Privacy Notice

Last updated: 01/07/2026

Quantalingo Ltd (“Quantalingo”, “we”, “us” or “our”) is the controller for the processing carried out through the website accessible at https://strawbs.ai/ website to which visitors or users may be redirected (together, the “Services”). Quantalingo is a company duly incorporated in England and Wales Company Registration Number 16308113.

The Services are an online chat/voice application that uses artificial intelligence algorithms to generate virtual and fictional characters (the “AI Companions”), with whom you, as a user of the Services (“you” or “user”), can chat and exchange messages. The Services also include, but are not limited to, other media such as images, and videos. Parts of the Services may require you to create a user account and/or become a paid subscriber.

This Privacy Notice explains how Quantalingo collects, uses, discloses and otherwise processes your personal data in connection with the Services and, as applicable, your rights under:

• the EU General Data Protection Regulation 2016/679 and Directive 2002/58/EC (the “ePrivacy Directive”) (together, the “EU GDPR”);
• the UK Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (together, the “UK GDPR”);
• the Swiss Federal Act on Data Protection 235.1 (the “FADP”); and
• other applicable data protection laws (including, but not limited to, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and the Virginia Consumer Data Protection Act).

Together, these are referred to as the “Applicable Data Protection Law”.

By using the Services, you confirm that you have read and understood this Privacy Notice and our Cookies Notice, which is incorporated by reference.

1. Definitions

Capitalised terms used but not defined in this Privacy Notice or in the GDPR have the following meanings:

• “Content”: the information you provide to register as a user and/or in the course of using our Services. This includes your personal data, inputs in conversations with AI Companions, and outputs generated in response to those inputs.
• “Consent”: any freely given, specific, informed and unambiguous indication of your wishes by which you, by a statement or clear affirmative action, signify agreement to the processing of personal data relating to you.
• “Controller”: the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purposes of the Services, the Controller is Quantalingo Ltd. As used here, “Controller” also includes “Business” as defined under the CCPA.
• “Data Subject”: an identified or identifiable natural person. As used here, “Data Subject” also includes “Consumer” as defined under the CCPA.
• “Performance of our Services”: the actions necessary for us to provide our Services.
• “Personal Data”: any information relating to a Data Subject, such as name, address, date of birth, gender, spoken languages, photos, account number, location data, etc.
• “Processing”: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• “Subscription”: an arrangement between Quantalingo Ltd and you to enable you to benefit from and/or use the Services.
• “User”, “you”, “your”: any person who visits or uses the Services.
• “Visitor”: anyone who browses the Services without a valid account and/or valid Subscription.

2. Purposes of Personal Data Processing

We process personal data only where we have a legal basis to do so. If you do not or cannot provide us with required data, we may not be able to provide the Services to you.

The table below summarises the main purposes for which we process personal data, the categories of data involved, and the legal bases we rely on.

2.1 Account creation and management

Purpose:

• Managing your registration and account for the Services.

Categories of Personal Data:

• Email address (mandatory registration field);
• Encrypted password;
• Username name;
• User gender;
• First and last name (as disclosed by you or via third-party login/authentication systems such as Google single sign-on);
• Creation date and time and sign-up provider (e.g. Twitter, Google, Discord, email);
• Successful results of any third-party age estimation or age and identity verification process, and associated user-ID and metadata (e.g. start and finish time and technical data needed for debugging), where applicable based on your location;
• Currency (based on detected country);
• Country and/or city (detected based on IP address and postcode, if given);
• Token / Credit balance (generated on the basis of your purchase);
• Last account update date and time;
• Current and last sign-in date, time and IP address;
• Sign-in count.

Legal basis:

• Consent;
• Necessity for the performance of a contract;
• Compliance with our legal obligations;
• Our legitimate interest in managing your account and addressing your queries.

2.2 Provision of the Services

Purpose:

• Memory of the AI Companions and specific features of the Service;
• Interactive chat with AI Companions;
• Voice calls and related features.

Categories of Personal Data (Content data):

• Output generated in response to your input, to the extent this contains personal data;
• Where voluntarily provided in connection with specific features, your Discord username.

