Hellolisa — Privacy Policy Last Modified: 28 October 2026

1. Introduction and Scope

This Privacy Policy explains how the company identified in Section 13 (the "Company", "we", "us" or "our") processes personal data when you use Hello Lisa (the "Service").

By using the Service, you consent to the data practices described in this Policy. If you do not agree, please do not use the Service.

Where you purchase through the Outpost checkout channel, Outpost Technologies Ltd. acts as merchant of record and an independent controller of the billing and payment data it processes for that transaction, under its own privacy policy (see Section 4).

2. Personal Data We Collect

2.1 Account Information

When you use the Service, we collect:

  • Email address (if you sign in with email)
  • Device identifier (UUID generated by your device)
  • Display name / nickname (if you set one)
  • Age confirmation (you must confirm you are at least 18)
  • Preferred language

2.2 Profile and Preferences

You may optionally provide:

  • Gender
  • Preferred character attributes (ethnicity, eye color, hair, body type — used for character creation only)
  • Profile photo (if uploaded)

2.3 Chat Content

  • Messages you send to AI Characters
  • AI-generated responses
  • Images and videos generated through the Service
  • Audio played by voice features. Voice features use text-to-speech to generate synthetic audio from text; we do not record, collect, or store your own voice, and we do not create any voiceprint or biometric identifier.
  • Gifts sent to AI Characters

2.4 Payment Information

  • We do not store full credit or debit card numbers or card security codes (CVC).
  • Payment processing is performed by third-party payment providers and Merchants of Record: our web card-payment providers (which may include Stripe, Adyen, and Unlimit, orchestrated via Payrails). Where the checkout channel indicates that the sale is made through Outpost, the transaction is processed by Outpost as Merchant of Record.
  • Data our web payment providers process to complete your purchase includes: your name, email address, card brand, the last four digits and expiry of your card, BIN and BIN country, transaction amount and currency, IP address, a recurring-billing indicator, and authorization/refund response codes.
  • Where your purchase is made through Outpost, Outpost acts as an independent controller of the payment and transaction data it processes and may share information with us to enable delivery, access, and support of the Service, in accordance with the Outpost Merchant of Record Terms and Outpost's privacy policy: https://outpost.ai/privacy-policy/.
  • We store transaction metadata: subscription status, plan type, purchase date, billing period, and a payment-provider customer ID.

2.5 Device and Technical Data

  • IP address (used for geolocation, fraud prevention, and service rendering)
  • Device model, operating system, app version
  • Browser type and version (for web)
  • Screen resolution
  • Approximate location (country / city — based on IP)

2.6 Usage Data

  • App / web events (screen views, button clicks, feature usage)
  • Session duration
  • Daily message count
  • Subscription and purchase events
  • Crash logs and performance metrics

2.7 Server Logs

Our hosting provider automatically logs: browser type and version; operating system; referrer URL; host name; time of server request; IP address. Logs are kept for 2 weeks for security and error analysis (GDPR Art. 6(1)(f)).

2.8 Cookies and Tracking

We use cookies and similar technologies on the website. See Section 11 for details.

3. How We Use Personal Data

Purpose — Legal basis (GDPR)

Providing and operating the Service — Contract (Art. 6(1)(b))

Processing payments and subscriptions — Contract (Art. 6(1)(b))

Payment orchestration and routing across providers — Legitimate interest (Art. 6(1)(f))

AI Character conversations and personalization — Contract (Art. 6(1)(b))

Improving the Service and AI models (aggregated, de-identified) — Legitimate interest (Art. 6(1)(f))

Sending product updates and important notices — Contract / Consent

Marketing communications and promotional offers — Consent (Art. 6(1)(a))

Advertising and audience targeting — Consent (Art. 6(1)(a))

Fraud prevention and security — Legitimate interest (Art. 6(1)(f))

Compliance with legal obligations — Legal obligation (Art. 6(1)(c))

3.1 AI Model Improvement

We may use aggregated, de-identified, and/or anonymized user interactions to improve our AI models, the quality of our Service, and to develop new features. Where re-identification is not reasonably possible, such data no longer constitutes personal data under applicable data protection law.

4. Sharing and Recipients

We work with the following categories of third-party service providers. Each provider has access only to the data necessary to perform its function and is contractually obligated to protect your data.

4.1 AI Model Providers

  • OpenAI Inc. (USA) — AI text generation (chat conversations). Data shared: the content of your messages and prompts, with conversation context. We contract on terms that restrict use of your content to serving your request and prohibit its use to train the provider's own foundation models.
  • OpenRouter / X.AI (Grok) (USA) — alternative AI text generation. Data shared: same scope and same no-training terms as OpenAI.
  • ElevenLabs Inc. (USA) — voice synthesis for voice features. Data shared: the text to be converted to speech. Your own voice is not sent, recorded, or stored.
  • fal.ai (USA) — AI image and video generation. Data shared: text prompts.
  • getimg.ai — character image generation. Data shared: text prompts.

A limited number of trained personnel may review de-identified interactions for safety, moderation, and quality purposes.

