REALMIRAGE — Privacy Policy

Darwin AI Technologies Ltd., operating as RealMirage Suite 1430, 150 — 9th Avenue SW, Calgary, Alberta T2P 3H9, Canada

Effective Date: June 15, 2026

Version: 1.125

1. Who We Are and Why This Policy Exists

Darwin AI Technologies Ltd., operating as RealMirage ("RealMirage," "we," "us," or "our"), is a corporation incorporated under the laws of the Province of Alberta, Canada. We operate the RealMirage platform at realmirage.ai, an AI-native adult content creator platform that allows studios to create, manage, and monetize AI characters and allows subscribers to discover, subscribe to, and interact with those characters.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have. It applies to all users of the Platform: subscribers, studio operators, and visitors.

We are committed to complying with Canada's federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), Alberta's Personal Information Protection Act ("AB PIPA"), and, where applicable, Quebec's Act to Modernize Legislative Provisions Respecting the Protection of Personal Information ("Law 25").

2. Information We Collect

2.1 Account Registration Data

When you create an account, we collect:

• Your email address and chosen username.
• Your date of birth (for age verification purposes).
• Your account type (subscriber or studio).
• Your password (stored in hashed form only — we never store plaintext passwords).
• Timestamp and IP address at account creation.
• Your acceptance of the Terms of Service, Privacy Policy, Content Policy, and Community Guidelines, with version, timestamp, and IP address logged.

2.2 Identity Verification Data (Studio Accounts)

Studio accounts are required to complete identity verification through Veriff, our third-party KYC provider. During verification, Veriff collects:

• Government-issued photo identification (e.g., passport, driver's licence).
• Liveness verification data (a real-time selfie or video).

The result of the identity check is transmitted to us as a pass/fail result and a verification reference ID. We do not store the raw government ID images on our servers; these are processed and retained by Veriff pursuant to their own privacy policy.

2.3 Payment and Transaction Data

We process payments through third-party payment processors: CCBill (and such other card processors as we may designate) for credit and debit card transactions; NOWPayments for cryptocurrency transactions (USDT and BTC); and Stripe Connect for studio fiat payout disbursement. We do not store your full credit card number, debit card number, or cryptocurrency wallet private keys on our servers. Our payment processors handle cardholder data in accordance with PCI DSS.

We do collect and store:

• Transaction records: date, amount, currency, transaction type (subscription, credit purchase, tip, demand content, voice message).
• Credit balance and transaction history within the Platform.
• Payout records for studio accounts (payout amount, method, date, status).
• NOWPayments IPN webhook confirmation data for cryptocurrency transactions.
• For studio accounts: revenue ledger entries, platform fee records, processor fee records, and payout history.

2.4 Conversation and Interaction Data

Your interactions with AI Characters on the Platform are processed and stored. This includes:

• Text messages sent to and received from AI Characters.
• Voice Messages: audio files of AI-synthesized voice responses delivered to you within conversations (generated by ElevenLabs text-to-speech technology — see Section 7).
• Timestamps, read receipts, and message metadata.
• Studio operator messages when a human studio operator takes over a conversation (disclosed to the subscriber at the time of takeover).

Conversation data is stored to provide continuity of conversation context, enable content moderation and safety review, support Demand Content generation, and comply with legal data retention obligations.

Conversation Memory Layer

In addition to raw message storage, the Platform maintains a conversation memory layer that extracts and retains salient facts you share with an AI Character in order to enable natural continuity across conversations. Examples include your stated first name, stated preferences, and topics you have discussed. This layer is operated by an open-source memory library (Mem0) running on Platform infrastructure, backed by a vector database (Qdrant). Embeddings used for retrieval are generated by an on-platform embedding model and are not transmitted to third-party AI providers.

ISOLATION GUARANTEE: Each character–subscriber pair has its own isolated memory space, enforced by a composite key at the database level. Facts you share with one AI Character are not accessible to other AI Characters, other subscribers, or studio operators other than the studio operating that specific character.

Subscribers have the following controls over the conversation memory layer, accessible from account settings:

• A plain-language summary of what an AI Character remembers about you on a per-character basis.
• The ability to request deletion of all memory for a specific character, which resets that relationship to day one.
• The ability to delete all conversation memory associated with your account across all characters.

