Privacy & Data

Last updated: June 15, 2026

Crush on Demand is operated by Brunella Barbone, Italy. We’re an 18+ AI companion app. Your trust matters more than anything we sell. This page tells you exactly what we collect, why, with whom we share it, and what you can do about it.

Questions? Email hello@crushondemand.app.

1. What we collect

You give us

• A nickname (whatever you want him to call you)
• Email address (sign-in, recovery, important updates)
• Date of birth (we store only the year and a confirmation flag, not the full date)
• Quiz answers (to match you with characters)
• Messages and any content you create in conversations
• Voice notes (for upcoming Boyfriend/Devotion tiers, when those features launch)
• Payment info — handled entirely by Apple/Google Play. We never see your card details.

We collect automatically

• Device type, OS version, app version
• Crash reports (anonymized)
• Usage data: features used, message counts, session length
• IP address (security, fraud prevention, and country-level routing for crisis helplines)

We do not collect

• Your real name (unless you share it in chat)
• Your GPS location
• Your contacts
• Photo library or camera access
• Biometric or health data

2. How we use it

• To make the experience work: your messages are processed by AI models so characters can respond. Bond progress, chemistry, and history live in your account.
• To improve the service: we look at aggregate, anonymized usage patterns. We do not routinely read individual conversations.
• For safety: automated systems detect signals of self-harm, abuse, or minors. Human review occurs only when content is flagged by automated safety systems or when required to investigate abuse, fraud, security incidents, or legal obligations.
• For payments and support: we use your email and account info to resolve issues.
• Legal compliance: when required by Italian or EU law.

3. Who we share with

We use a small number of trusted vendors. Each has its own privacy policy and is bound by a Data Processing Agreement.

4. Legal basis (GDPR)

• Performance of contract: to deliver the service you signed up for.
• Consent: for optional features (push notifications, marketing emails, voice features).
• Legitimate interest: security, fraud prevention, service improvement.
• Legal obligation: when required by Italian/EU law.

Special category data (Art. 9 GDPR)

You may, voluntarily and at your discretion, disclose sensitive personal data within conversations — including (but not limited to) information about your sexual orientation, mental or physical health, religious beliefs, or political opinions.

• This is fully optional. You can use Crush on Demand without disclosing any such data.
• Where you voluntarily choose to include such information in conversations, we process it solely for the purpose of generating character responses and providing the conversational service you requested.
• We never use this data for advertising, AI model training, marketing profiling, or any other purpose.
• You may request deletion of this information at any time by contacting us or deleting your account.
• We will never ask you to disclose sensitive data. Characters are designed to respect your boundaries.

If you do not wish us to process sensitive personal data, please avoid sharing such information in your messages.

5. Retention

• Account data: kept while your account is active.
• Conversations & memory: kept while active; permanently deleted within 30 days of account deletion.
• Voice recordings: when voice features launch in upcoming tiers, recordings will be retained for 90 days and then deleted, unless the user requests earlier deletion.
• Payment receipts: 10 years (Italian/EU tax law).
• Logs, IP addresses: max 30 days for security monitoring.
• Anonymous aggregate analytics: may be kept indefinitely.

6. Your rights

Wherever you live, we honor these rights:

• Access: get a copy of everything we hold about you.
• Correction: fix anything wrong.
• Deletion: erase your account and all data.
• Portability: get a machine-readable export.
• Restriction / Objection: stop certain processing.
• Withdraw consent: for optional features (such as marketing communications, push notifications, or voice features) at any time.

EU/EEA/UK users: you can also file a complaint with your Data Protection Authority. In Italy: Garante per la Protezione dei Dati Personali (garanteprivacy.it).

California (CCPA/CPRA) users: you have the right to know, delete, correct, and opt out of “sale” or “sharing” of personal info. We do not sell or share.

Other US states (Virginia, Colorado, Connecticut, Utah, Texas): your rights mirror CCPA — exercise them the same way.

Email hello@crushondemand.app to exercise any right. We respond within 30 days.

7. Security

• Data in transit: encrypted with TLS 1.2+
• Data at rest: encrypted with AES-256
• Passwords: never stored in plaintext; we prefer Sign in with Apple/Google so we usually don’t see them
• Access controls + audit logging on internal systems

No security system is 100% safe. If a breach affects you, where required by applicable law, we will notify affected users without undue delay.

8. Age & minors

Crush on Demand is strictly 18+. We use date-of-birth verification with confirmation prompts, automated detection of underage signals, and permanent lockout for users who declare under-18. If an account is detected as belonging to a minor (at sign-up or later during chat), the account and all associated data are permanently deleted automatically.

We do not knowingly collect data from anyone under 18. If we learn that a minor has provided data, we delete it immediately. To report a minor using our service, email hello@crushondemand.app.

9. International transfers

We’re based in Italy. Some vendors (Anthropic, ElevenLabs, Apple) are in the US. For transfers outside the EEA we rely on Standard Contractual Clauses (EU Commission decision 2021/914) and the EU-US Data Privacy Framework where applicable. You can request copies of SCCs by emailing us.

10. AI-specific disclosures

Crush on Demand uses generative AI (Anthropic’s Claude) to create character responses, and ElevenLabs to synthesize voice in upcoming Boyfriend/Devotion tiers. The characters are fictional and AI-generated.

• We do not use your conversations to train AI models.
• AI responses are simulated. Not advice, not human, not real intimacy. Users are solely responsible for decisions made based on AI-generated content.
• Characters “remember” facts you’ve shared via summarized memory. View/delete: Profile → Settings → Memory.
• Automated safety filters prevent harmful, illegal, or unsafe outputs.
• No human reads your chats unless flagged by automated safety systems or required for investigation of abuse, fraud, security incidents, or legal obligations.

11. EU AI Act transparency

Per Regulation (EU) 2024/1689 (the EU AI Act), Article 50 (transparency obligations for generative AI systems):

• You are interacting with AI-generated characters, not humans.
• The system simulates emotional and romantic responses.
• AI-generated images and voices are clearly marked with “AI” or “AI-generated” labels.
• This system is classified as “limited risk” under the AI Act (chatbot with transparency obligations only). It is not a high-risk system under Annex III.

12. Data Protection Officer

We have not appointed a Data Protection Officer because we are not legally required to do so under GDPR Art. 37. As a small business, we do not engage in large-scale systematic monitoring of data subjects nor large-scale processing of special category data, which would otherwise trigger that obligation.

Privacy inquiries are handled directly by Brunella Barbone, owner of the data controller, at hello@crushondemand.app.

13. Changes to this policy

If we make material changes, we’ll notify you in-app and by email at least 30 days before they take effect. Minor changes (typos, clarifications) may be made without notice. “Last updated” is always at the top.

14. Contact

• All inquiries (privacy, safety, security, general): hello@crushondemand.app
• Account deletion: Profile → Settings → Delete account