Date of Revision: June 15, 2026

Aithalon Labs Ltd (“FlirtaGPT,” “we,” “us,” or “our”) is the data controller for the processing implemented through the website accessible at flirtagpt.ai and any affiliated websites or applications to which users may be redirected from flirtagpt.ai (the “Services”). FlirtaGPT is a company duly incorporated in the Republic of Cyprus, having its registered address at Lapathou, 6, Strovolos, 2027, Nicosia, Cyprus, and registered with the Cyprus Department of Registrar of Companies and Intellectual Property under company number HE 493820.

This Privacy Notice describes how FlirtaGPT collects, uses, discloses and handles your personal data and the rights you have under: the EU General Data Protection Regulation 2016/679 and Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (together “EU GDPR”); the United Kingdom Data Protection Act 2018 and Privacy and Electronic Communications Regulations 2003 (together “UK GDPR”); the Swiss Federal Act on Data Protection 235.1 (“FADP”); the Cyprus Law 125(I)/2018 implementing the EU GDPR; and applicable non-European data-protection laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, and equivalent laws of other US states (collectively, “Applicable Data Protection Law”).

By using the Services, you acknowledge that you have read and understood this Privacy Notice and our separate Cookies Notice available at flirtagpt.ai/cookies.

Language. This Privacy Notice is originally drafted in English. Translations are provided for convenience only. In the event of any conflict between the English version and any translation, the English version shall prevail, except where applicable consumer or data-protection law of your country of habitual residence requires otherwise.

Quick contact. Data Protection Officer: [email protected]. General support: [email protected]. Cyprus supervisory authority: Office of the Commissioner for Personal Data Protection — [email protected] — www.dataprotection.gov.cy.

Table of Contents

• 1.  Definitions
• 2.  Data Protection Contact
• 3.  Personal Data We Collect
• 4.  Purposes of Processing — Lawful Bases (GDPR Articles 6 and 9)
• 5.  Authentication via Google and Discord
• 6.  We Do Not Train Our AI Models on Your Personal Data
• 7.  Special Category Data (GDPR Article 9) and Explicit Consent
• 8.  Automated Decision-Making and Article 22 GDPR
• 9.  Sub-Processors and Recipients of Personal Data
• 10. International Data Transfers
• 11. Retention Periods
• 12. Your Rights under EU/UK/Swiss Data Protection Law
• 13. California Privacy Rights (CCPA/CPRA)
• 14. Other US State Privacy Rights
• 15. Children’s Data — Underage Policy
• 16. Marketing Communications
• 17. Data Security
• 18. Changes to this Privacy Notice
• 19. Contact and Complaints

1. Definitions

Capitalised terms not defined in this Privacy Notice have the meaning given to them in the Terms of Service available at flirtagpt.ai/terms. The following definitions apply:

“Content” means information you provide in order to register as a User and in the course of using the Services, including your Personal Data, prompts and inputs to AI Companions, and outputs generated in response.

“Controller” means the natural or legal person which determines the purposes and means of the Processing of Personal Data, namely FlirtaGPT for the Services. “Controller” includes “Business” as defined under CCPA/CPRA.

“Data Subject” means an identified or identifiable natural person. “Data Subject” includes “Consumer” as defined under CCPA/CPRA and equivalent terms under other US state privacy laws.

“Personal Data” means any information relating to an identified or identifiable natural person, including name, contact details, account identifiers, IP address, location data, and any other identifier; “Personal Data” includes “Personal Information” under CCPA/CPRA.

“Processing” means any operation performed on Personal Data, whether or not by automated means, including collection, recording, storage, retrieval, use, disclosure, alignment, restriction, erasure or destruction.

“Special Category Data” means data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, within the meaning of Article 9(1) GDPR. “Sensitive Personal Information” under CCPA/CPRA and “Sensitive Data” under other US state privacy laws have analogous meanings.

“Sub-Processor” means any third party engaged by FlirtaGPT to process Personal Data on our behalf in connection with the Services, within the meaning of Article 28 GDPR.

2. Data Protection Contact

You can contact our Data Protection Officer at [email protected]. We have also designated a dedicated point of contact for all data-protection matters, and you may contact us about any privacy question, the exercise of your data-subject rights, or any complaint regarding the processing of Personal Data at the addresses below.

Data protection contact: [email protected]

All questions, requests for the exercise of data-subject rights, and complaints regarding the processing of Personal Data should be directed to us at the address above.

