Privacy Policy

01 Data Controller

The data controller responsible for your personal data is:

This is a private, non-commercial project. The Operator is not a registered business and does not hold a UID or Gewerbeschein in connection with this Platform.

02 Scope of This Policy

This Privacy Policy applies to all personal data collected through:

• The NightEchoesAI website at nightechoesai.mirrorsoulai.com;
• The beta application form on the website;
• The bug report form on the website;
• The contact / impressum form on the website;
• Any AI companion bot operated via Telegram as part of the NightEchoesAI platform.

This policy does not apply to third-party services you may use to access or interact with the Platform (such as Telegram), which are governed by their own privacy policies.

03 Data We Collect & Why

We collect only the data necessary to operate the Platform and process beta applications. The table below details each category.

We do not collect payment information. We do not build advertising profiles. We do not sell your data to any third party under any circumstances.

04 Legal Basis for Processing (GDPR Art. 6)

All processing of personal data is grounded in one or more of the following lawful bases under Article 6 of the General Data Protection Regulation (EU) 2016/679:

• Art. 6(1)(b) — Contract performance: Processing necessary to evaluate and fulfil the beta participation agreement (application data, contact data).
• Art. 6(1)(a) — Consent: Processing based on your freely given, specific, and informed consent provided when submitting forms or accepting the age/consent gate. You may withdraw consent at any time — see Section 13.
• Art. 6(1)(f) — Legitimate interests: Processing of anonymous usage analytics and technical data for platform development and spam prevention, where these interests are not overridden by your rights.
• Art. 6(1)(c) — Legal obligation: Processing required to comply with applicable Austrian law, including responding to verified legal requests.

For any sensitive data (e.g. content of adult conversations), processing is additionally grounded in Art. 9(2)(a) GDPR — your explicit consent, given by voluntarily initiating and continuing interaction with adult-oriented Companions.

05 Data Processors & Third Parties

We use the following third-party processors. Each processes your data only as necessary to provide their service and is subject to their own privacy policy and, where applicable, EU data protection law.

We do not use advertising networks, social media trackers, Google Analytics, or any other analytics or marketing platform.

06 International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States, via Google's Gmail service.

Such transfers are carried out on the basis of:

• Google's participation in the EU-U.S. Data Privacy Framework, which provides an adequate level of protection as recognised by the European Commission;
• Standard Contractual Clauses (SCCs) adopted by the European Commission, where applicable.

Conversation data processed via Telegram may also be stored outside the EEA. Telegram's international transfer mechanisms are governed by Telegram's Privacy Policy.

07 Anonymous Analytics & Usage Statistics

The Platform collects anonymous usage statistics to understand how Companions are used and to guide development priorities. This data includes:

• Message frequency and session duration;
• Response time and system performance metrics;
• Feature interaction counts (e.g. how often proactive messaging triggers);
• Intimacy level progression patterns (aggregated, not per-user).

This data is fully anonymised before storage — it cannot be linked back to any individual user, Telegram account, or conversation. It is used solely for internal development purposes and is never shared with third parties.

By accepting the Platform's age/consent gate or submitting a beta application, you consent to this anonymous data collection.

08 Conversation Data

Messages sent to AI Companions and the AI-generated responses are processed by the Platform's local AI inference system (Ollama, running on the Operator's own hardware). This means conversation data is not transmitted to third-party AI providers such as OpenAI, Anthropic, or Google AI.

Conversation data is stored locally to enable:

• Persistent memory across sessions (conversation history window);
• Cross-session narrative summaries;
• Entity memory (names, preferences, topics mentioned);
• Intimacy and mood tracking.

Conversation data is retained for as long as you remain an active user of the Platform. Inactive accounts (no messages for 12 months) may have their stored conversation data purged.

09 Cookies & Local Storage

The NightEchoesAI website uses minimal browser storage:

• Age verification (sessionStorage): A flag indicating that you have passed the age gate, stored for the duration of your browser session. Cleared when you close the tab.
• Theme preference (localStorage): Your chosen light/dark theme setting. Stored indefinitely until cleared by you. Contains no personal data.
• Cookie consent decision (localStorage): Whether you accepted or declined cookies. Stored indefinitely until cleared by you. Contains no personal data.

We do not use advertising cookies, tracking pixels, Google Analytics, or any third-party cookies of any kind. No cookie consent is required under ePrivacy Directive for strictly functional storage of this nature, but we inform you of it for full transparency.

10 Data Retention

Upon project discontinuation, all personal data will be deleted within 30 days of the Platform ceasing operation.

11 Data Security

The Operator implements reasonable technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all website and form transmissions;
• Local AI inference ensuring conversation data does not leave the Operator's own infrastructure to third-party AI services;
• Access controls on the web dashboard and bot administration interface;
• No storage of payment information (none is collected).

However, no method of transmission over the internet or method of electronic storage is 100% secure. The Operator cannot guarantee absolute security and excludes liability for security breaches to the fullest extent permitted by law.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, the Operator will notify affected individuals without undue delay as required by GDPR Art. 34.

12 Children & Minors

The Platform is strictly restricted to persons aged 21 years or older. We do not knowingly collect personal data from anyone under the age of 21.

If the Operator becomes aware that personal data has been collected from a person under 21 without valid parental consent, that data will be deleted immediately. If you believe a minor has provided personal data to the Platform, please contact us at unifiedbizdesk@gmail.com immediately.

13 Your Rights Under GDPR

As a data subject under the General Data Protection Regulation (EU) 2016/679, you have the following rights with respect to your personal data:

14 Exercising Your Rights

To exercise any of your rights, contact the Operator at:

We will respond to verified requests within 30 days of receipt. Where requests are complex or numerous, this period may be extended by a further 60 days — we will notify you if this is the case.

We may ask you to verify your identity before processing your request. We will not charge a fee for reasonable requests. Manifestly unfounded or excessive requests may be refused or charged a reasonable administrative fee.

15 Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority. In Austria, this is:

We encourage you to contact us first so we can address your concern directly before escalating to the supervisory authority.

16 Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in our data practices, applicable law, or platform features. The effective date at the bottom of this page will be updated accordingly.

Where changes are material, we will notify active beta users via Telegram. Your continued use of the Platform after any update constitutes acceptance of the revised policy. If you do not accept the revised policy, you must discontinue use of the Platform and request deletion of your data.

17 Contact

For any privacy-related questions, data subject requests, or concerns: