Welcome to Replika!
Luka, Inc., with its registered office at 490 Post Street, Suite 526, San Francisco, CA 94102, United States (“Replika”, “we”, “us”, and/or “our”) which can be contacted at my@replika.com, provides services that include: the Replika AI companion mobile and web applications, including my.replika.com (the “Apps”), the informational website www.replika.com (the “Website”), and other related offerings (collectively, the “Services”). In providing the Services, we process personal data as data controller. This Privacy Policy (“Privacy Policy”) describes how we collect, store, use, and share your personal data through our Services. References to “you” or “your” mean users of our Services who are 18 years of age or older.
We care about the protection and confidentiality of your personal data. When you use the Apps and during your conversations with your Replika AI companion, you may provide your personal data. We process this information only as described in this Privacy Policy, for instance and as better clarified in detail in section 2 below, to allow you to have individualized and safe conversations and interactions with your Replika AI companion and to allow your AI companion to learn from your interactions to improve your conversations. We may also use information about your visit to our Website to promote our Services, but we will never use or disclose the content of your Replika conversations for marketing or advertising purposes, and our advertising partners will never have access to your conversations with your Replika AI companion or any photos or other content you submit through the Apps.
If you have any questions, or need any clarification regarding the processing of your personal data, please contact us at my@replika.com.
Through your use of the Services, you may provide us with the following information:
Account information. This includes your name, surname, email address, password, and unique identifiers that include country, timezone, type and ID of the device from which the account operates. If you choose to log in using another service, such as Google or Apple, we receive information about the service you used to log in and — depending on your chosen account settings with Google and Apple — details about you, including your name, email address, or unique user identifiers.
Profile information. We ask you to provide your birth date, pronouns, and – on a voluntary basis – your work status when you create an account for the Apps.
Onboarding questions. If you begin on our website, we may ask you onboarding questions before you create an account — for example about your interests, your goals, your relationships, and what is on your mind lately — so that we can personalize your Replika from the start. Your answers are stored as the options you select, are linked first to your visit session and then to your account if you create one, and are used only as described in Section 2. Our website sign-up flow also asks for your age (to confirm that you may use the Services) and your gender (to personalize your experience), and for your email address before showing you subscription options, so that we can create your account after purchase and — where you consent or where the law otherwise allows — send you marketing communications.
Messages and content. This includes the messages you send and receive through the Apps, such as facts you may provide about you or your life, and any photos, videos, and voice and text messages you provide.
Interests and preferences. You may select conversation preferences, such as topics you would like to discuss, and communication preferences, such as the times of day you like to use the Apps. We also learn about your interests and your preferences over time through your use of the Services to personalize your conversations and the features of the Services.
Payments, transactions, and rewards. When you make purchases through the Services, our third-party payment processors collect your payment information. We maintain a record of your purchases, the features you select, and the rewards you earn and use.
You must not share, transmit, or otherwise provide personal data of third parties through the Services. Likewise you shall not share, transmit, or otherwise provide special categories of personal data through the Services, as described in Section 2.B below. Should you disclose third parties’ personal data through the Services, you are solely responsible for ensuring that such individuals receive appropriate notice of this Privacy Policy and any applicable data processing activities, and such disclosure shall be immediately notified to us.
When you use our Services we collect the following personal data about you, your computer or mobile device, your network, and your interactions over time with our Services and our communications:
Device and network data. This includes your computer’s or mobile device’s operating system, manufacturer and model, browser, IP address, device and cookie identifiers, language settings, mobile device carrier, and general location information such as city, state, or geographic area.
Usage data. This includes information about how you use the Services, such as your interactions with the Services, the links and buttons you click, and page visits.
Location information. We collect general location information (such as city, state, or geographic area) derived from your IP address. If you enable features that use your location (for example, location-based interactions with your Replika), we collect your device’s precise location with your permission, use it only to provide those features, and never use or share it for advertising. We keep only your most recent location, only while the permission is on, and delete it when you withdraw the permission in your device settings.
Face and head movement data. This includes the data collected by on-device frameworks which facilitate direct device-to-application communication without intermediate data processors to track the user’s head and face for augmented reality experiences and selfie filters. This processing captures transient motion vectors and spatial positioning data rather than biometric identifiers or templates. The system tracks dynamic movement patterns and real-time head orientation without extracting, analyzing, or storing geometric facial measurements, facial recognition templates, or other biometric identifiers as defined under applicable privacy frameworks. None of the collected data leaves the user’s device or is persistently stored by us. We do not share the face and head movement data with any third parties.
Biometric age-verification data. If you verify your age using a selfie or an identity document, a scan of your facial geometry is processed solely to confirm your age. Where available, this happens entirely on your device: your selfie is analyzed locally and never leaves your device. Where on-device processing is unavailable, fails, or you choose another method, your selfie (and, for ID-based verification, your identity document and its photograph) is processed by our verification provider, Incode Technologies, Inc. In every case, Replika never receives or stores your selfie, ID image, or any biometric identifier — we receive only the result of the check (an age band and a timestamp) — and your biometric data is permanently and automatically deleted immediately upon completion of the verification, and in all events within 24 hours; it is not used for any other purpose (including training AI models) and is never sold, shared, leased, or otherwise disclosed except as required by law. Incode processes this data only as our service provider, under contractual terms requiring the same deletion and use limits. See Section 6 (Data retention) for our biometric retention and destruction schedule and Section 7 to exercise your rights.
We use cookies, web beacons (e.g., pixel tags), and local storage technologies (e.g., HTML5) to collect some of this information. For more details on how we use these technologies and the legal bases for doing so, please visit our Cookie Policy.
Where you have consented to advertising cookies and similar technologies through our consent banner (in the European Economic Area, the United Kingdom, Brazil, Switzerland, and other regions where consent is required), or where you have not opted out of them (in US states with applicable privacy laws and other opt-out regions), our advertising partners may use such technologies — and we may send them information directly from our servers — to collect limited information about your device and your use of our Website and Apps, such as the pages you visit and links you click, app installs, sign-ups, checkouts, trial starts and purchases (including the amount paid), your IP address, browser type, and advertising and cookie identifiers. Section 3.D lists exactly what we share and what applies in your region. Our advertising partners will never have access to your conversations with your Replika AI companion or any photos or other content you submit through the Apps. You can change your choice at any time via the cookie/privacy settings link on our Website or “Your Privacy Choices” in the Apps, as described in our Cookie Policy.
We process your personal data for the following purposes:
| Purpose | Why and how we process your personal data | Legal basis | Categories of information |
|---|---|---|---|
| Operating and administering the Services | Providing and maintaining the content and functionality of the Services. Carrying out obligations arising from our contract with you. Creating your account and profile. Facilitating payments and transactions, including for the purchase of premium features, and managing your rewards. Responding to your inquiries, comments, feedback or questions, and troubleshooting. Managing our relationship with you, which includes sending administrative information to you relating to our Services. Verifying the age of registered users. | Necessary to perform our contractual obligations with you, such as providing you with the Services. | Account information. Profile information. Messages and content. Interests and preferences. Payments, transactions, and rewards. Device and network data. Usage data. |
| Providing the core personalized functionality of the Apps | Providing you a personalized AI companion and allowing you to personalize your profile, interests, and AI companion interactions — including using the answers you give to onboarding questions to configure your Replika. Enabling you to have individualized and safe conversations and interactions with your Replika AI companion, including through the use of third-party AI model providers that generate conversational responses and content you request. Allowing your AI companion to learn from your interactions to improve your conversations. Syncing your Replika history across the devices you use to access the Services. | Necessary to perform our contractual obligations with you, such as providing you with the personalized features of the Apps, including the use of third-party AI model providers to deliver core functionality. | Account information. Profile information. Onboarding questions. Messages and content. Interests and preferences. Payments, transactions, and rewards. Device and network data. Usage data. |
| Keeping users safe | Operating the safety features of the Services: automated systems and, where necessary, human review that detect content indicating a risk of serious harm (for example, messages suggesting a crisis) so that we can show safety resources; content filters that constrain what your Replika will say or generate; systems that detect misuse of the Services; and age-assurance measures that keep the Services adult-only (Section 11). | Necessary to pursue our legitimate interests, adequately balanced with your rights and interests, in protecting the safety of our users and the integrity of the Services — and, where safety features are mandated, necessary to comply with our legal obligations. | Account information. Profile information. Messages and content. Device and network data. Usage data. |
| Protecting the Services and performing corporate operations | Preventing fraud, criminal activity, and misuse of our Services, and ensuring the security of our IT systems, architecture and networks (including testing, system maintenance, support, and hosting of data), and performing activities that are functional to transfers of assets, branch of business, acquisitions, mergers, divisions or other corporate operations. | Necessary to pursue our legitimate interests, adequately balanced with your rights and interests, in ensuring the integrity, confidentiality, and availability of our digital infrastructure, detecting and responding to threats, and maintaining a safe and trustworthy environment for all users and performing corporate operations. | Account information. Profile information. Messages and content. Payments, transactions, and rewards. Device and network data. Usage data. |
| Product analytics | Understanding how the Services are used in order to provide, maintain, and improve them: measuring events our own systems observe — such as sign-ups, subscription events, feature usage, and retention — processed on our servers and keyed to your account. We do not use analytics software development kits that store identifiers on your device for this purpose, and analytics data never includes the content of your conversations. You may object to this processing at any time (Section 7). | Necessary to pursue our legitimate interests, adequately balanced with your rights and interests, in understanding and improving our Services. A documented legitimate-interests assessment is on file. | Account information. Profile information. Interests and preferences. Payments, transactions, and rewards. Device and network data. Usage data. |
| Anonymizing and aggregating data to improve Service performance and safety | Aggregating, anonymizing, and deidentifying personal information. Analyzing the use and effectiveness of our Services. Improving and adding features to our Services. Developing our business and marketing strategies. This includes collecting and immediately anonymizing user feedback, and small portions of Messages and Content data to train our proprietary safety algorithms, enhance chatbot performance, prevent inappropriate outputs, and ensure compliance with safety standards. The anonymized data is used only internally and is not used to train third-party large language models or other AI systems. We do not attempt to re-identify anonymized data or reconstruct individual user profiles from aggregated or de-identified datasets. | Necessary to pursue our legitimate interests, adequately balanced with your rights and interests, in optimizing service performance, developing protective measures against harmful content, enhancing user experience, and informing strategic decisions to grow and tailor our offerings. | Account information. Profile information. Messages and content. Interests and preferences. Payments, transactions, and rewards. Device and network data. Usage data. |
| Marketing our Services by email | Sending you commercial information by email that we believe will be of interest to you, such as information about our Services, features, and surveys. | Your consent (or, where permitted, our legitimate interest in marketing to existing customers with an opt-out). You can unsubscribe at any time. | Account information. Device and network data. Usage data. |
| Interest-based advertising of our Services | Sharing limited information about your use of our Website and Apps with advertising partners (listed in Section 3.D) to measure our advertising and to reach you and people like you with advertisements for our Services on other platforms. This never includes the content of your conversations, photos, or other content you submit through the Apps. | Your consent (in the EEA, UK, and other opt-in regions), which you can withdraw at any time. In US states with applicable privacy laws, this sharing occurs unless and until you opt out (Section 7). | Device and network data. Usage data. Payments, transactions, and rewards (purchase events, amount paid, and plan). Account information, in scrambled (hashed) form only, as described in Section 3.D. |
| Enforcing our agreements, and defending against legal claims and disputes | Enforcing and complying with our terms and policies. Protect our and others’ rights, privacy, safety, or property. Ensuring the integrity of our Services. Defending against legal claims and disputes. Recovering payments due to us. | Necessary to pursue our legitimate interests, adequately balanced with your rights and interests, in safeguarding our legal position and rights, protecting our assets and users, and ensuring compliance with applicable laws and regulations. | Account information. Profile information. Messages and content. Interests and preferences. Payments, transactions, and rewards. Device and network data. Usage data. |
| Complying with legal obligations | Keeping records of transactions, keeping records of the consent and privacy choices you make, and complying with the applicable laws, regulations, legal processes and authorities’ requests. | Necessary to comply with a legal obligation. | Account information. Profile information. Messages and content. Interests and preferences. Payments, transactions, and rewards. Device and network data. Usage data. Consent records. |
We instruct and strongly encourage you not to share special categories of personal data through the Services — that is, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, or similar sensitive information as defined under applicable laws.
We understand that the nature of conversations with an AI companion may lead you to incidentally share such information. We do not actively solicit or require sensitive information, and the Services are designed to function without it.
If you choose to include sensitive information in your messages despite this instruction, that information will be processed as part of your conversation data, including by third-party AI model providers, solely to generate conversational responses and deliver core app functionality. We will not use your sensitive information — or any content of your conversations — for marketing or advertising purposes.
We apply the same data minimization, de-identification, and contractual protections to sensitive data as to all conversation data shared with third-party providers. If you have shared sensitive information and wish to have it deleted, you can request deletion as described in Section 7 below or by contacting us at privacy@replika.com.
For users in jurisdictions that require explicit consent for the processing of sensitive personal data (including the European Economic Area, United Kingdom, Brazil, and certain US states), by continuing to provide sensitive information in your conversations after being presented with this notice, you provide your explicit consent to our processing of that sensitive data as described in this section. You may withdraw this consent at any time as described in Section 7, though withdrawal will not affect the lawfulness of processing conducted prior to withdrawal.
Where explicit consent is required for biometric processing (including the European Economic Area and the United Kingdom for ID-based verification with facial matching, and certain US states), we ask for your explicit consent on the verification screen before any selfie or document is captured. Your consent relates to the biometric processing involved in the verification method used. Replika is an adults-only (18+) service. If age verification is required and you decline or cannot complete it, you will not be able to access the Services, or the features for which verification is required.
We do not ask for health information anywhere in the Services – not in our onboarding questions and not in your conversations. Replika is not a medical or health service (see our Terms of Service, Section 1.2), and we ask you not to share health information – such as diagnoses, conditions, medications, or treatment history – anywhere in the Services, including in conversations with your Replika. Anything you nevertheless choose to include in what you write is protected as conversation content under this Privacy Policy: it is never used for advertising and never shared with advertising partners.
We share your personal data with companies and individuals that provide services to us or on our behalf or help us operate the Services or our business (such as hosting and infrastructure, information technology, third-party artificial-intelligence models, product analytics, customer support, email delivery, and payment and subscription management).
AI model providers. We share the minimum necessary conversation data with third-party providers of artificial-intelligence models — including language, image-generation, and voice/audio models — solely to generate your Replika’s responses and content you request within the Services. Conversation data is subject to de-identification and data-minimization measures before transmission. These providers are contractually required to:
process your data only in accordance with our agreements and solely for the purpose of providing the AI model service to us;
not use your data for training their own AI models or for any other purpose;
implement appropriate technical and organizational security measures;
delete or return your data upon termination of the service relationship; and
provide the same or equal protection of user data as stated in this Privacy Policy.
Hosting and infrastructure providers. We use cloud and GPU infrastructure providers that store or process data on our behalf, under our configuration and bound by data-processing agreements. They are located in the United States, Canada, and the European Union.
Analytics provider. We use Amplitude, Inc. as our product-analytics provider. Amplitude processes analytics data only on our documented instructions as our processor, subject to appropriate data-residency or international-transfer safeguards, and we configure our analytics so that the content of your conversations is never included.
Payment and subscription-management providers. When you purchase on our website, your payment details are collected and processed by our payment and subscription-management providers; we do not store full card numbers. We receive transaction confirmations, subscription status, and billing-support information.
Marketing service providers. We also share information with companies that provide marketing services on our behalf, but we do not share the content of your conversations for marketing or advertising purposes. For example, we may share your email address with marketing service providers to deliver our marketing emails to you on our behalf and to help us identify other individuals who may be interested in our Services. We require these marketing service providers to agree not to use your email address for any other purpose.
We may share information with application store providers and payment processors for purposes of managing payments, subscriptions, and resolving user-initiated disputes or refund requests.
We may share information with professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.