3. Personal Data We Collect

3.1 Data you provide directly

When you register for and use the Services, you may provide us with the following Personal Data:

Account-creation data: email address (mandatory), encrypted password (for email/password accounts only), nickname (1–20 characters), gender (male or female, used for grammatical agreement in AI Character responses).

Onboarding data: the timestamp at which you confirmed you are aged 18 or over (*age_verified_at*), and the age-confirmation record described in Section 15 (confirmation timestamp, IP address, user-agent and device identifier).

Conversation Content: the inputs you submit to AI Companions and the outputs the AI Characters generate in response, including text messages, image-generation requests, and any text used by the per-message text-to-speech feature.

Payment data: for Premium subscriptions and Credits purchases, basic billing information collected by our payment processor (see Section 9). FlirtaGPT does not store full payment-card numbers; payment-card processing is handled by our PCI-DSS-compliant payment processor, and we receive only a tokenised reference, the last four digits of the card, and the card brand for the purpose of receipt and chargeback handling.

Support correspondence: the content of messages you send to our support, complaints, appeals, DPO, or DSA inboxes, plus your email address.

3.2 Data we collect automatically

Technical data: IP address, user-agent (browser type and version, operating system), device type, language preference, time-zone, referrer URL, the pages and features accessed within the Services, the date and time of access, and event-level telemetry such as latency and error codes.

Authentication and session data: session identifier, CSRF tokens, refresh tokens, sign-in count, last sign-in timestamp and IP, sign-in provider (email, Google, Discord).

Usage and ledger data: Credits balance, Credits ledger entries (purchase, consumption, stipend grant, refund), Premium subscription status, *premium_expires_at*, and aggregated usage indicators (number of messages sent, photos viewed).

Cookies and similar technologies: see our separate Cookies Notice at flirtagpt.ai/cookies.

3.3 Data from third parties

Identity providers: when you sign in via Google or Discord, we receive the data described in Section 5.

Payment processor: transaction status, decline reasons, chargeback notifications.

Email-deliverability infrastructure: bounce and complaint notifications from AWS Simple Email Service via Amazon SNS, used to maintain our email-suppression list.

4. Purposes of Processing — Lawful Bases (GDPR Articles 6 and 9)

The following table sets out the purposes for which we process Personal Data, the categories of data involved, the lawful basis under Article 6 GDPR, and where Special Category Data is involved, the condition under Article 9(2) GDPR. Each purpose is paired with its specific lawful basis as required by Article 13(1)(c) GDPR and confirmed by the supervisory practice of the Italian Garante per la Protezione dei Dati Personali.

4.1 We do not use legitimate interest for AI training

Legitimate interest under Article 6(1)(f) GDPR is not used as a lawful basis to train, fine-tune or evaluate any AI model on User Personal Data. See Section 6.

5. Authentication via Google and Discord

FlirtaGPT supports three authentication methods: email and password, Google, and Discord. The OAuth-provider sections below describe exactly what data each provider transmits to us, how we use that data, and what we do not do with it. These disclosures satisfy the Google API Services User Data Policy and the Discord Developer Policy.

5.1 Sign in with Google

When you sign in with Google, we receive the following data from Google in respect of the OpenID Connect openid email profile scopes: your Google account email address, profile name, profile picture URL, language preference, and the OpenID *sub* identifier.

Limited use disclosure (Google API Services User Data Policy). Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only for account creation, authentication, account communication, and fraud prevention. We do not use Google user data to train, fine-tune or evaluate AI models. We do not transfer Google user data to third parties except as necessary to provide or improve the user-facing features of the Services, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users. We do not use or transfer Google user data for serving advertisements, including retargeted, personalised, or interest-based advertising. We do not allow humans to read Google user data unless we have obtained your affirmative consent, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for limited internal operations purposes such as debugging where the data has been aggregated or de-identified.

5.2 Sign in with Discord

When you sign in with Discord, we receive the following data from Discord in respect of the identify email scopes: your Discord user identifier, username, global display name, avatar hash, locale, and verified email address.

We do not share Discord Data with any ad network, data broker, or other advertising or monetisation-related service. We do not use Discord Data to train, fine-tune or evaluate AI models. We retain Discord-derived data only for the duration of your Account and delete it on Account deletion. You may request deletion of your Discord-derived data by contacting [email protected] or by deleting your Account.

