IRIS Privacy Policy

Last Updated: 2026-09-17

Welcome to IRIS. Protecting your privacy is central to how we operate, especially because the Services let you have private, message-based conversations with an AI companion you create yourself. You may also interact with AI companions you have not created, such as companions created by your friends or by other users. This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, and what rights you have.

IRIS is operated by Iris is You AB, a company organized under the laws of Sweden (reg. no. 559397-5112), with its registered address at Kungsgatan 20, 411 19 Gothenburg, Sweden. For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Iris is You AB is the data controller responsible for the processing of your personal data described in this Policy.

This Privacy Policy applies to all users of the IRIS website and mobile application (the “Services”). It complements our Terms of Use. We may update this Privacy Policy from time to time; if we make material changes, we will notify you through the App or by email before they take effect.

Personal Data We Collect

• Account information. Your name, email address, date of birth or age confirmation, and other contact details provided when you register.
• Companion Content and conversations. The AI Companion you create (its name, personality, and other characteristics) and the messages you exchange with it.
• Payment information. If you purchase a paid Subscription, billing details such as your name and payment method. Payments are processed by Stripe, our payment processor, or, where you purchase through a mobile app store, by Apple (App Store) or Google (Google Play). We do not ourselves store full card numbers.
• Technical data. Device identifiers, IP address, operating system, browser type, and similar network and diagnostic information.
• Usage and interaction data. How you use the Services, including engagement patterns and feature usage.
• Non-personal data. We may also collect aggregated or anonymized data that cannot reasonably be used to identify you, such as device type, app version, and general analytics. If we ever combine such data with personal data (for example, via an account login), we treat the combined data as personal data.

Legal Bases for Processing

Under the GDPR, we rely on the following legal bases, depending on the purpose:

• Performance of a contract (Article 6(1)(b)): to create your account, operate the AI Companion feature, and process payments for Subscriptions.
• Legitimate interests (Article 6(1)(f)): to secure the Services, prevent abuse, and improve and develop our AI models and features, balanced against your interests and fundamental rights.
• Consent (Article 6(1)(a)): for optional features such as marketing communications, where required.
• Legal obligation (Article 6(1)(c)): to comply with tax, accounting, and other applicable law.

How We Use Your Data

• Operating the AI Companion feature. To generate your AI Companion's responses, maintain your conversation history, and personalize its behavior to you.
• Improving and training our AI models. We process conversation data, including through internal AI models, to detect abuse or safety risks, improve the overall user experience, and train, develop, and improve our AI models. Further detail is set out in “Private Conversations” below.
• Service operation and security. To provide, maintain, secure, and troubleshoot the Services, and to detect and prevent fraud, abuse, and security incidents.
• Payments. To process Subscription purchases, renewals, and refunds.
• Communications. To send you service-related notifications (for example, about your account or changes to our Services) and, where you have consented, marketing communications.
• Legal compliance. To comply with applicable law, respond to lawful requests from authorities, and enforce our Terms of Use.

Private Conversations

Confidentiality

Conversations between you and your AI Companion are private. They are not made visible to other users of the Services, and we do not share your conversation content with any external third party for that third party's own independent purposes.

Internal processing

Your conversations are processed by our own technical systems and by our subprocessors (see “Who We Share Your Data With” below), including to generate responses and to train, develop, and improve our AI models. This does not mean that a member of our staff routinely reads individual conversations manually.

Aggregated and de-identified data

We may use de-identified or aggregated data derived from conversations, which does not identify you, for research, product development, and other purposes.

Who We Share Your Data With

We do not sell your personal data. We share it only in the following circumstances:

Hosting and AI infrastructure

The Services are hosted using cloud infrastructure provided by Amazon Web Services (AWS) and Google Cloud. To generate your AI Companion's responses, we use large language models (“LLMs”) provided by DeepSeek, Google (Gemini), OpenAI, z.ai, Anthropic, and xAI. These providers process personal data on our behalf as our data processors, under data processing agreements that require GDPR-compliant safeguards.

Payment processing

We use Stripe to process payments. For most purposes, Stripe acts as our data processor. For certain purposes required by law, such as fraud prevention, anti-money-laundering checks, and other regulatory compliance, Stripe acts as an independent data controller of your payment data. Stripe's own use of your data for those purposes is described in Stripe's privacy policy, available at stripe.com/privacy. Where you purchase a Subscription through the App Store or Google Play, the transaction is processed by Apple or Google as independent data controllers of the payment data, in accordance with their own privacy policies. We receive only confirmation of the purchase and limited transaction details, not your full payment card information.

Other service providers

We may share data with analytics, customer support, or similar providers who process it on our behalf and are contractually bound to GDPR-compliant practices.

Legal and safety reasons

We may disclose data where required by law, in response to a valid legal request, or where necessary to protect the rights, property, or safety of IRIS, our users, or the public.

Business transfers

If IRIS is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality protections.

International Data Transfers

Some of our subprocessors, including AWS, Google Cloud, and Stripe, may process personal data outside the EU/EEA. Where this occurs, we rely on the European Commission's Standard Contractual Clauses, an applicable adequacy decision, or another legally recognized transfer mechanism, together with additional safeguards where necessary, to ensure your data receives a level of protection equivalent to that guaranteed within the EU/EEA.

Data Retention

We retain personal data for as long as your account is active and as needed to provide the Services. Accounts that have been inactive for more than 12 months will be marked “inactive,” and we will notify you before any further deletion. We may retain certain data for longer where required by law (for example, accounting records) or to resolve disputes and enforce our agreements.

You may request deletion of your data, including your AI Companion and conversation history, at any time, see “Your Rights” below.

Your Rights

Subject to the conditions and exceptions set out in the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete personal data;
• Erase your personal data, including your AI Companion and conversation history;
• Restrict or object to certain processing, including processing based on our legitimate interests;
• Data portability, i.e. to receive your data in a structured, commonly used, machine-readable format;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Lodge a complaint with a supervisory authority, in Sweden the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or the supervisory authority of your EU/EEA country of residence.

To exercise any of these rights, contact us at support@iris.la. We will respond within the timeframes required by the GDPR.

Automated Processing

Your AI Companion's responses are generated automatically using AI models. This does not involve automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. If this changes, we will update this Policy and provide the additional information required by law.

Age Requirement

The Services are intended solely for individuals who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will delete that data.

Security Measures

• Encryption. Data is encrypted in transit and at rest.
• Access controls. Access to personal data is restricted to personnel and subprocessors who need it to provide the Services.
• Monitoring. We monitor our systems to detect and respond to security incidents.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy to reflect legal, technical, or business developments. If we make material changes, we will notify you through the Services or by email before they take effect. The “Last Updated” date at the top of this Policy indicates when it was last revised.

Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at:

Iris is You AB
Reg. no.: 559397-5112
Email: support@iris.la
Address: Kungsgatan 20, 411 19 Gothenburg, Sweden