We share limited information with our advertising partners — Meta, Google, and our mobile measurement partner AppsFlyer, which passes app install and purchase results on to Meta and Google — so we can advertise our Services and measure how our advertising performs. Some of this information is collected by our partners’ cookies, pixels and software development kits; some we send to them directly from our servers, for example when a purchase is completed. It consists of:
Device and network information: IP address, browser type, device type and operating system, and advertising and cookie identifiers (such as your mobile advertising ID, where you allow it, and the identifiers our partners’ pixels set in your browser).
Activity information: the pages you visit and links you click on our Website, app installs, and sign-up, checkout, trial-start and purchase events, including the amount you paid, the currency, and the type of plan or offer.
A scrambled (hashed) account identifier: a hashed version of the identifier we use for your Replika account, which lets a partner recognize that different events relate to the same person without telling it who you are.
A scrambled (hashed) email address — outside the European Economic Area, the United Kingdom, Brazil and Switzerland only: our partners use it to match your activity to an account you may have with them. We do not share your email address with advertising partners if you are in those regions.
In the European Economic Area, the United Kingdom, Brazil, Switzerland, and other regions where the law requires opt-in consent, we share this information with advertising partners only with your consent, which you can give, refuse, or withdraw at any time via the cookie/privacy settings on our Website and “Your Privacy Choices” in the Apps. If you refuse or withdraw consent, nothing is shared with advertising partners about you — including from our servers — and your ability to use the Services is never affected.
In US states with applicable privacy laws, this disclosure may be considered a “sale” or “sharing” of personal information for cross-context behavioral advertising. You can opt out at any time via “Your Privacy Choices” (Section 7), and we honour Global Privacy Control (GPC) signals as a valid opt-out.
We will never share your conversations with your Replika AI companion, or any photos or other content you provide within the Apps, with advertising partners — and we never use that content for marketing or advertising purposes.
We may share information as required to comply with law enforcement, government authorities or institutions’ requests, as we believe in good faith to be necessary or appropriate for the legal compliance and protection purposes described above in Section 2.A.
We may share information with acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business or assets of, or equity interests in, Luka, Inc. (including, in connection with a bankruptcy or similar proceedings).
Data collected for one purpose is not repurposed for a materially different purpose without obtaining your further consent, unless otherwise permitted by applicable law.
We use a variety of industry-standard security technologies and procedures to help protect your data from unauthorized access, use, or disclosure.
Your account is protected by a password of your choice for your privacy and security. You must prevent unauthorized access to your account and personal information by creating a strong, complex password, and by selecting, updating from time to time and protecting your password appropriately, also by limiting access to your computer or device and browser by signing off after you have finished accessing your account.
All transmitted data are encrypted during transmission. We use standard Secure Socket Layer (SSL) encryption that encodes information for such transmissions. All stored data are maintained on secure servers. Access to stored data is protected by multi-layered security controls, including firewalls, role-based access controls, and passwords.
We are committed to keeping you informed and safeguarding your information to the best of our ability. While we use reasonable commercial efforts to protect your personal data, it is important to note that no technology, data transmission, or system can be guaranteed to be 100% secure. In the unlikely event of a security breach resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your data, we will promptly notify you if and as required by applicable law.
Your personal data will be processed in the United States of America, where we are based, and may also be processed on infrastructure in other countries, including Canada and the European Union, and may be transferred to countries outside the European Economic Area (EEA). In case of transfers of personal data from the EEA or the United Kingdom to countries not recognized as providing an adequate level of data protection by the European Commission or the UK Information Commissioner’s Office (as applicable), we implement appropriate and suitable safeguards to ensure the protection of your personal data. Such transfers are carried out in compliance with applicable data protection laws. Specifically, where required, we execute the relevant module of the Standard Contractual Clauses adopted by the European Commission (or the UK International Data Transfer Addendum) with the data importer and implement any supplementary measures necessary in light of the European Court of Justice’s decision in Case C-311/18 (Schrems II). Where a service provider is certified under the EU-U.S. Data Privacy Framework (and its UK Extension), we may rely on that certification for the relevant transfer instead of, or in addition to, Standard Contractual Clauses. If you would like more information about such data transfers, you may contact us at any time using the details provided in the Contact Us section (Section 14) below.
