Privacy Policy

1. What We Collect

We practice strict data minimisation. We collect only the information required to match you with the right AI persona and to provide a meaningful conversational experience:

• Display name - the name you choose to go by (does not need to be your legal name). Encrypted at rest.
• Email address - used for authentication and essential communications (data deletion confirmations, policy change notifications). Stored by our authentication provider and protected by provider security controls.
• Timezone- used to align your persona's temporal context (their schedule, mood, and availability) with your local time.
• Personality scores - derived from your onboarding conversation with the Discovery system. These scores determine which of our personas is most aligned to you. Encrypted at rest.
• Conversation content - your messages and the persona's responses. Encrypted at rest using column-level encryption.
• Relationship signals - minimal derived metadata such as connection status, relationship phase, and interaction counts. Long-term memory extraction is not enabled for MVP.

We do not collect your real name, phone number, physical address, government ID, financial information (beyond payment processing), or any biometric data.

2. How We Use Your Data

Your data is used exclusively to operate the service you signed up for:

• Persona matching - personality scores are used to find your most aligned AI persona from our catalogue of unique identities.
• Relationship continuity - minimal relationship signals help the app show connection status, phase, and interaction history. Long-term memory extraction is not enabled for MVP.
• Service improvement - anonymised, aggregated usage patterns (never individual data) may be used to improve matching quality and persona behaviour.

We will never:

• Sell your data to third parties
• Use your data for advertising or marketing
• Share your personal data with other users (connection requests use anonymised identifiers)
• Train AI models on your private conversations

If you consent to analytics cookies, we use Google Analytics 4 through Google Tag Manager and PostHog (EU-hosted at eu.posthog.com) for aggregate product analytics, including activation and checkout funnel measurement. Analytics events identify the user by their account UUID only - never by name, email, or other personal fields - and never include conversation content, personality answers, or payment card details. Analytics is optional and is not required to use the service.

3. Encryption & Storage

We employ multiple layers of encryption to protect your data:

• Column-level encryption - sensitive fields (display name, personality scores, birth data, message content, legacy contact, notification content, and feedback comments) are encrypted before being written to the database. Even if someone gained access to raw encrypted fields, they could not read those values without the application encryption key.
• Encryption at rest - the database itself uses full-disk encryption on all storage volumes.
• Encryption in transit - all connections between your browser and our servers, and between our servers and third-party services, are secured with TLS 1.3.
• Data residency - all user data is stored in the European Union (Frankfurt, Germany), subject to GDPR protections regardless of your location.

4. Your Rights

Under the General Data Protection Regulation (GDPR) and other applicable privacy legislation, you have the following rights:

• Right of access - request a complete copy of all personal data we hold about you. We will provide this within 30 days as a downloadable export.
• Right to erasure - request deletion of all your personal data. Once confirmed, your data will be permanently removed within 72 hours.
• Right to rectification - correct any inaccurate personal data we hold about you.
• Right to portability - receive your data in a structured, commonly used, machine-readable format (JSON) that you can transfer to another service.
• Right to restrict processing - request that we temporarily stop processing your data while a complaint or correction is being resolved.
• Right to object - object to processing of your data for specific purposes.
• Right to withdraw consent - withdraw any consent you have previously given, at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@samagama.ai or use the data management tools in your account settings.

5. Data Retention

We retain your data only as long as necessary:

• Active accounts - data is retained for the duration of your active account and use of the service. If paid plans are enabled, billing records may be retained for the period required by tax, accounting, fraud prevention, or legal obligations.
• Inactive for 12 months - you will receive a notification asking whether you wish to keep your account. If we receive no response, your account and all associated data will be scheduled for deletion.
• Inactive for 18 months - if no response has been received, all personal data is permanently deleted.
• Deleted accounts - when you delete your account, all personal data (conversations, personality scores, relationship signals, profile information, push subscriptions, and legacy contact data) is permanently and irreversibly removed after the 72-hour grace period unless a legal hold applies.

Anonymised, aggregated analytics data (which cannot be linked back to any individual) may be retained indefinitely for service improvement.

6. Cookies

We use strictly necessary cookies for authentication, security, and remembering your cookie choices. Optional analytics cookies are used only after you consent through the cookie banner. The authentication session token is strictly necessary for you to log in and use the service. Analytics cookies are used for aggregate product measurement and paid checkout funnel reporting.

• We use authentication cookies for signed-in sessions.
• We use Google Tag Manager / Google Analytics 4 for aggregate product analytics only after analytics consent is granted.
• You can reject optional analytics cookies from the banner before they load.
• We use no advertising cookies.
• We use no social media tracking pixels.

Analytics storage is not required to use the service. You can reject optional analytics cookies or clear your browser storage to withdraw that browser-level consent. For full details, see our Cookie Policy.

7. Third Parties

We work with a limited number of third-party service providers, each selected for their security and privacy practices:

• Supabase - database hosting and authentication. Data stored in EU (Frankfurt). Supabase is independently certified for security compliance.
• Anthropic - AI conversation processing where Claude models are selected in our production configuration. Only the conversation context needed to generate a response is sent.
• Google Vertex AI - AI model hosting where Gemini or Vertex Anthropic models are selected in our production configuration.
• Langfuse - LLM observability and quality monitoring. Only anonymised conversation IDs and performance metrics are sent to Langfuse. No personal data or conversation content is shared.
• Google Analytics 4 / Google Tag Manager - optional aggregate product analytics and checkout funnel measurement after analytics cookie consent. Payment analytics events do not include payment card details.
• PostHog (EU) - optional EU-hosted product analytics for activation, retention, and core feature funnels after analytics cookie consent. Events identify the user by their account UUID only; conversation content, personality answers, and payment card details are never sent to PostHog.
• Resend - email delivery for account, notification, and privacy request messages.

We do not share your personal data with any other third parties. We do not use any advertising networks, social media trackers, or data brokers.

8. Children

samāgama.ai is intended exclusively for users aged 18 and older. We do not knowingly collect personal data from anyone under the age of 18. If we discover that we have inadvertently collected data from a minor, we will delete it immediately and terminate the associated account.

If you believe a minor has created an account on our platform, please contact us at privacy@samagama.ai and we will take immediate action.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

• Minor changes (clarifications, formatting) will be reflected in the "Last updated" date at the top of this page.
• Material changes (new data collection, new third parties, changes to your rights) will be communicated to you via email at least 30 days before they take effect. Where required by law, we will request your renewed consent before applying material changes.

10. Contact

For any privacy-related questions, concerns, or requests, contact our data protection team:

• Email: privacy@samagama.ai

If you have concerns about how your data is handled, please contact us at privacy@samagama.ai and we will work to resolve your concern promptly.