Legal basis:

• Consent;
• Necessity for the performance of a contract.

2.3 Support of the Services

Purpose:

• Providing service support, answering your requests, sending service emails, technical support, and responding to customer queries.

Categories of Personal Data:

• Supporting data (entered in the free field through the “Contact us” window and sent by email to Quantalingo), your email address, and our responses;
• Device information (mobile/desktop), browser type (e.g. Chrome, Firefox, etc.), Content as needed to investigate technical issues;
• Cookies.

Legal basis:

• Our legitimate interest in addressing your queries and technical issues.

2.4 De-identification, anonymisation, improvement and development

Purpose:

• De-identification and/or anonymisation of data;
• Improving and developing our services;
• Conducting internal research;
• Performing quality assurance and data analysis.

Categories of Personal Data:

• Information associated with you, including exchanges with AI Companions (prompts, requests, and corresponding outputs), which may be aggregated, anonymised and/or de-identified;
• Aggregated and de-identified information (for example, aggregated trends about the general use of our Services) which we may analyse and share with third parties.

Legal basis:

• Our legitimate interest in providing and improving the Services;
• The legitimate interests of Data Subjects and/or authorised users to practice data minimisation and privacy by design.

2.5 Research, training and development of AI and technology

Purpose:

• Improvement and development of our Services and technology;
• Training and developing our AI models and moderation technologies;
• Preparing datasets for further training, which may include human review of de-identified and/or anonymised interactions with AI Companions;
• Conducting internal research, for example to develop new product features;
• In connection with user surveys: Account, usage, and/or other data that you have specifically consented to having reviewed in connection with voluntary participation in user surveys.

Categories of Personal Data:

• Information associated with you, including exchanges with AI Companions (prompts, requests, and corresponding outputs), which may be aggregated, anonymised and/or de-identified;
• Users’ interactions with the platform for internal research;
• Account, usage, and/or other data that you have specifically consented to in connection with voluntary participation in user surveys.

Legal basis:

• Our legitimate interest in providing and improving the Services;
• The legitimate interests of Data Subjects and/or authorised users to practice data minimisation and privacy by design.

2.6 Quality assurance and statistical analysis

Purpose:

• Quality assurance (QA) and statistical analysis;
• Querying data for QA purposes, e.g. ensuring that content generation tools are working as intended;
• Analysing de-identified and/or aggregated data, e.g. to monitor usage trends.

Categories of Personal Data:

• Content data randomly queried for QA purposes;
• De-identified and/or aggregated data for trend analysis.

Legal basis:

• Our legitimate interest in providing the best possible Service and detecting errors and/or misuse of the platform.

2.7 Debugging and technical analysis

Purpose:

• Debugging and technical analysis;
• Monitoring use of the platform to detect anomalies or security vulnerabilities.

Categories of Personal Data:

• Log files that include users’ interactions with the platform, user-IDs and timestamps;
• Log files (automatically deleted after 30 days).

Legal basis:

• Our legitimate interest in improving our Service, debugging, detecting and responding to errors, misuse of the platform, and security threats.

2.8 Payment processing

Purpose:

• Processing by payment service providers and payment orchestrators for security and payment for subscriptions, tokens, refunds, etc.

Categories of Personal Data (examples by provider):

• Payment Provider Telecom 2:
  • First and last name;
  • Email address;
  • Card brand;
  • Last 4 digits of payment card number;
  • Payment transaction date and time;
  • Type, amount and currency;
  • BIN country;
  • IP address;
  • Recurring billing type;
  • Response code (issuer);
  • Type of refund (full or partial).
• Yoti:
  • Selfie Image;
  • Document ID Details;
  • Age;
  • Address;
  • IP address;
  • Browser type and version;
  • Operating system and platform;

Legal basis:

• Necessity for the performance of a contract (payment service processing);
• Legitimate interest in optimising payment processing (payment orchestration).

2.9 Direct marketing

Purpose:

• Delivering marketing emails to users who have opted in, to inform them of updates, offers and features through our newsletter;
• Enabling affiliate marketing programme questionnaire.