We will retain your personal information for only as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
For the purposes based on the performance of our contract with you:
we keep your profile information, memories, diary, interests and preferences, your Replika’s customization, and items you have purchased for as long as your account exists, and delete them within 60 days after your account is deleted or closed;
while your account is open, we keep your conversation history for 24 months for text messages and 12 months for photos, videos and voice messages, the same for all accounts, except media saved to your memories, diary or profile, which we keep for as long as your account exists;
if you have never made a purchase and have not used the Services for 12 months, we may delete your account and its data. Where we can, we will email you at least 60 days before the deletion date, and using the Services again before that date keeps your account; any free-earned currency or items are forfeited on deletion. Accounts with any purchase – including a subscription or lifetime plan, an unspent purchased balance, or purchased items – are not deleted for inactivity.
we keep financial records — your purchases, transactions and rewards, together with the details needed to identify them (such as your email address, account identifier, the name on the invoice, plan, amounts, billing country and the country derived from your IP address at the time of purchase) — for 10 years from the end of the year in which the transaction took place, because tax and accounting laws require it. After your account is deleted, these records are used only for finance, tax, legal and support purposes, and device and advertising identifiers are removed from them within 60 days.
For the purposes based on your consent: we process your personal data until you withdraw your consent. Once withdrawn, we stop processing your personal data for that specific purpose, unless another legal basis allows us to continue.
For the purposes based on legal obligations: we retain personal data for the duration prescribed by applicable laws for each category of data, and in any case for up to 10 years from the date of collection.
For the purposes based on our legitimate interests:
personal data collected for the purpose of analyzing trends in the use of the Services — such as aggregating, anonymizing, and deidentifying data to improve service performance and inform business strategies — is retained only for the minimum period necessary to complete such analysis and anonymization and is deleted within 1 year from the date of collection.
product-analytics data is retained for no longer than 24 months and is deleted or de-identified thereafter. If you object to analytics processing or delete your account, we stop onward analytics processing of your data and delete it from our analytics systems.
personal data collected for other legitimate interest purposes is retained for the entire duration of the contract with you and, in case of either a pending dispute or a risk that such dispute might arise, for the additional period necessary to protect or enforce our rights in the context of legal claims or disputes.
Biometric age-verification data. Biometric data processed for age verification (facial geometry scans and, where applicable, identity documents) is permanently destroyed by automated deletion immediately upon completion of the verification and in all events within 24 hours of collection — that is, when the initial purpose for collecting it has been satisfied — and is not retained by Replika or by our verification provider thereafter. We retain only the verification result (age band, method, and timestamp) as a record of the check. This paragraph constitutes our public written retention schedule and destruction guidelines for biometric information.
Consent records. Records of the consent and privacy choices you make (for example cookie and advertising consents, and any consents relating to sensitive information), including when and how they were given or withdrawn, are retained for as long as needed to demonstrate compliance with applicable law, and for 5 years after you delete your account, as proof of the choices you made while you had one.
Onboarding answers of visitors who do not create an account. If you answer onboarding questions on our website but do not create an account, your answers are deleted no later than 90 days after your last visit.
Data transmitted to third-party AI model providers for the purpose of generating conversational responses or content is processed transiently and is not retained by those providers beyond the duration necessary to generate the response, unless a longer retention period is required for service integrity, security, or legal compliance purposes. We contractually require AI model providers to delete conversation data promptly after processing.
We store your device, network and usage data for as long as it is necessary for the achievement of the purposes above. Your data will be deleted in accordance with the contract or after termination of the contract, unless legal regulations require the ongoing storage for a definite period of time.
Right to Opt-Out of Marketing Communications. Regardless of where you live, you may opt out of marketing-related emails and other communications by following the opt-out or unsubscribe instructions in the communications you receive from us or by contacting us as provided in Section 14.A below. You may continue to receive Services-related and other non-marketing communications from us.
Right to Know / Access / Portability. Depending on where you live, you may have the right to request that we confirm whether we are processing your information, obtain details about the processing activities, and obtain a copy of such information, subject to certain exceptions.
Right to Delete / Erasure. Depending on where you live, you may have the right to request that we delete your information, subject to exceptions. When you request deletion of your data, we will also instruct our service providers to delete your personal data in accordance with our contractual agreements with them. You can delete your account in your account settings. Payment providers keep their own records of transactions where the law requires them to, and we keep financial records as described in Section 6.
