toptok

Privacy Policy

Last updated: September 1, 2026

Article 1 (Overview, Scope)

  1. This Privacy Policy describes how personal information is processed in connection with the TopTok website, AI character chat, content, and related features (collectively, the ‘Service’). In this Policy, ‘we,’ ‘us,’ and ‘our’ refer to the operator of the Service. We process personal information lawfully, fairly, transparently, and securely in accordance with applicable privacy and data-protection laws.
  2. This Policy applies to Service visitors, Members, Creators, support requesters, and other individuals who interact with the Service. Information independently processed by an external website or platform is governed by that provider's own policy.

Article 2 (Personal Information and Legal Bases)

  1. Service delivery and contract performance: Where account registration, login, or similar account features are provided, we may process the minimum account-identification information and Service settings supplied by the user or login provider as necessary to provide and operate the Service.
  2. AI chat and content features: We may process prompts, chat content and history, character and scenario settings, uploaded images, audio, and files, generated output, content reports, and safety-review information as necessary to provide requested features and operate the Service.
  3. Support, rights requests, and reports: We may process, to the extent necessary, an email address or account identifier, inquiry or report content, attachments, identity-verification results, and resolution records to respond to requests, comply with legal obligations, and protect users and the Service.
  4. Automatically generated Service data: We may process, to the minimum extent necessary, IP address, device, browser, operating-system and language information, access time, usage, click, search and error logs, session identifiers, cookies, and fraud or security signals for Service delivery, security, fraud prevention, troubleshooting, and other legitimate operational purposes. Where legitimate interests are relied upon, we balance those interests against user rights and apply appropriate safeguards.
  5. Consent-based information: Where consent is required, we separately disclose and obtain consent for optional marketing contact details, optional analytics or advertising technologies, sensitive information for a separate feature, or information beyond what is necessary, including the relevant purpose and retention period. Refusing optional consent does not prevent use of the core Service, though the optional feature may be unavailable.
  6. Information from third parties: We may receive the minimum account identifiers, public profile information, or security signals necessary for a user-selected feature from login providers, fraud-prevention providers, or partners.

Article 3 (Purposes of Processing)

  1. We process personal information to register and manage accounts, enable login, provide AI chat, character, image and community features, maintain user settings, and generate requested output.
  2. We process personal information to receive, verify, and resolve support inquiries, reports, privacy-rights requests, complaints, and disputes, and to communicate the outcome.
  3. We process necessary information to detect and address account compromise, fraud, spam, security incidents and prohibited content, ensure system reliability, enforce our terms, and protect users and the Service.
  4. We may process minimal information to analyze Service use, troubleshoot errors, improve quality, and develop features. We do not currently use raw chats to train general-purpose AI models.
  5. Where a user separately consents, we may send event, benefit, new-feature, or promotional messages and measure advertising performance.

Article 4 (AI Chats, Sensitive Information, and Training Use)

  1. AI chats may contain private thoughts and sensitive content relating to sexual preferences or sex life, health, beliefs, or similar matters. We do not require users to submit real-world sensitive information to use core chat features. Users should not unnecessarily submit their own or another person's real name, contact details, unique identifiers, confidential information, or sensitive information.
  2. Chat input may be processed by us and AI providers to generate the requested response and review safety or errors. Direct account identifiers are separated or removed before transmission. Any temporary processing or retention by an external AI provider, and its duration, is governed by our applicable contract and API settings and that provider's data-retention policy. We limit processing to what is necessary to provide the Service, and internal access is restricted to personnel with a business need.
  3. We do not currently use raw chats to train general-purpose AI models or process chat messages as a separate pseudonymized dataset for analytics or model improvement. If we introduce such processing, we will establish an appropriate legal basis, apply safeguards required by applicable law, and update this Policy.
  4. If a separate feature intentionally processes sensitive information or provides it to a third party, we obtain explicit or separate consent where required by applicable law, or rely on another lawful basis permitted by applicable law. Users may report or challenge inappropriate output or data use at support@toptok.live.

