Privacy Policy

At FlirtMaster, your privacy is not a statement: it is an architectural decision. Servers in Germany, self-hosted embeddings, messages never shared with third parties for training. This policy explains what data we process, why, for how long, and how to exercise your rights.

1. Who is responsible for your data

The data controller is Codelabs Studio, S.L. (Tax ID B88708797), registered at Paseo Federico García Lorca 6, 3.º E, 29130 Alhaurín de la Torre (Málaga, Spain), owner of the Memchats and FlirtMaster brands, with contact email hola@memchats.com. For data protection matters, write to dpo@memchats.com.

FlirtMaster is the dating edition of Memchats: the same service, from the same controller, with its own brand and tools to improve your own profile. Both editions share the single Codelabs Studio account (the same one you use for AvatarSuite, AudioMap and the company's other products), so this policy applies equally to both.

2. What data we process

2.1 Account data

• Email, name and the identifier of your account on our identity server (Keycloak, hosted by us)
• App language, taken from your browser at signup and changeable
• Subscription plan and billing status
• If you declare you are an adult to use Dating, the date you declared it

Signing in with Google or Apple. If you choose one of these providers, it authenticates you and sends us your email, your name if you share it, and an identifier of your account with that provider. We never receive your password, your contacts or any other data from your Google or Apple account. Apple lets you hide your email: in that case we receive an Apple relay address. Google and Apple process that sign-in as independent controllers under their own policies. If you already had an account with the same email and the provider reports it as verified, we link them so you keep a single account with all your data; we never link on an unverified email.

2.2 Conversations you import, and memory

When you import a WhatsApp, Telegram, email, screenshot or voice note export, we store:

• Plain text of messages, stored in our database on a dedicated, access-restricted server (without disk encryption)
• Metadata: timestamps, sender (alias), source channel
• Vector embeddings (mathematical representation) computed locally with self-hosted bge-m3
• Derived structured memory (traits, commitments, timeline events) generated by LLMs
• The original files (exports, screenshots, audio) in Cloudflare R2, encrypted at rest by the provider

2.3 Dating: your own data

• Your voice profile: how you write (tones, languages, what you would never say, the corrections you make to suggested messages). It makes the messages we suggest sound like you
• Suggested messages and the network where you met each person

2.4 Analysis of your own dating profile (FlirtMaster only)

In FlirtMaster you can upload screenshots of your own dating app profile and your bio to get a critique and rewritten versions. The screenshots are sent to the language model for analysis and are not stored. We keep only the latest result (the critique and the rewrites), replaced each time you run the analysis again. This feature does not exist in Memchats.

2.5 Profile photos generated from yours (FlirtMaster only)

When this feature is available, you will be able to upload photos of yourself so we can improve them and generate new photos of you in different scenes. Only photos of yourself are accepted, and only if you are 18 or older. The legal basis is your explicit consent (Article 6.1.a GDPR), given by accepting a specific text before uploading anything (version 2026-09-24.profile-self-adult-2; if you accepted it earlier under the previous version, that acceptance stays valid until 30 November 2026); we keep that text, its version, the date, and the IP address and browser you accepted it from, as evidence. You can withdraw it at any time by asking for your photos to be deleted: your original photos, everything generated from them and their variants are erased, and the declaration is kept as revoked, without IP or browser.

The processing is done by AvatarSuite, another Codelabs Studio product: not a third party, the same company. Your photos are not biometric data under Article 9 GDPR: we do not extract any facial template from them, and we do not use them to identify you or anyone else (Recital 51 GDPR, which reserves that category for images processed through specific technical means of unique identification); they are only used to generate new photos of you. Even so, we ask for your explicit consent for this feature (Article 6.1.a), with the text described above. Generated photos carry a metadata label stating they were made with artificial intelligence.

2.6 Notifications

• Your device identifier to send you push notifications (Firebase Cloud Messaging and, on iPhone, Apple Push Notification Service)
• If you use Dating, a daily notice about conversations going cold (at most one a day, at 19:00 Madrid time). It is discreet by design: it only says how many conversations are waiting for your reply, with no names, no networks and no content, so nobody who sees your lock screen learns who it is about

2.7 Usage data

• Error logs via Sentry (no message content; stack traces only)
• Product events (signup, upgrade, which tier, which of Alma's areas), no content
• If you use the FlirtMaster keyboard, technical keyboard events (without the text you type), deleted after 90 days

2.8 The demo

You can try FlirtMaster without signing up. The demo uses fictitious data we seeded, saves nothing you write, and the whole session is deleted after 24 hours. To prevent abuse we limit how many demos can be opened from the same connection, for which we use your IP address transiently.

