Another Meaning
Privacy Policy
Version: 1.1 Effective date: 17 September 2026
1. CONTROLLER
1.1. The personal data controller is Crisdesign Ltd, UIC 200879454, address: Sofia, Obelya residential district, 14 Street, block 4, entrance V, apartment 32, Bulgaria (the "Controller"). Requests and questions concerning personal data may be submitted through the form on the Contact page.
2. SCOPE
2.1. This Policy applies to registration, recording and reflecting on Experiences, creating stories, using a trial or subscription, publishing, voting, reporting and communicating with the Controller.
3. CATEGORIES OF DATA
3.1. Account data: name or pseudonym, email, password hash, preferred language, age declaration and settings.
3.2. Experiences: dreams, real-life events, dilemmas, titles, dates, labels and text entered by the User.
3.3. Additional context: emotions, relationships, concerns, life circumstances and other voluntary answers. These may contain special categories of data or data about third parties.
3.4. AI and creative data: prompts, reflections, guiding conjectures, Story Projects, episodes, directions, edits and technical provenance information.
3.5. Public and community data: published text, display name, date, votes, competition eligibility, reports, moderation decisions and appeals.
3.6. Subscription data: plan, trial, quotas, billing status, identifiers from the payment processor, card type and last digits where provided by that processor.
3.7. Technical and security data: IP address, browser or device, timestamps, session or cookie identifiers, logs, rate-limit signals and fraud or security signals.
3.8. Contact correspondence: name, email address, subject, message, account association, delivery status and limited technical data used to prevent abuse.
4. PURPOSES AND LEGAL BASES
| Purpose | Data | Legal basis |
|---|---|---|
| Account and core service | account, experience, generated content | performance of a contract |
| Personalised AI reflection | optional context, experience | explicit consent where required; contract for the remainder |
| Subscription and payment | billing, account | contract and legal obligation |
| Security and abuse prevention | technical, security | legitimate interest and/or legal obligation |
| Public hosting | selected public content | contract/express action; consent for specific data where necessary |
| Competition and prize | publication, votes, entitlement | performance of the competition rules |
| Reports and moderation | report, content, decisions | legal obligation and legitimate interest |
| Contact correspondence and data-protection requests | contact-form data and related records | legitimate interest in responding and managing correspondence; legal obligation where applicable |
| Legal claims | relevant records | legitimate interest and legal obligation |
4.1. Where processing includes special categories of data, the Controller applies explicit consent or another applicable legal basis and provides the necessary information before processing.
5. SENSITIVE DATA AND THIRD-PARTY DATA
5.1. The User is not required to provide health, religious, political, sexual or other sensitive data.
5.2. Before voluntary personal context is sent to an AI provider, the Platform displays clear information and records separate consent where required by law.
5.3. The User should avoid unnecessary names and third-party data. Original text is published only after the exact canonical content is made available for review and the declaration is accepted. A translated view identifies the source language and provides access to the original. This does not release the Controller from applicable obligations.
6. AI PROCESSING
6.1. The Platform may use an external AI service provider for generation. Data is received only by the provider enabled for the relevant function. Current information about provider categories and processing locations may be requested through the Contact page.
6.2. Only the minimum necessary text is sent to the provider. Personal context is sent only to a provider approved for such processing and with applicable consent.
6.3. Data is not used to train or fine-tune models by the Controller or provider unless there is separate, voluntary and demonstrable consent and appropriate contractual safeguards.
6.4. AI output and metadata are stored in the account in accordance with section 9.
7. RECIPIENTS AND PROCESSORS
Data may be disclosed, to the extent necessary, to:
- hosting, database, storage, email and monitoring providers;
- AI providers;
- the payment processor;
- professional advisers subject to confidentiality;
- competent authorities where there is a valid legal basis;
- content moderation or security providers where such an external service is enabled.
Only providers required for functions that are actually enabled are used. Information about the role and processing location of a specific provider is supplied on request through the Contact page.
8. INTERNATIONAL TRANSFERS
8.1. For a transfer outside the EEA, the Controller uses an applicable mechanism, such as an adequacy decision, standard contractual clauses and supplementary measures where necessary.
8.2. The applicable mechanism and supplementary measures are determined for each provider actually used before data is transferred outside the EEA.
9. RETENTION PERIODS
| Category | Retention period |
|---|---|
| Account and private content | until account deletion; access ends immediately and records due for deletion are erased within 90 days |
| Public content | until unpublishing or removal, except where an applicable legal basis requires retention |
| Deleted records and backups | up to 90 days after the applicable deletion event |
| Billing and accounting records | statutory period |
| Security logs | up to 180 days |
| AI operational logs | up to 180 days; full input and output text is not logged by default |
| Contact correspondence | up to 5 years after receipt; it may be erased earlier following a valid erasure request |
| Reports, moderation and appeals | until the case is completed and afterwards only while required by law or to establish, exercise or defend legal claims |
| Competition and reward records | while needed to determine, automatically activate and evidence the entitlement, and for any applicable legal or accounting obligation |
| Consent records | while needed as evidence plus the limitation period |
9.1. Longer restricted retention is permitted only for a documented legal obligation, active dispute, fraud or security investigation, or an active retention hold. Anonymous information that can no longer identify a person may be retained for aggregate analysis.
10. PUBLIC CONTENT
10.1. Published Experiences and stories are accessible to internet users and may be copied or indexed outside the Controller's control.
10.2. Unpublishing stops future display by the Platform but does not guarantee deletion of copies lawfully or unlawfully made by third parties.
11. COOKIES AND LOCAL STORAGE
11.1. Strictly necessary cookies are used for sessions, authentication, security, locale and CSRF protection.
11.2. Optional analytics or marketing cookies are not used without prior valid consent and applicable information about them.
12. AUTOMATED DECISIONS
12.1. AI generates content but does not make decisions that produce legal or similarly significant effects for the User.
12.2. Automated fraud or content flags may trigger a temporary restriction or human review. Contested material moderation decisions are subject to human review where applicable.
13. DATA SUBJECT RIGHTS
The User may request access, rectification, erasure, restriction, portability and may object or withdraw consent, and may lodge a complaint with the Bulgarian Commission for Personal Data Protection.
Requests are submitted through the form on the Contact page. Identity may be verified proportionately.
14. ERASURE AND WITHDRAWAL OF CONSENT
14.1. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
14.2. Where context is required for future personalised generation, withdrawal stops such future use.
14.3. Account deletion does not erase data that must temporarily be retained by law, for security, disputes or the protection of rights.
15. SECURITY
The Controller applies appropriate technical and organisational measures, including access control, hashing, encryption in transit, backups, logging, rate limits, vendor review and incident response. No system can guarantee absolute security.
16. CHILDREN
The Platform is not intended for persons under 16. If an account belonging to a person below that age is identified, access is ended and the data is handled in accordance with applicable law.
17. CHANGES AND CONTACT
Material changes are communicated appropriately and, where necessary, fresh consent is requested. Questions, requests and complaints may be submitted through the form on the Contact page.