Privacy Notice

"Kallfi" including its affiliates (collectively, the "Company", "we", "our", or "us"), offers online entertainment services (collectively, the "Services") via:

The data controller for the processing activities described in this Privacy Notice ("Notice") is Pythia Grant Ltd., registered in Cyprus.

The Services include adult-oriented content and are intended only for adults. Please read this Notice carefully, together with our Terms and Conditions available at https://kallfi.com/terms (the "Terms").

Your access to and use of the Services, whether by visiting the Websites or by creating an account, means that you have read and understood this Notice and the Terms and agree to the collection, use, retention, and disclosure of your personal information on these terms. If you do not agree, do not use the Services. You are not legally required to provide personal information, but without it we cannot provide you with the full Services.

In this Notice, "Personal Information" means any information that identifies or can reasonably identify directly or indirectly an individual, including without limitation name, username, date of birth, address, IP address, email address, telephone number, identification documents, financial documents such as a utility bill or bank statement, and other non-public information associated with or linked to any of the foregoing. Processing activities include, among other things, the collection, use, retention and disclosure of such data.

Your Personal Information is processed by us (including our agents and employees) and, where appropriate, by other companies in our group and by our partners and subcontractors, in accordance with this Notice. Questions can be directed to the section "How to contact us" below.

In this Notice, you can learn about:

1. What information we collect
2. Minors
3. AI-generated content
4. Purposes and conditions for processing personal information
5. Marketing
6. With whom we share information
7. International transfer of information
8. Third-party tracking technologies
9. Retention of personal information
10. Your rights
11. Changes to this Notice
12. Language version
13. How to contact us

1. What information we collect

We collect Personal Information from users and visitors of the Services, including:

• Registration and login: When you open an account, we ask for details such as your email address, a username or similar identifier, and a password. We also collect information you provide when you update your profile.
• Identity and age verification: We may collect and store uploaded identity documents (such as government-issued ID or passport).

Age and identity verification is performed by trusted third-party verification providers (such as Yoti and VerifyMe), who may collect and process selfie or video images and, where applicable, biometric data to confirm your identity and age.

We receive the verification results from these providers but do not directly access or store biometric data. Your identity documents and verification results are used to verify that you are Legally of Age, to identify you, to process your requests, and to comply with applicable laws, including age-verification, anti-money laundering, and fraud prevention requirements.

As part of the identity verification process, we store the liveness check selfie provided during verification. We use this image for identity verification purposes, including verify that any subsequently uploaded content depicting a human face corresponds to the verified individual associated with the account, thereby helping to prevent impersonation, unauthorized account use, and fraudulent activity.

For information on how these verification providers process your data, please refer to their respective privacy policies.

• Account information: We collect the profile information, posts, images, video, captions, and other material you create, upload, or make public through the Services. Content you publish on a public profile or post may be visible to other users and, depending on settings, to people who are not logged in.
• Messaging and interaction content: We collect the content of messages, chats, and AI interactions you send and receive through the Services, including paid or pay-per-view messages and your interactions with Creators.
• Payment information: When you purchase on our Services, we do not directly access or store your full payment-card details; our trusted third-party payment processors collect that information (such as card number and bank account details) and provide us with transaction records including purchase history, amounts, and payment status.
• Creator payout and tax information: If you earn through the Services as a Creator, we and our payout providers collect payout details such as bank or payout-account information and tax identification information, in order to pay you and to meet tax-reporting obligations.
• AI generation data: we collect the information detailed in section 3, including but not limited to prompts, parameters, and any media you provide, along with the resulting outputs and related metadata.
• Voluntary information: We collect information you provide voluntarily to personalize your account or for a specific function, and the contents of your communications with us, such as feedback and support requests.
• Preferences and settings: We collect your account settings, notification preferences, privacy settings, content preferences, and safety controls that you configure through the Services.
• Device and technical information: We collect connection and device details that could identify you, such as unique device identifiers (for example UDID, IMEI, or MAC address), browser fingerprint, browser and operating system type, language preference, IP address, and approximate geolocation data derived from your IP address.
• Information from third parties: We sometimes receive Personal Information from third-party providers, for example to verify your identity and to prevent fraudulent or illegal activity.
• Inferred and derived data: We may derive or infer information about you based on your activity on the Services, such as content preferences, interests, and behavioral patterns.
• Usage and analytics information: We collect information about your use of the Services, including login history, access times, referring domain, feature usage, pages and content viewed, interactions, time spent, log files, timestamps, and alerts, for troubleshooting, research, analytics, and security purposes.
• Creator information: If you are a Creator on the platform, we collect additional information including: your real identity and identity documents for verification purposes; text descriptions, prompts, and parameters you use to create AI characters or personas ("Souls"); and the resulting AI-generated outputs and personas.