5.4 No automatic linking across providers

Each OAuth identity is associated with a single FlirtaGPT Account and is not automatically linked across providers. If you sign in with a different provider using a different email address, a separate Account will be created.

6. We Do Not Train Our AI Models on Your Personal Data

FlirtaGPT does not train its AI models on your Personal Data.

We do not use any of the following to train, fine-tune, evaluate or otherwise develop the large language model, the text-to-speech model, or any other generative AI model used by the Services:

1. Inputs you submit through the chat interface, including prompts, messages, and roleplay text;
2. Outputs generated by AI Companions in response to your inputs;
3. Account profile data, including nickname, gender, language preference, age-verification artefacts, payment-related data, support correspondence, or any data received from Google, Discord or X via OAuth sign-in;
4. Text-to-speech audio generated for your Account;
5. Account-deletion feedback or subscription-cancellation feedback (which is in any event recorded anonymously at write).

The behaviour of our AI Companions is defined exclusively by character-specific system prompts, persona files and language hints maintained by our internal AI specialists; this material is authored manually and is not derived from User data. We may use de-identified, aggregated technical telemetry (such as latency metrics, queue depths, and error rates) to monitor and improve the reliability and performance of the Services. Such telemetry does not include the substance of your conversations or any data through which you may be identified.

If we ever change this position, we will provide you with prior notice and, where required by Applicable Data Protection Law, obtain your prior explicit consent before any such change takes effect. Any such change will additionally be subject to the safeguards set out in Section 10 of our Terms of Service, including a minimum of thirty (30) days’ prior notice, the ability to opt out of AI training in your account settings, and the exclusion of minors’ data.

7. Special Category Data (GDPR Article 9) and Explicit Consent

Conversations through the Services may include data revealing your sex life or sexual orientation, which is Special Category Data under Article 9(1) GDPR. We do not actively solicit this data and the Services are designed to function without it. However, given the nature of an adult AI-companion platform, we cannot exclude that you will share such data in the course of your conversations.

By continuing to use the Services after being presented with this notice and by ticking the box at signup marked “I expressly consent to the processing of Special Category Data that I may share through conversations, on the basis of Article 9(2)(a) GDPR”, you provide your explicit consent to this processing.

You may withdraw this consent at any time, without affecting prior lawful processing, by contacting [email protected] or by deleting your Account. Withdrawal of consent will result in suspension of access to the Services because we cannot reliably operate the Services if we are unable to process Conversation Content.

We process Special Category Data only on the lawful bases set out in the table at Section 4 above and never for purposes incompatible with the basis on which it was originally collected. We do not perform sensitive-trait profiling, do not infer political opinions, religious beliefs, or health status, and do not share Special Category Data with any advertising or marketing third party.

7.1 Maryland Online Data Privacy Act — strict minimisation of Sensitive Personal Information

Under the Maryland Online Data Privacy Act (“MODPA”), Sensitive Personal Information may be collected, used, and shared only when strictly necessary to provide or maintain the specific product or service requested by the consumer, and may not be sold. FlirtaGPT collects and processes Sensitive Personal Information from Maryland residents (including data revealing sex life or sexual orientation that may be shared in conversations) only as strictly necessary to provide the AI Companion Services that you request. We do not sell Sensitive Personal Information of Maryland residents, do not use it for targeted advertising, do not use it to train or develop AI models, and do not share it with third parties for any secondary purpose. This strict-necessity posture is supported by our overall commitment in Section 6 not to train AI models on User Personal Data.

8. Automated Decision-Making and Article 22 GDPR

Conversational responses generated by the Services are produced by automated artificial-intelligence systems without individual human review. The Services do not use these conversational outputs to make decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR.

Where any feature of the Services does involve solely automated decision-making producing such effects — for example, automated suspension of an Account on safety grounds following CSAM-detection or repeat-violation triggers — you have the right under Article 22(3) GDPR to: (a) obtain human intervention by contacting [email protected]; (b) express your point of view in writing; and (c) contest the decision. The internal complaint-handling process under Article 20 of the Digital Services Act is described in Section 8 of the Terms of Service.

