Last updated: 24 June 2026

Privacy Policy

This Privacy Policy explains how we process personal data when you use HoneyLulu (honeylulu.ai, the “Service”). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Controller

2. The data we process

• Account data: your email address and an encrypted (hashed) password, plus account metadata such as sign-up date.
• Chat and content data: the messages you exchange with companions, virtual gifts you send, companions you create, and images or videos generated for you within a conversation.
• Relationship and usage data: interaction counters, relationship level and a rolling summary used to provide continuity in your conversations.
• Technical data: IP address, browser and device information, and server log data, processed primarily for security and delivery of the Service.
• Advertising attribution:if you reach the Service through one of our advertisements, we store the advertising network's click identifier and the placement it came from together with your account, so we can measure which campaigns lead to sign-ups and purchases. Sign-up and purchase are reported to the advertising network (ExoClick) as conversion events that contain only that click identifier and, for purchases, the amount — no name, e-mail, chat or content data. We do not use the identifier to track you elsewhere.
• Payment data: when paid features become available, payments are handled by our payment processor (see Section 6). We do not store full card details; we receive only transaction status and subscription information.

3. Sensitive data and explicit consent

Because the Service is an adult platform, the content you submit and generate may reveal information concerning your sex life or sexual orientation, which is a special category of personal data under Article 9 GDPR. We process such data solely to provide the Service you request, on the basis of your explicit consent (Article 9 (2) (a) GDPR), which you give by registering for and actively using the Service. You may withdraw this consent at any time with effect for the future, for example by deleting the relevant conversations or your account.

4. Purposes and legal bases

• Providing the Service (accounts, chat, generated media, companions) — Article 6 (1) (b) GDPR (performance of a contract) and, for sensitive data, Article 9 (2) (a) GDPR (explicit consent).
• Safety and abuse prevention (automated screening of inputs, outputs and generation prompts to prevent prohibited content, rate limiting, fraud prevention) — Article 6 (1) (f) GDPR (legitimate interests) and Article 6 (1) (c) GDPR (legal obligations).
• Security and operation (logging, backups, defending against attacks) — Article 6 (1) (f) GDPR.
• Payments — Article 6 (1) (b) GDPR (performance of a contract) and Article 6 (1) (c) GDPR (legal and tax record-keeping obligations).

5. Age verification

The Service is strictly for adults aged 18 and over. We process the data necessary to confirm your eligibility and to prevent access by minors. Any future identity or age-verification check is carried out to comply with youth-protection law (in particular the German Interstate Treaty on the Protection of Minors in the Media, JMStV).

6. Service providers and recipients

We use carefully selected service providers who process data on our behalf as processors under Article 28 GDPR, or who act as independent controllers where indicated:

• Supabase — authentication and database hosting (account and content data).
• DeepInfra — routing of chat messages to AI language models that generate companion replies, and voice-message (text-to-speech) synthesis using preset synthetic voices.
• RunPod — generation of images from text prompts on self-hosted AI image models.
• AtlasCloud — generation of short videos from images and text prompts.
• ExoClick— advertising network; receives conversion events (click identifier, purchase amount) for visitors who reached us through its advertisements.
• Bunny.net (BunnyWay d.o.o., Slovenia, EU) — content delivery network and storage for generated media.
• Cloudflare — content delivery, DNS and security / protection against attacks.
• Our hosting provider — operation of the application server.
• Our payment processor (independent controller for payment processing) — handling of payments and subscriptions once paid features go live.

7. International data transfers

Some of the providers listed above are located in, or process data in, the United States or other countries outside the European Economic Area. Where personal data is transferred to such third countries, we rely on appropriate safeguards under Articles 44 et seq. GDPR, in particular the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You may request a copy of the relevant safeguards using the contact details above.

8. Cookies and local storage

We use cookies and similar browser storage that are strictly necessary to operate the Service — for example to keep you signed in, to remember your age confirmation, and to store guest conversations locally on your device. These are used on the basis of § 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and do not require consent. Should we introduce non-essential cookies (for example analytics), we will ask for your consent beforehand.

9. Retention

We retain personal data only for as long as necessary for the purposes set out above or as required by statutory retention periods (for example tax and commercial law). Account and content data are deleted when you delete the relevant content or your account, subject to any legal obligation to retain certain records.

10. Your rights

Under the GDPR you have the right to:

• access to your personal data (Article 15);
• rectification of inaccurate data (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• data portability (Article 20);
• object to processing based on legitimate interests (Article 21); and
• withdraw consent at any time with effect for the future (Article 7 (3)).

To exercise any of these rights, please contact us at .

11. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for us is the Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (https://www.baden-wuerttemberg.datenschutz.de).

12. Data security

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encrypted transport (HTTPS) and access controls. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The current version is always available on this page, with the date of the latest update shown at the top.

This page belongs to tryhoneylulu.ai, the landing page of honeylulu.ai. Both are operated by the same operator, and these policies are identical to the ones on honeylulu.ai.