Article 5 (Retention and Destruction)

  1. Account, profile, and Service settings are retained until account deletion and, where necessary to prevent restoration errors or misprocessing, destroyed within up to seven days afterward. Account identifiers, IP addresses, and enforcement records necessary to prevent abuse may be retained for up to one year from collection under legitimate interests and data-minimization principles.
  2. Chat input, attachments, generated output, and safety-review information are generally retained for six months from collection for Service delivery, disputes, and safety response. If a user deletes a chat earlier, we delete it within a reasonable period except where legal retention or security needs apply.
  3. Support, complaint, and dispute records are retained for up to three years after resolution. Analytics and behavioral information is retained for up to one year from collection or the shorter period configured in the applicable tool. A shorter operational setting controls where applicable.
  4. We destroy personal information without undue delay when its retention period expires or its purpose is fulfilled. Electronic files are deleted in a manner designed to prevent restoration, and paper records are shredded or incinerated. Information retained by law is logically separated and restricted from use for other purposes.

Article 6 (Provision to Third Parties)

  1. We process personal information within the disclosed purposes and do not provide it to a third party without separate consent or another legal basis. Before a third-party provision, we disclose the recipient, purpose, data, retention period, and effect of refusing consent.
  2. We may provide only necessary information within the scope permitted by law in response to a lawful request from an investigative authority, court, or regulator, or where there is a legal basis to urgently protect the life, body, or property of a user or third party.
  3. An AI, cloud, or analytics provider acting only on our instructions is managed as a processor. If a provider uses information for its own purposes or independently retains it, we separately assess third-party provision and provide any required disclosure or consent.

Article 7 (Processing by Service Providers)

  1. We may outsource the following categories of work to service providers: cloud hosting and backup; AI model inference and response generation; login; support and message delivery; analytics and error monitoring; and security and fraud prevention.
  2. We use Amazon Web Services for cloud services and ByteDance/Volcengine, Google, OpenRouter, Anthropic, and OpenAI for AI models or infrastructure. Optional analytics and advertising may use Google, Meta, and other advertising platforms, advertising networks, or advertising-measurement providers. Specific providers may vary depending on advertising activities.
  3. Our processing agreements address purpose limitation, security, confidentiality, subcontracting restrictions, incident notice, return or destruction, oversight, and responsibility. We supervise processors' secure handling and disclose changes to processors or outsourced work through this Policy.

Article 8 (International Data Transfers)

  1. Because TopTok relies on cloud, AI, analytics, and other service providers located in multiple countries, personal information may be transferred to, stored in, or processed in countries other than the country or region where a user is located. We use lawful transfer mechanisms and appropriate contractual, technical, and organizational safeguards where required by applicable law.
  2. Amazon Web Services, Inc. (United States, privacy@amazon.com): When the Service is used, minimum account-identification information, usage records, chats and attachments, and IP and device information may be transferred through encrypted networks such as TLS for hosting, storage, and backup. Information is retained and deleted in accordance with the retention periods in this Policy and applicable contractual deletion schedules.
  3. ByteDance Ltd. (Volcengine) (Singapore, privacy@bytedance.com), Google LLC (United States, data-protection-office@google.com), OpenRouter, Inc. (United States, privacy@openrouter.ai), Anthropic PBC (United States, privacy@anthropic.com), and OpenAI OpCo, LLC (United States, privacy@openai.com): When an AI feature is used, chat input, attachments, character settings, and technical information needed for generation are transferred via HTTPS for model inference, response generation, and safety processing. Direct account identifiers are excluded. Each provider's retention and use period is governed by our applicable contract and API settings and that provider's data-retention policy.
  4. Google LLC, Meta Platforms, Inc., and other advertising platforms, advertising networks, or advertising-measurement providers: If a user allows optional Analytics or Marketing technologies and we actually deploy those tools, cookies, browser or device identifiers, IP address, and visit, click, or conversion events may be transferred through encrypted networks for usage analytics, online advertising operations, and advertising-performance measurement. Specific providers may vary depending on advertising activities; retention and refusal methods are described in Articles 5 and 9.
  5. If an international transfer is necessary to provide a requested AI, account, or other core feature, refusing or preventing that transfer may make the relevant feature unavailable. Optional transfers for analytics or advertising may be refused through the Service's Cookie Settings, and related cookies may also be blocked through browser controls. We update this Policy when a new provider materially changes the processing purpose, transferred data, destination, retention, or other important conditions.

