Privacy Policy

RunChatLab (the Service) is provided by RunChatLab (we, us). Contact for all privacy matters: support@runchatlab.com.

This policy covers two groups of people:

• Creators, who sign up and use the Service. For their account data we are the controller.
• Fans, who message a creator on a supported fan platform (the Supported Platform) where the creator has connected the Service. Where applicable, for the processing needed to reply on the creator's behalf we act as the creator's processor, on the creator's instructions; the creator is the controller and is responsible for telling fans about it. For safety, fraud and abuse prevention, billing and legal compliance we act as a controller in our own right.

Replies to fans are written by an AI system following the creator's settings and are sent automatically. The Service is for adults only.

• Account data: email address, name, sign in method (email and password or Google sign in), account creation and login times.
• Persona and settings: what you enter to configure your Agents (persona details, tone, limits, schedules, prices, safety settings), and the descriptions of your gallery items and voice notes.
• Connection data: your creator ID and handle on the Supported Platform and the access tokens that let the Service act for you (stored server side only).
• Usage and billing data: messages sent and characters counted, model usage and cost, sales and revenue per Agent, settlement records, and the record of the connection terms you accepted (version, time and a fingerprint of the text).
• Support data: messages you send to our support.
• Technical data: IP address, browser and device information and logs needed to run and secure the Service.
• Country at sign up: when you create your account, we determine your country from your IP address, for statistics. We keep only the country, not the address itself.

• Identifiers: the fan's ID, username and display name on the Supported Platform.
• Conversation: the messages exchanged with the creator's account, including text the AI wrote.
• Memory: facts the fan chose to share in the chat (for example a first name, interests, plans), kept so later replies stay consistent.
• Relationship and purchases: subscription status, items offered, bought, tipped or refunded with this creator, and amounts. Payments are handled by the Supported Platform; we never receive card details.
• Photos and voice notes the fan sends, only when the creator has enabled this feature. The file is passed to an AI provider to be read or transcribed; we keep the resulting text, not a copy of the file.
• Safety signals: flags when a message suggests the fan may be under 18, may be in crisis, is asking to move off the platform, or disputed a payment.

Sensitive information. Conversations on adult platforms can reveal information about sex life or sexual orientation, or about health (for example in a crisis). We do not seek this information, use it only to reply within the conversation and to protect the fan, and never use it for advertising or profiling across creators.

Separation. Each creator's fan data is kept separate and is never shared with or used for another creator. Only the recent part of a conversation and the stored memory are sent to the AI model for each reply. We do not sell fan data and do not train our own AI models on it.

• Providing the Service (creator account, Agents, replies, sales, memory): performance of our contract with the creator (Art. 6(1)(b) GDPR). For fan data, on the creator's instructions as processor, relying on the creator's legal basis.
• Safety and protection of minors and people in crisis: our legitimate interest and, where applicable, legal obligations and the vital interests of the person (Art. 6(1)(f), (c), (d)).
• Billing, settlement, accounting and tax: contract and legal obligation (Art. 6(1)(b), (c)).
• Security, fraud and abuse prevention, debugging and improving the Service: legitimate interest (Art. 6(1)(f)).
• Support and service messages: contract and legitimate interest.
• Legal claims and requests from authorities: legal obligation and legitimate interest.

We do not sell personal data or share it for cross context behavioural advertising. We share it with:

• AI model providers, which read the recent part of a conversation and write a reply, and read photos or voice notes a fan sends when the creator enables it.
• Cloud hosting providers, which host the Service, its database, sign in, file storage and scheduled tasks.
• The supported fan platform, which delivers messages and processes fan payments; it is an independent controller and we exchange data with it through its API.

The providers we use today:

We update this list before we add or replace a provider. We may also disclose data to professional advisers, to a buyer in a merger, acquisition or sale of assets, or where the law requires it, including reports of suspected child sexual abuse material to the competent authorities.

Personal data is processed in the countries listed above, which may not offer the same protection as your country. Where the GDPR or UK law applies, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer mechanism, together with supplementary measures where needed. You can ask us for more information about these safeguards at support@runchatlab.com.

