EB Financial Holdings, LLC ("EB Financial Holdings, LLC", "we", "us", or "our") is the Controller for the processing carried out through the PrettyFace website and applications and any affiliated property to which you may be redirected (the "Services"). EB Financial Holdings, LLC is organized under the laws of Delaware, U.S., with its registered office at 1375 E Hampden Ave Unit 516 Englewood, CO 80113.
The Services are an online application that uses artificial-intelligence systems to generate virtual, fictional characters (the "AI Companions") with whom you ("you") can chat and exchange messages. The Services also include other media such as images, video, and voice notes. Parts of the Services require you to create an account and/or hold a paid plan or credit pack.
This Privacy Notice explains how EB Financial Holdings, LLC collects, uses, discloses, and handles your Personal Data for the Services and, as applicable, your rights under the European Union's General Data Protection Regulation 2016/679 and the UK GDPR (together, "GDPR"), and under non-European data-protection laws including the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA") — collectively, "Applicable Data Protection Law".
By using the Services, you confirm that you have read and understood this Privacy Notice and our Cookie Policy, which is incorporated here by reference. The Services are for adults only. You must be at least 18 years old, or the age of majority in your jurisdiction if higher, to use them (see Section 7 and our 2257 Compliance Statement).
Contents
- Definitions
- Purposes of Personal Data Processing
- AI-Generated Content
- Disclosing Your Personal Data
- Cookies & Tracking
- Retention Period
- Personal Data of Minors
- Third-Party Links
- Your Rights
- International Data Transfers
- Data Security
- Changes to This Privacy Notice
- Contacting Us
1. Definitions
Capitalized terms not otherwise defined in this Privacy Notice or in the GDPR have the following meanings:
- "Content" — the information you provide when registering as a User and in the course of using the Services, including your Personal Data, the inputs you enter in conversations with AI Companions, and the outputs generated in response.
- "Consent" — any freely given, specific, informed, and unambiguous indication of your wishes by which you signify agreement to the Processing of your Personal Data.
- "Controller" — the entity that determines the purposes and means of the Processing of Personal Data (here, EB Financial Holdings, LLC). For CCPA purposes, "Controller" includes "Business".
- "Personal Data" — any information relating to an identified or identifiable individual, such as name, email address, account identifiers, or location data.
- "Processing" — any operation performed on Personal Data, whether or not by automated means (for example, collection, storage, use, disclosure, or erasure).
- "User", "you" — a person who visits or uses the Services.
- "Visitor" — anyone browsing the Services without an account or subscription.
2. Purposes of Personal Data Processing
We process Personal Data only on a valid legal basis. If you do not provide data we require, we may be unable to provide some or all of the Services.
| Purpose of Processing | Categories of Personal Data | Legal basis |
|---|---|---|
| Account creation — registering you for the Services. | Email address; encrypted password; username; user gender; signup provider and creation date/time; the result of any age-verification process where applicable. | Consent; performance of a contract; compliance with legal obligations. |
| Account management — operating and securing your account. | Detected country/city and currency; token or credit balance; sign-in dates, IP addresses, and sign-in count; last account-update timestamp. | Performance of a contract; our legitimate interest in operating the account. |
| Provision of the Services — chat, image and media generation, voice, and AI Companion customization. | Your preferences for AI Companion attributes; prompts and messages you enter (to the extent they contain Personal Data); outputs generated in response. | Consent; performance of a contract. |
| Support — answering your requests and resolving technical issues. | The content of your support messages and your email address; device and browser information; relevant Content where needed to investigate an issue. | Our legitimate interest in addressing your queries. |
| Improvement & analytics — quality assurance, debugging, and product development. | Aggregated, de-identified, or anonymized usage information and interaction logs (interaction logs are deleted after 30 days). | Our legitimate interest in improving the Services and detecting errors and misuse. |
| Payment processing — taking payment for subscriptions and credits, and issuing refunds. | Billing details and transaction data, processed by third-party payment providers. The provider used for a transaction is identified at checkout. We do not store full card numbers. | Performance of a contract; our legitimate interest in optimizing payment processing. |
| Direct marketing — sending updates, offers, and newsletters to users who have opted in. | Email address; first and last name (where provided); whether an email was opened. | Our legitimate interest in marketing our own similar Services, or your consent. |
| Safety & moderation — detecting abuse, enforcing our policies, and reporting unlawful activity (including CSAM) to authorities. | Requests and prompts to the AI models; flagged Content and the action taken; Content metadata (time, originating IP); account data and history; information required by authorities in appropriate cases. | Compliance with legal obligations; performance of a contract; our legitimate interest in preventing misuse. |
| Legal & accounting — record-keeping, compliance with court orders, and exercising or defending legal rights. | Contact and payment data, credentials, and any information within the scope of a lawful request or a potential dispute. | Compliance with legal obligations; our legitimate interest in defending our rights. |
2.1 Sensitive content
Conversations with AI Companions may, by their nature, include intimate, sexual, or otherwise sensitive material that you choose to share. We treat this content with care and restrict internal access to it. Because such content is inherently sensitive, please share only what you are comfortable storing on an online service. Where your inputs constitute sensitive personal data under Applicable Data Protection Law, we rely on your consent to process them.
3. AI-Generated Content
PrettyFace generates text, voice, images, and video using AI systems. When you interact with an AI Companion:
- your prompts and conversation history are processed to generate responses;
- we retain conversations linked to your account so you can revisit past interactions and so we can enforce our safety policies;
- you may delete individual conversations, or your entire account, at any time (see Section 6); and
- we do not sell your conversation data. Some messages may be processed by third-party AI providers strictly to generate responses, under their own terms; those providers may receive the content of your messages.