4.2 Payment Processors (Merchants of Record)

  • Authorised Reseller (Boros Studio LLC or Oha Tech LTD, as shown on your receipt): merchant of record for website purchases. Receives only the data needed for payment, receipts, taxes, refunds, chargebacks and fraud prevention, and acts as an independent controller for those purposes only.

  • Stripe Payments Europe Ltd. (Ireland) — website / funnel card payments. Data shared: name, email, card brand, last four digits and expiry of your card, BIN and BIN country, transaction amount, currency, IP address, recurring-billing indicator, and authorization/refund codes. We do not receive your full card number.

  • Adyen N.V. (Amsterdam, Netherlands) — website / funnel card payments. Data shared: same categories as Stripe.

  • Unlimit (Unlimint EU Ltd, Limassol, Cyprus, for EU/EEA users; Unlimit UK Ltd, London, United Kingdom, for other users) — website / funnel card payments. Data shared: same categories as Stripe.

  • Payrails GmbH (Berlin, Germany) — payment orchestration; routes each transaction to the appropriate payment provider above. Data shared: transaction routing metadata, tokenized payment identifiers, IP address, and device metadata.

  • We may also engage other web payment service providers from time to time for card processing on the website / funnel channel.

  • Outpost Technologies Ltd. (United Kingdom) — Merchant of Record and seller of record for the Outpost checkout channel. For purchases made through this channel, Outpost processes your order, billing, payment, tax, and transaction data as an independent controller under its own privacy policy: https://outpost.ai/privacy-policy/. Data shared: order, billing, and payment information necessary to complete and support your purchase.

  • RevenueCat Inc. (USA) — subscription state management across platforms. Data shared: app/device user identifier, subscription status, and purchase events.

  • Web2Wave — web paywall processing for gem purchases. Data shared: checkout/paywall interaction and purchase events, with transaction metadata.

4.3 Analytics and Attribution

  • Google Firebase Analytics (Google LLC, USA) — app and web behavior tracking. Data shared: pseudonymous app/web event data, device identifiers, and IP address.
  • AppsFlyer Ltd. (Israel) — mobile attribution and marketing analytics. Data shared: mobile device identifiers, IP address, app-installation events, and in-app purchase events, for advertising attribution purposes.
  • Sentry (Functional Software Inc., USA) — application error tracking. Data shared: crash and error diagnostics, device model/OS, app version, and technical request context.
  • Firebase Crashlytics (Google LLC, USA) — crash reporting. Data shared: crash reports, device model/OS, and app version.
  • Microsoft Clarity (Microsoft Corporation, USA) — session-replay and heatmap analytics on the website. Data shared: anonymized interaction and session-replay data.

4.4 Advertising and Marketing

  • Meta / Facebook (Meta Platforms Ireland Ltd.) — Facebook Pixel and Meta Ads for advertising, retargeting, and audience building. Data shared: hashed email, device ID, app events (install, purchase, signup), and aggregated audience signals.
  • Google Ads (Google LLC) — search and display advertising, conversion tracking. Data shared: Google Click ID, hashed email, conversion events.
  • TikTok Ads (TikTok Pte. Ltd.) — app install and conversion campaigns. Data shared: hashed email, install and purchase events.
  • Snapchat Ads (Snap Inc.) — app install and conversion campaigns. Data shared: device ID, install events.

4.5 Push Notifications and Engagement

  • Firebase Cloud Messaging (Google LLC) — push notification delivery (mobile). Data shared: your device push token.
  • Pushwoosh — push campaign management and engagement analytics. Data shared: device push token, device identifier, and engagement events.
  • Resend — transactional email delivery (magic link, receipts, account notifications). Data shared: your email address and email delivery/open status.

4.6 Infrastructure and Storage

  • Amazon Web Services (AWS) — cloud hosting and S3 media storage (chat images, character photos, voice-feature audio). Data shared: the Service content and account data stored to operate the Service. Data centers may be located in the EU (Frankfurt, eu-central-1) or the USA depending on the resource.
  • Google Cloud / Vercel — hosting and web deployment. Data shared: web application hosting data and request logs.

(Our databases and caches — e.g. PostgreSQL and Redis — are internal components operated within the infrastructure above, not separate third-party recipients of your data.)

4.7 Customer Support

  • Zendesk (Zendesk Inc., USA) — customer support ticketing. Data shared: the content of your support messages, your email/contact details, and your account reference.

4.8 Cookie Consent

  • CookieScript — cookie consent management on the website.

4.9 Legal and Compliance

We may disclose personal data to law enforcement or other authorities when required by applicable law, subpoena, or court order.

4.10 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to this Policy.

4.11 We Do Not Sell Personal Data

We do not sell your personal data to third parties for monetary consideration. Our use of advertising and attribution partners (Section 4) constitutes "sharing" for cross-context behavioral advertising under the CPRA. You may opt out of this sharing on our Do Not Sell or Share My Personal Information page, through your device advertising settings, or by sending a Global Privacy Control (GPC) signal, which we honor.