• Fan conversations and fan memory (messages, the log of why the AI replied as it did, and facts a fan shared): kept while useful to run the Service for that creator, and automatically deleted after 365 days without activity from that fan with that creator. Activity means a message, a purchase or a tip from the fan; messages the AI or the creator send do not count. They are also deleted when the Agent is deleted, when the creator's account is deleted, and on a verified fan request. If a fan said they are under 18, we keep only that marker, so the protection stays on if they write again.
• Agent settings, products and uploaded product files: while the Agent exists.
• Creator account: while the account is open. After the creator deletes it, there is a 30 day recovery window; then the account, its Agents, conversations, fan memory, safety flags, usage and sales statistics, voice note library, gallery details, uploaded files, campaigns, support messages, platform connection and stored platform tokens are permanently deleted. The platform connection and its message notifications are switched off at the moment the account is deleted.
• Safety flags (possible minor, crisis, off platform requests): until the creator account is deleted, so a safety history is not lost when one Agent is deleted.
• Platform connection tokens: deleted when the creator disconnects or deletes the account.
• Records of accepted terms: the accepted version, the time and a fingerprint of the text, linked to the account id only, for up to 6 years after the account is deleted, as proof of agreement. The IP address and browser details of the acceptance are deleted with the account.
• Settlement, billing and tax records: up to 7 years, or longer if tax or accounting law requires. When an account is deleted, the settlement records and the account totals are kept in anonymised form (amounts and dates, without the creator's identity) and the per sale records are deleted. When a fan's data is deleted on request, sales records are kept without the fan's id.
• Support messages and fan data requests: deleted 24 months after the last update, or with the creator account.
• Technical delivery records: incoming platform events and scheduled welcome jobs 30 days; reply and campaign sending jobs 7 days; sign in handshakes 10 minutes. These expire automatically.
• AI providers: keep request data according to their own API terms, which may include limited retention for abuse monitoring.
• We may keep data longer where needed to comply with the law, resolve disputes or establish or defend legal claims.

The creator you message decides to use the Service and is responsible for your data. You can ask the creator directly, or use our fan data request form (or email support@runchatlab.com) with the creator's handle on the Supported Platform, your username there and an email address for our answer. Tell us whether you want a copy of your data or want it deleted.

To protect you, we verify the request before acting on it, for example by asking you to confirm it from your Supported Platform account. We answer within 30 days. Deletion removes your conversations, memory and logs with every creator who uses the Service; sales records are kept for billing without your id. It does not delete messages held by the Supported Platform, which you need to ask it about. If you write to a creator again later, the Service starts a new conversation.

Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of your personal data, to restrict or object to processing, and to withdraw consent where we rely on it. You may complain to the data protection authority where you live or work.

Creators can edit their settings, delete Agents and delete their account in the dashboard, or write to us at support@runchatlab.com. We answer within one month (GDPR) or 45 days (California), and may need to verify your identity.

California residents have the right to know what personal information we collect, use and disclose, to delete and correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in California law, and we use sensitive personal information only for the purposes the law permits.

We use encryption in transit, access controls that keep each creator's data separate, server side storage of platform access tokens, and signed verification of events from the Supported Platform. No system is perfectly secure and we cannot guarantee the security of data. If a breach affects you we will notify you, and the authorities where the law requires.

The Service is only for people aged 18 or over. It is not directed to anyone under 18, and creators must confirm they are adults when they sign up. What the Service does when a fan seems to be under 18 is described in our Safety protocol. If we learn that we hold data of a child beyond what safety requires, we delete it. Report a concern at support@runchatlab.com or through our content removal and abuse page.

We checked what the website stores in your browser. It is only:

• Sign in state, kept by our authentication provider (Firebase Authentication) in your browser storage, so you stay signed in. Strictly necessary.
• Drafts of the Agent setup you are writing, kept in your browser's local storage so you do not lose them. They never leave your device until you save.

We do not use advertising or analytics cookies, tracking pixels or third party trackers, so we do not show a cookie banner. If that ever changes, we will update this section first and ask for your consent before anything non essential is stored.

We may update this policy. We will post the new version here and notify creators of material changes by email or in the dashboard. See also our Terms of Service. Contact: RunChatLab, support@runchatlab.com.