Privacy policy.
Last updated: 28 September 2026
Itclickt is run by [Company name], a company registered in [Country of registration] under company number [Company number], with its registered office at [Registered address]. In this policy "we" and "us" mean [Company name], and "you" means anyone who uses the Itclickt web app at app.itclickt.com or visits this website. We're the controller of your personal data, which means we decide what's collected and what it's used for.
The short version. Everyone you talk to on Itclickt is an AI, and what you type to them is sent to an AI provider (Anthropic) so a reply can be written. Chats can get personal, so we ask for your explicit consent to that before you start. We use your data to run your account, keep the service safe and make it better. We don't sell it, and there are no ads or ad trackers. Your data is stored in the EU. You can delete your account in account settings whenever you like, and you can write to hello@itclickt.com about anything in this policy.
1. How to contact us
Email hello@itclickt.com. That inbox is read by the people who run Itclickt, and it's the right place for privacy questions, requests to use your rights and complaints. You can also write to us at [Registered address].
We haven't appointed a data protection officer. Privacy questions come straight to the team, at the address above.
If we need one, our representative in the UK is [UK representative, if needed] and our representative in the EU is [EU representative, if needed].
2. What we collect, why, and our lawful basis
Data protection law says we need a lawful basis for each thing we do with your data. The table sets out what we hold, what we use it for and which basis we rely on. "Contract" means we need it to give you the service you signed up for. "Legitimate interests" means we have a good reason of our own that doesn't override your rights; section 3 explains each one.
| What | Why we use it | Lawful basis |
|---|---|---|
| Email address and password | To create your account and let you sign in. Your password is stored hashed by Supabase Auth, so nobody at Itclickt can see it. | Contract |
| First name, and optionally your gender and profile photos with captions | To build your profile. Companions call you by your first name. | Contract |
| Who you want to meet (women, men or everyone) | To choose which profiles you see and how companions respond. | Contract, and explicit consent (see section 4) |
| Likes, passes, Instant Matches and matches | To run Discover and show you who you've clicked with. | Contract |
| Chat messages and when they were sent | To deliver your chats, write companion replies and set the pace of their messages. | Contract, and explicit consent (see section 4) |
| Memories | Short notes our system draws out of your chats so companions remember what you told them. | Contract, and explicit consent (see section 4) |
| Studio companions you create, including their text and generated photos | To save and show your own companions. They're private to you. | Contract |
| Your plan and credit balances | To apply the limits of your plan (messages, chats, creations, Instant Matches). | Contract |
| Moderation flags, warnings and strike records | To enforce our rules and protect people. See section 5. | Legitimate interests; legal obligation or recognised legitimate interest for crime and safeguarding |
| Reports you make about a profile | To look into the profile you reported. | Legitimate interests |
| The version of our AI disclaimer you agreed to and when | To show that you were told everyone on Itclickt is AI. | Legitimate interests |
| Your explicit-consent record for chat content | To show when and how you gave consent, and to record it if you withdraw it. | Legal obligation (we have to be able to show consent) |
| Technical logs: IP address, device and browser details, timestamps | Kept by our hosting and database providers to run the service, fix faults and spot misuse. | Legitimate interests |
| Payment and transaction records (once paid plans launch) | To take payment and keep tax records. | Contract; legal obligation for tax records |
| Marketing emails | We don't send any at the moment. If we start, we'll ask first. | Consent |
We don't ask for your date of birth. You confirm you're 18 or over when you sign up.
3. Our legitimate interests
Where we rely on legitimate interests, these are the interests we mean:
- Moderation: keeping Itclickt within our rules and the law, and stopping people using it to create harmful content.
- Security: protecting accounts and our systems from attack and unauthorised access.
- Fraud prevention: stopping abuse of free allowances and, once payments exist, payment fraud.
- Service improvement: finding bugs, understanding what breaks and making companions work better. We do this with logs and account data we already hold, and staff don't read chats to do it.
- Handling reports: following up on profiles you flag.
- Record keeping: being able to show you saw and agreed to the AI disclaimer.
