Privacy Notice

This Notice explains what personal data are processed in connection with WWZS, for what purposes, upon what legal basis, with whom they are shared, and for how long. It is given pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and Romanian Law no. 190/2018.

1.Identity of the controller

1.1The controller is Ars Amorata International SRL, a company incorporated under the laws of Romania, having its registered office at Calea Moșilor 88, Sector 3, Bucharest, Romania, registered with the Trade Register under number J2023024518405, sole registration code (CUI) 49314839 (the “Controller”, “we” or “us”).

1.2Enquiries concerning this Notice or the processing of personal data may be addressed to info@arsamorata.com.

2.Scope

2.1This Notice applies to personal data processed in connection with WWZS (“What Would Zan Say”), an artificial-intelligence mentor drawn from the work of Zan Perrion and offered at wwzs.zanperrion.com (the “Service”), and to correspondence concerning it. A person who holds an account with the Service is referred to as a “Member”.

2.2The website zanperrion.com, the private programmes offered there, and the website arsamorata.com are the subject of separate notices published on those sites.

3.The nature of the Service

3.1The Service is an artificial-intelligence system. Its answers are generated by a language model instructed to answer in the manner of Zan Perrion and supplied with passages from his published and recorded work. It is not Zan Perrion, and no person reads or writes a Member’s answers as they are given. Where the Service speaks aloud, the voice is synthetic.

3.2The Service keeps a short private notebook for each Member, written automatically from his conversations, so that it may remember his circumstances from one conversation to the next. The notebook is visible to the Member, who may correct or delete any part of it.

3.3No decision producing legal effects concerning a Member, or similarly significantly affecting him, is taken by automated means within the meaning of Article 22 GDPR. Decisions concerning an account, including suspension or closure, are taken by a person.

4.Categories of data, purposes and legal bases

4.1Account. Electronic mail address; the name the Member chooses to give; confirmation that he is aged eighteen or over; the version and date of the Terms he accepted; his choices within the Service; and the status of his account. Purpose: to provide the Service and to operate the account. Legal basis: Article 6(1)(b), performance of a contract.

4.2Conversations, notebook and Folio. The messages a Member sends, the answers he receives, the notebook described at clause 3.2, the items he saves to his Folio, and any rating or comment he gives on an answer. Purpose: to answer him and to remember his story. Legal basis: Article 6(1)(b).

4.3Special categories. By its nature the Service concerns a Member’s romantic and intimate life, and what he writes may reveal data concerning his sex life or sexual orientation, his health, or his beliefs, being special categories within the meaning of Article 9(1) GDPR. Such data are processed only on the basis of his explicit consent pursuant to Article 9(2)(a), which he gives on entering the Service and may withdraw at any time by deleting the conversations concerned or his account. Members are advised to share no more than is necessary to be helped.

4.4Private conversations. A Member may open a private conversation. Its messages are sent to the processors identified at clauses 7.2(c) and 7.2(d) solely in order to produce each answer, and are not stored by the Controller, added to the notebook, or retained after the conversation is closed.

4.5Information about other persons. A Member may speak of other persons, most often a woman he knows. The Terms require him to use a first name only and to omit surnames, telephone numbers, photographs, addresses and any other detail by which she could be identified, and the notebook records a first name only. Such information is processed only within that Member’s own account, in order to advise him, on the basis of Article 6(1)(f), the legitimate interest of the Member and of the Controller in the provision of advice the Member has sought; no profile of any such person is compiled, and nothing concerning her is used for any other purpose. A person who believes that information concerning her has been entered into the Service may write to the Controller under clause 9.

4.6Use and fair use. The date and time of each message, the number of messages sent, the language model used and its cost. Purpose: to apply the fair-use limit, to protect the Service from abuse, and to understand its use in aggregate. Legal basis: Article 6(1)(f), the legitimate interests of the Controller in the proper functioning and financial sustainability of the Service.

