Aimee Says Privacy Policy
Aimee Says Privacy Policy
Effective: October 13, 2026 | Aimee Says Inc., a Delaware corporation
At a glance
· We do not sell your personal information.
· We do not train any AI on your chats or other data.
· Signed-in chats are not stored by our AI provider. Anonymous chats are handled differently - see Section 9.
· You own your content.
· Aimee Says staff do not access your data in the ordinary course.
· We will resist overbroad legal requests and, where lawful, notify you before producing your data.
These highlights summarize key points but are not a substitute for the full Policy. Please read the full Policy below.
1. About this Policy
This Privacy Policy describes how Aimee Says Inc. ("Aimee Says," "we," "us") collects, uses, retains, and protects information about the people who use our service. References to "you" mean a user of the service. We are the data controller for the personal information described in this Policy. The legal bases on which we rely are described in Section 4.
2. Definitions
· Personal information - information that identifies, relates to, or could reasonably be linked to you
· Content - what you create or upload using the service, including chats, Events, Binders, My Story, and uploaded documents
· Processing - any handling of personal information, including collection, use, disclosure, storage, and deletion
· Subprocessor - a third party we engage to process personal information on our behalf
· AI provider – the 3rd party company whose models generate Aimee's responses and perform the automated processing described in Section 9.
· Rights request - a request to exercise one of your privacy rights described in Section 17, such as access, correction, deletion, or export.
3. Sensitive information
We treat all user content as sensitive personal information and apply commercially reasonable best practices to secure it. Those practices are described in Section 14 and evolve over time. We do not claim certification under SOC 2, ISO 27001, or HIPAA.
4. Lawful basis (EU, EEA, and UK users)
We process personal information to provide the services you request, including creating and maintaining your account, generating responses, storing information you choose to save, and operating security features. For these activities, our lawful basis under Article 6 GDPR is generally the performance of our contract with you and our legitimate interests in maintaining and improving the security and reliability of the service.
Some information you choose to provide may qualify as special category data under Article 9 GDPR (for example, information relating to health, sexual life, or experiences of abuse). Where required by law, we process this information based on your explicit consent when you choose to provide it for use within the service.
We may also process limited information where necessary to comply with legal obligations, protect rights and safety, or respond to lawful requests.
5. Information we store for free and paid accounts
To provide the service and manage your account (not anonymous chats), we store:
Account information. Your display name (which may be a pseudonym), your email address, and either a password (hashed) or your Google account identifier.
Service content. Your chat history, Events, Binders, My Story, and any documents you upload or that are generated during your use of the service.
Information we record about you. To personalize your experience and maintain continuity across sessions, the service records and infers certain facts about you from your activity - for example, details you share during chats.
Payment information (paid users only). Cardholder name, email, billing address, the last four digits of the payment card, and payment history. Full card numbers are held by Stripe; we never see them.
Correspondence. Any correspondence between you and our team.
6. Usage and device data
To operate the service reliably and understand how it is used, we collect:
· Device and connection data - IP address, device type, browser, and referring page
· Usage data - pages viewed, clicks, product events, feature usage, and timestamps
· Email engagement - opens and link clicks for transactional emails (such as password resets and account notices), and emails for newsletter subscribers
We rely on analytics and email-delivery providers for this processing; see Section 11 for subprocessor categories.
7. Application logs and backups
We maintain application logs for the operation of the service. We also maintain backups of our production systems for disaster-recovery purposes. Deleted data may persist in those backups for up to 14 days after deletion before it is purged.
8. Affiliate attribution
We use Rewardful to attribute affiliate referrals. The Rewardful first-party cookie sets an anonymous identifier to credit a referring affiliate when a user signs up. The Rewardful cookie does not contain or transmit your name, email address, IP address, or any other personally identifiable information to the affiliate.
9. AI providers and AI training
9.1 Our models
We do not train any Aimee Says model on your content.
9.2 What we send to our AI provider
To generate Aimee's responses and organize your information, we send our AI provider what is needed for that task. This includes your messages, the text extracted from documents you upload, screenshots you upload, and relevant details from your account. Our agreement with the provider prohibits it from training on your content.
9.3 Signed-in accounts (free and paid)
For signed-in accounts, our AI provider operates under a zero data retention arrangement. It processes your content only to return a result to us. It does not store your prompts or Aimee's responses, and it does not keep them in its abuse-monitoring logs.
There is one exception, which applies to every customer of the provider: if the provider's systems flag an uploaded image as possible child sexual abuse material, the provider keeps that image for manual review, as required by U.S. federal law.