You can object to any use based on legitimate interests (section 11). We'll stop unless we have a strong reason to carry on, such as the safety of other people or a legal claim.
4. Chat content and your explicit consent
People say all sorts of things in chats. Some of it may be what the law calls special category data: information about your sex life, sexual orientation, health, or religious or philosophical beliefs. Who you choose to meet, read alongside your gender, can also say something about your sexual orientation. This kind of data needs extra protection, so we don't rely on contract alone.
The sign-up form asks for your explicit consent, under Article 9(2)(a) of the UK GDPR, for us to process anything of this kind that appears in your chats, your memories or your preferences, including sending chat text to our AI provider and running automated moderation checks on it. We record the date and time you gave it.
You can withdraw that consent at any time by emailing hello@itclickt.com. Withdrawing doesn't make anything we did before unlawful. But we can't run chats without processing what you write, so in practice withdrawing consent means closing your account, and we'll delete your data as set out in section 8.
5. Moderation and automated decisions
Every message you send is checked by an AI model (one of Anthropic's Claude models) against our rules. It looks for content that breaks them, and it treats anything that sexualises minors as the most serious breach of all.
What happens next is decided automatically, without a person looking first:
- The first time a message is flagged, you see a warning in the app.
- If another message is flagged after you've seen that warning, your account is disabled automatically.
- If a message contains content sexualising minors, your account is disabled straight away, with no warning first.
Disabling an account has a real effect on you: you lose access to your chats and companions. We treat it as a significant decision based solely on automated processing, under Articles 22A to 22D of the UK GDPR (added by the Data (Use and Access) Act 2025). These are the safeguards we have in place:
- We tell you. The warning, and the message you see when your account is disabled, say that an automated system made the decision.
- You can tell us your side. Email hello@itclickt.com with anything you'd like us to consider.
- You can ask for a person to review it. An admin will look at the flagged messages and the decision. They can restore your access, clear the warning or strike from your record, or confirm the decision, and we'll tell you which.
- You can contest the decision with us, and you can complain to the ICO (section 12).
The model gets things wrong sometimes, in both directions. That's why the review exists, and why we'd rather you asked for one than assumed the decision is final.
Where the content involves child sexual abuse material, we may report it to the police or another authority, and we may keep the records for longer (section 8). We rely on a legal obligation where one applies, and otherwise on the recognised legitimate interests in preventing and detecting crime and safeguarding children, with the conditions in Schedule 1 to the Data Protection Act 2018 for preventing unlawful acts and safeguarding.
6. Who we share your data with
We use a few providers to run Itclickt. Most of them act as our processors, which means they handle data on our instructions and not for their own purposes. We don't sell your data to anyone.
| Who | What they do | What they receive |
|---|---|---|
| Supabase | Sign-in, our database and file storage (EU, Ireland region) | Everything in your account, including chats, memories and photos |
| Railway | Hosts the app (EU West, Amsterdam) | Data passing through the app, and technical logs |
| Anthropic | Its Claude models write companion replies, draw out memories and run moderation checks | Chat text and the context needed for a reply, such as your first name and relevant memories |
| Its Gemini image model makes companion and studio photos from text prompts | The text prompts only. It's our practice not to send your own photos to image models. | |
| Apple | In-app purchases, once the iPhone app launches | What Apple needs to take payment. Apple handles this under its own privacy policy. |
| A payment provider | Card payments, once paid plans launch. We haven't chosen one yet, and we'll update this policy when we do. | Payment details |
| Professional advisers | Our lawyers, accountants and insurers, when we need advice | Only what the advice needs |
| Police and other authorities | Where the law requires it, or where we report child sexual abuse material | Only what the report or request needs |
If we sell or restructure the business, your data may pass to the new owner, who would have to use it in line with this policy.
7. Sending data outside the UK
Your account data is stored in the EU. The UK treats the EU as giving adequate protection, so those transfers need no extra paperwork.
Some data goes further. Anthropic and Google are US companies, so chat text and image prompts are processed in the US. Supabase and Railway store our data in the EU but are headquartered in the US and use sub-processors of their own, some of which may be outside the UK and EU.
