Regional Privacy Disclosures
This Regional Privacy Disclosures is effective August 27, 2025
While our Privacy Policy and the privacy representations made in that policy apply to all data subjects (unless otherwise specified), the Regional Privacy Disclosures made in this notice provide additional information for data subjects located in the jurisdictions specified below and are intended to supplement the Privacy Policy.
- For residents of the United States, please refer to the U.S. State Privacy Notice below.
- For data subjects located in the European Economic Area or the United Kingdom, please refer to the European Economic Area & United Kingdom Privacy Notice below.
U.S. State Privacy Notice
Effective August 27, 2025
This U.S. State Privacy Notice (“Notice”) provides additional information for residents of the United States. This Notice is intended to supplement our Privacy Policy to address state-specific transparency requirements and rights you may have under applicable state laws, depending on where you live.
Information We Collect & How We Use and Disclose It
Throughout our Privacy Policy, we discuss in detail the specific pieces of personal information and sensitive personal information we collect, the sources of that information, and how we disclose it. In the preceding 12 months, we disclosed or shared the categories of personal information described in more detail in Section 1 of the Privacy Policy for the business purposes described in Section 2 of the Privacy Policy.
Please note that laws in California and other states treat certain common disclosures of personal information to third parties as “sales” of information, even when no money changes hands. This may include personal information shared with third parties for purposes of targeted advertising. While these disclosures may be considered sales under certain state laws, we do not sell personal information for monetary consideration, and Character.AI is not a data broker. If you would like to opt out of “sales” or targeted advertising, please refer to the Rights You May Have section below. In the preceding 12 months, we disclosed personal information for business purposes and “sold” personal information to the following categories of recipients:
| Category of Personal Information | Recipients of Disclosures for a Business Purpose | Recipients of “Sales” |
|---|---|---|
| Identifiers (such as name, email address, phone number, username, IP address, device identifiers, Service-related identifiers) | Vendors and service providers (e.g., data storage providers, content moderation providers, customer support providers, analytics, data management providers, payment providers, fraud prevention and security providers, experimentation providers, mobile measurement providers, push notification providers, email marketing providers), advertising providers, affiliates, other users (if you choose to make this information publicly available) | Advertising providers |
| Demographic information (such as date of birth, age) | Vendors and service providers (e.g., data storage providers, analytics providers, data management providers), advertising providers, affiliates | Advertising providers |
| Financial information (such as payment information and related details) | Vendors and service providers (e.g., payment providers, data management providers), affiliates | n/a |
| Commercial information (such as purchases, transaction history) | Vendors and service providers (e.g., payment providers, data management providers), affiliates | n/a |
| Geolocation data (i.e., approximate location based on IP address) | Vendors and service providers (e.g., data storage providers, analytics providers, data management providers), advertising providers, affiliates | Advertising providers |
| Audio or video information (such as voice recordings or pictures and videos you submit) | Vendors and service providers (e.g., data storage providers, content providers, content moderation providers, data analytics providers), affiliates, other users (if you choose to make this information publicly available) | n/a |
| Device, Internet, or other electronic network activity information (such as information about your device or browser; information about how you use and interact with the Services, our ads, or third-party sites or platforms) | Vendors and service providers (e.g., data storage providers, analytics providers, data management providers, fraud prevention and security providers, mobile measurement providers, push notification providers), advertising providers, affiliates | Advertising providers |
| Content and communications you submit (such as chat communications, posted images or videos, biography descriptions, shared Characters, customer support messages) | Vendors and service providers (e.g., data storage providers, content providers, content moderation providers, customer support providers, analytics providers, data management providers, fraud prevention and security providers), affiliates, other users (if you choose to make this information publicly available) | n/a |
| Inferences drawn from other personal information (such as preferences and interests) | Vendors and service providers (e.g., data storage providers, analytics providers, data management providers), advertising providers, affiliates | Advertising providers |
| Sensitive personal information (such as log-in credentials or information you voluntarily share when using the Services such as content revealing your race, religion, or sexual orientation) | Vendors and service providers (e.g., data storage providers, analytics providers, data management providers, content moderation providers), affiliates, other users (if you choose to make this information publicly available) | n/a |
We may also disclose any or all of the categories of information listed above in the event of a sale or transfer of all or part of our business, in response to legal process, or in the interests of protecting rights or safety, as described in more detail in our Privacy Policy.
Please note that our advertising practices may vary depending on where you are located and whether you access the Services via our websites or mobile applications. In some jurisdictions, we may provide targeted advertising to minors over the age of 13, which may include disclosures to third parties that are considered “sales” in some jurisdictions. Where applicable under local law, we obtain consent before providing targeted advertising or “selling” personal information of minors.