Right to Correct. Depending on where you live, you may have the right to request that we correct your information, subject to certain exceptions.
Right to Restriction. If you are in the EEA or the UK, you may ask us to temporarily restrict the processing of your personal data in the specific situations provided by law — for example while we verify a correction you have requested or consider an objection. While processing is restricted, we continue to store your data.
Right to Opt-Out of Selling, Sharing, or Targeted Advertising. We may disclose certain of your personal information to third parties, including the use of certain online tracking technologies through our Services, that may be considered a “sale”, “sharing”, or “targeted advertising” under applicable law. You can opt out of these disclosures at any time — without deleting your account — via the “Your Privacy Choices” link in our Website footer and in the Apps’ settings, or as described in our Cookie Policy. We honour the Global Privacy Control (GPC). If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of the “sale” or “sharing” of your personal information for targeted advertising for that browser, and — where we can associate it with your account — for your account. Because “Do Not Track” (DNT) has no settled meaning or legal effect, we do not respond to DNT signals; GPC is the signal we honour. To learn more about GPC, visit https://globalprivacycontrol.org.
Right to Withdraw Consent. Where we have collected and processed your personal information with your consent, you may withdraw that consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Right to Appeal. You have a right to appeal the denial of any of your rights above. You may submit your appeal to us via Contact Us, and we will respond in accordance with applicable law.
To exercise your rights or make a request, you can use the in-product controls where available — “Your Privacy Choices” in the Apps’ settings and in our Website footer (advertising consent and opt-outs, analytics objection) and account deletion in your account settings — or contact us as provided in Section 14.A below. Withdrawing a consent is as easy as giving it. We may ask for specific information from you to help us confirm your identity. Depending on where you reside, you may be entitled to empower an authorized agent to submit requests on your behalf. We will require authorized agents to confirm their identity and authority, in accordance with applicable laws. You are entitled to exercise the rights described above free from discrimination.
In some instances, your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. If you are not satisfied with how we address your request, you may submit a complaint by contacting us as provided in Section 14.A below. Depending on where you reside, such as if you reside in the European Economic Area or United Kingdom, you may have the right to complain to a data protection regulator where you live or work, or where you feel a violation has occurred.
California Consumer Privacy Act
Rights. You have a right to submit requests to know, access, delete, correct, and opt-out of the sale / sharing of your personal information. To submit these requests, please see Section 7. You have a right to exercise these rights without being discriminated against.
Notice of Collection. To learn more about the categories of personal information we have collected about you in the 12 months preceding the date this Privacy Policy was last updated, including the business purposes for which the information was collected and used, and how it was disclosed to third parties, see Sections 1-3 above.
Notice of Disclosure for a Business Purpose. To learn more about the categories of personal information we have disclosed for a business purpose, and the categories of third parties with whom we’ve disclosed such information, see Sections 1-3 above.
Notice of Sale and Sharing. We “sell” and “share” your personal information by providing your personal information to certain third parties and through the use of certain online tracking technologies. We do not knowingly sell or share the personal information of anyone under 18 — our Services are 18+ only.
Notice of Use of Sensitive Personal Information. We do not process your sensitive personal information for purposes beyond those permitted under law. We do not use or disclose sensitive personal information for purposes requiring a “limit” option under California law.
California “Shine the Light” Law
If you are a California resident, you have a right to request information from us once per calendar year regarding information we disclose to third parties for those third parties’ direct marketing purposes. To send such a request, please Contact Us.
Notice of Collection. To learn more about the categories of personal data we collect about you and how we use it, including how we disclose it to third parties and certain information about those third parties, please see Sections 1-3 above.
Notice of Sale and Targeted Advertising. We “sell” your personal data and engage in targeted advertising by providing certain of your personal data to certain third parties, including through certain tracking technologies made available through our Services.
