Privacy Policy

Effective date: October 9, 2026
Version: v1
Language: English (this version controls in case of conflict with translations)

TLDR

We collect what we need to provide the Service and nothing more. The most important things:

• Your conversations contain intimate content. We treat them as sensitive personal data and protect them accordingly.
• We do not sell identifiable conversation data to anyone. Period.
• We do not use your conversations to train our AI unless you opt in explicitly through your account settings. Default is off.
• The Service is available worldwide. Your data is processed in the country where we and our service providers operate, which may differ from your own - see Section 10.
• California residents have specific rights under CCPA/CPRA - see Section 8.
• You can request your data or delete your account at any time through Settings, or by emailing privacy@enprint.ai.

Read the full document for the details. This summary does not replace it.

1. Who we are

This Privacy Policy is published by Konstantin Semochkin, with principal office at Astana, Kazakhstan. We operate the Enprint service at enprint.ai ("Enprint", "we", "us", "our").

For privacy-related questions: privacy@enprint.ai.

2. What this Policy covers

This Policy explains what personal information we collect when you use Enprint, why we collect it, how long we keep it, who we share it with, and what choices you have.

It applies to your use of enprint.ai, our progressive web app, and any other surface where this Policy is linked.

3. What we collect

3.1 Information you give us

Account information. When you sign in through Google or with your email and password (our authentication providers), we receive: your email address, your display name, and a unique account identifier. We use this to create and identify your account.

Account settings. Preferences you configure: language, notification settings, data improvement consent (opt-in to allow use of conversations for AI training and internal product research), age confirmation timestamp.

Conversations with AI characters. Every message you send to AI characters, every character preference you configure, every persona detail you set up. This is the core sensitive data we process. It typically reveals intimate aspects of your life, including your emotional state, relationships, and personal circumstances.

Payment information. If you purchase a paid plan, you provide payment details (card number, billing address) to our payment processor. We do not store full card numbers on our servers - the processor handles that. We receive only a payment token and basic transaction metadata (amount, currency, last four digits, payment status).

Support communications. When you email us, we keep that correspondence to follow up and improve support.

3.2 Information we collect automatically

Technical metadata. IP address, browser type and version, operating system, device identifier, screen size, timestamp of each request, referrer URL.

Usage analytics. Pages visited, features used, session duration, time between messages, button clicks. Aggregated for product improvement. We use a privacy-respecting analytics setup and we do not embed third-party tracking scripts for advertising.

Cookies and similar. See Section 7.

3.3 Information we do not collect

• We do not collect government ID, biometric data, or precise geolocation.
• We do not collect health records, political opinions, religious beliefs, or trade union membership.
• We do not connect to your social networks beyond sign-in (which only confirms your email/name).
• We do not buy enrichment data about you from data brokers.

4. Why we collect it (lawful basis)

For US residents, US state laws (mainly CCPA in California, similar laws in Virginia, Colorado, Connecticut, Utah) require us to disclose the purpose of collection. For all users, here is why:

Sensitive data. Your conversations may include data about your emotional and relational life - a category that receives extra protection under most modern privacy laws. We process it on the basis of your explicit consent (which you give when accepting these Terms) and limit processing to what is necessary for the Service. We do not infer health or medical conditions from conversations.

5. How long we keep it

Account deletion. When you request account deletion through Settings, your account and all associated data are immediately and permanently removed from our systems. This action cannot be undone. There is no grace period. If you sign up again with the same email address, you start with a fresh, empty account -- no previous data is recovered. Records we are required to keep by law (payment records) may persist as required by applicable law, but they are stored separately and not used for any purpose other than legal compliance.

6. Who we share with

We do not sell your personal information. Specifically, we do not sell identifiable conversation content to anyone, ever.

We share data in these categories:

6.1 Service providers ("processors")

Companies that process data on our behalf, under contracts that bind them to our standards:

• Cloud hosting (compute and storage)
• Database hosting (PostgreSQL operations)
• AI inference providers (the large language models that generate AI character responses - your messages are sent to them to produce a response)
• Authentication (Google Firebase)
• Payment processor (a merchant of record that handles card data and returns us a token)
• Email service (transactional emails to you, internal notifications to us)
• Analytics (anonymized product usage)
• Error monitoring (technical exceptions, scrubbed of personal content)

For each, we use contractual safeguards (Data Processing Addenda) and verify their security and privacy practices. The list of current providers is available on request to privacy@enprint.ai.

6.2 Law enforcement and legal requests

We disclose data when required by valid legal process (subpoena, court order, search warrant) in jurisdictions where we operate. We will challenge requests we believe are overbroad or unlawful, and we will notify you of the request unless we are legally prohibited. We also disclose data when we believe disclosure is necessary to comply with applicable law, prevent harm, or respond to credible safety threats.

6.3 In a business transaction

If we sell or transfer our business (merger, acquisition, restructuring), your data will transfer to the new owner. They will be bound by this Policy (or a substantially similar one) until they notify you of a change.

6.4 With your consent

Any other sharing is only with your explicit consent.

6.5 Anonymized aggregate data

We may share statistics that cannot reasonably be linked back to you - for example "70% of users prefer evening conversations" or "average session length is 22 minutes". This is not personal data because it cannot identify any individual.

Anonymized aggregate statistics (for example: average session length, feature usage rates) are processed under our legitimate interest in understanding and improving the Service. This data cannot identify any individual and is not personal information. No consent toggle is required for this processing. This is separate from the AI improvement consent toggle in your Settings, which covers use of your actual conversation content for AI training.

