Privacy policy

The controller for personal data processed on Luvo (luvo.ai) is:

Registered at the Amtsgericht Hamburg under HRB 176756. You can reach us at support@luvo.ai. Full details are in our imprint.

This policy describes the personal data we process when you visit Luvo, create an account, chat, generate images, verify your age or pay. It is not the Terms & Conditions— those are the contract. This is how we handle information about you.

Account. Your email address, whether it is verified, a display name if you set one, your plan and credits, and the choices you make (language, adult-content preference, cookie consent). Sign-in is a link or a code we send to that email; we do not store a password for new accounts.

What you make. The companions you design, the messages you send and receive, the facts she remembers about you, and the images, short videos and voice messages you generate. Conversations on Luvo can be intimate. We keep them so the product can work — so she can reply, and so a memory you told her is still there next time — and we do not use them to advertise to you or sell them.

Age verification. Whether you have passed an 18+ check, the provider that ran it, an opaque reference they give us, and when. We never store an identity document, a selfie or a date of birth. The provider answers one question — is this person 18+ — and we keep the answer.

Payments. What you bought, when, for how much, how you paid (card or crypto), and the status of the order. We do not see or store card numbers. Card payments are handled by finby; crypto payments by NOWPayments.

On your device. What we write there, and which of it needs a choice first, is listed in section 7 and in the cookie settings on the site.

Where you are connecting from. Our host gives us a country (and, where relevant, a region) from the request, so we can apply the consent rules and the access rules that depend on where you are. We do not keep a log of IP addresses on your account.

• To provide Luvo — creating and running your account, generating replies and media, taking payment, cancelling a plan. Art. 6(1)(b) GDPR (the contract).
• To verify you are an adult before adult content. Art. 6(1)(b) and, where a law requires the check, Art. 6(1)(c).
• To keep the service safe — blocking abuse, investigating fraud, enforcing the Terms. Art. 6(1)(f) (legitimate interests). Our interest is a service that is not used to harm people or to break the law.
• To measure how the site is used, only if you agree. Art. 6(1)(a) (consent). You can refuse, and you can change your mind from Cookie settings.
• To keep records the law requires — invoices, tax, reports we are obliged to make. Art. 6(1)(c).

Intimate conversation data is processed only to operate the companion you are talking to. It is not used for advertising, profiling for ads, or sale.

We use other companies to run Luvo. Each sees only what it needs for that job:

• Vercel hosts the website and, if you agree, measures visits.
• Railway hosts the API and the database.
• Amazon S3 (Frankfurt) stores the images and media you generate.
• Resend sends the sign-in email.
• Didit runs the age check. They see what that check needs (a selfie, or a document where the law requires one). We receive only the result and a reference.
• finby processes card payments, including Apple Pay and Google Pay. NOWPayments processes crypto payments.
• RunPod runs the image models. A language-model provider generates chat replies. Both receive the prompt for that request; they are not given your account to browse.

We do not sell personal data. We disclose it if the law requires it, or to defend a legal claim.

Your account, conversations, memories and media stay for as long as the account exists. Email support@luvo.ai and we delete the account and what it holds, except records we are legally required to keep (typically payment records for the retention period German tax law sets).

Age-verification status stays on the account so we do not have to ask you again. The provider keeps whatever they need for their own legal duties; we never held the document.

Analytics identifiers last until you refuse analytics or the consent record expires (six months, then we ask again).

We write a small amount of data on your device. Sign-in, your language, your gallery layout and the girls you have already seen are necessary for the site to work, or are settings you chose. Measuring how the site is used — a persistent id, where you came from, Vercel Analytics — is optional and off until you accept. There is no advertising pixel and no sale of that measurement.

In the EU, the EEA and the UK we ask before the optional storage. Elsewhere a visitor can still open Cookie settings from the footer. Closing the bar without choosing is not consent.

Some of the companies in section 5 are outside the European Economic Area. Where they are, we rely on the Standard Contractual Clauses those providers offer, or on an adequacy decision if one applies.

You can ask us to:

• tell you what we hold and give you a copy;
• correct it;
• delete it, including closing the account;
• restrict how we use it;
• send it to you or to someone else, where the right of portability applies;
• object to processing we base on legitimate interests;
• withdraw consent, where we asked for it — Cookie settings does that for analytics.

Write to support@luvo.ai. You also have the right to complain to a supervisory authority. Ours is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, datenschutz-hamburg.de. If you live in another EU country you may complain there instead.

Luvo is for adults. You must be at least 18, and of legal age to view sexually explicit material where you live. We do not knowingly collect data from a child. If we learn an account belongs to one, we close it.

We may change this policy. The date at the top is when it last changed. If a change affects you in a way you would not expect, we will tell you.