9.4 Anonymous chat
Anonymous chat (no account) runs under a different arrangement with our AI provider, called private retention with private safety processing. The provider's automated safety systems may keep an encrypted copy of some or all anonymous conversations. These copies are:
· encrypted before they are stored, and readable only by automated safety systems in a secured, verified environment;
· never reviewed by people at the provider unless the law requires it.
· never used to train AI models; and
· unreadable after 30 days, when the provider destroys the encryption keys.
Anonymous chats are not linked to an account, so we cannot find or delete these copies on request. If you want the zero data retention protections in Section 9.3, create a free account. You can sign up with a pseudonym.
9.5 Automated safety screening
For signed-in accounts, every message and uploaded document is checked by our AI provider's moderation tool, under the same zero data retention arrangement. The results are stored only in our own systems. We store the result with your account: which safety categories, if any, were flagged, and the associated scores. The screening does not block or restrict your use of the service.
9.6 Changes to our AI provider's terms
Our AI provider sometimes changes its data-handling options. If a change would let it keep content from signed-in accounts beyond what Section 9.3 describes, we will update this Policy and notify registered users before the change applies to your content.
10. Human review of Content
No one at Aimee Says reads your Content in the ordinary course. We access content to help you only at your request. Our AI provider's staff do not review your content, except when child sexual abuse material is identified as described in Section 9.3.
11. Subprocessors
We engage subprocessors - third parties that process personal information on our behalf - in the following categories:
· Hosting and infrastructure
· Database
· Background job processing
· AI processing (response generation, content analysis, document text extraction, and automated safety screening)
· Payment processing
· Email delivery (transactional and marketing)
· Authentication and single sign-on
· Analytics and product feedback
· Affiliate attribution
We require each subprocessor to protect personal information consistent with this Policy. If we engage a new subprocessor that processes user content, we will update this Policy and notify registered users of material changes.
12. How we use your information
We use your information to:
· provide and operate the service
· maintain and improve the service
· respond to your inquiries
· send transactional messages (billing, account, security)
· send marketing messages to which you have opted in
· detect and defend against fraud and security threats
· comply with legal obligations and protect rights
· analyze anonymized and aggregated metadata to understand needs and improve the service
13. We do not sell your information; we do not share it for advertising
We do not sell your personal information. We do not share your personal information with advertising networks or for cross-context behavioral advertising. There are no Meta, Google Ads, TikTok, or Reddit pixels on the service. The single attribution mechanism we use is the first-party affiliate cookie described in Section 8.
14. Security
We use commercially reasonable safeguards appropriate to the sensitivity of the information, including:
· TLS encryption of data in transit
· encryption at rest at the infrastructure level by our hosting, database, and storage providers
· log retention configured per Section 15
· routine security review and pre-publication review of changes that affect user data
· access to user content is limited to a small number of authorized personnel, all bound by confidentiality obligations
We do not claim SOC 2, ISO 27001, or HIPAA compliance.
15. Retention
Data | Retention |
Anonymous chat sessions | Deleted from Aimee Says within 24 hours. Encrypted safety copies held by our AI provider become unreadable after 30 days - see Section 9.4 |
Active accounts and their content (free or paid) | Retained while your account is in use |
Deletion or data wipe you request | Immediate - see the Data Deletion Policy |
Inactive* free accounts | Deleted after 365 consecutive days of inactivity*, following 14 days' advance notice |
Cancelled paid subscriptions | Converted to a free account; not deleted on cancellation. A converted account then follows the inactivity rule above |
Payment records (Stripe) | Retained by Stripe per tax and anti-money-laundering law, typically 7 years |
Application logs | Retained for operational purposes; purged in regular maintenance cycles every 14 days |
Backups | Deleted data persists in backups up to 14 days, then purged |
Usage and analytics data | Raw analytics events up to 14 months; aggregated, non-identifiable reports indefinitely. |
Content sent to our AI provider (signed-in accounts) | Not retained by the provider (zero data retention), except flagged images described in Section 9.3 |
Automated safety screening results | Retained with your account; after account deletion, kept only as non-identifiable metadata |
* "Inactivity" is determined as described in our Data Deletion Policy (no new account activity, chat sessions, document uploads, events, or binders).
On deletion, your content and identifying information are removed and only non-identifiable metadata is retained for aggregate analytics. See our Data Deletion Policy for details.