5. International Transfers

Your personal data may be transferred to and processed in countries outside your country of residence, including the United States, the United Kingdom, Israel, and EU member states (e.g. Ireland, Cyprus, Germany, the Netherlands).

For transfers from the EU/UK to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards. Transfers to the United States may additionally rely on a provider's certification under the EU-US Data Privacy Framework where applicable. Israel benefits from an EU adequacy decision.

6. Retention

We retain personal data only as long as necessary for the purposes described in this Policy or as required by law.

General retention periods:

  • Active account data: retained while your account is active.
  • Deleted account data: anonymized following the deletion request, fully removed within a reasonable period (typically within 90 days), except data required for legal retention (for example, billing records for tax purposes — typically 5–10 years depending on jurisdiction).
  • Chat messages and generated media: retained while your account is active, removed in line with account deletion.
  • Aggregated/de-identified data used to improve our Service and models: retained in non-identifying form and not deleted with your account.
  • Server logs: 2 weeks.
  • Crash and error logs: 90 days.
  • Marketing consent records: retained for the duration of consent + 3 years for proof.

7. Security

We use industry-standard technical and organizational measures to protect your personal data: SSL / TLS encryption for data in transit; encryption at rest for sensitive data; access controls and authentication; regular security audits; incident response procedures.

Despite our measures, no internet transmission is 100% secure. You use the Service at your own risk.

If we become aware of a personal data breach affecting your rights, we will notify the relevant data protection authority and (where required) you, within 72 hours of becoming aware.

8. Your Rights and Choices

Under GDPR (EU), CCPA / CPRA (California), and other applicable laws, you have the right to:

Right — What it means

Access — Request a copy of personal data we hold about you.

Rectification — Correct inaccurate or incomplete data.

Erasure — Request deletion of your account and personal data.

Restriction — Restrict processing in certain circumstances.

Portability — Receive your data in a structured, machine-readable format.

Object — Object to processing for marketing or based on legitimate interest.

Withdraw consent — Withdraw consent for processing based on consent.

Complain — Lodge a complaint with your local data protection authority.

To exercise any right, contact support@hellolisa.io. We will respond within 30 days (GDPR) or as required by local law.

8.1 Account Deletion

You can delete your account directly in the app: Settings → Delete Account. Account deletion will:

  • Mark your account as deleted and anonymize personal identifiers.
  • Permanently remove account data within a reasonable period (typically within 90 days of the deletion request), except where retention is required by applicable law (for example, financial transaction records for tax purposes, fraud prevention, or legal claims), and except for aggregated/de-identified data used to improve our Service, which is retained in non-identifying form.

Note: Website subscriptions billed via our web payment providers will be cancelled together with account deletion.

8.2 Marketing Opt-Out

Unsubscribe from marketing emails via the link at the bottom of each email, or in your account settings.

8.3 Advertising Opt-Out

Use our Do Not Sell or Share My Personal Information page, the cookie consent banner where it is shown, or a Global Privacy Control (GPC) signal.

9. Regional Information

9.1 United States

If you are a California resident, you have additional rights under CCPA / CPRA, including: the right to know what categories of personal information we collect; to delete personal information; to correct inaccurate personal information; to opt out of "sale" or "sharing" of personal information; to limit the use of sensitive personal information; and to non-discrimination for exercising privacy rights.

To exercise these rights, contact support@hellolisa.io or use our Do Not Sell or Share My Personal Information page. We honor Global Privacy Control (GPC) signals.

10. Children

You must be at least 18 years old to use the Service. We do not knowingly collect personal data from minors. If we learn that a minor has registered, we will delete the account immediately. Parents or guardians who believe a minor has used the Service may contact support@hellolisa.io. We enforce a zero-tolerance child-safety policy and report apparent child sexual abuse material to the appropriate authorities, including NCMEC.

11. Cookies and Tracking

We use cookies on our website to: enable basic functionality (necessary cookies); remember preferences (preference cookies); analyze usage (statistical cookies — Firebase, Microsoft Clarity); and display relevant ads (marketing cookies — Facebook Pixel, Google Ads, TikTok Ads, Snapchat Ads).

You can manage cookies via the consent banner (CookieScript), which is shown on your first visit where consent is required (the EU/EEA, the United Kingdom, Switzerland, Türkiye, Canada and California), or via your browser settings. A detailed, current list of the specific cookies we use, their purpose and duration, is available in the consent banner's preference center.

12. Changes to This Policy

We may update this Policy at any time. Material changes will be communicated via in-app notification, email, or website banner. Your continued use of the Service after a change constitutes acceptance.

13. Controller and Contact

The controller of the personal data described in this Policy is Lina Studio Reklam Yazılım Teknolojileri Araştırma Geliştirme ve Pazarlama Anonim Şirketi, a company incorporated in Türkiye, İçerenköy Mah. Topçu İbrahim Sk. Quick Tower Sit. No: 8-10D, Ataşehir / İstanbul, Türkiye.

For privacy questions or to exercise your rights: support@hellolisa.io.

Support: https://support.hellolisa.io/