We process the categories of personal information identified above for the purposes as described in more detail in Section 2 of our Privacy Policy. We do not use or disclose your sensitive personal information for purposes other than permitted under applicable law.
Retention of Personal Information
We keep your information for the time necessary for the purposes for which it is processed or as otherwise described at the time the information is collected, unless a shorter retention period is required by law. The length of time for which we retain information depends on the purposes for which we collected and use it and your choices, after which time we may delete and/or aggregate it. We may also retain and use this information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. For more information about our data retention practices (including with respect to Characters you create and make public), please refer to Section 7 of our Privacy Policy.
Rights You May Have
Where applicable under state law and subject to applicable exceptions, you may have the following rights:
- To request information about our processing of your personal information;
- To request access to and/or a copy of certain information we hold about you (including in a portable and/or machine-readable format);
- To update or correct your personal information;
- To request that we delete certain personal information we hold about you, subject to certain exceptions;
- To opt out of targeted advertising or the sale of personal information to third parties;
- The right not to be discriminated against for exercising your rights; and
- The right to appeal our decision to deny your request, if applicable.
To exercise the rights you may have under applicable law (with the exception of the opt-out right; see below), contact us at https://support.character.ai/hc/en-us/requests/new, email us at [email protected], or visit our Help Center at support.character.ai. To protect your privacy and security, we take reasonable steps to verify your identity and requests. If we are unable to verify your identity, we may be unable to respond to your requests.
You may also be able to designate an authorized agent to make requests on your behalf. Authorized agents may submit requests using the methods described above. In order for an authorized agent to be verified, you must provide the authorized agent with signed, written permission to make such requests or a legally valid power of attorney. We may also follow up with you directly to verify your identity before processing the authorized agent’s request, consistent with applicable law.
Where applicable under local law, if your request is denied, we will provide information about how to submit an appeal in our response denying the request.
To opt out of targeted advertising or the sale of personal information to third parties, please navigate to the Your Privacy Choices page and follow the directions.
Please refer to Section 4 of the Privacy Policy for more information about other choices or options you may have with respect to your information.
European Economic Area and United Kingdom Privacy Notice
Effective August 27, 2025
This European Economic Area (“EEA”) and United Kingdom (“UK”) Privacy Notice provides additional information for data subjects in the EEA and UK that provide for certain privacy rights and requirements specified under laws applicable in the EEA and UK, including the General Data Protection Regulation (“GDPR”) and UK Data Protection Act.
Our Privacy Policy and the privacy controls we offer are in line with these laws, and this Notice is intended to supplement the Privacy Policy with additional EEA and UK-specific disclosures. For example, all users can access a copy of their data, request deletion, correct their personal data, and control what personal data they share in their account on our website or in the privacy settings in the mobile application. You have the right to object to our use of your personal data. With many types of data, we have provided you with the ability to delete it if you do not want us processing it anymore. For other types of data, you can stop the use of your data by disabling the feature altogether. You can do these things in your account settings on our website or directly in the mobile application. If there are other types of personal data you do not agree with us processing, you can contact us, using the contact information provided below.
Character Technologies, Inc. is considered the “data controller” of the “personal data” (as defined under the GDPR) we handle under our Privacy Policy. In other words, Character.AI is responsible for deciding how to collect, use, and disclose personal data, subject to applicable law. The laws of the EEA and the UK require data controllers to tell you about the legal ground that they rely on for using, sharing, or disclosing your personal data. To the extent those laws apply, our legal grounds are as follows:
- Contractual Commitments: We may use, share, or disclose personal data to honor our contractual commitments to you. For example, we will process your personal data to provide the Services, and to honor our commitments in any agreements that we have with you.
- With Your Consent: Where required by law, and in some other cases, we use, share, or disclose personal data on the basis of your consent. If we ask for your consent to process your personal data, you may withdraw your consent at any time by contacting us using the details at the end of our Privacy Policy. (Please note that if you withdraw your consent, this will not affect the processing activities that took place prior to your withdrawal of consent.)
- Legitimate Interests: In many cases, we use, share, or disclose personal data on the ground that it furthers our legitimate business interests in ways that are not overridden by the interests or fundamental rights and freedoms of the affected individuals, such as customer service, certain promotional activities, analyzing and improving our business and Services, providing security for the Services, preventing fraud, and managing legal issues.
- Legal Compliance: We need to use and disclose personal data to comply with our legal obligations, for example to carry out fraud prevention checks or comply with other legal or regulatory requirements, where this is explicitly required by law.