Categories of Personal Data:

• Email address;
• First and last name (as disclosed by you or via certain authentication methods);
• Account number;
• Website or traffic source URL;
• Whether an email was opened or not;
• Data linked to the affiliate marketing programme questionnaire free fields (to introduce potential affiliates and how they plan to promote the Service).

Legal basis:

• Our legitimate interest in improving our Services (direct marketing by us for similar products and Services); or
• Consent (for third-party marketing).

2.10 Analytics (other than via cookies or other tracking technologies)

Purpose:

• Allowing customer surveys, marketing campaigns, market analysis.

Categories of Personal Data:

• Account number;
• Email address;
• Answers provided by the user.

Legal basis:

• Consent.

2.11 Safety, moderation and compliance

Purpose:

• Moderation of the Services (problematic behaviour, abuse reports, action taken);
• Human review of content and users flagged by our moderation controls and/or reported by you;
• Ensuring compliance with and enforcing our Policies;
• Reporting to law enforcement in appropriate cases.

Categories of Personal Data:

• Requests and prompts to the AI models;
• Users and/or Content that is reviewed by human moderators, including:
• Action taken in response to flagged Content;
• Metadata regarding your Content (time/date sent, originating IP address);
• Account data and history;
• In appropriate cases, information required by local authorities and/or information to facilitate the investigation of individuals who use the Services to conduct unlawful activity, including but not limited to uploading or creating CSAM.

Legal basis:

• Necessity for compliance with legal obligations (e.g. detecting and reporting illegal behaviour);
• Necessity for the performance of a contract (e.g. to respond to breaches of our policies);
• Legitimate interest in preventing misuse of our Services.

2.12 Legal and accounting

Purpose:

• Record keeping;
• Invoice recovery;
• Compliance with court orders;
• Management of Data Subject requests.

Categories of Personal Data:

• Supporting data (as provided by you) such as contact data, payment data or credentials.

Legal basis:

• Necessity for compliance with legal obligations.

2.13 Complying with lawful requests from authorities and exercising/defending legal rights

Purpose:

• Complying with lawful requests from authorities, court orders and exercising and/or defending our legal rights.

Categories of Personal Data:

• Supporting data (as provided by you) such as contact data, payment data or credentials, and/or any information within the scope of lawful legal requests or processes;
• Any data relating to an apparent potential legal dispute.

Legal basis:

• Complying with our legal obligations;
• Our legitimate interest in defending our rights.

3. Marketing

We may send you marketing communications about our Services and other information in the form of alerts, newsletters and invitations to events or functions which we believe might be of interest to you, or to update you with information which we believe may be relevant (such as commercial news). We may communicate this to you according to the contact channels you provided and your stated preferences, including by telephone, email or other digital channels.

If you do not wish to receive marketing information from us, you can unsubscribe by:

• a) clicking on the “Unsubscribe” or subscription preferences link in a direct marketing email that you have received from us; or
• b) contacting us using the contact details in Section 11 below.

Please note that opting out of marketing communications will not affect the sending of communications related to the Services themselves (such as service updates, security notices, or billing information).

4. Third-Party Marketing

We will obtain your express opt-in Consent before we share your personal data with any company outside Quantalingo for marketing purposes.

You can ask us or third parties to stop sending you direct marketing messages by electronic means at any time by logging into the Services or third parties’ websites and adjusting your marketing preferences, or by following the opt-out links on any marketing message sent to you by such third parties.