For Souls that do not involve sexually explicit content, we also collect facial images you upload, from which we process biometric data to generate an avatar that reflects your likeness. For Souls that involve sexually explicit content, we collect only text-based descriptions and parameters; no photographs are uploaded and no biometric data is collected or processed in connection with sexually explicit Souls.

2. Minors

We do not sell or share the Personal Information of users under the age of 18.

The Services are not designed for or directed to anyone under 18, or under the age of legal consent for the use of such Services in any relevant jurisdiction, whichever is higher ("Legally of Age").

If you are not Legally of Age, you must not use the Services or provide any Personal Information to us.

We reserve the right to access and verify Personal Information collected from you. If we become aware that a user who is not Legally of Age has provided information, we will terminate your account in accordance with our Terms. We strictly prohibit any description, reference, prompts, outputs, messages or any content that may depict, portray, represent, symbolize, associate with, or sexualize a minor or a person resembling a minor, including AI-generated or stylized depictions, and any non-consensual intimate content. Where we identify such content, we will retain such data, suspend the account, and, where applicable, report it to the appropriate authorities and organizations, as required by law.

If you have reason to believe that a minor has shared information with us or that prohibited content exists on the Services, please contact us at Privacy@Kallfi.com.

3. AI-generated content

The Services include AI-generated content. The content is produced by real individuals ("Creator") using AI tools we make available. The platform allows Creators to build "Souls" - AI-digitized representation characters. There are two distinct categories of Soul creation, each involving different data processing activities:

Non-Sexually Explicit Souls: Creators may upload a photograph of themselves, from which we process biometric data (specifically, facial geometry data) to generate an AI avatar that reflects the Creator's likeness. This involves the collection and processing of special category data under GDPR Article 9 and sensitive personal information under applicable US privacy laws.

Sexually Explicit Souls: Creators describe the characteristics of the avatar through text-based inputs only, and the platform uses the AI provider's trained database to produce the Soul. No photographs are uploaded and no biometric data is collected or processed in connection with the creation or any processing related to such Souls or content.

When you use AI features, we process the following categories of data:

Inputs: The prompts, text descriptions, parameters, reference images, facial images, and any other media you provide to the AI generation tools;

Outputs: The resulting AI-generated avatars, personas, images, videos, and other content created by the AI tools based on your inputs;

Interaction Data: Your usage patterns, preferences, generation history, and interactions with AI-generated content and Souls;

Technical Metadata: Timestamps, session identifiers, model versions, generation parameters, and system logs associated with AI processing. The Services are intended exclusively for AI-generated or AI-modified content. We provide appropriate disclosures informing users of the AI-generated nature of the content available through the Services, in accordance with applicable law.

We may use your inputs (such as prompts, parameters, and uploaded media), outputs (such as generated avatars and personas), and related interaction data to develop, train, fine-tune, evaluate, and improve our AI models, machine learning systems, algorithms, products, and Services.

This processing is necessary for our legitimate interests in improving the quality, accuracy, safety, and functionality of our AI features and in developing new capabilities that benefit all users.

Where your inputs or outputs contain special categories of personal data (such as biometric data derived from facial images to create non-sexually explicit Souls, or data revealing racial or ethnic origin), we rely on your explicit consent for processing and training purposes. We obtain this consent at the point of collection before any biometric data is processed. For the avoidance of doubt, biometric data is not collected, processed, or used in connection with the creation of sexually explicit Souls

You may provide or withdraw such consent through your account settings at any time, and withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

Biometric data safeguards: We implement enhanced technical and organizational measures to protect biometric data, including: encryption of biometric data both in transit and at rest; strict access controls limiting access to authorized personnel on a need-to-know basis; regular security assessments and audits; data minimization practices to ensure biometric data is processed only to the extent necessary for avatar generation; and secure deletion protocols when retention is no longer required. Biometric data is not used for any purpose other than generating the Creator's non-sexually explicit Soul avatar unless additional explicit consent is obtained.

