Privacy Policy
Effective 3 November 2026 · Version 2026-11-03.1
Contents
- 1. What we collect
- 2. What we do not collect
- 3. Why we may use your data
- 4. Who receives your data
- 5. How long we keep it
- 6. Closing your account
- 7. Storage on your device, measurement, and your choice
- 8. Where it is processed
- 9. Your rights
- 10. Children
- 11. Security
- 12. Changes to this policy
- 13. Who we are and contact
This policy explains what personal data ALEKSEI KIM PR BEOGRAD (a sole proprietor registered in the Republic of Serbia), of Vojvode Vlahovića 039U, apt. 14, Zvezdara, Belgrade, Republic of Serbia ("Flirty", "we", "us"), collects when you use flirty.club and the Flirty app, why, how long we keep it, who else receives it and what rights you have. We are the controller of your data. Questions and requests: support@flirty.club.
We never sell your data. We do not sell personal data, we do not share your conversations with advertisers, and no advertising or analytics company runs on Flirty. Our providers receive only what they need to do a job for us.
1. What we collect
Data you give us
| Data | Why we use it |
|---|---|
| Your email address (stored as a hash and an encrypted copy) | To sign you in with a code, to send you the codes and receipts you ask for, and to find your account |
| Your Google account email, when you sign in with Google | To create and recognise your account. We receive the verified email only |
| Your nickname, your time zone and the interests you pick | To address you, to order the people we show you, and to time what she says |
| What you write in conversations, and your reactions and tips | It is the service: we need it to reply, to show you the chat and to bill you |
| What you ask her for: photos, clips, unlocks | To produce them and to charge for them |
| What you tell us when you report something or write to us. On the report form without an account: an email address, and a name if you give one | To handle your report and to send you the receipt and the decision. The address and the name are deleted once the decision letter is sent |
Data the service creates about you
| Data | Why we use it |
|---|---|
| Short notes about you that a language model extracts from your messages (for example your name, what you like, plans you mentioned), kept per person | So she remembers you |
| Her private notes about the conversation (what she wants to say next, what thread to continue) and a level that measures how the conversation goes | To keep replies consistent. You do not see these notes |
| Pictures and clips we generated for you, and a record of what each of your unlocks delivered | To show your collection and to account for what you bought |
| Your wallet: balance, every movement (what was spent on what, bonuses, returns), your Premium periods | To run billing, to answer disputes and for accounting |
| Your orders and payment status. We do not receive your wallet keys or your name from the payment processor | To credit what you paid for and to keep accounting records |
| Your browser's push subscription, if you switch notifications on | To tell you she wrote or that your picture is ready |
| Your session and the page you came from | To keep you signed in and to learn which channel brought you |
Data from your device and your use of the app
| Data | Why we use it |
|---|---|
| The country of your connection | to know where visitors come from. We keep the two-letter country code only, never your address |
| Which link brought you (UTM marks, referring website, landing page), and the country of your request | to know which advertising worked and where. This is a source and a country, not a profile: the country is read from the address of your request and only its two letters are kept, never the address |
| The steps you take in the app — pages that bring you in, personas you open, videos you watch to the end, payment windows you open | to improve the service. See §7 for how you choose |
| Technical logs: request time, path, error class and the IP address the request came from | To keep Flirty running, to find faults and to stop abuse |
| Your IP address | To limit sign-in attempts. It is used briefly for that and is not stored with your account |
Sensitive data. What you are into, and what you say in a sexual conversation, can reveal things the law treats as special, such as a person's sex life or orientation. We use it only to give you the service, as set out here. By accepting our terms, you give us your explicit consent to use the interests you pick for this purpose, and by writing to a persona you ask us to process what you write to give you the service. You can withdraw your consent by clearing your interests, or by deleting your account.
2. What we do not collect
- No third-party analytics, advertising or tracking scripts run on this service today. None, apart from the Google sign-in prompt described next. The Google sign-in prompt. Where measurement is allowed for you (§7) and you are not signed in, the page loads Google's sign-in script from Google, so your browser contacts Google and that script may store its own data in your browser. What Google receives and keeps is governed by Google's own policy. Where measurement is not allowed for you, the script is not loaded. This is a description of how it is built rather than a promise never to change it, and if it changes you will be asked before it does, because consent is what a tag would make owed (§7).
- We do not sell personal data, and we do not share what you talk about with advertisers or partners.
- No profile of you is built from what you say to target you or to sell to others. We do measure the service: which link brought you, what worked, what broke. That is a legitimate interest, not a portrait of you.
- We collect no precise location, no contacts, no photos or files from your device, no voice and no biometric data. You cannot upload images or files to Flirty.
