Misty Dialogue AI — Privacy Policy

1Data Controller and Contact Information

Dedicated channel for data protection requests: You may submit requests via "Settings → Privacy → Data Rights" within the app, or email the address above.

2Categories of Personal Information We Collect

We follow the data minimisation principle and only collect information necessary to provide the Service.

1. Account and Identity Information

If you choose to register an account, we collect your email address and custom username. If you use the Service as a guest, no registration information is required, and we will not actively link your identity.

2. Conversation and Interaction Data

Prompts, questions, text content and attachments you upload during conversations (such as documents and images);
Conversation history and your feedback on generated content (likes, dislikes, reports);
Your functional preferences (such as conversation style, output language, history toggle settings).

3. Device and Technical Log Information

Device model, operating system version, browser type, screen resolution;
IP address (used only for regional compliance verification and security risk control), service access time, crash logs and performance metrics.

4. Payment and Order Information

If you use paid features, payment information is processed directly by third-party payment providers. We do not store sensitive payment details such as your full card number or CVV code. We only obtain order numbers, payment status and transaction timestamps for reconciliation and service delivery.

5. Customer Support and Feedback Information

Contact details, problem descriptions and supporting materials you voluntarily provide when contacting support or submitting feedback.

3Purposes and Legal Bases for Data Processing

In accordance with Article 6 of the GDPR and regional privacy laws, we define the scope and legal basis for each processing activity as set out below:

Purpose	Data Processed	Legal Basis (GDPR)
Delivering core services incl. AI conversation & content creation	Conversation data, account info	Art. 6(1)(b) — performance of a contract
Stable operation, troubleshooting & performance optimisation	Device & log info	Art. 6(1)(f) — legitimate interests
Preventing fraud, malicious attacks & account takeovers	IP, logs, device info	Art. 6(1)(f) + statutory obligations
Improving model quality (only with your explicit consent)	Deidentified conversation data	Art. 6(1)(a) — explicit consent
Responding to support enquiries & feedback	Support & feedback info	Art. 6(1)(b) & Art. 6(1)(f)
Complying with lawful judicial / regulatory requests	All relevant information	Art. 6(1)(c) — legal obligation

Important Note: Your conversation data will NOT be used for AI model training by default. Only after you actively enable "Allow use of conversation data to improve our service" under "Settings → Privacy" will your conversation content be deidentified and used for model iteration. You may disable this option at any time. Withdrawing consent will not affect your use of core features.

4Sharing and Disclosure of Data

We do not sell any of your personal information. Data is shared only in the scenarios listed below, and recipients are bound by strict confidentiality and data protection obligations:

Third-party AI Technology Providers — Necessary conversation request data is transmitted to generate responses over encrypted interfaces. We execute Data Processing Agreements (DPAs) prohibiting any other use. The partner list and privacy policy links are in-app under "Settings → Privacy → Third-Party Partners".
Engaged Service Providers — Cloud storage, payment processors and analytics vendors process data solely on our instructions.
Legal and Compliance Requirements — Disclosure only when legally required; we notify in advance where practicable unless prohibited by law.
Business Restructuring and Transfer — Successors remain bound by this Policy; otherwise we notify you and offer account deletion.

5Special AI System Compliance Disclosure (EU AI Act)

Clear AI Identity NoticeYou are clearly notified you are interacting with an AI system; outputs are AI-generated and are not human opinions or professional advice.

Limitations of ContentAI content may contain errors, fabrications or biases; it is not medical, legal, financial or investment advice.

Automated Decision-MakingNo purely automated decisions significantly affecting your rights; in-app personalisation uses only immediate context, no advertising profiles.

Training Data ComplianceBase models use lawfully licensed datasets, proprietary corpora and consented user data — never unlawfully obtained personal information.

6Data Retention Periods

We apply the purpose limitation principle and delete or anonymise data once retention periods expire:

Data Category	Retention Period
Account information	30 days after deletion request, then permanently erased
Conversation history	30 days default; deletable anytime; purged from backups within 30 days
Data for model improvement	Long-term (deidentified, non-reidentifiable)
Logs & security records	12 months for troubleshooting & audits
Statutory obligations	As required by law, deleted once the obligation ends

7Your Data Rights

We uphold statutory data rights for users globally. Submit requests via the in-app "Settings → Privacy → Data Rights Hub" or our contact email; we respond within 30 calendar days.

Global General Rights

Right of accessObtain a copy of your personal data with processing details.

Right to rectificationCorrect inaccurate or incomplete data.

Right to erasureRequest deletion ("right to be forgotten").

Right to portabilityReceive data in a machine-readable format for transfer.

Right to withdraw consentWithdraw any previously granted consent.

EU / United Kingdom (GDPR / UK GDPR)

Right to restriction of processing
Right to object to legitimate-interests processing
Right to lodge a complaint with your Member State DPA

California Users (CCPA / CPRA)

Right to know — categories, sources, purposes and third parties.
Right to deletion — subject to statutory exceptions.
Right to opt out — of "sale" or cross-context ad sharing. We do not sell data nor use it for cross-context ad tracking.
Right to non-discrimination — no degraded service for exercising rights.

Canada, Australia & other jurisdictions

We respect equivalent rights of access, rectification and erasure under PIPEDA, the Privacy Act 1988 and other local laws.

8Safeguards for Cross-Border Data Transfers

Your data may be processed on servers outside your country, including the United States and EU Member States. All transfers comply with local legislation:

Transfers outside the EU rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
Transfers to the US rely on the Data Privacy Framework (DPF) adequacy determination or equivalent agreements.
All transfers undergo Data Protection Impact Assessments to ensure equivalent protection.

9Children's Privacy Protection

The Service is intended for users aged 13 and older and is not directed to children under 13, in compliance with COPPA and the GDPR. We do not knowingly collect personal information from children under 13. If we discover such information, we delete it permanently without delay. Guardians who believe a child has submitted data may contact us via the support email.

10Data Security Measures

End-to-end transmission with TLS 1.3 encryption; storage protected by AES-256.
Strict access controls — only authorised personnel where necessary.
Regular security audits, penetration testing and DPIAs.
Mandatory staff training, signed confidentiality and breach accountability procedures.

11Cookies and Similar Technologies

We use strictly necessary Cookies to operate core functions, plus a small number of analytical Cookies to improve experience. You may disable non-essential Cookies via browser settings or the in-app privacy page, though some features may not function fully.

12Policy Updates

We may revise this Policy to reflect regulatory changes, service upgrades or business adjustments. Material changes are notified at least 7 days in advance via in-app alerts and email. Continued use after the effective date constitutes acceptance of the updated terms.

13Enquiries and Feedback

If you have questions, comments or data rights requests relating to this Privacy Policy, please contact us at:

Dedicated Email [email protected]