Memory deletion is propagated to the underlying vector database within a commercially reasonable timeframe, subject to our legal retention obligations set out in Section 5.

2.5 Content You Upload (Studio Accounts)

Studio operators upload content to the Platform, including images, character configuration data, LoRA model parameters, Voice Design prompts, and character profile information. All uploaded content is stored on our servers and subject to our content moderation pipeline.

Voice Design prompts (text descriptions used to configure AI character voices) are logged and retained for as long as the associated character exists on the Platform, plus a 30-day period following character deletion for compliance review. Voice Design prompts are not shared with any third party.

2.6 Usage and Technical Data

• IP address and approximate geographic location (country/region level).
• Device type, operating system, browser type and version.
• Pages visited, features used, time spent on Platform.
• Referral source (how you arrived at the Platform).
• Session identifiers and authentication tokens.
• Error logs and crash reports.

2.7 Communications with Support

If you contact us through [email protected] or through the Platform's support channels, we retain the content of your communications and any attachments for customer service and dispute resolution purposes.

3. How We Use Your Information

4. How We Share Your Information

4.1 We Do Not Sell Your Personal Information

RealMirage does not sell, rent, or trade your personal information to third parties for their marketing purposes.

4.2 Service Providers

We share personal information with service providers who help us operate the Platform, under contractual obligations of confidentiality and data protection:

Primary Platform data is stored on infrastructure operated by Darwin AI Technologies Ltd. in Canada (see Section 6.1).

4.3 Law Enforcement and Mandatory Reporting

We will disclose personal information to law enforcement, regulatory authorities, and mandatory reporting bodies where required or permitted by law. Mandatory disclosures include:

• Reports to the Canadian Centre for Child Protection (C3P) and the National Center for Missing & Exploited Children (NCMEC) where content is identified that may constitute child sexual abuse material (CSAM), pursuant to Bill C-22 and applicable US law.
• Compliance with valid court orders, production orders, search warrants, and subpoenas issued under Canadian federal or provincial law.
• Disclosure to FINTRAC where required under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.

We will notify affected users of any law enforcement disclosure to the extent permitted by law.

4.4 Business Transfers

If Darwin AI Technologies Ltd. is involved in a merger, acquisition, or sale of all or substantially all assets, your personal information may be transferred as part of that transaction. We will notify users via email or a prominent Platform notice before any such transfer occurs.

4.5 Studio Operators — Subscriber Interaction Data

Studio operators have access to certain interaction data for their own AI Characters, including: subscriber message counts and activity metrics; demand content orders placed by subscribers; subscription tier and revenue data. Studios do not have access to subscriber email addresses, payment information, personal identification details, or the contents of conversation memory. Studios operate under contractual obligations set out in the Studio Creator Agreement that restrict how they may use subscriber data.

5. How Long We Keep Your Information

We retain personal information for as long as your account is active and for a period thereafter as required to:

• Comply with applicable legal obligations (including tax records, which are retained for a minimum of 7 years under the Income Tax Act of Canada).
• Resolve disputes and enforce our agreements.
• Fulfill mandatory CSAM reporting and cooperation obligations.
• Maintain financial ledger integrity for completed transactions.

Upon account deletion, we will delete or anonymize your personal information within 90 days, except for:

• Financial transaction records (retained 7 years for tax purposes).
• CSAM-related records (retained indefinitely or as directed by law enforcement).
• Records relating to ongoing disputes or legal proceedings.

Purchased Content — Special Retention Rule

If a subscriber has purchased content from a studio, and that studio subsequently deletes content or leaves the Platform, the purchased content remains accessible to that subscriber in their Purchased Media Library. The underlying media files are never deleted from storage for as long as a valid purchase record exists. This is a fundamental subscriber protection: if you paid for it, you retain access to it.

However, deleted or deactivated studio content is not actively promoted, featured in discovery, recommended, or made available to new subscribers. It exists solely for the benefit of existing purchasers.

Conversation Memory Retention

Conversation memory (described in Section 2.4) is retained for the life of the subscriber account unless the subscriber requests earlier deletion, or unless the associated character is deleted by the operating Studio. Upon character deletion, conversation memory associated with that character is scheduled for deletion from the vector database within 30 days. Upon subscriber account deletion, all conversation memory associated with the account is scheduled for deletion within the 90-day period described above.