5. Disclosing your Personal Data

We generally disclose your personal data to third parties only:

• for the provision of Services to you;
• where we or the third party have a legitimate interest for the disclosure;
• where we have your Consent (where required); or
• where required to fulfil a legal obligation. We work with and rely on third-party service providers to operate and provide our Services and run our business. We may share your information with the following categories of recipients (unless otherwise noted, this may involve transferring your data outside the European Union, including to the United States):
• a) Service providers to deliver the Services, including:
  • payment service providers (based in the EU for European users);
  • age verification providers
  • hosting service providers;
  • email marketing tools providers;
  • affiliate partner tools;
  • moderation tool providers; and
  • other tools or technologies that support our AI Services, including, at our discretion, third-party LLM providers and/or hosters. Please note that these third parties may receive the content of your messages exchanged with our chatbot.
• b) Professional advisers where necessary to obtain advice or assistance, including lawyers, accountants, IT or public relations advisers;
• c) Legal and regulatory authorities, as required by applicable laws and regulations;
• d) Our staff, as needed for them to carry out their work;
• e) In the event of a restructuring, sale or change of control, your data may be transferred to any successor, acquirer or purchaser as part of that transaction;
• f) Analytics: We may share aggregated, de-identified information (for example, aggregated trends about the general use of our Services) publicly and with our affiliates, subsidiaries, and partners.

We will not disclose, sell, trade, or otherwise transfer your Personal Data to any third parties without your Consent (where required) or unless otherwise stated in this Privacy Notice.

If Quantalingo Ltd merges with, or is acquired by, another company or organization, or sells all or a portion of its assets, your Personal Data may be disclosed to our advisers, any prospective purchaser or any prospective purchaser’s adviser, and may be among the assets transferred. However, Personal Data will always remain subject to this Privacy Notice, as updated in accordance with section 13.

6. Retention Period

We retain your Personal Data for as long as your account is in existence or necessary to fulfill the purposes for which we collect it or as needed to provide you with the Services, except if required otherwise by law.

However, when you terminate your account, we will still retain your Personal Data for a period of time. Usually, we will store your Personal Data for a period after you cease being a User of our Services, beginning at the date your account is closed.

We generally retain:

• a. Personal Data relating to your Account (for which there is no legally mandated retention period):

  • For three years after your last Account activity, to address potential customer inquiries and/or permit further use of the platform. For operational, technical, or infrastructure-related reasons, this retention period may be shortened to the later of: one year after your last Account activity or after your paid subscription ended; or
  • Until you request deletion of your Personal Data, in which case we delete Personal Data relating to your Account data without undue delay.

• b. Financial and transactional data: ten years from their date of issuance (in accordance with our obligations under applicable tax and accounting laws)

• c. Marketing data: until you withdraw your Consent, or for a maximum period of two years after your last platform interaction; and

• d. Personal data subject to a mandated retention period or relevant to legal disputes:

  • In accordance with any legally mandated retention periods, or
  • In connection with apparent potential or ongoing legal disputes (as applicable), for as long as necessary to defend or exercise our legal rights.

Retention periods may be changed from time to time based on business or regulatory requirements. In such cases, we will update this Privacy Notice accordingly.

7. Personal Data of minors

Quantalingo Ltd does not provide Services or collect Personal Data from anyone under 18 years of age or equivalent minimum age depending on jurisdiction. Our Services are intended for use only by adults who are at least 18 years of age, or the age of majority in the jurisdiction in which they reside and/or access the Services. If we learn that our Services have been improperly and in violation of our Policies accessed by an underaged individual, we will take steps to delete the information as soon as possible and block such User. Please also refer to our Underage Policy.

8. Third-party links

The Services may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. We encourage you to read the Privacy Notice of every website that can be accessed through the Services.

9. Your Rights under the GDPR

9.1. Right to access your Personal Data

You have the right to request a copy of your Personal Data that we hold in accordance with Article 15 GDPR. You have the right to be informed of:

• a. the purposes of the Processing;
• b. the categories of your Personal Data;
• c. the recipients or categories of recipients to whom your Personal Data have been or will be disclosed, in particular recipients in third countries or international organisations;
• d. the envisaged period for which your Personal Data will be stored, or, if not possible to say, the criteria used to determine that period;
• e. the existence of the right to request rectification or erasure of Personal Data or restriction of Processing of Personal Data concerning the Data Subject or to object to such Processing;
• f. the right to lodge a complaint with a supervisory authority;
• g. where the Personal Data are not collected from the Data Subject, any available information as to their source;
• h. the existence of automated decision-making, including profiling.

To submit such a request, please see the “Contact us” section below.