7. Cookies and similar technologies

We use a small number of cookies and similar technologies. Categories:

Strictly necessary (cannot be disabled):

• Authentication session (so you do not log in every time)
• Age confirmation record (the self-attestation you gave when creating your account)
• CSRF protection token

Functional (improve your experience):

• Language preference
• Interface settings

Analytics (help us improve):

• Anonymized usage metrics

We do not use advertising or tracking cookies.

We display a cookie notice on first visit. You can opt out of non-essential cookies through that notice or your browser settings. Note that some cookies are required for the Service to work, so disabling them may break functionality.

8. Your rights

8.1 Rights of California residents (CCPA / CPRA)

If you are a California resident, you have specific rights:

• Right to know what personal information we have collected about you, where it came from, what we use it for, and who we share it with.
• Right to delete your personal information (subject to limited exceptions, such as legal retention).
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" of personal information. As stated, we do not sell or share for cross-context behavioral advertising. There is nothing to opt out of, but you have the right.
• Right to limit use of sensitive personal information - you can ask us to use your conversations only for the purposes necessary to provide the Service, not for AI training or other secondary uses. By default we already do this (training is opt-in).
• Right to non-discrimination - we will not deny service, charge different prices, or provide different quality because you exercise these rights.

To exercise these rights, use the request form in your account Settings or email privacy@enprint.ai. We will verify your identity (typically by confirming you can access the email tied to your account) before fulfilling the request, and we will respond within 45 days (extendable by 45 more days for complex requests, with notice to you).

Authorized agents may submit requests on your behalf - they must provide written authorization signed by you.

8.2 Rights of residents of other US states

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and several other states grant similar rights. We honor these rights in the same way as California rights.

8.3 Rights of users outside the United States

The Service is available worldwide, including to residents of the European Union, European Economic Area, United Kingdom, and other countries with their own data-protection regimes.

If you are located in one of these jurisdictions, we apply the same baseline rights described in Sections 8.1-8.2 to you as well: the right to know what we hold about you, to correct it, to delete it, and to receive a copy of it, on request to privacy@enprint.ai. We are working toward a fuller, jurisdiction-specific privacy framework (including the legal-basis and international-transfer details that regimes like the GDPR require) as the Service grows outside the United States; until that work is complete, treat this section as the baseline commitment we honor for every user, wherever they are.

9. How we protect your information

We use commercially reasonable technical and organizational measures:

• TLS encryption for data in transit
• Encryption at rest for sensitive data
• Access controls (only authorized personnel can access production data)
• Regular security review of our code and infrastructure
• Audit logs of administrative access
• Vendor security review before onboarding service providers
• Incident response procedures

No system is 100% secure. If we suffer a data breach affecting your personal information, we will notify you and any required regulators within the legally required timeframe (typically 30-72 hours depending on jurisdiction).

10. International transfers

We and our service providers may be located in different countries than you are. By using the Service, you understand that your data is transferred to and processed in the country or countries where we and our providers operate, which may have different data protection laws than your own.

11. Children

The Service is for adults aged 18 or older. We do not knowingly collect personal information from anyone under 18.

If we learn that an account belongs to a minor, we will terminate the account and delete the associated data. If you are a parent or guardian and believe your child has created an account, please contact privacy@enprint.ai immediately.

We do not collect or process information from children under 13 (or other age that may apply under your local children's privacy law).

12. Automated decision-making

Our AI generates responses to your messages using large language models. These responses are not decisions about you in any meaningful legal sense (they do not affect your access to credit, employment, healthcare, or housing). However:

• AI responses may sometimes contain inaccurate, inappropriate, or biased content. We use safeguards to reduce this but cannot eliminate it.
• Our safety filters (self-harm detection, abuse detection, and similar safeguards) may automatically block or modify AI responses, or trigger human review. You can request human review of any such automated action by emailing privacy@enprint.ai.

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes:

• We will update the "Effective date" at the top.
• We will notify you by email or in-app notification.
• For significant changes (especially expansion of data use), we will require re-acceptance before continuing to use the Service.

Continued use after the effective date of an update means you accept the updated Policy.

14. Contact

For privacy questions, requests, or complaints:

• Email: privacy@enprint.ai
• Mail: Konstantin Semochkin, Astana, Kazakhstan

We will respond as quickly as possible, typically within 5 business days for general inquiries and within the legal SLA for formal requests (45 days CCPA, similar for other US state laws).

15. Language

This English version of this Policy controls. Any translation is provided for convenience only; in case of conflict, this English version prevails.

Glossary

CCPA - California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, CPRA, of 2020). The main California privacy law.

Cookies - small data files a website stores in your browser to remember information (login state, preferences, etc.).

DSAR - Data Subject Access Request. A formal request to know what personal data we have about you (and related rights like deletion, correction, portability).

GDPR - General Data Protection Regulation. The main EU privacy law, referenced here because the Service is reachable from the EU/EEA.

Lawful basis - the legal justification we have to process your data (contract, legitimate interest, consent, legal obligation).

Personal information - any information relating to an identifiable individual. Sometimes called "personal data".

Processor / Service provider - a third party that processes data on our behalf under our contract.

Sale / Sharing (CCPA-specific) - transferring personal information to a third party for money or for cross-context behavioral advertising. We do neither.

Sensitive personal information (CCPA-specific) - includes sexual orientation, sex life, racial origin, religious beliefs, etc.

Special category data (GDPR-specific) - similar to sensitive personal information, with stricter rules.