Rights. You have a right to submit a request to access, know, portability, delete, correct, and to opt-out of the sale or processing of your personal data for targeted advertising purposes. You may exercise these rights in Section 7. If you live in certain states (e.g., Delaware, Oregon, or Minnesota), you have a right to request a list of specific third parties to which we’ve disclosed your personal data. If you live in Connecticut, you may have a right to request a list of specific third parties to which we have sold your personal data. And if you live in Maryland, you have a right to request a list of categories of third parties to which we’ve disclosed your personal data.
European Economic Area and United Kingdom. The legal bases in Section 2.A apply to you. You may lodge a complaint with your local supervisory authority, or contact us and our representatives listed in Sections 13 and 14. You can object at any time to processing based on our legitimate interests — including product analytics — via the controls in Section 7 or by contacting us; we will stop unless we have compelling legitimate grounds required by law.
United Kingdom (analytics). UK law permits statistics-only analytics storage without consent, provided you are informed and can object. Where we rely on this, the objection control in Section 7 applies.
Brazil. We process personal data under the Lei Geral de Proteção de Dados (LGPD). You have the rights in Article 18 LGPD — including confirmation of processing, access, correction, anonymization, deletion, portability, and information about the entities with which we share data — exercisable as described in Section 7. You may also petition the Autoridade Nacional de Proteção de Dados (ANPD). Where this Privacy Policy refers to “legitimate interests” or “consent”, the corresponding legal bases of LGPD Article 7 apply.
Canada. We process personal data in accordance with PIPEDA and, for Québec residents, the Act respecting the protection of personal information in the private sector (Law 25). You may withdraw consent at any time (subject to legal or contractual restrictions and reasonable notice), and you may complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information. Our marketing emails comply with CASL and always include an unsubscribe mechanism.
If anything in this section conflicts with the rest of this Privacy Policy, this section prevails for users in the region it covers.
The Services are only for adults. You must be at least 18 years old (or the age of majority where you live, if higher) to use the Services. We ask your date of birth when you create an account and we do not permit registration by anyone under 18.
We may use age-assurance measures to keep the Services adult-only. Where required by law or where we have reason to doubt a declared age, we may use an age-estimation or age-verification check provided by a specialised vendor; images or documents used for such checks are processed solely to confirm age, are not used for any other purpose, and are not retained after the check.
If we discover that a person under 18 is using the Apps, we will promptly block their access and delete their account. If you have reason to believe that a person under 18 has provided personal information to us through the Services, please contact us as provided in Section 14.A, and we will endeavor to delete that information from our databases.
The Services and our business may change from time to time. As a result, at times it may be necessary for us to make changes to this Privacy Policy. We reserve the right to update or modify this Privacy Policy at any time and from time to time and we will notify you in advance of any change. We encourage you to periodically review this page for the latest information on our privacy practices. This Privacy Policy was last updated on the date indicated above.
Pursuant to Article 27 of the General Data Protection Regulation (GDPR), Luka, Inc. has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You may contact EDPO as our appointed EU representative regarding any matter pertaining to the GDPR:
by using EDPO’s online request form: https://edpo.com/gdpr-data-request/
by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium
Pursuant to Article 27 of the UK GDPR, Luka, Inc. has appointed EDPO UK Ltd as its UK GDPR Representative in the UK. You may contact EDPO UK as our appointed UK representative regarding any matter pertaining to the UK GDPR:
by using EDPO’s online request form: https://edpo.com/uk-gdpr-data-request/
by writing to EDPO UK Ltd, Unit 33, Waterside, Schooner Court, 44-48 Wharf Road, London, N1 7UX, United Kingdom
For all data subject requests and routine privacy matters, please contact Luka, Inc. directly using the details in Section 14.A below. The contacts listed in Section 13 (our EU and UK representatives) and Section 14.B (our Data Protection Officer) are also available if you prefer to direct your matter to them.
You can contact us directly:
by email: my@replika.com
by writing to Luka, Inc. at 490 Post Street, Suite 526, San Francisco, CA 94102, United States
Pursuant to Article 37 of the General Data Protection Regulation (GDPR), Luka, Inc. has appointed heyData GmbH as its Data Protection Officer. You can contact our Data Protection Officer regarding matters pertaining to the GDPR:
by email: datenschutz@heydata.eu
by writing to heyData at heyData GmbH, Bertolt-Brecht-Platz 3, 10117 Berlin, Germany