Privacy Policy

01. Who is responsible

LIVEWORLD PTE. LTD. (“Paramia,” “we,” “us” or “our”) is responsible for the personal information described in this Policy and acts as its controller where that concept applies. Our registered address is 152 BEACH ROAD, #11-05, GATEWAY EAST, SINGAPORE 189721. Contact us about privacy at contact@paramia.ai.

This Policy covers the Paramia application, www.paramia.ai, and related support. It explains how information is handled when you explore stories, interact with AI characters, use an account, buy Credits or contact us. It is a privacy notice, not a request for blanket consent. Separate permissions are required where applicable law requires them.

The Service is for people aged 18 or over, subject to any higher local age of legal adulthood. Third-party services you access independently, including Apple’s store and payment services, also have their own privacy notices.

02. Information we collect and its sources

We receive information from you, your device and use of the Service, and providers involved in authentication, payment and attribution.

Apple handles your payment method for Apple In-App Purchase. The Paramia purchase flow receives transaction and fulfillment information, not your full payment-card number or payment password.

Reporting a story submits the report directly, without asking you to select a reason or type an explanation; the app includes a preset report category and reason. For message reports or feedback, you choose from the available reasons. The app submits the corresponding reason information and the text of your selections without asking you to type a separate explanation. If you send additional information by email, that information becomes part of your support correspondence.

You decide what to put in messages. Avoid submitting government identifiers, payment credentials, precise private addresses, health records or other sensitive information about yourself or others. If your message contains personal information, sending it for an AI reply causes that information to be processed with the conversation. A guest session also uses identifiers and is not anonymous.

03. Purposes and legal bases

We use information to operate accounts and requested conversations; provide stories and history; verify purchases and maintain Credits; handle reports and support; secure and troubleshoot the Service; measure usage and attribution; and meet applicable legal obligations.

Where a legal basis is required, the basis depends on the purpose:

Providing an email address is necessary to use email-link sign-in. Messages and relevant context are needed to generate a requested reply. Transaction information is needed to verify a purchase. If you do not provide information needed for a feature, that feature may not work; this does not make optional tracking necessary for the core Service.

Right to object: where we rely on legitimate interests, you may object to processing on grounds relating to your situation. Where your information is used for direct marketing, you may object to that use at any time.

04. AI processing and conversation privacy

We use Amazon Web Services (AWS), through Amazon Bedrock, to generate AI replies. Your message, relevant conversation history, story and character context, and instructions needed to generate a response are sent through our backend to Amazon Bedrock for processing. Personal information you include in a message is also part of that processing. The resulting reply is returned to Paramia and may be stored with the conversation so you can return to it. Conversations are not confined to your device, and this Policy does not describe them as end-to-end encrypted.

Access to identifiable conversations must be limited to authorized people and providers who need it for the disclosed purposes, such as delivering the interaction, investigating a report or addressing a security issue. A conversation is not a confidential relationship with a doctor, lawyer or other regulated professional.

AWS states that inputs and outputs processed through Amazon Bedrock are not used by AWS or third-party model providers to train their base models. This describes the provider's use of inference data; it does not mean that Paramia conversation history is never stored. See the Amazon Bedrock privacy and security FAQs.

AWS may process inputs and outputs for safety and abuse detection. Depending on the model and applicable settings, this may include retention and, in limited cases, human review by AWS. Amazon Bedrock is therefore not described here as a service with universal zero retention or no human access. See AWS's data retention and abuse detection explanations. You can contact us with questions or requests concerning your conversation information; if you do not want a message processed for AI generation, do not submit it to the chat.

A request to generate a reply and permission to use a conversation for a separate training purpose are different matters. Where a new purpose requires notice or consent, that requirement must be satisfied before the new use begins.

05. Analytics and advertising attribution

The app uses Google Analytics for Firebase to process usage events and identifiers. Events can be associated with a Paramia account, a guest identity, a device or an app session. Using pseudonymous identifiers does not make this information automatically anonymous. Analytics is enabled by default in the app version covered by this Policy.

The app also uses AppsFlyer for installation and session attribution. The integration supplies a Paramia device identifier and can receive attribution results. On iOS, access to the advertising identifier is subject to App Tracking Transparency permission. AppsFlyer can still perform permitted processing using other information when access to that identifier is denied.

You can change tracking permission in iOS Settings → Privacy & Security → Tracking. Declining it does not disable all Firebase analytics, account processing or device identifiers. The app currently has no separate in-app switch that turns off all analytics. Contact us to exercise applicable objection or consent-withdrawal rights; a legal right to withdraw consent is not replaced by the Apple tracking setting.

We use the analytics and attribution information described above to understand how people discover and use Paramia, measure campaign effectiveness, and inform marketing decisions. Google / Firebase and AppsFlyer receive the relevant identifiers, device and connection information, and usage or installation events for their respective services. The advertising identifier is included only when permitted by the applicable device permission. These measurement purposes do not make advertising tracking necessary to generate an AI reply or maintain an account.