When personal data leaves the UK for a country without UK adequacy, we use one of two safeguards. If the recipient is certified under the UK Extension to the EU–US Data Privacy Framework, we rely on that. If not, we use the EU Standard Contractual Clauses with the ICO's International Data Transfer Addendum, or the ICO's International Data Transfer Agreement. For users in the EU, we rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses in the same way.
You can ask us for a copy of the safeguards that apply by emailing hello@itclickt.com. We may black out commercial terms, but not the parts that protect you.
8. How long we keep your data
| Data | How long |
|---|---|
| Account, profile, chats, memories and studio companions | While your account is open |
| The same data after you delete your account | Deleted within 30 days. Copies in our backups roll off within a further 30 days. |
| Moderation records for serious breaches, such as child safety | Up to 2 years, or longer if we need them for a legal claim or a report to the authorities |
| Other moderation records (warnings, strikes) | Deleted with your account |
| Technical logs at our hosting and database providers | About 30 days |
| Transaction records, once payments exist | 6 years, which is what UK tax law expects |
| Consent and disclaimer records | While your account is open, and for as long as we might need to show we had your consent |
9. Age limit
Itclickt is for adults. You must be 18 or over, and you confirm your age when you sign up. We don't check ID. If we find out an account belongs to someone under 18, we close it and delete the data, except what we have to keep for safeguarding or for a report to the authorities.
If you think a child is using Itclickt, please tell us at hello@itclickt.com.
10. Keeping your data secure
Data travelling between your device and our servers is encrypted in transit. Our database uses row-level security, so each account can only reach its own data. Access to our systems is limited to the few people who need it, and it's protected by access controls at each provider.
Our staff don't read your chats. The exceptions are when we're reviewing a moderation flag, looking into a report, or when you ask us to (for example, to help with a problem you've raised).
Two things to be clear about. The companions are AI, not people. And what you write in a chat is sent to an AI provider to produce the reply, so it doesn't stay only on our servers. We choose providers carefully, but no system is perfectly secure. If there's a breach that puts your rights at risk, we'll report it to the ICO, and if the risk to you is high we'll tell you directly.
11. Your rights
You have these rights over your personal data:
- Access: ask for a copy of the data we hold about you.
- Rectification: ask us to correct data that's wrong.
- Erasure: ask us to delete your data. The quickest way is to delete your account in account settings.
- Restriction: ask us to pause using your data while a complaint or correction is sorted out.
- Portability: ask for data you gave us in a format you can take elsewhere, where we use it under contract or consent.
- Objection: object to uses based on legitimate interests (section 3), and to direct marketing at any time.
- Withdrawing consent: withdraw any consent you've given, including the explicit consent for chat content (section 4).
- Automated decisions: be told about them, give your view, ask for a human review and contest the result (section 5).
To use any of these, email hello@itclickt.com from the address on your account, so we know it's you. If we can't be sure, we may ask for something else to confirm who you are.
We'll reply within one month. If a request is complicated, or you've sent several, we can extend that by up to two more months, and we'll tell you within the first month if we do. It's free. We may refuse, or charge a reasonable fee, only if a request is clearly unfounded or excessive, and we'll explain why.
Some rights have limits. For example, we can't delete records we have to keep for a report to the police.
12. Complaints
If you're unhappy with how we've handled your data, please complain to us first at hello@itclickt.com. We'll acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.
You can also complain to the Information Commissioner's Office, the UK regulator, at any time, whether or not you've come to us first. Its website is ico.org.uk and its helpline is 0303 123 1113.
If you live in the EU, you can complain to the data protection authority in your country.
13. This website
The Itclickt website you're reading is a static site. It has no analytics and no advertising pixels.
The sign-up form sends your details straight to Supabase Auth; the website doesn't keep a copy. The fonts are served from our own server, so your browser doesn't contact a font service. Companion photos on the site load from our Supabase storage.
For cookies and browser storage, see our cookie policy.
14. Changes to this policy
We'll update this policy when what we do with your data changes, for example when paid plans or the iPhone app launch. If a change is material, we'll email you before it takes effect. The date at the top shows when it last changed.