2.9 Connecting FlirtMaster to other tools (MCP and API)

If you create an API key and connect FlirtMaster to an external assistant (for example an MCP client), the data that assistant requests travels to it because you decide so. That provider is not our processor: it handles that data under its own terms. Photos of the people in Dating are never delivered this way.

If you move from FlirtMaster to another Codelabs Studio product (for example from Memchats to FlirtMaster or AudioMap), we carry your session over with a signed link that contains your account identifier and your email, expires in 60 seconds and can only be used once.

3. Third-party data (important)

3.1 The people in your conversations

When you import a chat with María, María did not sign a consent form. FlirtMaster treats this data as personal use analogous to a diary:

• The other party's data stays under your account: it is never shared with other accounts and never used to train models
• You see a stable alias ("contact-1a2b" or the name you assign), not the raw identifying data
• The original files you upload stay under your account in Cloudflare R2, encrypted at rest by the provider, and are never processed without your explicit action
• If a person appears in your chat and requests deletion of their data from FlirtMaster via dpo@memchats.com, we process it within 30 days

3.2 The people you keep in Dating

In Dating you upload screenshots of the public profiles of people you meet on dating apps (Tinder, Bumble, Badoo…) and of your conversations with them. From those screenshots we extract and store, only in your account:

• Their nickname and the network where you met, with the history of networks the conversation has moved through
• What their profile says about them: age, distance, the place they state, whether they live there or are passing through, what they are looking for, whether they have or want children, languages, their bio and interests
• Crops of their profile photos, with a short description of what is shown, so you can remember them
• The messages you have exchanged, as with any other conversation

What for: so you remember each person and write better, in your own voice. Legal basis: legitimate interest (Article 6.1.f GDPR): yours in organising your own social life and ours in providing you the service, balanced against those people's rights; you can request the full assessment at dpo@memchats.com. The safeguards that balance it are these, and they are in the code, not only on this page:

• They are never used to train models, never indexed by search engines, never shared with other accounts and never sold
• They do not appear in your general lists or searches: only in the Dating section, so nobody sees them if you show the app to someone
• Photos have no public URL: they are served only to your session, checking on every request that they are yours
• They are kept while that person remains in your account. Deleting the person or your account deletes, in cascade, their profile, history, photos and the photo files in storage
• Special category data (health, sexual orientation, religion…) beyond what the person publishes in their own profile must not be uploaded, nor profiles of minors: our terms forbid it

We cannot notify each of these people because we do not have their contact details (Article 14.5.b GDPR): this section is the public information about this processing. If you believe your data is in FlirtMaster, write to dpo@memchats.com with your nickname and the network (and, if you can, a screenshot of your profile). We will search all accounts and, if we find you, delete your profile and photos. We honour your objection (Article 21) without asking for further justification, within one month at most.

4. What we use the data for, and on what legal basis

• Providing the service (your account, conversations, memory, Dating, suggestions, notifications): performance of the contract (Article 6.1.b)
• Third-party data in your conversations and in Dating: legitimate interest (Article 6.1.f), see section 3
• Product improvement: aggregated, anonymized usage analysis (e.g., "what % of questions to Alma fall in her legal area"): legitimate interest
• Security: detecting abuse, fraud and violations; logging errors: legitimate interest
• Generated profile photos (FlirtMaster) and the marketing cookie: your consent (Article 6.1.a), which you can withdraw at any time
• Billing: legal obligation (Article 6.1.c) to keep invoices
• Communication: transactional emails (welcome, password reset, alerts) and, optionally, a newsletter (opt-in)

We never use your data to train AI models. We never sell it. We never share it with advertisers. We make no automated decisions with legal effects on you (Article 22): analyses and suggestions are proposals you decide whether to use.

5. Who we share data with

Only with the providers we need to run the service, who process data on our behalf under a processing agreement. What we host ourselves (database, queues, embeddings, email, identity, analytics and the gateway that routes model calls) runs on Hetzner servers in Germany.