9. Sub-Processors and Recipients of Personal Data

FlirtaGPT engages the following Sub-Processors under Article 28 GDPR data-processing agreements. Each Sub-Processor is contractually bound to process Personal Data only on FlirtaGPT’s documented instructions and to apply appropriate technical and organisational security measures. The list below reflects the position as at the effective date of this Privacy Notice and may be updated from time to time. The current list is set out in the table below:

9.1 Other recipients

Beyond the Sub-Processors listed in Section 9, we may disclose Personal Data to: (a) our professional advisers (lawyers, accountants, IT and public-relations advisers) where strictly necessary to obtain advice or assistance; (b) competent supervisory, judicial, regulatory or law-enforcement authorities in compliance with legal obligations or court orders; (c) the National Center for Missing & Exploited Children (“NCMEC”) in respect of CSAM in accordance with applicable law; (d) any successor or acquirer in the event of a corporate restructuring, merger, sale of assets, or change of control, with notice to affected Users; and (e) recipients to whom you direct disclosure or to whom disclosure is necessary to provide a feature you have requested.

We do not sell Personal Data, and do not share Personal Data for cross-context behavioural advertising, within the meaning of CCPA/CPRA and equivalent state laws.

10. International Data Transfers

The majority of our processing takes place within the European Economic Area, principally in France, Germany and Cyprus. Where Personal Data is transferred to a Sub-Processor or recipient outside the EEA, we ensure that one of the following transfer mechanisms is in place pursuant to Chapter V GDPR:

• (a) an adequacy decision of the European Commission (for example, transfers to Switzerland, the United Kingdom under the UK adequacy bridge, or the EU-US Data Privacy Framework where the recipient is certified);
• (b) the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), supplemented where necessary by additional technical, organisational, and contractual safeguards following a transfer impact assessment;
• (c) where applicable, the UK International Data Transfer Agreement or Addendum to the EU SCCs;
• (d) where applicable, the Swiss FDPIC-recognised version of the SCCs.

You can request a copy of the safeguards applied to a specific transfer by contacting [email protected].

11. Retention Periods

We retain Personal Data only for as long as necessary for the purposes for which it was collected, in accordance with the following retention schedule:

Retention periods may be updated from time to time based on changes in business needs or regulatory requirements; in such cases we will update this Privacy Notice.

12. Your Rights under EU/UK/Swiss Data Protection Law

If you are located in the EEA, the United Kingdom, Switzerland, or in any jurisdiction whose law applies the GDPR or an equivalent regime, you have the rights set out in this Section 12. To exercise any right, contact [email protected]. We will respond without undue delay and in any event within one (1) month of receipt of your request, extendable by two (2) months for complex or numerous requests with notice to you.

12.1 Right of access (Article 15 GDPR)

You may request a copy of your Personal Data and information regarding the purposes of processing, the categories of data, the recipients, the retention period, the source of the data, the existence of automated decision-making, and your other rights.

12.2 Right to rectification (Article 16 GDPR)

You may request that we correct inaccurate or incomplete Personal Data we hold about you. Most account information can be edited directly in your profile settings.

12.3 Right to erasure (“Right to be forgotten”, Article 17 GDPR)

You may request that we erase your Personal Data where (a) it is no longer needed for the purposes for which it was collected; (b) you withdraw consent and there is no other lawful basis; (c) you successfully object to processing; (d) the data has been processed unlawfully; or (e) erasure is necessary to comply with a legal obligation. We may decline to erase Personal Data where processing is necessary for compliance with a legal obligation, for the establishment, exercise or defence of legal claims, or where one of the other exemptions in Article 17(3) GDPR applies. Account deletion is available directly in your account settings and is processed immediately as described in Section 11.

12.4 Right to restriction of processing (Article 18 GDPR)

You may request that we suspend processing of your Personal Data while (a) we verify the accuracy of the data; (b) the processing is unlawful and you oppose erasure; (c) we no longer need the data but you require it to establish, exercise or defend a legal claim; or (d) you have objected to processing pending verification of overriding legitimate grounds.

12.5 Right to data portability (Article 20 GDPR)

Where processing is based on consent or on a contract and is carried out by automated means, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format, or that we transmit it directly to another controller where technically feasible.

12.6 Right to object (Article 21 GDPR)

You may object at any time, on grounds relating to your particular situation, to processing of your Personal Data based on legitimate interests under Article 6(1)(f) GDPR. Where you object, we will cease that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. You may object at any time to processing for direct-marketing purposes, in which case we will cease such processing immediately.

12.7 Right to withdraw consent (Article 7(3) GDPR)

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. Where consent is withdrawn for Special Category Data processing under Section 7, we will be unable to continue providing the Services to you.

