Privacy Policy

1. Controller, Scope, and Roles

Lazys decides why and how it processes account, security, web checkout, support, and core product-operation data. Lazys generally acts as the controller for that processing.

This Policy does not govern independent processing by Stripe, your bank, your email provider, or another third-party service. Review their privacy notices for their separate practices.

2. Information You Provide

2.1 Account and authentication data

• Email address, normalized where needed to keep one account per address.
• Sign-in code request, verification, expiry, attempt, and consumption records. Lazys signs you in with a six-digit code sent to your email and stores a keyed cryptographic hash of the code rather than a password. Lazys does not ask for or store passwords.
• Session identifiers, account identifiers, and account creation times needed to keep you signed in and secure the account.

2.2 Chats and prompts

• Messages and prompts you write to characters, unsent message drafts, group chats you create (name and members), and the times chats started and messages were sent.
• Chat preferences, such as the video length you choose.

2.3 Characters and saved content

• Character drafts you build in the character creator, which appear under My AI, and video drafts you save in the video studio.
• Characters and profiles you save to your favorites and collection, and short drama series you save.

2.4 Support and communications

• Your name or email, message, attachments, transaction references, and follow-up communications when you contact support, request a refund, make a complaint, report content, or exercise a privacy right.
• We ask you not to send full card data, sign-in codes, or unnecessary information about another person.

3. Purchase, Subscription, and Coin Data

Where offered, purchases of Premium plans (weekly, monthly, and yearly subscriptions and one-time lifetime access) and coin packs are processed by Stripe through web checkout. We may receive or create the following records:

• Purchase email, internal user identifier, selected plan or coin pack, amount, currency, payment status, checkout-session identifier, customer identifier, subscription identifier, invoice identifier, and provider event identifier, type, and time.
• Subscription state, renewal or current-period end, scheduled cancellation, lifetime status, coin balance, invoice history, and entitlement activation or revocation state.

Lazys does not receive or store your complete card number or card security code. Stripe, your bank, and the relevant payment network process payment credentials under their own privacy notices.

4. Chat and Browser-Stored Data

Your chats, unsent message drafts, group chats, favorites, saved series, character drafts, video studio drafts, stories you have viewed, and chat preferences are stored in your browser's local storage on the device you use. They are not synced to your account or to other devices. Clearing your browser data, using a private window, or switching devices can remove or hide them.

You can reset or delete a chat at any time from the chat menu in Chat. Resetting keeps the thread but clears its messages; deleting removes the thread and its unsent draft from your browser.

If we introduce features that process your messages or prompts on our servers, for example to generate character replies or sync chats across devices, we will update this Policy before that processing begins.

5. Technical, Security, and Usage Data

• IP address at the network or infrastructure layer, and a keyed cryptographic derivative of the IP used for sign-in rate limiting.
• Request time, route, response status, request identifier, browser or device type, operating system, locale, error context, and security signals.
• Cookie and local-storage values used for authentication, chats, drafts, favorites, saved series, viewed stories, interface state, and remembering product choices on the device.

6. Information We Do Not Intend to Collect

The Services are not designed to collect contact lists, precise device location, address-book data, account passwords, or full payment-card credentials. Do not include sensitive personal information about yourself or anyone else in chats, prompts, or character drafts, and do not submit any of these categories to support. Payment and email providers may process broader information under their own policies.

7. Sources of Information

We obtain information:

• Directly from you when you enter an email, sign-in code, message, prompt, character draft, support message, preference, or checkout instruction.
• Automatically from your browser, device, network, and our security and operational systems.
• From Stripe and your bank or payment network regarding purchases, entitlement, refunds, disputes, or fraud signals.

8. Why We Process Data and Our Legal Bases

8.1 Contract performance and requested steps

We use account and session data to create and secure your account. We use checkout and entitlement data to validate purchases, provide invoices, credit coins, and restore access. We use relevant records to answer support requests.

8.2 Legitimate interests

We use proportionate technical, transaction, and usage records to prevent fraud and abuse. These records help us rate-limit attacks, diagnose failures, and secure infrastructure. They also help us understand aggregate product performance, enforce our Terms, respond to disputes, and improve reliability. We balance these interests against the rights and expectations of affected people. We limit data where practical.

8.3 Consent

We rely on consent where it is required for an optional feature or browser permission. You can withdraw consent through the relevant control or your browser or device settings. You can also contact us. Withdrawal does not invalidate earlier lawful processing. It may prevent the requested feature from working.

8.4 Legal obligations and legal claims

We process and retain information when reasonably necessary to comply with tax, accounting, consumer, sanctions, law-enforcement, court, and data-protection obligations and to establish, exercise, or defend legal claims.

