Privacy Policy
Last updated: March 10, 2026
This Privacy Policy describes how FLOWVATE DEVELOPMENT LTD ("Company", "we", "us") collects, uses, and protects your personal data when you use the Too Shy platform ("Service").
1. Data Controller
FLOWVATE DEVELOPMENT LTD, 8046, Paphos, Galateias 2-4, Cyprus.
Contact: support@tooshy.ai
2. Data We Collect
2.1 Account Data
- Phone number (WhatsApp) or Telegram username/ID
- Email address (if provided)
- Country of residence
- Preferred language
- Subscription tier and billing information (processed by Stripe)
2.2 Conversation Data
- Messages you send to AI companions
- AI-generated responses (text, voice, images)
- Conversation metadata (timestamps, message counts)
- Memory data (facts and preferences the AI remembers about you)
2.3 Technical Data
- IP address and approximate location (via website analytics only)
- Browser type, device type, operating system (website visits only)
- Pages visited, referral source (Google Analytics)
3. How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Delivering the Service (messages, voice, photos) | Contract performance |
| Processing payments | Contract performance |
| AI memory and personalization | Contract performance |
| Safety and content moderation | Legitimate interest |
| Improving AI model quality (anonymized data) | Legitimate interest |
| Website analytics | Consent (cookie banner) |
| Customer support | Contract performance |
| Legal compliance | Legal obligation |
4. Third-Party Services
We share data with the following third-party processors, strictly for service delivery:
| Service | Purpose | Data Shared |
|---|---|---|
| OpenRouter | AI language model inference | Conversation text (no personal identifiers) |
| ElevenLabs | AI voice generation | Text for voice synthesis (no personal identifiers) |
| Green API | WhatsApp message delivery | Phone number, message content |
| Telegram API | Telegram message delivery | Telegram ID, message content |
| Stripe | Payment processing | Payment method, billing address |
| Google Cloud Platform | Infrastructure and storage | All data (encrypted at rest) |
| Google Analytics | Website analytics | IP address, page views (anonymized) |
We do not sell your personal data. We do not share conversation content with advertisers.
5. AI Model Training
We may use anonymized and aggregated conversation data to improve our AI models. Individual conversations are never shared publicly or with third parties for their own training purposes. Third-party LLM providers (OpenRouter) are contractually prohibited from using your conversation data for their own model training.
6. Data Retention
- Conversation data: Retained while your account is active. Deleted within 30 days of account deletion.
- Account data: Retained while your account is active. Deleted within 30 days of account deletion.
- Payment records: Retained for 7 years as required by tax law.
- Analytics data: Aggregated data retained indefinitely. Individual session data retained per Google Analytics defaults (14 months).
7. Your Rights (GDPR / EEA / UK)
If you are in the EEA or UK, you have the right to:
- Access — Request a copy of your personal data.
- Rectification — Correct inaccurate data.
- Erasure — Request deletion of your data ("right to be forgotten").
- Portability — Receive your data in a machine-readable format.
- Restriction — Restrict processing of your data.
- Objection — Object to processing based on legitimate interest.
- Withdraw consent — Withdraw consent for analytics cookies at any time.
To exercise any of these rights, email us at support@tooshy.ai. We will respond within 30 days.
8. Your Rights (CCPA / California)
If you are a California resident, you have the right to:
- Know what personal data we collect and how we use it.
- Request deletion of your personal data.
- Opt out of the sale of personal data (we do not sell personal data).
- Non-discrimination for exercising your privacy rights.
9. Cookies
Our website uses the following cookies:
- Essential cookies: Required for site functionality (session, locale preference).
- Analytics cookies: Google Analytics (GA4) for understanding site usage. Can be declined via cookie banner.
We do not use advertising or tracking cookies.
10. Data Security
We implement industry-standard security measures including encryption in transit (TLS 1.3), encryption at rest, access controls, and regular security reviews. However, no system is 100% secure, and we cannot guarantee absolute security.
11. International Transfers
Your data may be processed in the European Economic Area (Cyprus) and the United States (Google Cloud Platform). Transfers to the US are covered by Standard Contractual Clauses (SCCs) as required by GDPR.
12. Children
The Service is not intended for anyone under 18 years of age. We do not knowingly collect data from minors. If we discover that a user is under 18, we will terminate their account and delete their data.
13. Changes
We may update this Privacy Policy periodically. Material changes will be communicated via the Service or email. The "Last updated" date at the top indicates the most recent revision.
14. Contact & Complaints
For privacy-related questions or to exercise your rights: support@tooshy.ai
You also have the right to lodge a complaint with your local data protection authority. For Cyprus, this is the Commissioner for Personal Data Protection (dataprotection.gov.cy).
FLOWVATE DEVELOPMENT LTD
8046, Paphos, Galateias 2-4, Cyprus