Privacy policy
This English version is a courtesy translation. The French version prevails.
Version of 7 October 2026. What we record, why, on what legal basis, with whom, for how long, and how to exercise your rights (General Data Protection Regulation, “GDPR”, and the French Data Protection Act).
1. Controller
Florent Puccini EI (entrepreneur individuel), Chemin de la Daby, 83330 Le Beausset, France, publisher of Ai-Koma, is the controller. Contact for any question or to exercise your rights: contact@ai-koma.com. Ai-Koma has not appointed a data protection officer; this contact acts as such.
2. What we record, why and for how long
- Account (email address, hashed password never stored in plain text, dates of sign-up and of acceptance of the terms, account status). Why: to provide the service. Basis: performance of the contract. Duration: until the account is deleted, which you can do at any time from “My account”.
- Age: your date of birth is checked at sign-up and then forgotten; it is never kept. For an account aged 15 to 17, we keep only the day you turn 18, to lift the restrictions on that day. Basis: legal obligation (protection of minors) and contract.
- Age verification (explicit sex and gore, levels 3 and 4): done by Didit at each session. We only receive the result (adult or not), kept in a signed session cookie that disappears when the browser closes or after one hour without use, never in your account; the technical log only records that a check succeeded or failed, and when. Basis: legal obligation (French criminal code, art. 227-24; law on confidence in the digital economy, art. 10).
- Projects (titles, stories, storyboards, dialogue, settings, character sheet, pages, covers). Why: to create your mangas. Basis: performance of the contract; for a sensual or sexual story, your explicit consent (see 3). Duration: until you delete the project, the story or your account. Only you can see them.
- Credits and purchases (credit movements, purchases, subscription, customer identifier at the payment provider). We never receive or keep your card number. Basis: contract and accounting obligations. Duration: accounting records ten years (French commercial code, art. L123-22), including after the account is deleted.
- Proof of sale (request for immediate performance and waiver of the right of withdrawal, withdrawal, refunds, disputes). Basis: legitimate interest in proving our commitments and yours. Duration: five years (French civil code, art. 2224), in anonymous form if you delete your account.
- Technical log (errors, content refusals, safety-check decisions, with a short reason, never the full text of your story). Basis: legitimate interest (security, abuse prevention, enforcement of the prohibitions). Duration: twelve months, then automatic erasure; erased as soon as your account is deleted.
- Login sessions (hashed token, dates). Duration: thirty days, then erased one month after expiry.
- Service emails (link to choose a new password, valid for one hour; notice of a password change; acknowledgements of a withdrawal or a cancellation; confirmation of account deletion), sent to your email address, never advertising. Basis: performance of the contract and legal obligation (acknowledgements on a durable medium). We keep no copy; our sending provider keeps a technical record, under its own terms.
- IP address: used in memory to limit login attempts, never stored in our database; our hosting and network providers keep it briefly in their access logs, for security.
The information requested at sign-up (email address, password, date of birth) is mandatory: without it, we cannot open an account. We do not ask for your name or postal address, except your first and last name if you withdraw from a purchase. No advertising, no commercial profiling, no data resale, no marketing email.
3. Stories that may be intimate: explicit consent
The stories you write may reveal your sex life or sexual orientation, which are specially protected data (GDPR, art. 9). For any sensual or sexual romance story (level 2 and above), we ask for your explicit consent, through a box separate from the terms and conditions, before processing it; the date of that consent is kept with the project. You withdraw it at any time by deleting the project or your account, with no effect on your other projects. Your stories are used only to produce your pages; the team reads them only when necessary (support you ask for, a report, checking a safety refusal); they are never published and we do not use them to train models. Write fiction: do not include data identifying a real person.
4. Who receives your data
Apart from the team and Stripe, these recipients are our processors (GDPR, art. 28): they process your data on our behalf, on our instructions and only for the task described.
- The Ai-Koma team, for operations and support.
- Render Services, Inc. (United States): application hosting, servers in Frankfurt (Germany).
- Supabase Pte. Ltd. (Singapore): database and page storage, servers in Ireland (European Union).
- Cloudflare, Inc. (United States): routing and protection of the website traffic (it sees IP addresses and requested pages).
- SpicyAPI (United States), our processor for access to artificial intelligence models: it receives the texts, scene descriptions, reference images (character sheet, internal pose references) and the pages to check, without your email address or identity, and processes them on our behalf to produce and check the results. It has them processed, as its own sub-processors, by Anthropic’s Claude models (United States) for text and checks, and Alibaba’s Qwen models for images. According to its terms, it keeps texts for up to 30 days and images for about 14 days, and does not use them to train models.
- Didit Identity Spain, S.L. (Barcelona, Spain): age verification, independent provider; it receives your selfie, technical data about your device (against fraud) and, if the estimate is uncertain, an identity document, as well as the technical identifier of your account (never your email address); it keeps no template of your face to recognise you later, and only sends us the result.
- Resend, Inc. (United States): sending of service emails, from the European Union (Ireland); it receives your email address and the content of these messages.
- Stripe Payments Europe, Ltd. (Ireland), Stripe group (United States): payment; it receives your email address and processes your card data, for which it is responsible.
Transfers outside the European Union. Render, Cloudflare and Stripe are certified under the EU–US Data Privacy Framework (adequacy decision of 10 July 2023), complemented by the European Commission’s standard contractual clauses. For Supabase (Singapore), for SpicyAPI and its models, and for Resend, transfers rely on the European Commission’s standard contractual clauses. You can obtain a copy of these safeguards by writing to contact@ai-koma.com.
5. Automated decisions
Stories, storyboards and every page are checked automatically to enforce the service’s prohibitions: a story may be refused, a page redrawn and then removed (and refunded), and repeated refusals in one day may suspend an account while a person reviews the situation. You are told the reason each time. On simple request to contact@ai-koma.com, a person reviews any automated decision concerning you and you can express your point of view.
6. Minors
The service is open from age 15, the age of digital consent in France (Data Protection Act, art. 45). An account aged 15 to 17 only accesses all-audience content, and nothing sensual is offered to it. A person who signed up as a minor may ask at any time for the erasure of the data collected while a minor (art. 51): deleting the account from “My account” does it immediately.
7. Your rights
You may access your data, have it corrected or erased, restrict its processing, object to processing based on our legitimate interest, withdraw your consent at any time and get your data back in a reusable format: “My account” → “Download my data” (account, credits, purchases, projects), the export of each project and the download of the pages. You may also set instructions on what happens to your data after your death (art. 85). Write to contact@ai-koma.com: we answer within one month. You may lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, France (cnil.fr).
8. Cookies
Only strictly necessary cookies, with no tracker or audience measurement, hence no consent banner: your session cookie (HttpOnly, thirty days); the one that remembers the chosen language (one year); the one that keeps the age proof of your session (erased when the browser closes, one hour at most without use); after a sign-up refused because the date of birth shows an age under 15, a technical cookie with no identifier that remembers that refusal for one day; and, where applicable, Cloudflare’s security cookies that protect the site against bots (a few minutes).
9. Security and incidents
Encrypted connection (HTTPS), hashed passwords, pages stored in a private space reachable only through your account, restricted admin access, backups at our hosting providers. In the event of a data breach, we record it, notify the CNIL within 72 hours when it presents a risk, and inform you if the risk is high.
10. Changes to this policy
A significant change is announced on the site before it takes effect. The version in force is always the one on this page.