9. Data About Other People

Messages, prompts, and character drafts can contain personal data about someone who is not the account holder. Do not use Lazys to impersonate a real person, to create characters based on a real person without their permission, or to share another person's private information. Do not use it to infer sensitive traits about or build a profile of a real person.

A person who believes their personal data appears on Lazys unlawfully may contact us. We may request enough information to locate the content and verify the request. We may also need information to protect another user's account. We will then identify the lawful response. We may restrict or remove the content while we investigate where appropriate.

10. Service Providers and Recipients

We disclose only the information reasonably needed for the following recipients and purposes:

• Cloud and infrastructure providers, including Cloudflare: hosting, databases, media storage, network delivery, security, rate limiting, logging, and sign-in email delivery.
• Stripe: web checkout, subscription status, invoices, refunds, fraud prevention, and payment disputes.
• Google (Google Analytics): aggregate website usage and purchase measurement, as described in section 13.
• Professional advisers: legal, accounting, insurance, security, or audit assistance subject to confidentiality duties.

Providers can process data under their own legal obligations. We use contracts, access controls, and data-minimization measures appropriate to the service and our role.

11. Legal Disclosure and Business Transfers

We may preserve or disclose data when we reasonably believe the law requires it. This includes valid legal process or a request from a court or regulator. We may also act when disclosure is necessary to protect a person from harm. We may preserve or disclose data to investigate fraud, security incidents, abuse, or violations of the Terms. Where permitted, we assess each request for scope and legal validity.

Lazys may become involved in a merger, financing, reorganization, acquisition, insolvency, or asset transfer. In that event, data may be disclosed under confidentiality. Any transfer will remain subject to this Policy unless we give notice of a materially different policy.

12. No Sale or Cross-Context Behavioral Advertising

We do not sell personal data for money and do not share personal data for cross-context behavioral advertising as those terms are defined by California privacy law. We do not use your chats, prompts, or character drafts to target advertising.

13. Cookies and Local Storage

The website uses a secure, HttpOnly session cookie to keep a signed-in user signed in. The session lasts up to 30 days and ends earlier when you sign out. When you confirm that you are 18 or older, a first-party cookie and a local-storage value remember that answer on that browser for one year, so the age confirmation is not shown on every visit. Functional browser storage keeps your chats, unsent drafts, group chats, favorites, saved series, character and video drafts, viewed stories, and other requested preferences on your device. Blocking cookies or functional storage can prevent sign-in or product features from working.

Google Analytics. We use Google Analytics 4, provided by Google, to measure how the website is used in aggregate: pages viewed, the referring site, search terms typed into the site search, device and browser type, approximate location (country and city, derived from the IP address, which Google Analytics does not store), and product events such as sign-up, sign-in, opening the store, choosing a plan or coin pack, starting checkout, and completed purchases with the plan or pack and its price. We do not send your email address, account identifier, chats, prompts, or character drafts to Google Analytics. Google Analytics sets the first-party cookies _ga and _ga_*, which last up to two years. Visitors in the European Economic Area, the United Kingdom, and Switzerland are measured without these cookies, through cookieless signals only. Analytics data is kept for up to 14 months. You can opt out by blocking these cookies in your browser or with Google's browser add-on at tools.google.com/dlpage/gaoptout.

Lazys does not use advertising cookies, and Google Analytics advertising features are turned off. There is no uniform standard for browser "Do Not Track" signals, so we do not currently respond to every signal. We honor legally required opt-out signals when they apply to our processing.

14. International Transfers

Lazys and its providers may process information in the United Kingdom, European Economic Area, United States, or other countries where they operate. Those countries may have different privacy laws. Some transfers require a legal safeguard. Depending on the transfer, we may use an adequacy decision, the UK International Data Transfer Agreement or addendum, or Standard Contractual Clauses. We may use another lawful mechanism when appropriate. We also apply supplementary measures where needed.

15. Retention

We keep data only for as long as reasonably necessary for the purpose collected, the duration of the account or feature, security and dispute periods, backup cycles, and legal obligations. The following criteria apply:

• Account and session data: while the account is active and for a limited period needed for authentication, security, recovery, or claims. Sessions expire after 30 days and are revoked when you sign out.
• Sign-in code data: codes expire after 10 minutes and can be used only once; verification and abuse-prevention records may remain for a limited security and audit period.
• Chats, drafts, and favorites: kept in your browser until you reset or delete them, clear your browser data, or the browser removes them. We do not hold a server copy.
• Purchase and invoice records: for the life of the entitlement and any longer period required for tax, accounting, chargeback, refund, fraud, audit, and consumer-law records, which can extend for several years.
• Support and legal records: until the request is resolved and for an appropriate claims, compliance, or audit period.
• Provider copies: Stripe, banks, and other independent providers retain information under their own schedules and legal duties.

Backups are protected and removed or overwritten on their normal cycle. We may retain de-identified aggregate information that can no longer reasonably identify a person.