9.2. Right to rectification

You have the duty to maintain your Personal Data up to date. To do so, you have the right to obtain from the Controller without undue delay the rectification of inaccurate Personal Data concerning you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the Personal Data you provide to us.

9.3. Right to erasure

You can also request that we erase your Personal Data in limited circumstances where:

• a. it is no longer needed for the purposes for which it was collected; or
• b. (where applicable) you have withdrawn your Consent, and where there is no other legal ground for the Processing; or
• c. following a successful right to object (see below); or
• d. it has been processed unlawfully; or
• e. to comply with a legal obligation to which Quantalingo is subject.

We are not required to comply with your request to erase Personal Data if the Processing of your Personal Data is necessary:

• a. for compliance with a legal obligation; or
• b. for the establishment, exercise or defence of legal claims; or
• c. for performance of a contract.

9.4. Right to request restriction of Processing of your Personal Data

You may request that we suspend the Processing of your Personal Data in the following scenarios:

• a. if you want us to establish the Personal Data’s accuracy;
• b. where our Processing of Personal Data is unlawful, you do not want us to erase it, and you request us to suspend the Processing instead;
• c. where it is no longer needed for the purposes for which it was collected, but you need us to hold the Data to establish, exercise or defend legal claims; or
• d. you have objected to our Processing of your Personal Data and we need to verify whether we have overriding legitimate grounds to use it.

We can continue to use your Personal Data following a request for restriction where:

• a. we have your Consent; or
• b. we need to:
  • establish, exercise or defend legal claims;
  • protect the rights of another natural or legal person; or
  • process Personal Data for reasons of important public interest of the Union or of a Member State.

9.5. Right to portability

You can ask us to provide you with the Personal Data you provided in a structured, commonly used, machine-readable format, or you can ask to have it transferred directly to another Controller, where the Processing is:

• a. based on your Consent or on the performance of a contract with you; and
• b. carried out by automated means.

9.6. Right to withdraw your Consent

We are committed to make it as easy to withdraw as it is to give Consent.

You have the right to withdraw your Consent at any time and free of charge. The withdrawal of Consent shall not affect the lawfulness of Processing of your Personal Data based on Consent before its withdrawal.

If you withdraw your Consent, we may not be able to provide our Services to you to their full extent

9.7. Right to object to the Processing of your Personal Data

You can object to any Processing of your Personal Data based on our legitimate interests, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms, or for the establishment, exercise, or defence of legal claims.

9.8. Right to object to how we use your Personal Data for direct marketing purposes

You can request that we change the manner in which we contact you for marketing purposes. You can withdraw your Consent to the transfer of your Personal Data to third parties for the purposes of direct marketing at any time and free of charge, either by clicking on the ‘Unsubscribe’ or subscription preferences link in a direct marketing email that you have received from us; or by contacting us using the contact details specified in Section 11 below.

10. Right to obtain a copy of Personal Data safeguards used for transfers outside Europe

You can ask to obtain a copy of, or reference to, the safeguards under which your Personal Data is transferred outside of the European Union, the United Kingdom or Switzerland, as applicable, redacted of any terms unrelated to data protection.

11. Contacting us, Complaints

You have a right to lodge a complaint with your local supervisory authority

If you have concerns about how we are Processing your Personal Data, we ask that you please attempt to resolve any issues with us first. If you have any questions, concerns, or complaints regarding this Privacy Notice, or if you wish to exercise your rights related to your Personal Data, you can reach us at the following contact details.

Privacy Team Email: [email protected]

Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

We have appointed a Data Protection Officer under Art. 37 GDPR, who may be reached at [email protected].

12. Data Security

We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

13. Changes to the Privacy Notice

We may revise this Privacy Notice from time to time to take account of our changes of practices or of new applicable data protection law. If we modify our Privacy Notice, we will post the revised version on the Services with an updated revision date. Where such changes are substantial, we will also notify you by other means prior to the changes taking effect, such as by sending you an email notification or through the Service. By continuing to use our Services thirty days after such revisions are in effect, you will be deemed to accept and agree to the revisions and to abide by them.