The following chart identifies the applicable legal basis for each processing purpose:
| Purpose | Legal basis |
|---|---|
| Provide, administer, and operate the Services and our business; Generate and analyze inferences about use of the Services, such as your preferences and interests and trends about our Services (e.g., which portions of the Services are used most frequently, how users navigate the Services, and what our users like or do not like); Tailor the Services to your preferences and interests; Evaluate the success of advertising campaigns; Communicate with you, including to inform you about features or aspects of the Services we believe might be of interest to you; Analyze, maintain, improve, modify, customize, and measure the Services, including to train our artificial intelligence/machine learning models; Develop new features, algorithms and machine learning models, programs, and services; Provide advertising and recruit new users, including provision of tailored advertising; Authenticate your account credentials, as necessary to log you in to the Services and help protect the security of your account; Comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other parties, including to enforce our Terms of Service and any other agreements or policies; and Detect and prevent fraud, criminal activity, or misuses of our Service, and to maintain the security of our IT systems, architecture, assets, customers, and networks. | Legitimate interests (Article 6(1)(f) GDPR) |
| Provide, administer, and operate the Services; Communicate with you about changes to our terms, conditions, or policies; or to respond to your inquiries, comments, feedback, or questions; Authenticate your account credentials, as necessary to log you in to the Services and help protect the security of your account; Process payments; Detect and prevent fraud, criminal activity, or misuses of our Service, and to maintain the security of our IT systems, architecture, assets, customers, and networks; and Comply with legal obligations and legal process and to our rights, privacy, safety, or property, and/or that of our affiliates, you, or other parties, including to enforce our Terms of Service and any other agreements or policies. | Contractual necessity (Article 6(1)(b) GDPR) |
| Provide advertising and recruit new users, including provision of tailored advertising; Communicate with you, including to inform you about features or aspects of the Services we believe might be of interest to you; and Communicate with you about your responses to user feedback and survey questionnaires. | Consent (where legally required) (Article 6(1)(a) GDPR) |
| Detect and prevent fraud, criminal activity, or misuses of our Service, and to maintain the security of our IT systems, architecture, assets, customers, and networks; Authenticate your account credentials, as necessary to log you in to the Services and help protect the security of your account and Comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other parties, including to enforce our Terms of Service and any other agreements or policies. | Compliance with a legal obligation (Article 6(1)(c) GDPR) |
Where applicable under local law and subject to applicable exceptions, you have the following rights regarding your personal data:
- To request access to and/or a copy of certain information we hold about you (including in a portable and/or machine-readable format);
- To object to how we process your personal information;
- To update or correct your personal information;
- To request that we delete certain personal information we hold about you;
- To restrict how we process certain personal information about you;
- To request that we transfer your information to a third-party provider of services;
- To withdraw your consent at any time (where you have provided consent for the processing of your personal data); and
- To lodge a complaint with the relevant supervisory authority.
If you have a complaint or concern about your personal data, or to exercise your rights, we encourage you to contact us first, and we will do our very best to resolve your concern or fulfill your request. You can submit inquiries to https://support.character.ai/hc/en-us/requests/new, via email at [email protected], or via mail at:
Character.AI
#1152
700 El Camino Real
Suite 120
Menlo Park CA 94025
To withdraw consent to certain tailored advertising or the placement of cookies and similar tracking technologies, please refer to our Cookie Policy and follow the instructions.
European Union Representative. VeraSafe Ireland Ltd. has been appointed as our representative in the European Union for data protection matters. In addition to contacting us, if you are located in the European Union, you may also contact VeraSafe Ireland about matters relating to our processing of personal data. You can contact VeraSafe Ireland as follows:
- Online: https://verasafe.com/public-resources/contact data-protection-representative
- Telephone: +420 228 881 031
- Post:
VeraSafe Ireland Ltd.
Unit 3D North Point House
North Point Business Park
New Mallow Road
Cork 123AT2P
Ireland
United Kingdom Representative. VeraSafe United Kingdom Ltd. has been appointed as our representative in the United Kingdom for data protection matters. In addition to contacting us, if you are located in the United Kingdom, you may also contact VeraSafe United Kingdom about matters relating to our processing of personal data. You can contact VeraSafe United Kingdom as follows:
- Online: https://verasafe.com/public-resources/contact-data-protection-representative
- Telephone: +44 (20) 4532 2003
- Post:
VeraSafe United Kingdom Ltd.
37 Albert Embankment
London SE1 7TL
United Kingdom
International transfers. Our services are global, and your information may be stored and processed in the U.S. and other countries outside the U.S. that may have data protection laws that differ from the laws in your country, and data may be accessible to law enforcement and national security authorities under certain circumstances.
For data subjects in the EEA and the UK, where your information is stored and processed in a country outside the EEA and the UK that is not regarded under local law as ensuring an adequate level of protection for personal data, we have put in place appropriate safeguards to protect data in accordance with applicable legal requirements.