Privacy Notice

Updated: 8 September 2026 · version 2026-09-09-v16

1. Controller

Peter Valašik, Obrancov mieru 2005/10, 953 01 Zlaté Moravce, Slovakia, company ID 50058045, is controller for EMSYO. Privacy requests: drakderos@gmail.com, +421 948 616 012.

2. Data categories and sources

Depending on your choices, EMSYO processes account/email/settings; Free/paid status, plan or pass, renewal/expiry, credit balance and ledger, cloud quota, upload/deletion deadlines, daily file egress and payment references (not the full card); after an erasure request, a minimal pseudonymous account identifier, erasure time and server-side records needed to block or settle a delayed payment; messages, optional transcripts and explicit memories; audio for recognition or translation and text for speech synthesis, including the live interpreter and LIVE voice conversation (the ordinary chat microphone records a short clip for subsequent transcription); transient camera frames and a frame explicitly submitted for generation; uploaded documents/attachments; permitted or manually chosen location; journal, notes, calendar, tasks and lists, saved media and history; security, errors and limits; optional minimal analytics; and the name, email, contract identifier, content and time of a complaint or withdrawal.

Data comes from you, your device and providers used for your request (such as payment, map or weather results). EMSYO does not require special-category data; do not submit it unless necessary and you have a valid legal basis.

3. Purposes and legal bases

• Contract (GDPR 6(1)(b)): account, sign-in, subscription and requested AI, voice, camera, document, map, weather, media, organisation and support functions.
• Consent (6(1)(a)): optional product analytics and any feature explicitly labelled as consent-based. Withdraw it in Settings without affecting prior lawful processing.
• Legitimate interests (6(1)(f)): security, fraud/abuse prevention, protective limits, basic diagnostics and legal claims after balancing user rights. You may object.
• Legal obligation (6(1)(c)): accounting, tax, consumer requests, authority orders and other statutory records.

Browser permission for microphone, camera, location or notifications is a technical control; a function starts only at your request. Account email and payment data are required to create an account/paid contract. Other inputs are optional, but the chosen feature cannot work without them.

4. Feature processing

Audio may go to a configured provider for recorded-audio transcription, translation or a spoken response. The live interpreter and separate LIVE voice mode are active paid features: audio is sent to the realtime translation or voice-conversation provider during a session that the server ends after five minutes at the latest. The ordinary chat microphone sends a short recording for subsequent transcription. Answer text may be sent to ElevenLabs or OpenAI for standard speech generation. Disabling voice output blocks paid speech generation and starting the interpreter server-side, and the app stops LIVE voice; text and recorded microphone input can still work. Ordinary camera frames are not intentionally stored as history. An explicit generative edit or video sends one current frame and instruction, then stores the result privately. Vision is not used for identity, biometrics, emotion or sensitive-trait inference. Source documents are transient for the requested analysis and are not added to gallery, memory or history.

Permitted location is used only for a requested place, route, weather or context; EMSYO does not create continuous movement history. Google can receive the query/coordinates needed for maps, and weather providers receive place coordinates. EMSYO first shows a preview for a call, SMS, email or WhatsApp message and neither sends nor opens anything without user confirmation. After confirmation, the destination app processes the hand-off and the user completes sending. Navigation likewise opens only after a user action.

Journal, notes, events, tasks, lists, optional transcripts/memories and explicitly saved/generated media are private account content. Access is account-controlled. The browser receives no Storage link: an EMSYO proxy uses a random five-minute token and each GET/Range counts the full object size. Daily caps are Standard/pass/credits 200 MiB/50 requests, Plus 512 MiB/150 and Max 1 GiB/300; file-count caps are 500/2,500/7,500. Access fails closed. Deletion of owned files remains available. Saved media can contain EMSYO visual grading, signature and rendered description. Calendar push uses a browser subscription only for a requested reminder.

AR and game data

Shared AR data

To provide requested shared AR, the server processes the account or guest identifier, alias, membership, granted and approved permissions, activity time, chosen characters and their positions relative to the shared points. Approved participants see aliases and permitted characters. Shared games process questions, answers, turn order and scores. Before reveal, the secret word is accessible only to the thinker; a quiz answer is disclosed when the round is evaluated. The shared game has its own state, separate from your solo games.

The room shares a character's already generated synthetic speech and its text. This feature does not broadcast your live microphone or camera to other players. The response text can nevertheless contain information from your question. Audio is delivered through temporary private storage with a short access window; membership and permissions are checked during playback. This sharing does not add private responses to the public prepared-recording catalogue. Revoking permission cannot take back content someone has already heard or captured.