4. Disclosing Your Personal Data
We disclose Personal Data to third parties only:
- to provide the Services to you;
- where we or the third party have a legitimate interest in the disclosure;
- where you have given consent; or
- where required to comply with a legal obligation.
We rely on third-party service providers to operate the Services. Disclosure may involve transferring data outside your country, including to the United States. We may share information with the following categories of recipient:
- Cloudflare, Inc. — content delivery, DDoS protection, edge security, and object storage (privacy policy).
- Resend, Inc. — transactional email such as confirmations, password resets, and notifications (privacy policy).
- Payment service providers — one or more third-party processors, which may vary by region and payment method; the provider used for a transaction is disclosed at checkout.
- Professional advisers — lawyers, accountants, and similar advisers, where necessary.
- Legal and regulatory authorities — where required by Applicable Data Protection Law.
- A successor entity — in the event of a merger, acquisition, or sale of assets, in which case your data remains subject to this Privacy Notice.
We do not sell, rent, or trade your Personal Data, and we do not share it for cross-context behavioural advertising or for any third party's independent marketing purposes without your consent.
5. Cookies & Tracking
We use cookies and similar technologies to operate the Services (for example, authentication and session management) and to understand how they are used. Full details, and instructions for managing your preferences, are in our Cookie Policy.
6. Retention Period
We retain your Personal Data for as long as your account exists or for as long as necessary to fulfil the purposes for which it was collected, unless a longer period is required by law. We generally retain:
- Account data — until you request deletion, or for up to three years after your last account activity, whichever is sooner.
- Conversation history — until you delete the conversation or your account.
- Generated media — until you delete it from your library, or for up to 90 days after generation if not saved.
- Financial and transactional data — for the period required by applicable tax and accounting law (typically up to ten years).
- Marketing data — until you withdraw consent, or for up to two years after your last interaction.
- Data subject to a legal hold — for as long as necessary in connection with a potential or actual legal dispute or a mandated retention period.
To delete your account and associated data, go to Settings → Account → Delete Account, or email [email protected].
7. Personal Data of Minors
EB Financial Holdings, LLC does not provide the Services to, or knowingly collect Personal Data from, anyone under 18 years of age (or the age of majority in their jurisdiction, if higher). If we learn that the Services have been accessed by a minor in violation of our policies, we will delete the relevant data as soon as possible and block the account. Please also see our Underage Policy.
8. Third-Party Links
The Services may contain links to third-party websites, plug-ins, or applications that we do not control. Clicking those links may allow third parties to collect data about you. This Privacy Notice does not apply to them, and we encourage you to read the privacy notice of any third-party site you visit.
9. Your Rights
Subject to Applicable Data Protection Law and depending on where you live, you have the following rights. To exercise any of them, see Section 13.
9.1 Right of access
You may request a copy of the Personal Data we hold about you, together with information about how and why we process it, who we share it with, how long we keep it, and the source of the data where we did not collect it from you.
9.2 Right to rectification
You may ask us to correct inaccurate Personal Data and to complete incomplete data. We may need to verify the accuracy of the new data you provide.
9.3 Right to erasure
You may ask us to delete your Personal Data where it is no longer needed, where you withdraw consent and there is no other legal ground, following a successful objection, or where it has been processed unlawfully. We may decline where retention is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.
9.4 Right to restrict processing
You may ask us to suspend processing of your Personal Data — for example, while we verify its accuracy, or while we consider an objection you have raised.
9.5 Right to data portability
Where processing is based on your consent or on a contract and is carried out by automated means, you may ask to receive your Personal Data in a structured, commonly used, machine-readable format, or to have it transferred to another controller.
9.6 Right to withdraw consent
Where we rely on your consent, you may withdraw it at any time and free of charge. Withdrawal does not affect the lawfulness of processing carried out before you withdrew. If you withdraw consent, we may be unable to provide the Services in full.
9.7 Right to object
You may object to processing based on our legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your rights, or that the processing is needed to establish, exercise, or defend legal claims. You may object to direct marketing at any time, and we will stop.
9.8 California rights (CCPA / CPRA)
California residents may request to know, access, delete, or correct their personal information, opt out of any "sale" or "sharing" (we do neither), and limit the use of sensitive personal information. We will not discriminate against you for exercising these rights.
9.9 Right to lodge a complaint
You may lodge a complaint with your local supervisory or data-protection authority. We ask that you contact us first so that we can try to resolve your concern.
10. International Data Transfers
The Services are operated from Delaware, U.S.. If you use them from elsewhere, your Personal Data will be transferred to and processed in Delaware, U.S. and in other countries where our service providers operate, including the United States and the European Union. Where we transfer the Personal Data of users in the EEA, the United Kingdom, or Switzerland to a country not recognised as providing adequate protection, we rely on Standard Contractual Clauses approved by the European Commission, together with additional safeguards where appropriate. You may request a copy of the relevant safeguards by contacting us (see Section 13).
11. Data Security
We implement appropriate technical and organisational measures designed to protect Personal Data against accidental loss and unauthorised access, alteration, or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Changes to This Privacy Notice
We may revise this Privacy Notice from time to time to reflect changes in our practices or in Applicable Data Protection Law. We will post the revised version with an updated revision date and, where the changes are substantial, give you notice by email or in-app at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.
13. Contacting Us
If you have any question or complaint about this Privacy Notice, or wish to exercise any of your rights, please contact our privacy team:
- Email: [email protected]
- Post: EB Financial Holdings, LLC, 1375 E Hampden Ave Unit 516 Englewood, CO 80113
We will make every reasonable effort to respond to legitimate requests within one month. If your request is particularly complex, or you have made several requests, it may take longer; in that case we will let you know and keep you updated. We have not appointed a dedicated Data Protection Officer; please direct all privacy enquiries to the contact above.