3. Why we may use your data
| What we do | Legal basis (UK GDPR / GDPR) |
|---|---|
| Sign you in, reply to you, remember you, produce and deliver what you ask for, bill you | Performance of our contract with you |
| Use the interests you pick, and process intimate content you choose to share in conversations | Your explicit consent (Article 9(2)(a)): you give it when you accept the terms and when you choose to write it |
| Keep the service safe: moderation, fraud and abuse prevention, handling reports, staff reading of conversations for quality and safety | Our legitimate interests in running a safe and lawful service. You may object (section 9) |
| Measure and improve the service, find faults, find out which marketing worked | Our legitimate interests; measurement that needs your device is subject to your choice (section 7) |
| Keep accounting and tax records, answer authorities | Legal obligation |
| Establish, exercise or defend legal claims | Our legitimate interests |
We do not use your data for automated decisions that have legal or similarly significant effects on you. Software decides what a persona says, what you see first, and checks some requests and pictures. A person decides about suspending an account or a complaint, and you can contest it (see the Complaints and Content Removal Policy).
4. Who receives your data
We use a small number of providers (processors) to run Flirty. They may use your data only on our instructions. The list, with the data each receives, is in Subprocessors. In summary:
- Language-model providers (through OrcaRouter) receive your recent messages, her persona card and your remembered notes, to write replies and notes.
- Image and video generation (Siray) receives the picture prompts and reference pictures of the persona. The prompts are written from your conversation.
- Payment processing (NOWPayments) receives the amount, our order number and the return links. It does not receive your name or email from us.
- Email delivery (Resend) receives your email address and the text of the letter: sign-in codes and receipts.
- Google receives data from your browser if you use Google sign-in (section 7).
- Error reporting (Sentry), where it is switched on, receives the error reports of our servers (Subprocessors).
- Hosting is on Google Cloud infrastructure.
- Browser push services (Google, Mozilla, Apple, Microsoft) deliver notifications you switched on.
- Our staff may read conversations where needed for quality, safety, abuse, a report or fixing a fault. Each time staff open a page of a conversation, we log who read it and when. The same staff see your account, wallet and orders to support you.
- Authorities and advisers, where the law requires or to protect rights, and a buyer if the business is sold, under this policy or one at least as protective.
We do not sell personal data and we do not share it for advertising.
5. How long we keep it
| Data | How long |
|---|---|
| Conversations (including chats you deleted or started over), her notes about the conversation, remembered notes about you, your level with her, your collection, follows, likes, choices, interests, nickname | While your account exists. Deleted when you close it (section 6) |
| A chat you delete or start over | We keep a record of it while your account exists (it can contain messages and purchases made in it), and you may ask us to delete it sooner (section 9) |
| Copy of the conversation inside the journal of a generation task (the prompts and the text sent to the model for a reply or a picture) | Removed after 7 days, or at once when you close your account. The task record, costs and status stay, without your account |
| Pictures and clips generated for chats, and the text prompts given to the renderer | Kept with the picture. They are pictures of the persona, not of you |
| Wallet movements, Premium periods, orders, payment records | 10 years after the end of the year of the record, as Serbian accounting and tax law requires. After you close your account they are linked to no email or name |
| Detailed measurement of steps in the app ("client events") | 30 days, then only daily totals with no identifier |
| Your measurement and activity records (orders, registrations, unlocks, activity counts) | While your account exists; the detailed activity events of them are removed after 30 days, and the per-account totals (activity days, counts of orders and facts) are kept as long as your account exists. When you close your account, what remains is kept only under a random number that leads to nobody, for our totals |
| Server logs and metrics | About 7 days |
| Messages waiting to be published between our own systems, and their copies in the message broker | Removed 7 to 14 days after sending |
| Backups and disk snapshots of our servers | Removed within 30 days as they rotate. A restored backup is brought up to date with the accounts closed since, so a closed account does not come back |
| Our record that a staff member read a conversation page | While the conversation exists |
| A complaint you made, and its decision | While needed to handle it and to defend legal claims. When you close your account it is no longer linked to it |
| The email address and name you gave on the report form without an account | Until the decision letter is sent, then deleted, and in any case no longer than 90 days after the report; also deleted if the receipt or the decision could not be delivered after 7 days of tries. The address is not logged. The report and its decision stay without them |
| Push subscription | Until you turn it off, the browser drops it, or you close your account |
| Sign-in codes | Valid for 10 minutes, single use |
| Session | 30 days |
6. Closing your account
You can delete your account in the app. When you do, we delete at once your email address, nickname, profile, consent record and interests, and our systems then delete, within minutes, your conversations (including chats you deleted or started over), what she remembered about you, her notes about you, your collection, your follows, likes and choices, your push subscriptions and the emails we stored for you. Copies between our systems and in logs expire within 7 days, and backups within 30 days. We keep your wallet movements, Premium periods and orders, linked to no email or name, for as long as accounting and tax law requires, and a complaint you made, without your account, while it can matter for a legal claim. Our measurement records are kept only under a random number that leads to nobody. Tokens and Premium time that remain are lost, and are not refunded. A short record that an account existed is kept so we can handle fraud and legal claims.