Nearby discovery starts only on request and after browser location permission. The location sent to the server is rounded to hundredths of a degree, rather than an exact GPS coordinate. Making a room discoverable nearby is a separate option and does not allow admission without approval. Invite codes do not require GPS. Location permission can be withdrawn in the browser and discovery disabled in the room.

Rooms and their shared game data become eligible for deletion 24 hours after closure or inactivity, on the next successful cleanup. Technical request records are cleaned after 24 hours. Shared audio can be downloaded for two minutes; the short record used to check consent during already started playback is valid for at most ten minutes. Subsequent maintenance physically removes audio, so deletion need not occur exactly when access expires. Leaving stops further sharing but does not itself erase the shared game's progress for other players. Use the contact email to request your data or erasure.

To enable Bim's 18+ roast, we store the acknowledged warning version and confirmation time against your account identifier. This records your declaration that you are at least 18 and your acceptance of this optional mode; it is not a verified date of birth. We do not request your birth date or identity document for this purpose. We use this record to provide the mode you requested under GDPR Article 6(1)(b), not for marketing. Disabling 18+ access deletes the record and requires a new acknowledgement before using the mode again. It does not itself delete saved game progress or activity history, which follow the game-memory rules below. Account deletion also deletes this record. The rights and contact details in this policy apply to these data too.

Guest AR creates an anonymous identity and browser identifier to protect trial attempts. Game progress is saved to that identity and may be inaccessible if its session is lost. Use the contact email for data access or erasure requests.

Camera preview and AR tracking run on the device. Displaying companions does not send continuous video to AI. If you enable on-request analysis and ask about your surroundings, a captured frame may be sent to the AI provider with the question. Starting the AR microphone records a short clip for transcription; when creating new audio, text to be read aloud is sent to the speech provider. This also applies to a child's voice with Kiki. An adult can use the prepared buttons without the microphone and keep spoken output disabled.

Game mode, language, activity age band, current story or round, choices, score and previously used activities are saved to the account to resume play. Bim also saves the roast intensity and family mode. Vexo also saves the round's questions and answers and sends the necessary game history to OpenAI for AI turns. Prepared Kiki and Bim activities use game logic without an AI model; matching repeated requests uses a fingerprint of text input rather than its verbatim wording. Free-form AI conversation with Kiki and shared dialogue while she is present use AI, but do not use My World personal memory or save an ordinary conversation transcript.

Game memory provides the requested game and is separate from optional My World personalization. Current solo game data and its technical request records are retained while the account exists. Starting another game may replace current progress but does not itself erase previous request records. Account deletion removes this game data too. Contact us by email to request access, a portable copy or erasure of game data without deleting the account.

Explicitly saved AR scenes and lists of heard or liked Bim jokes may be stored in the account or on the device, as indicated by the save status. Local data is not a backup across devices and is removed when browser data is cleared. Server account deletion does not itself clear storage on another device. Playback progress and temporary audio of ordinary AI replies stay only in the open application's memory. Verified prepared-content recordings are stored separately on the server while used in the catalogue; they contain prepared catalogue text and mouth-animation timing, not private player input. Access to a stored 18+ recording still follows that level's restrictions. These shared recordings are not tied to an individual account and are not removed by its deletion.

5. My World (optional personalization)

My World is a voluntary personalization memory of your account, switched off by default. The legal basis is split by purpose:

• Storing, displaying, editing, exporting and deleting items at your explicit request is the provision of a feature you asked for, i.e. performance of the contract under Art. 6(1)(b) GDPR.
• Using relevant items to personalize an AI answer and any resulting transmission to the configured AI provider is based on consent under Art. 6(1)(a) GDPR.

Turning the feature on is opt-in. Turning it off withdraws only the personalization consent, without retroactive effect on earlier processing; the items remain stored at your request until you delete them individually or entirely, or delete the account.

• With memory on, only a few items relevant to the current request may be added to the prompt sent to the AI provider (data minimization, a small number of items per answer).
• Contact values (phone, e-mail) and items set to “Ask instead of using” are never sent to the AI provider; contacts are used server-side only in a call or message preview that you confirm.
• Store data about other people, including children, only where necessary and only if you are entitled to do so.
• In this version, storing passwords, PINs and one-time codes, payment data, access codes, government identifiers and special categories of data (health, genetics, biometrics, racial or ethnic origin, religion, political opinions, trade unions, sex life or orientation, criminal offences) is prohibited.
• You can view, correct, export to JSON, delete individually or entirely, or switch the use off at any time.
• Items are retained until you delete them or delete the account. Switching the feature off stops their use but keeps the items until you delete them.
• We record the on/off choice together with the version of this notice for accountability.

