General Data Protection Regulation (GDPR) Notice

1. Scope

This GDPR Notice applies to all users, with particular relevance to users located in the European Economic Area (EEA), the United Kingdom, and Switzerland. It supplements our Privacy Policy and outlines your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Czech Act No. 110/2019 Coll. on personal data processing.

2. Legal Basis for Processing

We process your personal data on the following legal bases (GDPR Art. 6):

• Performance of a contract (Art. 6(1)(b)): To provide the Service, manage your account, process payments, and deliver AI-generated content.
• Legal obligation (Art. 6(1)(c)): To comply with tax, accounting, anti-money laundering, law enforcement preservation, and mandatory reporting obligations (e.g., CSAM reporting under Directive 2011/93/EU).
• Legitimate interests (Art. 6(1)(f)): For fraud prevention, platform security, content moderation, analytics, and service improvement, where our interests are not overridden by your rights.
• Consent (Art. 6(1)(a)): For marketing communications and optional cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Substantial public interest (Art. 9(2)(g)): For processing age verification biometric data (selfie-based liveness check) to prevent minors from accessing adult content, as required by applicable law.

3. Special Category Data

Our age verification system processes a real-time selfie with liveness detection to estimate your age. This constitutes processing of biometric data (GDPR Art. 9). We process this data under Art. 9(2)(g) (substantial public interest in child protection). Processing duration: the selfie is analyzed in real time (typically under 5 seconds) by a third-party AI processor operating under a Data Processing Agreement, and is immediately and irreversibly discarded after verification — no biometric templates, facial geometry, or selfie images are stored by us or our processor. Necessity: this processing is strictly necessary because age-gating adult content is a legal requirement under Directive 2011/93/EU and applicable national law; less intrusive methods (e.g., self-declaration) are insufficient to meet our obligations. A Data Protection Impact Assessment (DPIA) under GDPR Art. 35 has been conducted for this processing activity.

4. Your GDPR Rights

Under GDPR Articles 15–22, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): Request deletion of your personal data (“right to be forgotten”). Exception: This right does not apply where data must be retained for compliance with a legal obligation, for the establishment, exercise, or defense of legal claims, or where a law enforcement legal hold is in effect (e.g., for CSAM investigations, deepfake offenses under §193b, or DSA authority orders).
• Right to Restriction of Processing (Art. 18): Request that we limit processing of your data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling and direct marketing.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right Not to Be Subject to Automated Decision-Making (Art. 22): Where automated decisions significantly affect you (e.g., account suspension), you have the right to request human review.
• Right to Lodge a Complaint: You may file a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, ÚOOÚ) at www.uoou.cz, or with the supervisory authority of your EU/EEA member state of residence.

To exercise any right, contact us at hello@aiallure.com. We will respond within 30 days (GDPR Art. 12(3)). We may verify your identity before processing your request.

5. International Data Transfers

Your data may be transferred to and processed in countries outside the EU/EEA. Where such transfers occur, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V, including:

• Transfers to countries with an adequacy decision by the European Commission (Art. 45)
• Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c))
• Other lawful transfer mechanisms as permitted under GDPR

You may request a copy of the safeguards by contacting hello@aiallure.com.

6. Data Controller & Supervisory Authority

Data Controller:
Novera Group s.r.o.
Rybná 716/24, CZ-110 00 Praha 1, Czech Republic
IČO: 22152610 | DIČ: CZ22152610
Email: hello@aiallure.com

Supervisory Authority:
Úřad pro ochranu osobních údajů (Ú OOÚ)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
www.uoou.cz