12.8 Right not to be subject to solely automated decisions (Article 22 GDPR)

See Section 8.

12.9 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The Cyprus Office of the Commissioner for Personal Data Protection is reachable at:

Office of the Commissioner for Personal Data Protection

Iasonos 1, 1082 Nicosia, Cyprus

Email: [email protected]

Website: www.dataprotection.gov.cy

UK Information Commissioner’s Office: ico.org.uk. Swiss Federal Data Protection and Information Commissioner: edoeb.admin.ch.

13. California Privacy Rights (CCPA/CPRA)

This Section 13 supplements the rest of this Privacy Notice with disclosures and rights specific to California residents under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”).

13.1 Categories of Personal Information collected and disclosed

In the preceding 12 months, we have collected the categories of Personal Information described in Section 3 of this Privacy Notice. We have disclosed those categories to the Sub-Processors and recipients described in Section 9. Categories of Personal Information collected, by reference to Civil Code § 1798.140(v):

(A) Identifiers: email address, account identifier, IP address, OAuth-provider identifiers.

(B) Customer Records information: name where provided, billing address, payment-card last 4 and brand, transaction history.

(C) Commercial information: products purchased, Credits balances and ledger entries.

(F) Internet or other electronic network activity information: pages and features accessed, time and duration, technical telemetry.

(G) Geolocation data: country and city derived from IP address; we do not collect precise geolocation.

(H) Audio, electronic, visual, thermal, olfactory, or similar information: text-to-speech audio (synthetic, generated by us; not your voice).

(K) Inferences: derived language preference, derived country.

(L) Sensitive Personal Information (Civil Code § 1798.140(ae)): account log-in credentials (encrypted password) and data revealing sex life or sexual orientation that may be shared in conversations.

13.2 Purposes for which Personal Information is collected

As described in Section 4 of this Privacy Notice. We do not sell or share Personal Information for cross-context behavioural advertising. We do not use Sensitive Personal Information to infer characteristics about you.

13.3 California rights

California residents have the following rights, free of charge and without discrimination for exercising them:

• (a) Right to know what Personal Information has been collected, used, disclosed, sold or shared (§ 1798.110, § 1798.115).
• (b) Right to delete Personal Information collected from you (§ 1798.105).
• (c) Right to correct inaccurate Personal Information (§ 1798.106).
• (d) Right to opt out of sale or sharing of Personal Information (§ 1798.120).
• (e) Right to limit use and disclosure of Sensitive Personal Information to the purposes specified in § 1798.121(a).
• (f) Right to opt out of automated decision-making technology where used to make decisions producing legal or similarly significant effects (CPPA ADMT regulations effective 1 January 2026).
• (g) Right to non-discrimination for exercising any CCPA right (§ 1798.125).

13.4 “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information”

FlirtaGPT does not sell Personal Information and does not share Personal Information for cross-context behavioural advertising. Nevertheless, the homepage and footer of flirtagpt.ai display two links titled “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information”, allowing California residents to formalise their preferences.

13.5 Universal Opt-Out Mechanism — Global Privacy Control

FlirtaGPT honours the Global Privacy Control (“GPC”) signal as a valid opt-out preference signal under § 1798.135(b). Where your browser transmits the GPC signal, we treat it as an opt-out of sale and sharing without further action on your part.

13.6 No financial incentives

FlirtaGPT does not offer financial incentives in exchange for Personal Information.

13.7 Authorised agents and exercise of rights

To exercise any California right, contact [email protected]. We will verify your identity using account-based verification or, where you do not have an Account, by matching information you provide against information we hold. You may use an authorised agent; we may require written authorisation and verification of the agent’s identity. We will respond within 45 days, extendable by an additional 45 days with notice.

14. Other US State Privacy Rights

Residents of states with comprehensive privacy laws have rights similar to those described in Section 13. The table below sets out the principal rights and the contact channel for exercising them; the substance of each right and the applicable exceptions are governed by the relevant state law.

To exercise any state-law right, contact [email protected] and identify the state of your residence and the right you wish to exercise. We will respond within the statutory deadline applicable to your state.