6. Recipients

As required by the feature and current configuration, recipients/processors can include:

• Supabase — authentication, database and private storage;
• OpenAI — AI, analysis, web tools, transcription, speech and media as configured, including LIVE voice conversation and live interpreting;
• ElevenLabs — paid AI voice output when configured;
• fal.ai and Meshy — detailed 3D generation from an explicitly submitted text description;
• Perplexity — current web search and deep research;
• Google Maps Platform — places/photos/routes; Open-Meteo — weather;
• Stripe — payments, subscription and billing portal;
• AudD — music recognition; PostHog — analytics only after opt-in;
• After optional device-level analytics consent we send minimal pseudonymous browser-level conversion events without a PostHog person profile, safe source/medium/controlled EMSYO campaign fields and only a boolean indicating whether an advertising click ID was present; the click ID itself, general UTM term/content fields, referrer, email, conversation content and precise location are never sent, and there is no advertising profiling or session replay;
• Resend — transactional email, including withdrawal confirmation;
• Lovable — connector/AI gateway and hosting infrastructure; a request routed through the gateway may also be processed by the configured upstream model provider (including Google where that deployment is used), always only to the extent actually configured.

EMSYO does not disclose personal data for targeted advertising or create an advertising profile from private content. Providers may retain limited security/legal records under their business terms.

7. International transfers

Some providers can process outside the EEA. A valid safeguard is used where required, such as an EU adequacy decision or Standard Contractual Clauses with appropriate supplementary measures. Request available safeguard information from the controller contact.

8. Retention

• Account/settings: while the account exists, then the necessary backup cycle.
• After account erasure, a minimal pseudonymous account identifier, erasure time and limited financial-settlement records may remain only to stop a delayed payment recreating access or credits and to complete cancellation, refund, accounting, security and legal-claim duties. They contain no erased account content, cannot restore the account and remain only for those purposes and applicable statutory periods.
• Account content, transcripts, memories and credit balance: until you delete the record or account. Purchased credits do not expire while the account exists. Account deletion is irreversible and removes the credit balance with the account.
• Cloud files: Free permits 0 new uploads. Subscriptions and passes permit uploads within quota only while paid access is active. The latest credit-pack purchase permits 1 GiB of new uploads for 30 days from purchase and only while at least 1 purchased credit remains. The exact preauthorized result of an already-started paid action may still save after consuming the final purchased credit, but only by its deadline.
• When upload access ends, existing Gallery files are read, download and delete only for exactly 30 days, with new uploads blocked. Buying eligible paid access before the deadline postpones deletion according to the new access; afterwards files are scheduled for permanent deletion. EMSYO does not promise indefinite retention.
• Ordinary camera frames, recorded audio and source documents: not intentionally retained by EMSYO as history after the request.
• Completed provider video job: deletion is requested after copying to private gallery; provider security retention can remain.
• My 3D objects: saved models remain available without credits or an active subscription until the object or account is deleted. Removing an object erases its file and prompt; a technical operation record protects against duplicate billing. Creating a custom 3D object sends the text description to fal.ai for the Meshy model; it does not send a camera frame. Reuse loads the private saved file without generating again.
• Payment/accounting/tax records: statutory period, generally 10 years.
• Complaints, withdrawals and claims: through handling and the period needed to evidence compliance, generally the relevant limitation period; accounting records can last longer.
• Security/technical logs: only as needed to investigate incidents, protect the service and meet legal duties.
• Opt-in analytics: the shortest configured period needed for aggregate product statistics, without person profiling.

9. Your rights

Subject to GDPR conditions, you can request access, rectification, erasure, restriction, portability and object to legitimate-interest processing, or withdraw consent. EMSYO does not make solely automated decisions about you with legal or similarly significant effects. Email the controller; identity can be reasonably verified and a response is normally due within one month. Account deletion is available in Settings.

You may complain to the Slovak Data Protection Authority, Galvaniho 7/B, 821 04 Bratislava, Slovakia, statny.dozor@pdp.gov.sk, dataprotection.gov.sk, or the authority where you habitually reside.

10. Children, security and changes

EMSYO includes Kiki activities for ages 4–9, to use together with a parent or legal guardian through their account. It does not provide a separate child account or a verified parental-consent mechanism; microphone permission does not replace such consent. An adult manages the account and payments. Select an activity age band, not a child’s date of birth, and do not provide unnecessary child personal data. Security measures include access control, private storage, server-side secrets and per-user limits. LIVE voice and interpreter connections are created by the server without exposing the provider key to the browser; no online service is absolutely secure. Material changes to this Notice are communicated appropriately before taking effect.

See Cookies and local storage for browser storage and optional analytics details.