4.7Review by Zan Perrion (optional). Only where a Member has so elected, Zan Perrion may read anonymised samples of that Member’s conversations in order to improve the answers of the Service, and may write a corrected answer, which the Service may thereafter use, with the question rewritten so that no person can be identified. Legal basis: Article 6(1)(a) and Article 9(2)(a), consent, which is off unless the Member turns it on and may be withdrawn at any time in his profile. Withdrawal does not affect the lawfulness of processing carried out before it.

4.8Payment and membership. Name, electronic mail address, country, plan, renewal date and payment reference. Card details are processed by the payment provider and are neither received nor retained by the Controller. Purpose: to sell and renew membership and to comply with accounting and fiscal obligations. Legal bases: Article 6(1)(b) and Article 6(1)(c), compliance with a legal obligation.

4.9Safety and enforcement. Where an account is suspended or closed for breach of the Terms, the Controller records that fact and the reason, and may retain the electronic mail address concerned so that it cannot be used to open a new account. Legal basis: Article 6(1)(f), the legitimate interests of the Controller in protecting the Service, its Members and third persons.

4.10Voice and dictation. Where a Member uses dictation, his speech is converted into text by the speech recognition service of his own browser or device, under the terms of its provider; the Controller receives the text only. Where the Service speaks an answer aloud, the text of that answer is sent to the provider identified at clause 7.2(g) to produce the audio, which is not retained by the Controller.

4.11Technical data. The Service and its hosting provider record internet protocol addresses, browser and device characteristics, and requests made, for security and for the diagnosis of faults. Legal basis: Article 6(1)(f). Cookies and equivalent technologies are addressed in the Cookie Notice.

4.12Correspondence. Messages sent to the Controller, and the addresses from which they are sent. Legal basis: Article 6(1)(f), the legitimate interests of the Controller in answering enquiries and keeping accurate records.

5.Artificial intelligence and training

5.1No personal data of any Member, including his conversations, notebook, Folio, and anything he writes, says or dictates, is used to train, retrain, fine-tune or otherwise improve any artificial-intelligence model, whether the Controller’s or any third party’s. The processors identified at clauses 7.2(c) and 7.2(d) are contractually prohibited from so using it.

5.2Should the Controller at any time adapt a model to the Service, it shall do so from the work of Zan Perrion and his own corrections only, including corrections made under clause 4.7, in which any Member’s question has been rewritten so that no person can be identified.

6.Confidentiality

6.1Members’ conversations are not read by any person, save:

1. anonymised samples read under clause 4.7, where the Member has so elected;
2. where the Member asks the Controller for help with a particular conversation, and then only that conversation;
3. where reading is necessary to investigate a serious breach of the Terms reported to or detected by the Controller, or to protect any person from serious harm; or
4. where disclosure is required by law.

6.2Nothing a Member writes shall be published, quoted or attributed to him. No Member is identified by name upon any site of the Controller.

7.Recipients

7.1Personal data are not sold, let, traded or otherwise transferred to third parties for those parties’ own purposes, and are not used for advertising.

7.2Personal data may be disclosed to the following recipients, each acting as a processor upon the documented instructions of the Controller pursuant to Article 28 GDPR:

1. Supabase, Inc., which stores the Service’s data, within the European Union (Frankfurt, Germany), and provides the login system;
2. Vercel Inc., which runs the Service, on servers in Frankfurt, Germany;
3. Anthropic, PBC, whose Claude models write the answers and the notebook: each message, with the context the answer requires, is sent to it, and, where an answer requires current information, the queries it makes to search the web on the Member’s behalf;
4. Google Ireland Limited and Google LLC, whose Gemini service converts each message into a numerical representation used to find relevant passages of Zan Perrion’s work, which is not stored;
5. Resend, Inc., which sends the login messages;
6. Stripe Payments Europe, Ltd., which processes payments;
7. ElevenLabs, Inc., which produces the synthetic voice, where a Member uses that feature;
8. Dropbox, which holds weekly backup copies of the Service’s data, encrypted before they leave the Controller, with a key held by the Controller alone; and
9. professional advisers, including accountants and legal counsel, where necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

7.3Personal data may further be disclosed to competent public authorities where required by law.

