Back to home

Privacy Policy

Last updated: July 21, 2026

1. Introduction and Data Controller

This Privacy Policy explains how ALLSTREAM LTD ("Hoty", "we", "us", "our"), a company registered in England and Wales under company number 15304620, with its registered office at 10 Stoneway, Unit M, Lakesview International Business Park, Canterbury, England, CT3 4GP, collects, uses, and protects information when you use hoty-ai.com and related services (the "Service"). We are the data controller for the personal data described in this Policy under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who This Policy Applies To

This Policy applies to all registered users of the Service. The Service is intended for adults only (18+); see Section 12.

3. Information We Collect

We collect the following categories of information:

  • Account data: your email address and a securely hashed password (we use the argon2id hashing algorithm and never store your password in plain text).
  • Uploaded images: photographs you upload for AI generation. Each upload is checked by our automated moderation system and processed through our generation pipeline; the original photograph is deleted from our servers immediately after generation completes and is not used to train AI models. The generated result is stored in our S3-compatible cloud storage for 30 days (see Section 8).
  • Chat messages: the text you exchange with AI Characters, which is processed by a third-party large language model (LLM) provider to generate responses.
  • Payment metadata: information about your transactions (such as amount, currency, and status) that we receive from our third-party payment providers. We do not collect or store your full card number or other sensitive payment credentials — these are handled directly by the payment provider.
  • Cookies: functional cookies used to keep you signed in and to protect your account (hoty_access, hoty_refresh, hoty_csrf — see Section 7).
  • Analytics data: information about how you interact with the Service, collected through our self-hosted analytics tool (see Section 7).

4. How We Use Your Information

We use the information described above to:

  • Create and manage your account, and authenticate you when you sign in;
  • Provide the Service — process uploaded images to generate content, and process chat messages to produce responses;
  • Process payments and maintain your Coin balance;
  • Run automated moderation to enforce the content rules described in our Terms of Service;
  • Maintain the security and integrity of the Service, including detecting fraud and abuse;
  • Understand, in aggregate, how the Service is used, so we can improve it;
  • Communicate with you about your account or respond to support requests;
  • Comply with applicable legal obligations.

5. Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases: performance of a contract (to provide the Service you signed up for, including processing images and chat messages you submit); legitimate interests (to secure the Service, prevent abuse, and improve it, balanced against your rights); and consent, where required (for example, for certain analytics features). You may withdraw consent at any time by contacting us, without affecting the lawfulness of processing carried out before withdrawal.

6. Third-Party Processors

We share data with the following categories of third-party processors, strictly to the extent necessary to provide the Service: our LLM provider, which processes chat messages to generate AI Character responses; our payment providers, which process payment transactions and share transaction metadata with us; and our cloud storage provider, which briefly processes uploaded images during generation and hosts the generated results (see Section 8 for retention periods). Each processor is contractually bound to use your data only to provide services to us and in accordance with this Policy.

7. Cookies and Analytics

We use a small number of strictly functional cookies (hoty_access, hoty_refresh, hoty_csrf) to keep you signed in and to protect the Service against cross-site request forgery. These cookies are necessary for the Service to function and cannot be disabled through a cookie banner. We also use Umami, a self-hosted, privacy-focused analytics tool that we operate ourselves (your data is not shared with an external analytics vendor). Our analytics setup includes session replay: a recording of how you interact with the interface (such as clicks, scrolling, and page navigation) that helps us understand and fix usability issues. We do not intentionally record content typed into password fields or other sensitive form fields.

8. Data Retention

We retain account data for as long as your account remains active. The original photograph you upload is deleted from our servers immediately after generation completes; it is not retained afterward and is not used to train AI models. The generated result (the output image or video) is retained in your account history for 30 days from the date it was created, after which it is deleted from our storage. Chat message history is retained to provide conversational continuity within the Service. If you request deletion of your account under Section 12, we will delete or anonymize your personal data, except where we are required to retain certain records (for example, transaction records) to comply with legal or accounting obligations.

9. Data Security

We apply technical and organizational measures designed to protect your data, including encrypted connections (HTTPS) between your browser and our servers, hashed password storage, and httpOnly authentication cookies that are not accessible to client-side scripts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Data Transfers

Some of our processors (including our LLM and payment providers) may process data outside the United Kingdom. Where this occurs, we take steps to ensure an adequate level of protection is applied to your data, such as relying on adequacy decisions or standard contractual clauses recognized under UK data protection law.

11. Automated Decision-Making

Every photograph you upload is evaluated by an automated moderation system before it is used to generate content. This system makes an automated decision to accept or reject an upload based on whether it can confirm compliance with the content rules described in our Terms of Service; by design, it rejects an upload whenever compliance cannot be confirmed. If you believe an upload was rejected in error, you can contact us at [email protected] to request a review.

12. Your Rights

Under the UK GDPR, you have the right to: request access to the personal data we hold about you; request correction of inaccurate data; request deletion of your data; object to or restrict certain processing; and request a copy of your data in a portable format. To exercise any of these rights, contact us at [email protected]. We will respond within the timeframes required by applicable law. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not handled your data properly.

13. Children's Privacy

The Service is not intended for, and we do not knowingly collect personal data from, anyone under the age of 18. If we become aware that we have collected personal data from a minor, we will take steps to delete it and terminate the associated account.

14. Language

This Policy is governed by the laws of England and Wales. Where this Policy is provided in a language other than English, the English version prevails in the event of any conflict or inconsistency.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

16. Contact Us

For questions about this Policy or to exercise your data protection rights, contact us at [email protected] or by mail at ALLSTREAM LTD, 10 Stoneway, Unit M, Lakesview International Business Park, Canterbury, England, CT3 4GP.