16. Breach notification
We commit to notifying users in the EU within 72 hours of becoming aware of a personal data breach affecting their information (the GDPR minimum), and to notifying users elsewhere without undue delay, consistent with applicable law.
17. Your rights
17.1 Everyone
You may access, correct, delete, and export your personal information, and you may complain to a relevant regulator.
17.2 California (CPRA)
You have the right to know, to delete, to correct, to opt out of sale or share (we do not sell or share for cross-context behavioral advertising), to limit our use of sensitive personal information, and not to be discriminated against for exercising these rights.
17.3 Other US states
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Tennessee, and other states with comprehensive privacy laws have substantially similar rights. We respond within 30 to 45 days, depending on the law that applies.
17.4 EU and UK
Under the GDPR and UK-GDPR, you have rights to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. You may also complain to your local supervisory authority.
18. Identity verification
18.1 Rights requests
When you exercise a right while signed in to your account, your authenticated session confirms the request and no separate verification is needed. If you make a request by email, we will take reasonable steps to verify that it comes from you. We do not require a government-issued ID; the specific steps depend on the nature of the request and the information we hold about you.
18.2 Account change or information requests
Most of this information can be gathered yourself from your authenticated session, which confirms the request and no separate verification is needed. However, you can reach out to us by email at support@aimeesays.com.
To help protect your privacy and prevent unauthorized access, we may ask you to verify your identity before making changes to your account, subscription, billing settings, or stored information. The easiest way to verify your identity is to contact us using the email address associated with your account.
If you no longer have access to the email associated with your account, we may ask you to confirm two pieces of information related to your account, such as:
· approximate account creation date or subscription start month;
· subscription plan information;
· last payment date or recent charge amount;
· limited account activity details.
We only request the minimum information necessary to confirm account ownership. We do not require government-issued identification for standard account support.
19. Rights request response time
When you exercise a right in the app while signed in, it takes effect immediately. For requests made by email, we aim to respond within 30 days and will not exceed 45 days; if we need additional time, we will explain why and give you an updated timeline.
20. Representative
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
· United Kingdom (UK)
· European Union (EU)
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/18683620905
21. Cookies and Global Privacy Control
We use a consent management platform that presents a granular cookie banner to users in the EU, UK, and where else required, with categories for strictly necessary, analytics, and marketing. We honor Global Privacy Control (GPC) signals from your browser as opt-outs for users in jurisdictions where GPC has legal effect.
22. Children
Aimee Says is not directed to anyone under 18. We do not knowingly collect information from anyone under 13. If we learn we have, we will promptly delete it. Parents or guardians may report concerns to support@aimeesays.com.
23. International data transfers
Our infrastructure is located in AWS us-east-2. If you are located outside the United States, your information will be transferred to and processed in the United States. For users in the EU and UK, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum with each relevant subprocessor.
24. Law enforcement
We require valid legal process before producing personal information in response to a law-enforcement request. A warrant is required for the contents of communications; metadata may be produced under a subpoena. We will resist requests that appear overbroad or unlawful and may challenge them in court where appropriate. We will notify you before producing your data unless we are legally prohibited from doing so.
25. Marketing communications
When you create an account, you are subscribed to our newsletter and may unsubscribe at any time. Where the law requires your consent (for example, in the EU and UK), we instead ask you to opt in before sending you any newsletter. Every newsletter includes an unsubscribe link, and you can manage your preferences in account settings. Transactional emails (billing, security, account) are not marketing and cannot be unsubscribed from while your account is active. We do not send marketing SMS.
26. Teams
Users invited to a Teams account see all content in the inviter's account. For the purposes of the sharing, the inviter is the controller of the shared content and is responsible for whom they invite.
27. Changes to this Policy
We may update this Policy. Material changes will be highlighted on the site and emailed to registered users. The change is effective on the date specified. A summary of each change is listed at the end of this Policy.
28. Privacy Complaints
I f you believe we have handled your personal information in a way that does not comply with this Policy or applicable data protection law, you may submit a privacy complaint directly to Aimee Says before contacting a regulator.
You can submit a complaint by emailing support@aimeesays.com with the subject line "Privacy Complaint."
29. Contact
For all privacy, rights-request, and data-deletion matters: support@aimeesays.com.
Summary of changes
October 12 2026 - Added Section 9.2-9.6 describing how our AI provider handles content for signed-in accounts and anonymous chat, automated safety screening, and notice of provider changes; updated Sections 10, 11 and 15.
June 22, 2026 - Policy restructured and published.
© 2023-2026 Aimee Says Inc. All rights reserved.
