← Back to main

Privacy policy

Effective from June 13, 2026.

1. Data controller

The controller of your personal data is Individual Entrepreneur Anatolii Golovanov, who provides the SPANiAI service. Privacy contact: officialspaniai@gmail.com.

2. What data we collect

  • Account data: email, name and avatar from your Google or Apple ID account, chosen nickname, biography, interface language.
  • User content: created presets, game adventures, AI messages, support tickets.
  • Usage data: daily number of characters sent to the AI; like statistics.
  • Technical data: IP address, browser type, error logs — limited and only for security/debugging.
  • Payment data: we do not store card details. All payments are processed by Paddle.

3. Purposes and legal grounds

  • providing the service (contract performance);
  • processing payments and subscriptions (contract performance, via Paddle);
  • user support (contract performance);
  • security, abuse prevention (legitimate interest);
  • improving the service (legitimate interest);
  • compliance with law (legal obligation).

4. Who we share data with and international transfers

We share data only with the processors strictly necessary to run the Service:

  • Paddle — Merchant of Record for payments, subscriptions, taxes and invoicing (EU/UK/USA).
  • Google — for sign-in via OAuth.
  • Apple — for Sign in with Apple (OAuth). If you choose to hide your email, Apple provides a private relay address.
  • Google (United States), accessed through Lovable's AI gateway — AI inference provider whose language models generate responses to your messages. Google is contractually bound not to use your API inputs/outputs to train models.
  • Supabase (EU) — data storage and authentication infrastructure.
  • State authorities — only upon a legally binding request.

5. Data retention

We keep your data for as long as your account exists. After account deletion, personal data is deleted or anonymised within 30 days, except where law requires longer retention (e.g. accounting records).

6. Your rights (GDPR, CCPA and other US states)

Regardless of where you live, you may: receive a copy of your data; correct or update inaccurate information; delete your account and related data; restrict processing or object to it; lodge a complaint with the personal data protection authority. To exercise these rights, write to officialspaniai@gmail.com — we respond within 30 days.

EU/EEA / UK GDPR: you additionally have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), object to processing based on legitimate interests (Art. 21), withdraw consent at any time without affecting prior processing, and lodge a complaint with your supervisory authority (Ukrainian users — the Ukrainian Parliament Commissioner for Human Rights; EU residents — your national Data Protection Authority).

California (CCPA / CPRA): you may know what personal information we collect, use and disclose; access and receive a copy; correct inaccurate information; delete; limit the use of sensitive personal information; and opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not process sensitive personal information beyond what is strictly necessary to provide the Service. We do not discriminate against users who exercise their rights. You may use an authorised agent. We honour Global Privacy Control (GPC) signals as a valid opt-out request.

Other US states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other comprehensive privacy laws): you have substantially similar rights (access, correction, deletion, portability, opt-out of targeted advertising and sale). We do not engage in profiling that produces legal or similarly significant effects.

7. Children's data (COPPA / GDPR-K)

We do not knowingly collect personal information from children under 13 (or under 16 in the EU/EEA/UK without parental consent). If you believe a child has provided us with personal data, contact officialspaniai@gmail.com and we will delete it promptly.

8. Automated decisions and AI training

We do not subject you to decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). Your prompts and AI responses are not used to train AI models — Google is contractually bound not to use API inputs/outputs for training. We may use aggregated, de-identified statistics to improve the Service.

9. Security

We use technical and organisational protection measures: encryption in transit (TLS), access control, regular updates, database isolation and the principle of least privilege.

10. Cookies, Do Not Track and Global Privacy Control

We only use cookies necessary for session operation and to preserve your authentication. No marketing or third-party tracking cookies.

Our Service does not respond to legacy Do Not Track (DNT) browser headers, but it does honour the Global Privacy Control (GPC) signal as an opt-out of sale/sharing under the CCPA/CPRA.

11. Changes to this Policy

We may update this Policy. We will notify of material changes in the Service or by email.