Some privacy laws define a “sale,” “sharing” or “targeted advertising” to include certain disclosures to advertising partners even when no money is exchanged. Where applicable law gives you the right to opt out of such processing, you may send a request to contact@paramia.ai with the subject “Advertising privacy request”. You may also use that channel to object to marketing-related processing or withdraw consent where applicable. We will handle these requests under Section 10; refusing optional tracking does not remove your access to core account and conversation features.

Where applicable law requires us to honor a recognized opt-out preference signal, such as Global Privacy Control (GPC), we must give that signal effect within the scope required by that law; an email request does not replace a legally required signal mechanism. Our public website does not run an advertising SDK or link a browser session to an app account. A browser signal does not itself change iOS tracking permissions or identify the app account to which a separate request should apply. Use the contact channel above for an account-related request, without limiting any right to use a legally recognized signal.

06. Recipients and service providers

Information is disclosed only for the purposes and on the bases described in this Policy, including to these recipient categories:

• Google / Firebase: authentication, app analytics and notification infrastructure. Depending on the service, Google receives account identifiers, an email address used for sign-in, device or installation identifiers, technical information and usage events. See Firebase privacy information and Google’s Privacy Policy.
• AppsFlyer: installation and session attribution using device, technical, campaign and permission-dependent advertising information. See the AppsFlyer Services Privacy Policy.
• Apple: App Store distribution, payment processing, transaction verification and system services. Payment and platform processing by Apple is also described in Apple’s Privacy Policy.
• AWS / Amazon Bedrock: your messages, relevant conversation and story context, instructions and generated replies, to provide AI inference and related service security as described in Section 4. See Amazon Bedrock data protection.
• Hosting and technical providers: request and technical information needed to operate infrastructure, deliver content and resolve faults. Google Cloud hosts our public website. Our app backend and API locations are described in Section 8; different services do not necessarily use the same infrastructure or processing locations.
• Authorized support, professional advisers and authorities: information reasonably needed to resolve a request, obtain professional advice, comply with a binding legal requirement, or protect lawful rights and safety.
• Parties to a corporate transaction: information necessary for a lawful merger, acquisition or transfer of the Service, subject to appropriate confidentiality and continued data-protection obligations. We will provide any notice required by law.

Providers acting on our behalf must be bound by obligations appropriate to their role, including purpose limits, confidentiality and protections consistent with this Policy and applicable law. A provider’s privacy notice supplements this explanation; linking to it does not transfer our responsibilities to that provider. Some recipients, such as Apple in administering its store, act independently for their own disclosed purposes.

07. Website and information stored on your device

The public Paramia website provides product information and legal pages. Its sample Chat and Roleplay preview uses temporary browser memory; it does not submit a conversation to an AI service. The website currently has no application-level advertising or analytics SDK, sign-in form or payment form, and the preview does not set application cookies or use persistent browser storage. Hosting infrastructure can still receive IP addresses and HTTP request information.

The iOS app stores authentication state, device identifiers, preferences, content and conversation caches, and purchase-recovery information needed for its operation. Certain credentials and device identifiers use system Keychain storage. Some Keychain identifiers may survive reinstallation. Signing out does not necessarily clear device identifiers or all locally stored records.

When you enable the available automatic text translation feature, the app passes displayed text to Apple’s Translation framework. System language resources may need to be downloaded. This does not remove the server-side processing of the original conversation described in Section 4.

08. International processing

Paramia's app backend and API services are hosted in the United States. Information sent to those services, such as account and device identifiers, conversation inputs and context, and transaction information needed to fulfill a request, is transferred to and processed in the United States. If you use Paramia from another country, this involves an international transfer, and the laws in the processing country may differ from those where you live.

Our company is established in Singapore. AWS / Amazon Bedrock, Google / Firebase, AppsFlyer and other providers process information for the purposes described in Sections 4–6 under their applicable service arrangements. The location of our app backend and APIs does not mean that every provider operation, support activity or backup is confined to the United States.

Where applicable law requires a safeguard for an international transfer, we must put an appropriate, legally valid mechanism in place before making that transfer. Depending on the transfer, this can require an applicable adequacy decision or contractual safeguards, such as the European Commission's Standard Contractual Clauses and the corresponding UK arrangements, together with any necessary supplementary measures. Contact contact@paramia.ai to ask about the processing locations and safeguards applicable to your information or request a copy of applicable safeguards, subject to limited redactions needed to protect confidential information or others' rights.

Our corporate location or a provider’s public certification alone does not establish the safeguard for a particular transfer. Acceptance of the Terms or this Policy is not blanket consent to unrestricted international transfers.

09. Retention and account deletion

9.1 Retention periods

We keep personal information only as long as needed for the stated purpose or required by law. Except for mandatory legal retention, the periods below are ordinary maximums, not minimum periods that prevent an earlier valid deletion request. We delete or irreversibly anonymize information when it is no longer needed for a stated purpose and no law requires retention. An identifier replaced by a code, or a report that still permits identification, remains personal information and is subject to these rules.

Intentional activity means a sign-in or a user-initiated interaction with Paramia; background refreshes, analytics events and automated system activity do not by themselves reset the inactivity period. We review the need for retained information at least annually and use shorter periods where the purpose can be met sooner.