8.Transfers to third countries

8.1Certain recipients identified at clause 7.2 are established, or have parent companies established, in the United States. Where personal data are transferred to a third country, such transfer is effected on the basis of an adequacy decision pursuant to Article 45 GDPR, including the EU–U.S. Data Privacy Framework where the recipient is certified under it, or on the basis of standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c), together with such supplementary measures as may be appropriate.

8.2A copy of the safeguards relied upon may be obtained by written request.

9.Retention

1. Account, conversations, notebook and Folio: for as long as the account exists. A Member may delete any conversation, his notebook, or his whole account at any time, upon which the data are erased from the Service at once and from backup copies as those copies expire, within twelve weeks.
2. Accounts not renewed: where a membership ends and is not renewed, or a free trial is not followed by membership, the account is kept for twelve months so that the Member may return, and is then deleted, the Member being notified by electronic mail beforehand.
3. Payment records: for the period required by Romanian accounting legislation, being ten years from the end of the financial year to which the transaction relates.
4. Records under clause 4.9: for as long as the suspension or block remains in force.
5. Messages sent to Anthropic: deleted by Anthropic within thirty days, save that messages flagged by its safety systems may be retained by it for up to two years, as its commercial terms provide.
6. Technical data and correspondence: technical logs for short periods, generally not exceeding thirty days; correspondence for three years from its conclusion.

10.Provision of data

10.1The provision of personal data is not a statutory requirement. An electronic mail address, and the confirmations requested on entry, are necessary in order to use the Service, which cannot be supplied without them. Everything else a Member tells the Service is his choice.

11.Rights of the data subject

11.1Subject to the conditions and exceptions provided by the GDPR, a data subject has the right:

1. to obtain confirmation as to whether personal data concerning him are processed and, where so, access to those data and to the information specified in Article 15;
2. to obtain rectification of inaccurate data and completion of incomplete data, pursuant to Article 16;
3. to obtain erasure, pursuant to Article 17;
4. to obtain restriction of processing, pursuant to Article 18;
5. to receive data provided by him in a structured, commonly used and machine-readable format, pursuant to Article 20;
6. to object at any time to processing carried out on the basis of Article 6(1)(f), pursuant to Article 21; and
7. to withdraw consent at any time where processing rests upon Article 6(1)(a) or Article 9(2)(a), without affecting the lawfulness of processing carried out before withdrawal.

11.2A Member may exercise most of these rights himself, at any time, within the Service: he may read and correct his notebook and choices in his profile, delete any conversation in his history, download all of his data, and delete his account.

11.3Requests may also be addressed to the Controller at info@arsamorata.com. The Controller shall respond without undue delay and in any event within one month of receipt, which period may be extended by two further months where necessary, taking into account the complexity and number of requests.

11.4A data subject who considers that processing infringes the GDPR has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his habitual residence, place of work or place of the alleged infringement. The competent authority in Romania is the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, dataprotection.ro.

12.Security

12.1The Controller implements appropriate technical and organisational measures pursuant to Article 32 GDPR, including encryption of data in transit and at rest, encryption of backup copies, two-step verification for administrative access, and restriction of access to those requiring it for the purposes identified at clause 4.

12.2No method of transmission or storage is entirely secure, and no warranty of absolute security is given.

13.Minors

13.1The Service is directed exclusively to persons aged eighteen years or over. The Controller does not knowingly process the personal data of any person below that age, and shall close the account and erase such data without undue delay upon becoming aware of it.

14.Amendment

14.1This Notice may be amended from time to time. The version in force is that published upon this page, bearing the date above. Where an amendment materially affects the rights of Members, notice shall be given within the Service or by electronic mail before it takes effect.