7. Storage on your device, measurement, and your choice
Storage we need. We store a few things in your browser so the service works: the address you last signed in with, that you dismissed the install prompt, the card in front of you, a message you are typing, the link that brought you here (for this tab only), and your answer about measurement below. Plus a session cookie that keeps you signed in. None of it is tracking, and no third party sets anything. The one exception: where measurement is allowed for you and you are not signed in, Google's sign-in prompt may store its own cookies for that prompt (see §2).
Measurement. We count how the service is used — which links bring visitors, which personas are opened, which videos are watched to the end, which payment windows are opened — with our own code on our own servers. No advertising or analytics company sees it, and we set no third-party cookie.
Where you are decides how we ask. When a page is served we work out the country of your connection from its address, using IP geolocation by DB-IP; we keep the two-letter country code and never the address.
- In the European Economic Area, the United Kingdom, Switzerland, Brazil, Canada, South Korea, Turkey, South Africa, India and China, and wherever we cannot tell the country, we ask first. Until you agree, we store nothing on your device for measurement, and we send only counts that carry no identifier and cannot be put together into a path through the service. If you agree, we keep a random identifier for as long as the tab is open, so the steps of one visit can be counted together, and if you are signed in, the steps are linked to your account. Closing the tab deletes the identifier.
- Everywhere else, measurement is on, and you can turn it off. If your browser sends Global Privacy Control or Do Not Track, we treat that as turning it off.
Turned off or declined, we send only the counts without an identifier described above. You can change your answer at any time under Measurement choices at the foot of every page; we remember it on this device for 12 months. We keep the detailed records of measurement for 30 days, and after that only daily totals with no identifier.
8. Where it is processed
Flirty runs on Google Cloud infrastructure in Europe. Some of our providers (for example in the United States) process data outside the UK and the EEA. Where they do, we rely on adequacy decisions, standard contractual clauses or an equivalent safeguard the law accepts. You may ask us for a copy at support@flirty.club.
The country of a request is found with a database that ships inside the service, so your address is not sent to anyone to find it. IP geolocation by DB-IP.
9. Your rights
Under the GDPR, the UK GDPR and similar laws you may ask us to: give you a copy of your data (access) and in a portable form; correct it; delete it; restrict its use; stop processing it based on our legitimate interests (object); and stop using it where you gave consent (withdraw consent). You can change your nickname and interests, switch off notifications and measurement, and delete your account yourself in the app. For anything else, write to support@flirty.club. We may ask you to confirm your identity from the email on the account. We answer within one month, and may extend it by up to two months for complex requests, telling you within the first month. It is free unless the request is manifestly unfounded or excessive.
If you are in California (and other US states with privacy laws), you may ask to know what we collect, to delete it, to correct it, and to opt out of the sale or sharing of your data. We do not sell or share personal data for advertising. We will not treat you worse for using your rights. We honour Global Privacy Control signals as an opt-out of measurement.
You may complain to the data-protection authority where you live or work (in the UK, the Information Commissioner's Office). We would appreciate the chance to fix it first.
10. Children
Flirty is for adults. We do not knowingly collect data from anyone under 18. If you think a child uses Flirty, tell us at support@flirty.club or use Report in the app. We delete the account and its data.
11. Security
Your email is stored as a hash with an encrypted copy. Connections to Flirty are encrypted. Access to administration is limited to named staff and protected by a code sent to their email, and their acts are recorded. If a personal data breach puts your rights at risk, we tell you and the regulator as the law requires, in the time it allows (72 hours for the regulator under the GDPR).
12. Changes to this policy
We publish changes here with a new date. Where a change materially reduces your protection, we tell you before it takes effect.
13. Who we are and contact
The controller of your personal data is the operator of Flirty:
Operator. ALEKSEI KIM PR BEOGRAD, a sole proprietor (preduzetnik) registered in the Republic of Serbia.
| Registered address | Vojvode Vlahovića 039U, apt. 14, Zvezdara, Belgrade, Republic of Serbia |
| Registration number (matični broj) | 66812782 |
| Tax ID (PIB) | 113420561 |
| support@flirty.club |
Representatives. The operator is established outside the EU and the UK. Where the GDPR or the UK GDPR requires a representative in the EU or the UK, we will name it here before it applies. Until then, write to the email above.