We implement appropriate technical and organizational measures to protect data used for training, including pseudonymization where feasible, access controls, and security safeguards. Data used for training is retained only as long as necessary to achieve the training purpose or as required to demonstrate compliance with applicable laws.

We use third-party AI and machine learning service providers to operate certain AI features of the Services. These providers may process your inputs and outputs on our behalf, acting as data processors under our instructions and subject to appropriate data processing agreements. Such providers may include inter alia AI model hosting services, and specialized AI generation platforms.

These third-party AI providers may have their own terms and privacy policies governing the use of their services. You are solely responsible for reviewing these policies before using these AI tools.

Where content resembles a real individual, the Creator agrees and accepts that such real individual has provided express consent for their likeness to be used and has control over the AI-generated output through our platform. If you believe content on the Services depicts or resembles a real, identifiable individual without that individual's consent, you or the affected person may request its removal using the contact details in "How to contact us", and we will process the request and the Personal Information it contains in accordance with this Notice.

To keep the Services safe and lawful, content, messages, and AI interactions may be subject to automated screening and human review for moderation, safety, and Notice-enforcement purposes.

4. Purposes and conditions for processing personal information

This section sets out the purposes and legal bases for processing your Personal Information.

Where you have not consented (or have withdrawn your consent) to the processing of your Personal Information by us, we will continue to process your Personal Information: (a) where processing is required for the performance of the contract (i.e. the Terms of Use) between you and us; and/or (b) where processing is necessary for compliance with a legal obligation to which we are subject; and/or (c) where processing is necessary for the purposes of a legitimate interest of the Company and its affiliates.

Special categories of personal data

Our processing of your Personal Information also involves special categories of personal data for the provision and safety of our Services (as defined under Article 9 of the GDPR/UK GDPR or under applicable laws). We shall only process such information, as well as disclose it to competent authorities (law enforcement bodies), where it is strictly necessary and permitted by applicable law, and on one of the following conditions: (i) your explicit consent, for the provision of the Services and any optional features that rely on it; (ii) reasons of substantial public interest under applicable Union or Member State law, for content moderation, safety, and the detection, prevention, and reporting of unlawful content; or (iii) the establishment, exercise, or defense of legal claims.

Biometric data under US State Laws: If you are a Creator who uploads facial images for the creation of non-sexually explicit Souls, we process biometric data derived from those images. Under applicable US state laws, including inter alia the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act, and similar statutes, we provide the following disclosures: (a) we collect Biometric Data for the specific purpose of generating an AI avatar reflecting your likeness; (b) we will not sell, lease, trade, or otherwise profit from your biometric data except as required to provide the Services; (c) we retain biometric data as described in the "Retention of personal information" section below; and (d) we implement reasonable security measures to protect your biometric data. By uploading a facial image for non-sexually explicit Soul creation, you acknowledge and consent to the collection and processing of your biometric data as described in this Notice. You may withdraw this consent at any time by deleting the relevant Soul or contacting us.

Biometric data is not collected, processed, or stored in connection with sexually explicit Souls or content.

5. Marketing

We use Personal Information such as your email address, telephone number, and other contact details, collected by us or through our trusted subcontractors, to send you promotional materials about the Services that we believe may interest you.

Marketing communications may be delivered via email, SMS or text message, push notifications, telephone calls, or other electronic channels. Depending on your jurisdiction and the applicable legal requirements, we send you marketing about our own Services either on the basis of your prior consent or on the basis of our legitimate interests (where permitted by law, such as for existing customers in certain jurisdictions).

We send you marketing about the products and services of our business partners and affiliates ("Marketing Affiliates") only with your prior consent.

Where you give your consent, we may also use your email address or telephone number, including in hashed or similar form, for advertising, retargeting, and promotional purposes carried out by us or through trusted third-party partners, which may include campaigns on third-party platforms and adult-oriented websites.

You have the right to opt out of marketing communications at any time.

You can withdraw your consent or opt out by: (i) adjusting your preferences in your account settings; (ii) following the unsubscribe or opt-out link in our promotional emails or text messages; (iii) replying STOP to any SMS marketing message; or (iv) contacting customer support. Your opt-out will be processed promptly, and in any event within the timeframes required by applicable law. Even if you withdraw consent or opt out of marketing, we will continue to send you service-related communications, such as account notifications, security alerts, and transaction confirmations, as these are necessary for the operation of your account.