• Hetzner Online GmbH (Germany): dedicated server with the Postgres database, Redis, workers, Keycloak, email (Mailcow) and analytics (Plausible)
• Google (Gemini, via Google AI or Vertex AI): the language model that writes Alma's answers, reads screenshots and extracts Dating profiles. Google LLC participates in the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023)
• Firebase Cloud Messaging (Google): push notification delivery. Same transfer basis as above
• Apple (Apple Push Notification Service): notification delivery on iPhone. Apple offers the European Commission's Standard Contractual Clauses for these transfers
• Cloudflare R2: storage of original files and Dating photos, encrypted at rest, in Cloudflare's Western Europe region. That region does not carry Cloudflare's contractual EU-jurisdiction guarantee, so the transfer is covered by its participation in the EU-U.S. Data Privacy Framework and by Standard Contractual Clauses
• Stripe (Stripe Payments Europe, Ireland): payment processing. We have no access to your card. Transfers to Stripe in the U.S. are covered by the Standard Contractual Clauses in its data processing agreement
• Sentry (Functional Software, Inc., U.S.): error logging without message content. Participates in the EU-U.S. Data Privacy Framework
• Voice note transcription: done by AudioMap, another Codelabs Studio product, with its own model in Germany or with AssemblyAI in its EU region
• Profile photo generation (FlirtMaster only, when available): AvatarSuite, from Codelabs Studio, has the images generated by an image model provider in the U.S. (Replicate, Inc.). This feature will not be switched on until that transfer is covered by Standard Contractual Clauses

Google and Apple, when you use them to sign in, act as independent controllers, not as our processors. A short list is also at /security.

6. GDPR and DPA (Data Processing Agreement)

If you are a company processing employee or customer data through FlirtMaster, we can sign a specific DPA. Request one at dpo@memchats.com with the subject "DPA request".

7. Your rights

Under the GDPR, you have the right to:

• Access: request a copy of your data. You can download it yourself from Settings in structured JSON format
• Rectify: correct inaccurate data
• Erase: request full deletion. From Settings, deletion is scheduled and carried out 30 days later; during those 30 days you can sign in and cancel it, and the account keeps working as normal. More detail on data deletion
• Portability: export your data to another service
• Object: object to processing based on legitimate interest
• Restriction: ask us to stop processing your data while a complaint is resolved
• Withdraw your consent, where it is the basis of the processing, without affecting what was done before
• Complain: to the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or the supervisory authority in your country

To exercise these rights: dpo@memchats.com, from your account email. We answer within one month at most. If the request comes from another address, we may ask you to confirm the account is yours.

8. Retention

• Active account: for as long as the account exists
• Cancelled account: 30-day grace period, then deletion from the live database and from stored files
• Deletion requested from Settings: the account is purged 30 days after the request, not at the time. That window exists so you can change your mind: cancelling before it expires leaves the account and the subscription exactly as they were
• People in Dating and their photos: while they remain in your account; deleted when you delete the person or the account
• Analysis of your own profile (FlirtMaster): only the latest, until you run it again or delete the account. Screenshots are not stored
• Profile photos and what is generated from them (FlirtMaster): until you withdraw consent or delete the account
• Demo sessions: 24 hours
• Keyboard events: 90 days
• Backups: up to 45 days. A deleted account is gone from the live database within the stated period, but may remain in backups already taken until those rotate out. They are never restored for any purpose other than recovering the service after an incident
• Operational logs: 90 days
• Billing data: 6 years (Spanish tax obligation)

9. Cookies

We use only strictly necessary cookies:

• next-auth.session-token: authenticated session (HttpOnly, Secure, SameSite=Lax)
• NEXT_LOCALE: the language you want the app shown in
• cl_consent: your cookie choice and the date you made it, so the server can obey it and so we can prove it (180 days)

We do not use Google Analytics, Facebook Pixel, or similar tools, and we build no behavioural profile of you. We do measure audience with Plausible, self-hosted by us in the European Union (analytics.codelabs.studio): it counts visits and page views, sets no cookies, does not follow you across websites and stores nothing that could identify you. That is why we do not ask your permission for it. The other metrics we collect are the error and performance ones from Sentry, listed above.

There is also a marketing cookie, cl_attr, recording where your visit came from (source, medium, campaign, landing page and, if you arrive from an ad, the platform click id) for 90 days. It is set by FlirtMaster from its own domain, never by a third party, and it is stored only if you accept marketing, never before you do. FlirtMaster does not show a cookie banner yet, so none is stored today.

Withdraw my consent

10. Minimum age

FlirtMaster is not directed at children under 16. We do not knowingly collect data from minors. If we discover that a minor has created an account, we delete it immediately.

Dating, and all of FlirtMaster, is for adults aged 18 or over only. Before you use it for the first time we ask you to declare it, and we keep the date. Profiles of minors may not be kept in Dating either.

11. Changes to this policy

If we make material changes to this policy, we will notify you by email 30 days in advance and publish the changelog at /changelog. The "last updated" date above always reflects the version currently in force.

12. Contact

General email: hola@memchats.com
Privacy: dpo@memchats.com
Support: hola@memchats.com