6. Where We Store Your Data and How We Protect It

6.1 Data Location

Primary data storage and AI inference infrastructure is located in Canada, on hardware operated by Darwin AI Technologies Ltd. Content delivery may involve transmission through international content delivery networks to optimize performance.

6.2 Security Measures

We employ industry-standard security measures including:

• JSON Web Token (JWT) based authentication with cryptographic signing and automatic session expiry.
• All secrets and API credentials stored in HashiCorp Vault (encrypted at rest).
• Database encryption at rest on all PostgreSQL instances.
• TLS encryption in transit for all data transmissions.
• Network segmentation between public-facing services and internal infrastructure.
• Content moderation pipeline that scans all uploaded content before storage.
• Multi-factor authentication available for studio accounts.

No method of electronic transmission or storage is completely secure. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security.

7. AI Processing and Third-Party AI Services

7.1 On-Platform AI Inference

The primary AI inference stack — including the large language model that generates AI Character conversational responses, the intent classification model, the image description model, and the embedding model used by the conversation memory layer — runs on hardware operated by Darwin AI Technologies Ltd. in Canada. Your conversation content is not transmitted to third-party AI providers for inference.

7.2 ElevenLabs Voice Synthesis

When you request or receive a Voice Message from an AI Character, the text of the AI's response is transmitted to ElevenLabs' servers to generate synthesized audio. By using the Platform's voice features, you acknowledge that:

• Voice Message text is processed by ElevenLabs in accordance with their Terms of Service and Privacy Policy (available at elevenlabs.io).
• ElevenLabs may process this data on servers located outside Canada.
• Voice synthesis data is used solely for the purpose of generating the voice response and is not retained by ElevenLabs beyond their stated data retention terms.

7.3 Content Moderation AI

Uploaded content is processed by automated AI moderation systems, including Shield by Project Arachnid (CSAM hash matching) and, pending approval, Google Content Safety API and CSAI Match (AI-based content classification). These systems process perceptual hashes and content analysis data. No subscriber-identifying information is shared with these providers as part of content moderation.

8. Your Privacy Rights

Under PIPEDA and AB PIPA, you have the following rights regarding your personal information:

To exercise any of these rights, contact us at: [email protected]

We will respond to all privacy requests within 30 days. Where a request is complex or numerous, we may extend this period by an additional 30 days with notice.

9. Electronic Communications — CASL Compliance

RealMirage complies with Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23.

• Transactional messages (purchase receipts, account security alerts, mandatory legal notices) are sent pursuant to implied consent as part of your contractual relationship with us.
• Commercial electronic messages (promotions, new features, studio recruitment communications) are sent only with your express consent, collected at account registration or through a separate opt-in mechanism.
• You may withdraw consent to commercial messages at any time via the unsubscribe link in any commercial message or through your account notification settings.
• All electronic messages from RealMirage identify the sender as Darwin AI Technologies Ltd., operating as RealMirage, and include a valid mailing address and a functioning unsubscribe mechanism.

10. Cookies and Tracking Technologies

The Platform uses essential cookies and session tokens to:

• Maintain your authenticated session.
• Remember your preferences (e.g., content display settings).
• Provide security features (CSRF protection).

We do not use third-party advertising cookies or behavioural tracking technologies for advertising purposes. We do not share browsing data with advertising networks.

You may disable cookies in your browser settings, but this will prevent you from logging in and using the Platform.

11. Age Restriction

The Platform is intended exclusively for individuals who are 18 years of age or older, or the age of majority in their jurisdiction. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a minor, we will immediately delete that account and all associated data, and where required, report the matter to the appropriate authorities.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or by a prominent notice on the Platform at least 30 days before they take effect. Your continued use of the Platform after the effective date of any update constitutes acceptance of the updated policy.

13. Contact Us

For privacy questions, requests, or concerns:

Darwin AI Technologies Ltd., operating as RealMirage Suite 1430, 150 — 9th Avenue SW Calgary, Alberta T2P 3H9, Canada

• Email: [email protected]
• General support: [email protected]

If you are not satisfied with our response to a privacy concern, you may contact:

• Office of the Privacy Commissioner of Canada: priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta: oipc.ab.ca

RealMirage Privacy Policy — Version 1.1 — Darwin AI Technologies Ltd.