6. With whom we share information

We do not rent, sell, or share your Personal Information with third parties ("Recipients") except as described in this Privacy Notice. The Personal Information will be disclosed to Recipients only to the extent required for the specific purpose, as stipulated in this Privacy Notice.

We share Personal Information with any of the following recipients:

• affiliated companies;
• Subcontractors and third-party service providers, as well as their subcontractors, which by way of example include (but are not limited to) cloud computing companies, AI and machine learning service providers (including providers of AI model hosting, training infrastructure, and generative AI platforms), marketing affiliates, identity verification and fraud prevention services, age verification providers, and other data verifiers;
• Payment service providers, payment processors and banks;
• To any third parties who provide services in relation to the operation or promotion of the Services;
• Auditors, contractors, legal counsel, insurance providers, or advisers of any of the Company's business processes;
• To any third parties who investigate, detect or prevent fraudulent or illegal activity (e.g. governmental authorities, police, banks and other investigatory organizations);
• Child safety organizations and reporting bodies (such as the National Center for Missing & Exploited Children (NCMEC), and equivalent bodies in other jurisdictions) as required by law for mandatory reporting of child sexual abuse material;
• Governmental and regulatory bodies, in accordance with applicable laws and regulations; and
• Potential purchasers or investors in any of the companies within the Company or Company's white label brand (if applicable), or in the event of a corporate transaction (e.g. sale of a substantial part of our business, merger, reorganization, bankruptcy, consolidation or asset sale of an asset or transfer in the operation thereof) in relation to any company within the Company (in such event, the acquiring company or transferee will assume the rights and obligations as described in this Privacy Notice).

7. International transfer of information

Since we operate globally, it is necessary for the provision of the Service and to the extent required for the specific purpose, as stipulated in this Notice, to transfer your Personal Information to countries outside the European Economic Area ("EEA"), the United Kingdom ("UK"), Switzerland, or Brazil. The data protection and other laws of these countries may not provide the same level of protection as those in your jurisdiction.

In these circumstances, we use our best efforts to ensure that your Personal Information is protected in accordance with our Notice, through contractual means (such as by using the standard contractual clauses approved by the European Commission, the UK International Data Transfer Agreement or Addendum, or equivalent mechanisms recognized in Brazil and other applicable jurisdictions), through adequacy decisions where available, or through other lawful safeguards. For transfers from Brazil, we rely on the transfer mechanisms provided under the LGPD, including standard contractual clauses and, where applicable, specific regulatory authorization from the ANPD.

For more information about the transfer of your Personal Information, our contact details are available under the section "HOW TO CONTACT US?"

8. Third-party tracking technologies

 We use third-party advertising technology across our websites to serve advertisements when you visit or use our Service. We use and authorize third parties to use web beacons, cookies, pixels, scripts, tags and other technologies ("Tracking Technologies").

Tracking Technologies automatically collects information about you, your online behavior on the Websites, and your device (for example your computer or mobile device), for different purposes, including improving and personalizing your navigation on our Service and enhancing our Service's performance. Third parties use this information to provide you with targeted content.

You can set your browser to refuse all third-party cookies, or to alert you when cookies are being sent, also you can opt-out of many third-party ad networks, including those operated by members of the Network Advertising Initiative ("NAI") and the Digital Advertising Alliance ("DAA").

We also allow third parties to collect information about you through Tracking Technologies. To learn more please visit our Cookie Notice .

For more information regarding this practice by NAI members and DAA members, and your choices regarding having this information used by these companies, including how to opt-out of third party ad networks operated by NAI and DAA members, please visit their respective websites.

9. Retention of personal information

If you have registered with an account through our Services, the Company will retain your Personal Information during the period your account is active. In addition, the Company will retain your Personal Information for additional periods, to enable the Company to meet its legal obligations under applicable laws or regulations, Know-Your-Customer and Anti-Money Laundering regulations.

In addition, the Company shall retain your Personal Information for longer periods, provided that retaining such information is necessary for the Company's legitimate interests, such as fraud prevention and record keeping.

Deletion of your account will result in the deletion of your Personal Information, subject to any information that we are required or permitted to retain under applicable law or for legitimate business purposes.

Biometric data processed for the creation of non-sexually explicit Souls is retained only for as long as necessary to generate and maintain your Soul avatar, or until you withdraw your consent or delete the relevant Soul from your account. Upon withdrawal of consent, deletion of the Soul, or account termination, we will securely delete your biometric data within thirty (30) days, unless retention is required to comply with legal obligations, resolve disputes, or enforce our agreements.