16. Security

We use measures designed to reduce risk. These measures include encrypted transport, protected secrets, and passwordless one-time sign-in codes. We also use hashed or keyed identifiers, secure cookies, access controls, and rate limits. Other controls include payment webhook signature verification, least-privilege practices, and operational monitoring. Session tokens are stored on the server only as cryptographic hashes.

No system is completely secure. You are responsible for protecting your email account, device, and sign-in codes. Chats and drafts stored in your browser are available to anyone who can use that browser profile. Notify us promptly at info@lazys.co if you suspect unauthorized access. Where applicable law requires notification of a qualifying breach, we will notify affected people and regulators within the required period.

17. Automated Processing and AI-Generated Content

Characters and related media on Lazys are generated with AI and are fictional, and so will character replies be once they are offered. Automated rules also validate input and rate-limit requests. They verify payment and entitlement status and determine whether a feature is available. We do not use Lazys data to make solely automated decisions that have legal or similarly significant effects on you. Contact us if you believe an automated access or billing result is incorrect.

18. Browser and Device Choices

You can block or clear cookies and local storage in your browser settings. Clearing local storage removes your chats, unsent drafts, group chats, favorites, saved series, and character and video drafts from that browser and cannot be undone by us. Clearing cookies signs you out. Clearing browser data does not cancel a subscription or delete server-side account data.

19. Account Deletion and Chat Deletion

You can request account deletion at info@lazys.co. We may verify control of the account email before acting. Account deletion removes your account and sessions from our active database.

You can separately reset or delete individual chats from the chat menu without deleting the whole account. Account deletion and chat deletion are distinct from cancellation and refund. Cancel a recurring Premium plan before deleting the account if you also want renewal to stop.

We may retain limited transaction, fraud, security, dispute, legal-request, and accounting records where deletion is not required or is prohibited. We will restrict retained information to the permitted purpose.

20. Your Privacy Rights

Depending on your location and subject to legal exceptions, you may have rights to:

• Know whether we process your personal data and access a copy.
• Correct inaccurate or incomplete data.
• Delete data in qualifying circumstances.
• Restrict processing or object to processing based on legitimate interests.
• Receive certain data in a structured, commonly used, machine-readable format.
• Withdraw consent for future processing.
• Appeal a qualifying refusal where local law provides an appeal right.
• Complain to a data-protection authority.

Send requests to info@lazys.co. State the right you want to exercise and provide the account email, country or state, and enough detail to locate the data. We may verify your identity and authority or request clarification. Where law permits, we may refuse excessive or manifestly unfounded requests. We may redact information that would expose another person's rights, security, or confidential data. We respond within the period required by applicable law. Because chats and drafts are stored only in your browser, we cannot access, export, or delete them for you.

21. UK and EEA Rights

UK and EEA users may have rights of access, rectification, erasure, restriction, objection, portability, consent withdrawal, and complaint. These rights depend on applicable data-protection law. Erasure is not absolute. We may retain information for legal obligations, freedom of expression, public-interest grounds, or legal claims. You can complain to the UK Information Commissioner's Office if it is your relevant authority. You can otherwise contact the supervisory authority where you live or work.

22. California and Other U.S. State Rights

Residents of California and other states with comprehensive privacy laws may have specific rights. These may include rights to know, access, correct, delete, and obtain a portable copy of covered personal information. Residents may also have a right to opt out of sale, sharing, targeted advertising, or qualifying profiling. Some laws provide a right to appeal certain decisions and receive equal service for exercising a right. Lazys does not sell or share personal information for cross-context behavioral advertising. Where law permits, an authorized agent may submit a request. We may verify the agent's authority and the consumer's identity.

23. Children's Privacy

The Services are intended only for adults aged 18 and over and are not directed to children. We do not knowingly allow a person under 18 to create an account or use the Services. If you believe a person under 18 provided personal data or is using Lazys, contact us so we can investigate, close the account, and delete the data where required.

24. Third-Party Links and Fictional Characters

Links to Stripe, social networks, or other services do not make their privacy practices ours. Characters on Lazys are fictional and generated with AI. Any resemblance to a real person is unintended, and characters do not represent, and are not endorsed by, any real person.

25. Changes to This Policy

We may update this Policy to reflect changes in the Services, providers, security, law, or processing. We will update the date above and provide additional notice where a material change or applicable law requires it. If consent is required for a new purpose, we will request it rather than relying only on continued use.

26. Contact and Complaints

Lazys

71-75 Shelton Street, Covent Garden, London, United Kingdom

Email: info@lazys.co

Use the subject Privacy request for rights requests, or visit our contact page. Do not include sign-in codes, full card data, or unnecessary third-party information. If we cannot resolve a concern, you may complain to the competent privacy regulator in your jurisdiction.