Character.ai Privacy Policy

This document is Character Technologies, Inc.'s Privacy Policy, last updated August 27, 2025, governing data collection and processing across all Character.AI websites, mobile applications, and offline services, with jurisdiction-specific supplements addressed in a separate Regional Privacy Disclosures document for EEA, UK, and US residents. The policy states that Character.AI collects a broad range of user data including identifiers, demographic information, voice recordings, chat communications, financial information, device and geolocation data, and publicly available internet data, and the terms authorize use of this information for AI and machine learning model training, tailored advertising, inference generation about user preferences, and disclosure to advertising and analytics providers, affiliates, and vendors. A notably broad provision under Section 7 reserves the right to preserve and keep active any Character created by a user that has been made available to others, even after account deletion, meaning that user-generated content may persist on the platform indefinitely regardless of a deletion request; additionally, the policy explicitly collects voice data and chat communications for model training, and acknowledges that users may voluntarily submit sensitive personal information including race, religion, and sexual orientation through chat interactions, though it discourages this practice. The policy engages GDPR and UK GDPR for EEA and UK residents, CCPA and applicable US state privacy laws for US residents, and COPPA given the platform's age restriction of 13 (16 in EEA/UK), with the Regional Privacy Disclosures document serving as the operative supplemental instrument for jurisdiction-specific rights; the collection of voice data, persistent minor-directed risk, and use of personal data for AI model training each engage distinct regulatory considerations depending on jurisdiction. The policy's reliance on a separate Regional Privacy Disclosures document for substantive GDPR and CCPA obligations means that the base policy alone does not fully disclose the legal bases for processing, data subject rights mechanisms, or controller identity details required under those frameworks, creating a layered disclosure structure that compliance teams should evaluate holistically.