Article 9 (Cookies and Behavioral Information)

  1. We classify storage technologies by purpose. ‘Necessary’ supports requested Service functions such as login sessions, security, language settings, and storage of cookie choices. ‘Analytics’ covers usage, error, and performance analysis, while ‘Marketing’ covers online advertising operations and advertising-performance measurement.
  2. On a first visit, users may choose ‘Accept all,’ ‘Continue with necessary only,’ or ‘Settings.’ Necessary is always active, while Analytics and Marketing are off by default until the user provides consent. The settings interface permits category-level choices, and the actual tools, data, and retention periods are disclosed in this Policy or a linked cookie list.
  3. Cookie choices are stored only in that browser's cookie or localStorage and are not linked to a login account or retained in our server database. A separate choice is therefore required in another browser or device, and the banner may reappear after browser data is cleared or when private-browsing mode is used.
  4. Behavioral information may include visited pages, searches, clicks, feature use, ad impressions and clicks, cookies, advertising identifiers, click IDs, IP, device and browser information, and conversion events, collected through web tags, pixels, SDKs, or server-to-server transmission. Such information may be processed through Google LLC, Meta Platforms, Inc., and other advertising platforms, advertising networks, or advertising-measurement providers. Specific providers may vary depending on advertising activities. We do not use raw chats or sensitive chat information concerning sexual preferences, health, or similar matters for advertising or advertising-performance measurement.
  5. Advertising pixels and server-to-server (‘S2S’) conversion transmission are used only where needed for actual advertising operations. If a user has not allowed Marketing in that browser, we do not run advertising pixels or send advertising-purpose S2S conversion events arising from that browser. This does not mean every tool uses an identical technical value or architecture; it means the same category choice governs the same advertising purpose. Before sending account, email, telephone, or other information to an ad provider for matching, we establish the required legal basis and separate disclosure.
  6. Users may change or withdraw choices for the same browser at any time through ‘Cookie Settings’ in the Service footer or another persistent location. They may also delete or block cookies in the browser or manage mobile advertising identifiers and tracking permissions. A change applies to that browser, and blocking Necessary storage technologies may prevent login or other features from working.

Article 10 (Promotional Communications)

  1. Where required by applicable law, we send promotional information by email, text, push, or web notification only after obtaining the required consent or other lawful permission for that communication channel. Operational notices concerning transactions, security, or policy changes are distinguished from promotional messages.
  2. Users may withdraw promotional-message consent at any time through the unsubscribe control in a message, account settings, or support@toptok.live. We stop promotional messages after withdrawal and notify the user of consent, refusal, or withdrawal processing as and when required by law.

Article 11 (Security and Data Incidents)

  1. We apply administrative, technical, and physical measures proportionate to processing scale and risk, including internal plans, training and least-privilege access, access control and log review, encryption in transit and at rest, one-way password hashing, vulnerability and malware response, backups, and physical access controls.
  2. Access logs of personnel and others to systems containing personal information are retained and reviewed for periods appropriate to security, audit, fraud prevention, and legal requirements. These logs differ from ordinary user web-visit records, and cookie choices are stored only in the relevant browser as described in Article 9.
  3. If a personal-data incident occurs, we take reasonable steps to contain and mitigate harm and, where required by applicable law, notify affected users and the competent supervisory, regulatory, or other authority within the applicable timeframe.