15. Children’s Data — Underage Policy

FlirtaGPT is intended exclusively for adults aged 18 years or older. We do not knowingly collect Personal Data from any individual under the applicable minimum age threshold. The following individuals are not authorised to use the Services and must not sign up for an Account:

1. any individual under 13 years of age (United States Children’s Online Privacy Protection Act of 1998, “COPPA”);
2. any individual under 16 years of age who is a citizen or resident of the European Economic Area, the United Kingdom or Switzerland (Article 8 GDPR and equivalent UK/Swiss provisions);
3. any individual under 18 years of age in any jurisdiction (FlirtaGPT minimum age, regardless of any lower local age of digital consent);
4. any individual prohibited by applicable law from accessing online adult content in their jurisdiction.

15.1 Age confirmation

The Services are strictly limited to adults aged 18 or over (or the age of majority in the User’s jurisdiction, whichever is greater). At registration, every User must affirmatively confirm, through an age-gate prompt, that they are 18 years of age or older. Access to explicit content additionally requires a paid subscription purchased with a valid payment card, at which point the User confirms that the card is registered in their own name and that they are authorised to use it. We record the age-confirmation timestamp, IP address, user-agent string and device identifier at the time of confirmation. We may, at our sole discretion, apply additional verification measures where we have reason to believe a User may be under 18, or where required by applicable law or by our payment processors.

15.2 Removal of underage data

If we learn that we have collected Personal Data from any individual below the applicable minimum age threshold, we will delete that data without undue delay and block the relevant Account. To report a suspected underage User, contact [email protected].

15.3 No targeted advertising or profiling of minors

FlirtaGPT does not engage in targeted advertising. In any event, we do not engage in any targeted advertising, profiling, or sale of Personal Data of any individual we know or reasonably suspect to be under 18 years of age.

16. Marketing Communications

We may send you marketing communications about the Services and similar offers, in accordance with applicable law. Where required (including in respect of recipients in the EEA, UK, Switzerland, and certain US states), we obtain your prior consent before sending marketing communications. Where permitted under the “soft opt-in” rule for existing customers, we may send marketing communications about similar Services with an opt-out at every point of contact.

You may unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by contacting [email protected]. Opting out of marketing does not affect transactional and account-related emails (such as receipts, security notices and Service updates), which are necessary for the performance of the contract with you.

17. Data Security

We implement appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include: TLS 1.2 or higher in transit; encryption at rest for backups and object storage; private-bucket access with signed URLs of five-minute lifetime for media; HttpOnly, Secure, SameSite cookies; Argon2id password hashing for email/password Accounts; Total Time-based One-Time Password multi-factor authentication for the admin panel; Cloudflare Access identity-aware proxy in front of administrative routes; Web Application Firewall and DDoS protection at the edge; principle-of-least-privilege access controls within the team; quarterly review of access rights; centralised log aggregation; 30-day production log retention; daily database backups with weekly restore tests; SNS-signature verification on inbound webhooks; rate-limiting on authentication and write endpoints; CSRF protection; SQL-injection and XSS hardening; and a documented incident-response procedure.

In the event of a Personal Data breach likely to result in a risk to the rights and freedoms of natural persons, we will notify the Cyprus Office of the Commissioner for Personal Data Protection without undue delay and in any event within 72 hours pursuant to Article 33 GDPR, and will notify affected Data Subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms pursuant to Article 34 GDPR.

18. Changes to this Privacy Notice

We may revise this Privacy Notice from time to time. The current version is identified by the “Date of Revision” at the top of this document. Where we make material changes (for example, changes that affect the categories of data we collect, the purposes of processing, or the lawful bases relied on), we will notify you by email or by an in-Service notice at least thirty (30) days before the changes take effect, and where consent is required for the change, we will obtain your prior consent before any new processing begins. Continued use of the Services after the effective date of a non-material change constitutes acknowledgement of the revised Privacy Notice.

19. Contact and Complaints

Controller: Aithalon Labs Ltd

Registered address: Lapathou, 6, Strovolos, 2027, Nicosia, Cyprus

Cyprus registration number: HE 493820

Data Protection Officer: [email protected]

General support, formal complaints and moderation appeals: [email protected]

DSA point of contact, for both users and Member State authorities (Articles 11 and 12 of the Digital Services Act): [email protected]

Cyprus supervisory authority:

Office of the Commissioner for Personal Data Protection

Iasonos 1, 1082 Nicosia, Cyprus

Email: [email protected]

Website: www.dataprotection.gov.cy

Other supervisory authorities:

United Kingdom Information Commissioner’s Office — ico.org.uk

Swiss Federal Data Protection and Information Commissioner — edoeb.admin.ch

California Privacy Protection Agency — cppa.ca.gov