings, agent configuration metadata).

• Conversation and Generation Data: text and other inputs/outputs generated during use of the Service, and related metadata.

• Usage and Technical Data: IP address, device/browser identifiers, cookies or similar technologies, timestamps, and security/performance logs.

• Support and Safety Data: messages submitted to customer support, reports, disputes, and records needed to process rights requests or handle safety issues.

2. How We Use Personal Data (Purposes)

We use personal data for the following purposes:

• Service Delivery: account creation, authentication, core functionality, and customer support.

• Payments and Account Administration: processing purchases, recurring subscription billing, refunds, chargebacks, invoicing/receipts, and operational accounting.

• Verification and Risk Management: age gating, identity verification (where required), fraud prevention, and abuse prevention.

• Safety and Policy Enforcement: monitoring, detecting, preventing, and responding to prohibited conduct and policy violations.

• Service Improvement: analytics and performance monitoring to improve reliability and user experience (with data minimization).

• Legal Compliance: complying with applicable laws and responding to lawful requests.

• Marketing (Opt-in): sending updates and promotional communications where you have opted in (you can withdraw consent at any time).

• Advertising Measurement (Opt-in): measuring visits, registrations, and purchases from Meta, X, and TikTok ads, optimizing conversion delivery, and remarketing, based on separate consent that you may withdraw at any time.

Google Sign-In Data Handling

• Access and collection: When you choose to continue with Google, we receive your Google Account's unique account identifier, email address, and email verification status. We do not request access to your name, profile photo, contacts, Google Drive files, or other Google Account data.

• Use: We use this information only to create your account, sign you in, link accounts, prevent duplicate accounts, and secure the Service. MyCream cannot access your Google password.

• Authentication and storage: The one-time authorization code and access token issued by Google are used only while completing sign-in and retrieving the information above; MyCream does not store them in its database. The Google account identifier, email address, and email verification status are stored as account authentication information.

• Retention and deletion: Google sign-in information is retained while your account remains active. After account closure or completion of a deletion request, we delete or de-identify it unless a legal retention exception applies. See Sections 5 and 8 for the detailed criteria and how to request deletion.

• Protection: We apply the safeguards described in Section 10 to Google sign-in information, including encryption in transit and at rest where appropriate, access controls, and permission management.

• Disclosure and use restrictions: Google sign-in information may be processed by service providers acting on our instructions where necessary for hosting, operations, or security, or disclosed where required by law. We do not sell it, share it for personalized advertising, or use it for advertising or AI model training.

3. Legal Bases (Where Required)

Where applicable (including in the EEA/UK), we rely on the following legal bases:

• Contract: to provide the Service you request.

• Legitimate Interests: to secure, operate, and improve the Service and prevent fraud/abuse.

• Legal Obligations: to comply with applicable laws and lawful requests.

• Consent: for optional marketing communications (withdrawable at any time).

4. Cookies and Similar Technologies

We use cookies and similar technologies for authentication, security, preferences, and analytics. You can manage cookies through your browser settings and, where available, our cookie preference tools.

Advertising Measurement

• Default preference: If no saved preference exists, advertising measurement is allowed automatically. Campaign parameters such as fbclid and utm_* are removed from the page URL. While allowed, we may store a valid Meta click value in an advertising cookie and load the Meta, X, and TikTok browser pixels. You can withdraw permission at any time in privacy settings.

• Data processed after permission: The browser pixels process advertising cookies and browser/device information made available by the browser, including IP address and user agent, together with the visited query-free page path, event name (PageView, CompleteRegistration, or Purchase), opaque event ID, event time, and purchase value and currency. Meta-specific identifiers may include _fbp and _fbc. After a registration, purchase, or the tenth cumulative chat (Chat10Milestone), our server may additionally send normalized event information to Meta Conversions API, TikTok Events API, and X Conversion API; Meta and X may receive a SHA-256 hash of the normalized email address. We do not enable TikTok Advanced Matching or intentionally send email addresses or phone numbers to TikTok.

• Purpose and exclusions: We use this data to measure ad visits, registrations, and purchases, deduplicate conversion events, optimize ad delivery, and remarket. Our explicit event payloads do not include chat text, creations, raw email addresses, or account, order, or payment identifiers.