Article 12 (User Rights and How to Exercise Them)

  1. Users may request access or transmission, correction or deletion, suspension of processing, and withdrawal of consent. A request may be limited where another law requires retention or another statutory restriction applies, in which case we explain the reason.
  2. Requests may be made through account settings, in-Service deletion tools, or support@toptok.live. We may verify the requester or a lawful representative and respond within the statutory period.
  3. If we make a solely automated decision that produces legal or similarly significant effects for a user, the user may request an explanation, object, or request human review to the extent provided by applicable law. Ordinary AI response generation is not, by itself, treated as a consequential automated decision.
  4. Automated tools may assist with fraud detection, content review, or account enforcement. We provide a reasonable appeal and human re-review mechanism for significant actions such as account suspension or restriction of Service access.

Article 13 (Age Restrictions and Minors' Data)

  1. The Service is available only to users aged 18 or older. Users must confirm that they are at least 18 before accessing or using the Service.
  2. We do not knowingly collect personal information from anyone under 18. If we learn that personal information from a person under 18 has been collected, we restrict access and take necessary steps, including prompt deletion, unless retention is required by law.

Article 14 (Public Areas)

  1. Information included in public characters, profiles, comments, posts, or Creator content may be visible to other users. Users should review the audience before posting real-world personal information or another person's information in a public area.

Article 15 (Privacy Contact and Complaints)

  1. Department responsible for privacy matters and related complaints: Customer Support / Contact: support@toptok.live
  2. Users may contact us regarding privacy concerns, rights requests, complaints, or suspected infringements. Users may also lodge a complaint with the competent privacy or data-protection authority in their country or region where applicable. Additional complaint rights for EEA and UK users are described in Article 16.

Article 16 (Additional Provisions for EEA and UK Users)

  1. If the EU General Data Protection Regulation (‘EU GDPR’) or the UK GDPR applies to our processing, this Article supplements the rest of this Policy. If an applicable EEA or UK data-protection rule conflicts with this Policy, that rule applies to the affected processing.
  2. For EEA and UK users, the legal basis depends on the purpose of processing. We rely on contract necessity for account, login, and user-requested AI or content features; legal obligations where required by law; legitimate interests for security, fraud prevention, Service integrity, support, and proportionate non-advertising Service improvement where those interests are not overridden by user rights; and consent for optional Analytics, Marketing, promotional communications, or other processing for which consent is required. Consent may be withdrawn at any time without affecting processing lawfully carried out before withdrawal.
  3. Where processing involves special-category data under Article 9 of the EU GDPR or UK GDPR, we apply an additional lawful condition required by applicable law and obtain explicit consent where required. We do not use raw chats or special-category chat information for advertising or advertising-performance measurement.
  4. Subject to applicable conditions and exceptions, EEA and UK users may request access, rectification, erasure, restriction of processing, and data portability; object to processing based on legitimate interests; object to direct marketing; withdraw consent; and exercise applicable rights relating to solely automated decisions. Requests may be submitted through the methods described in Article 12.
  5. EEA users may lodge a complaint with the competent data-protection authority, including the authority in their habitual residence, place of work, or place of the alleged infringement. UK users may lodge a complaint with the Information Commissioner’s Office (‘ICO’) at ico.org.uk. Users may also contact us first through the privacy contact described in Article 15.
  6. Where personal data subject to EEA or UK transfer restrictions is transferred to a country not covered by an applicable adequacy decision or regulation, we establish an available lawful transfer mechanism before the transfer. Depending on the transfer, this may include the European Commission’s Standard Contractual Clauses for EEA data or the UK International Data Transfer Agreement (‘IDTA’) or UK Addendum for UK data, together with supplementary safeguards or transfer-risk assessments where required. Users may request information about applicable transfer safeguards through the privacy contact described in Article 15.
  7. If applicable law requires the appointment of an EEA or UK representative or a Data Protection Officer, the relevant contact details will be made available through this Policy or another easily accessible Service notice.

Article 17 (Changes and Effective Date)

  1. We may revise this Policy when laws, the Service, technology, processors, or processing practices change. Material changes are announced through the Service, email, or another appropriate method before they take effect, and we obtain renewed consent where legally required. Urgent security or legal changes may be announced immediately or afterward where appropriate.
  2. Prior versions will be maintained for access through the Service's policy archive. Effective date: September 1, 2026 (draft; to be confirmed after legal review).