If you have deleted your account and believe that any Personal Information relating to you remains undeleted, please contact us at deletion@kallfi.com.

10. Your rights

Depending on the jurisdiction you live, you may have certain rights regarding the collection and processing of Personal Information. To the extent these rights apply to and concern you, you can exercise them by contacting us via the contact details available under the section below "HOW TO CONTACT US?" and exercise the following rights:

1. Rights of access - You can obtain a copy of the Personal Information held by the Company at any time;
2. Right of data portability - You have the right to receive your Personal Information, in a structured, commonly used and machine-readable format and to request that your Personal Information be transmitted to a third party of your choice;
3. Right of rectification - In the event that the data held about you by the Company is inaccurate, incomplete or outdated, you have the possibility to request the rectification of said data (except in cases where the information is required to be kept in its original format under any applicable laws and regulations);
4. Right of erasure - You have the possibility at any time to delete your account . However, you are advised that with the deletion of your Personal Information, you might not be able to use the Service anymore or the account might be totally closed;
5. Right to restriction of processing, objection to processing - At any time, you have the right to request that the Company restricts or ceases to conduct certain data processes provided that there exists no other lawful basis on which the Company is authorized to process said data;
6. Right to withdraw your consent - You have the right to withdraw your given consent at any time. The withdrawal of consent will not affect the lawfulness of processing;
7. Right to lodge a complaint - You may submit any requests, complaints, or queries through the dedicated complaint reporting system available within the Services . We will consider any requests, complaints or queries and provide you with a reply in a timely manner in accordance with applicable laws. You can also file a complaint with the relevant data protection authority should you not be satisfied with the way in which we handle your Personal Information.
8. Right not to be subject to automated decision making - You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly effects to you.
9. Limit the use and disclosure of sensitive personal information - You have the right to request us to limit the use and disclosure of your sensitive Personal Information to certain business purposes, such as helping to ensure data security and integrity, non-personalized advertising, performing Services on behalf of the business, or doing things to verify, maintain, or improve the Service or device that the Company owns or controls.
10. Opt-out of the sale or sharing of personal information - In the event that we sell your Personal Information, you have the right to submit a request to opt-out of the sale of your Personal Information. After you opt-out, we are able to continue disclosing some Personal Information with our partners to help us perform business-related functions such as, but not limited to, providing the Services, ensuring that the Services is working correctly and securely, providing aggregate statistics and analytics and preventing fraud.
11. Non-discrimination - You have the right to be free from any discrimination for exercising your rights, by offering you different pricing or products, or by providing you with a different level or quality of services, based solely upon your request.

Additional rights for users in Brazil (LGPD)

If you are located in Brazil, you may also have the following rights under the Lei Geral de Proteção de Dados (LGPD): the right to confirmation of the existence of processing; anonymization, blocking, or deletion of unnecessary or excessive data; data portability; information about public and private entities with which we have shared your data; information about the possibility of denying consent and the consequences of denial; and revocation of consent. To exercise these rights, please contact us at Privacy@Kallfi.com. You may also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

We take our obligations seriously and we ask that any concerns be first brought to our attention, so that we can try to resolve this.

These rights are not absolute. We may need additional information to verify your identity before responding, and if you have not created an account, we may be unable to identify you and respond.

Depending on your jurisdiction, you may appeal our decision by contacting us at Privacy@Kallfi.com , and we will review the appeal in accordance with applicable law. You may also use an authorized agent to submit a request on your behalf where you provide a signed written authorization, and we can verify your identity or the agent's authority.

11. Changes to this Notice

We may change this Notice from time to time, so please revisit this page regularly. We will use reasonable efforts to notify you of substantial changes as required by law. Changes are effective upon publication on the Websites and as of the stated "Last revised" date, and your continued use of the Services after that date constitutes acceptance of the changes.

12. Language version

The Notice has been drafted in the English-language, which is the original and controlling version of this Notice.

All translations of this Notice into other languages shall be solely for convenience and shall not control the meaning or application of this Notice. In the event of any discrepancy between the meanings of any translated versions of the Notice and the English language version, the meaning of the English language version shall prevail.

13. How to contact us

If you have questions about the Services or about the information we collect and how we use it, please contact us at Privacy@Kallfi.com or by writing to Pythia Grant Ltd., Agias Zonis & Thessalonikis 3025, Limassol, Cyprus