• Withdrawal and retention: We keep the preference in the browser and account for up to 180 days. You can withdraw at any time in privacy settings. Withdrawal stops subsequent browser-pixel calls, deletes _fbp and _fbc, and cancels server conversion events that have not yet been sent. Existing third-party cookies may remain until they expire or are removed through browser controls. Our conversion delivery records are deleted by default within 30 days after successful delivery, 7 days after consent cancellation, or 90 days after terminal failure. Data already delivered to Meta, X, or TikTok is handled under each provider's applicable policies and terms.

5. Data Retention

• Account and authentication information: We retain it while your account remains active. After account closure or completion of a deletion request, we delete or de-identify it unless continued retention is necessary for legal obligations, dispute resolution, or abuse prevention.

• When you request account closure: we hold your account information in a pending-closure state for 30 days from the date of the request, and you may log in again during that period to restore your account. After the 30-day period the closure becomes final and we delete the related personal data (excluding data we must retain to comply with legal obligations). If you want your data deleted immediately, without the 30-day grace period, contact social@mycream.ai and we will act without undue delay.

• Usage records and technical logs: We generally retain them for up to 12 months, to the extent necessary to provide and secure the Service.

• After that period, unless we must retain data to comply with legal obligations or to resolve disputes, we will securely delete it or de-identify it (anonymize/pseudonymize) and use it only for limited purposes such as aggregated analytics.

• Backup data may persist for a limited period due to system constraints and may be removed on a rolling basis.

6. Sharing and Disclosure

We may share personal data with:

• Service providers that help us operate the Service (e.g., hosting/cloud infrastructure, payment processing, identity verification/KYC, customer support tools, security monitoring, analytics).

• Authorities or third parties where required by law, to protect rights and safety, or to enforce our policies.

We require service providers to protect personal data and process it only on our instructions, subject to appropriate contractual safeguards.

7. International Data Transfers

We are based in Cyprus and may process or store personal data in Cyprus and other countries where we or our service providers operate. When personal data is transferred internationally, we take steps designed to ensure an adequate level of protection, such as contractual safeguards (including EU Standard Contractual Clauses where appropriate) and technical measures like encryption and access controls.

If you opt in to advertising measurement, the event data described in Section 4 is transferred by encrypted HTTPS connection to Meta Platforms Ireland Limited and relevant Meta processing entities; X Internet Unlimited Company, X Corp., and relevant X processing entities; and TikTok Technology Limited, TikTok Information Technologies UK Limited, and relevant TikTok processing entities. Processing may occur in Ireland, the United Kingdom, the United States, and other countries where those providers operate processing facilities. The transfer occurs when you visit a measured page or complete a registration or purchase. It is used for measurement, conversion deduplication, optimization, and remarketing. MyCream's retention periods are described in Section 4; each provider's retention is governed by its applicable policies and terms.

8. Your Rights

Depending on your location, you may have rights to:

• access, correct, or delete your personal data;

• restrict or object to certain processing;

• request data portability;

• withdraw consent where processing is based on consent.

To exercise your rights, contact us at social@mycream.ai. We may need to verify your identity before responding, and certain legal exceptions may apply.

EEA/UK Additional Rights (GDPR/UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you may have additional rights under GDPR/UK GDPR, including the right to:

• lodge a complaint with your local supervisory authority; and

• contact our Data Protection Officer (DPO) (if appointed) regarding privacy matters.

Cyprus Supervisory Authority: Office of the Commissioner for Personal Data Protection.

9. Adults Only (18+)

The Service is intended for adults only. We may use age-gating and verification measures and may restrict or suspend access if we suspect a user is underage.

10. Security

We maintain reasonable technical and organizational measures to protect personal data, including access controls, encryption where appropriate, and monitoring for security risks. No system is completely secure, but we work to reduce risks.

11. Automated Processing

We may use automated tools to detect fraud, enforce policies, and help keep the Service safe. Where required by law, you may request human review of certain decisions.

12. Third-Party Services

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices, which are governed by their own policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice through the Service or by other reasonable means. Continued use after notice may be treated as acceptance where permitted by law.

14. Contact

• Privacy inquiries: social@mycream.ai
• Privacy Officer (CPO): Shinhyung Cho (Director/CEO)
• DPO: Not appointed
• Address: Chrysanthou Mylona 1, PANAYIDES BUILDING, 2nd Floor, Flat/Office 1, 3030 Limassol, Cyprus

History