Privacy Policy

1. Sources and Composition of Information

1.1. Information may be personalized or non-personalized.

1.2. We collect:

• Telegram profile data (name, username, Telegram ID) when interacting with @gibridaibot
• Email and password (encrypted) upon registration, or Telegram login
• Messages and requests in chats with AI characters (Souls) and agents
• Technical data: IP address, browser info, software characteristics
• Activity statistics: usage frequency, model preferences, content volume
• Audio you record in the app (voice messages, calls with agents, samples for a voice clone)

1.3. Only information stored in encrypted form, accessible exclusively to us, is considered confidential.

1.4. Information voluntarily posted in public sections is not confidential.

2. Security

2.1. Access to data is via authorization (email/password or Telegram OAuth). You must keep credentials secure and not share them. All actions via your credentials are deemed performed by you personally.

2.2. Data collection and processing comply with applicable law.

2.3. You consent to data processing for the purposes set out in the Terms of Service and undertake to notify us of any changes.

2.4. Chat content with AI characters is used to maintain conversation history. We do not share correspondence with third parties except as required by law.

2.5. We do not use your conversation content to train AI models.

3. Your Rights

You may request export or deletion of your data at any time by writing to [email protected] or contacting @gibridhelpbot.

4. Cookies

We use technical cookies (session, language preference) — required for the site to function. Analytics — Google Analytics and PostHog — is enabled only if you accept it in the cookie banner; without consent it is not loaded. You can change your choice in cookie settings. No advertising cookies.

5. Legal Basis & International Users (GDPR / UK GDPR)

5.1. Data controller. The controller of your personal data is Gibrid AI, Corp., a Delaware C Corporation, 244 5th Ave, Suite 1718, New York, NY 10001, USA.

5.2. Legal bases. We process personal data on the following bases: (a) performance of a contract; (b) legitimate interests (securing the platform, preventing fraud and abuse, improving reliability); (c) consent (where required; withdrawable at any time); and (d) legal obligation.

5.3. Your rights (EEA/UK). Access, rectification, erasure, restriction of or objection to processing, data portability, withdrawal of consent, and the right to lodge a complaint with your local data protection authority.

5.4. International transfers. Data may be processed in the USA and the EU (infrastructure located in Frankfurt, Germany). Where required, transfers rely on Standard Contractual Clauses or an equivalent lawful mechanism.

6. California Privacy Rights (CCPA/CPRA)

6.1. California residents may request to know, delete, and correct personal information, and to opt out of any "sale" or "sharing."

6.2. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6.3. We do not discriminate for exercising these rights. Requests: [email protected].

7. AI Processing & Sub-Processors

7.1. To generate responses, your prompts and necessary content are transmitted to third-party AI model providers (which may include OpenAI, Anthropic, Google, and others) acting as sub-processors solely to return a result to you.

7.2. We select providers that contractually commit not to train their foundation models on data submitted through their business APIs. We do not use your content to train our own models.

8. Data Retention

8.1. We retain personal data while your account is active and as needed to provide the Service. Upon a verified deletion request, we delete or anonymize your data within 30 days, except where retention is required by law.

9. Children

9.1. You may use the Service from age 13 (16 in the EU and EEA). We do not knowingly collect data of children below this age; if such data reached us, contact [email protected] and we will delete the account and its data.

9.2. Features that work with faces and voices (personas, LoRA models, voice clones) are available only to users aged 18 or older.

10. Analytics & Diagnostics

10.1. With your consent in the cookie banner we use Google Analytics and PostHog: page views and actions in the service (for example, submitting a generation or starting a checkout). We send only your numeric account ID and plan — no email, name, message text or prompts. Without consent these services are not loaded.

10.2. Apps (iOS, iPad, Mac, Android). We use PostHog for product analytics: launching the app, opening screens and using features (for example, sending a message, starting a generation or a checkout). In the app, analytics is on by default and can be turned off under Settings → Legal → Usage analytics. While it is on, we send only your numeric account ID, plan, app version, device model, OS version and interface language — no email, name, message text, prompts or file contents. We do not use advertising identifiers (IDFA) and do not track you across other companies’ apps and websites.

10.3. The iOS app sends crash reports to Sentry with your account ID, without email or name.

10.4. Cloudflare processes requests to the site as a content delivery network and attack protection.

11. Faces & Voice

11.1. Personas. Photos you upload for a persona are used to describe the appearance and, if you request it, to train a model (LoRA weights) for generating images and video of that persona. We do not use them to identify people.

11.2. Voice. Recordings for a voice clone are sent to ElevenLabs to create a voice available only to your account.

11.3. Before creating a persona or a clone we ask you to confirm that you are 18 or older and that it is you or that you have that person’s consent; the confirmation, its date and IP address are kept in a log.

11.4. Photos, the description and weights are deleted together with the persona; a voice clone — on your request. If you were depicted or your voice was cloned without consent, email [email protected] and we will remove it.

12. Sub-processors

12.1. Hosting — Amazon Web Services (Frankfurt, Germany); content delivery and protection — Cloudflare.

12.2. AI models — via Vercel AI Gateway (OpenAI, Anthropic, Google, DeepSeek and others); image and video generation — kie.ai and fal.ai; voice — ElevenLabs.

12.3. Analytics — PostHog and Google Analytics (on the website — with your consent; in the apps PostHog is on by default and can be turned off in settings); iOS crash reports — Sentry; email — Amazon SES; push notifications — Apple Push Notification service and Firebase Cloud Messaging.

12.4. Sign-in — Telegram, Apple, Google; payments — Stripe and NOWPayments; in-app purchases in the mobile apps — Apple App Store and Google Play. We do not store card numbers.

12.5. Integrations you connect yourself (for example, Notion) receive data only within the access you grant.

13. Final Provisions

13.1. Gibrid is not liable for losses arising from use or inability to use the platform.

13.2. This Policy may be amended unilaterally. The current version is always at gibrid.ai/privacy.