Privacy Policy

This explains what Smitten collects, why, and what you can do about it. The data controller is Smitten.

What we collect

• Your messages and the replies. The full conversation is stored so it is still there when you return.
• A random reference. Placed in a cookie on your device to recognise you between visits. It is not linked to your name.
• Message counts and credits. How many messages you have sent and how many you have bought.
• Purchase records. When you buy a pack, we store the Stripe transaction reference and the number of messages bought.

We do not ask for your name, and you do not create an account. If you buy a pack, Stripe collects your email address and card details to take payment. We never see or store your card details.

Your messages are sent to an AI provider

To produce a reply, the text of your conversation is sent to xAI, which operates the language model behind the characters. Do not send anything you would not want processed by a third party. Please do not send passwords, financial details, or information about your health or identity.

Why we are allowed to hold it

• To provide the service you asked for (performance of a contract): your messages, credits and purchase records.
• Our legitimate interests: keeping the service working, preventing abuse and fraud.
• Legal obligation: keeping records of transactions for tax and accounting.

Cookies

Smitten sets one cookie, cr_anon. It holds a random reference so we can recognise your browser and show you your conversation and your remaining messages. It is strictly necessary for the service to work and is not used for advertising or tracking across other websites. It lasts 90 days. We do not use analytics or advertising cookies.

Who else processes your data

• Supabase — database hosting. Your conversations are stored on servers in Ireland.
• Vercel — website hosting and delivery.
• xAI — generates the replies. Message content is sent to them, and may be processed outside the UK and EEA under appropriate safeguards.
• Stripe — payment processing, if you buy a pack.

We do not sell your data or share it for advertising.

How long we keep it

Conversations are kept while your reference is active, and for up to 12 months after your last message, then deleted. Purchase records are kept for 6 years as tax law requires. You can ask us to delete your conversation sooner.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Email [SUPPORT EMAIL] and we will respond within one month.

Because we do not know who you are, you will need to make the request from the same browser, or give us the reference from your cookie, so we can find the right conversation.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Contact

Smitten. Email [SUPPORT EMAIL].