9.2 Requesting deletion and completion

Registered users can request deletion in Profile → Settings → Account → Delete Account and complete the confirmation. You may also email contact@paramia.ai, including if you cannot access an account or need help with guest information. We may need information proportionate to verifying your request. Do not send a sign-in link, password or payment credentials.

For a valid deletion request, we stop ordinary use of the affected information and complete deletion from active systems under our control without undue delay and normally within 30 calendar days of receiving the request, or sooner where applicable law requires. This includes the account, profile, conversation history and linked personal-data copies or derivatives, except the limited records lawfully retained below. If proportionate verification or a lawful extension is necessary, we explain what is needed, the reason and the expected timing within the applicable initial response period. Verification is not a reason to restart the clock indefinitely.

We send applicable deletion instructions to processors, including Firebase Authentication, Google Analytics for Firebase, AppsFlyer and any relevant AWS service, within 7 days after the request is verified, and track outstanding actions. Deleting the Firebase authentication user is separate from signing out. We do not describe deletion as complete merely because the app accepts the request, local access ends or a provider accepts an instruction. Our response distinguishes active-system deletion, pending provider or backup deletion, and any lawful retention, with the applicable timing. Provider processing remains subject to applicable legal deadlines; an ordinary retention schedule does not override a valid earlier erasure right.

Signing out, uninstalling the app or clearing a local cache does not itself delete server-held data. Apple may retain purchase records for its own legal and operational purposes; our deletion request does not erase records Apple controls independently.

9.3 Backups

Deleted information in backups managed by Paramia is placed beyond ordinary use and removed through the backup rotation cycle within 90 days after deletion from our active systems. Provider-managed disaster-recovery copies that cannot be selectively overwritten follow the provider's contracted deletion cycle; our policy requires a maximum of 180 days from the provider's receipt of the deletion instruction, unless a specific legal preservation duty applies or law requires earlier action. This is a limit for residual recovery copies, not permission to continue normal use or delay responding to you.

Backup access is restricted to recovery and security needs. If a backup is restored, deletion instructions are reapplied before the affected information becomes available for ordinary use. Backups must not be used to recreate a deleted account, resume marketing or restore deleted chats to an active profile.

9.4 Limited exceptions

A specific legal obligation, unresolved payment or legal dispute, or documented security incident may require a limited subset of records to be kept longer. We restrict that information to the relevant purpose, limit access and review the need at least every 6 months. When the obligation or documented need ends, we delete it within 30 days, or sooner if law requires. We tell you the retained categories and reason unless legally prohibited. A possible future dispute, general product improvement or the cost of deletion is not by itself a reason to retain everything indefinitely.

10. Your rights and requests

Depending on your location and the law that applies, you may have rights to access and obtain a copy of your information; correct it; request deletion; receive portable data; restrict or object to processing; withdraw consent; and opt out of certain sale, sharing, targeted advertising or qualifying automated decisions. You may also have a right to appeal a refusal and to complain to a regulator. We will not unlawfully discriminate against you for exercising these rights.

Send a request to contact@paramia.ai with the subject “Privacy request,” a description of the request and enough information to identify the relevant account or interaction. We will seek only verification information reasonably necessary for the request. An authorized agent may act where permitted by law, subject to verification of authority. You do not have to create a new account solely to make a privacy request.

Withdrawing consent does not affect processing that was lawful before withdrawal. If we refuse a request in whole or in part, we will explain the applicable reason and available review or complaint route, unless law prevents us from doing so. We will respond within the period required by the law applicable to your request and notify you of any lawful extension.

Where the EEA or UK data-protection regime applies, you may complain to the authority in your place of residence, work or the alleged infringement. UK users may contact the Information Commissioner’s Office. Where applicable US state privacy law grants an appeal, reply to our decision with the subject “Privacy appeal”; this does not prevent a complaint to your state regulator. See Section 5 for advertising privacy requests and opt-out preference signals.

11. Information about children

Paramia is intended for adults meeting the age requirement in Section 1, and people below that age must not use the Service. If you believe a child has provided information, contact contact@paramia.ai with enough information to locate the account or content. Do not send the child’s identity documents unless a secure, necessary verification step has been explained to you.

If we learn that information was collected from an ineligible child, we will take appropriate steps to restrict access and delete the information, subject to any strictly necessary legal retention. An age statement in this Policy does not itself establish that an account’s age has been verified.

12. Security

The app uses encrypted connections to its configured production services and system-protected storage for certain credentials and identifiers. We must apply appropriate technical and organizational measures to protect the information we handle and address security incidents as required by law. No transmission or storage method is completely secure.

Protect access to your device and email account, and keep sign-in links private. Contact us promptly about suspected account compromise. Do not include unnecessary sensitive information in a support report.

13. Changes and contact

We will update this Policy when our practices materially change and identify the revised effective date. We will give additional notice, and obtain consent before new processing where required by law. A policy update does not retrospectively authorize a previously undisclosed use.

LIVEWORLD PTE. LTD.

Registered address: 152 BEACH ROAD, #11-05, GATEWAY EAST, SINGAPORE 189721

Privacy and support email: contact@paramia.ai

Website: www.paramia.ai