Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information: your email address and basic profile (for example, a display name), and, if you sign in with a third party, the information that provider shares with us.
• Content you provide: your chats with AI characters, prompts, characters you create, and images or videos generated for you.
• Usage and device data: log data such as IP address, browser and device type, pages viewed, and interactions, collected to operate and secure the Service.
• Payment information: when you purchase, our payment provider (Stripe) processes your card details. We do not store full card numbers; we receive limited data such as subscription status and the last digits of your card.
• Cookies and local storage: small identifiers used for sign-in, security, and preferences (such as your chosen language).

2. How we use information

We use information to:

• Provide, personalize, maintain, and improve the Service;
• Generate AI responses, images, and videos in response to your prompts;
• Process payments, manage subscriptions and tokens, and prevent fraud;
• Keep the Service safe — including moderating content to detect and prevent prohibited uses (such as content involving minors or sexually explicit material), and enforcing our Terms;
• Communicate with you, including sending login codes and service or support messages;
• Comply with legal obligations and protect our rights and users.

3. AI processing of your content

To generate responses and media, your prompts and related content are processed by artificial-intelligence models, which may be operated by us or by third-party AI providers acting on our behalf. We share only what is needed to produce the output you request. We do not sell your content.

4. How we share information

We share information only as follows:

• Service providers who process data on our behalf under contract — for example: payments (Stripe), email delivery (Resend), hosting and content delivery / storage (Cloudflare), and AI model inference providers.
• Legal and safety: when required by law, legal process, or to protect the rights, safety, and property of Tualma, our users, or the public — including reporting illegal content such as child sexual abuse material to the appropriate authorities.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.
• We do not sell your personal information.

5. Cookies and local storage

We use cookies and browser local storage that are necessary for the Service to function — for example, to keep you signed in, secure sessions, and remember preferences like your language. You can control cookies through your browser, but disabling essential ones may break the Service.

6. Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the Service, and thereafter as required to comply with legal obligations, resolve disputes, and enforce our agreements.

You can delete your account from your settings. When you do, we soft-delete and anonymize your account data so it is no longer associated with you; some records may be retained in de-identified or aggregated form, or where retention is legally required (for example, transaction records).

7. Your rights and choices

Depending on where you live — including under Brazil’s LGPD, and comparable laws such as the EU GDPR and the California CCPA — you may have rights to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can exercise many of these directly in your account settings, or by contacting us at [email protected]. We will respond as required by applicable law.

8. Security

We use technical and organizational measures — such as encryption in transit and access controls — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. International data transfers

We and our providers may process and store information in countries other than yours. Where we transfer personal data internationally, we take steps to ensure it receives an adequate level of protection as required by applicable law.

10. Children’s privacy

The Service is for adults (18+) only. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact [email protected] and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. We will update the “Last updated” date above and, for material changes, provide additional notice where appropriate.

12. Contact

For privacy questions or to exercise your rights, contact us at [email protected].