Privacy Policy

1. Who we are

Dorothy is operated by Atlantic SQ Ltd ("we", "us"), a private limited company registered in England and Wales, company number 16467255, with its registered office at Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom. For UK and EU data protection law, Atlantic SQ Ltd is the controller of your personal data. You can reach us for anything privacy-related at [email protected].

2. What data we collect

• Account data: your email address, used for passwordless sign-in links. We do not ask for passwords or your real name.
• Conversation data: the messages, questions, journal entries, and readings you send or create in Relationship, Growth Cards, and Room.
• Device identifier: a random visitor key stored in your browser's local storage, used to link your purchases and privacy choices across pages. It contains no personal details.
• Technical and security logs: limited request and rate-limiting records needed to keep the service safe.
• Payment data: payment status, transaction identifiers, and subscription state. Card details are handled by Stripe and never reach our servers.
• Telegram data: if you use Dorothy in Telegram, your Telegram identifier and the messages you send there.
• Optional analytics data: if you allow it, pseudonymous usage events (such as page views or checkout starts) and anonymous topic counters. Your questions and answers are never included.
• Launch-notification email: if you ask to be notified when the Dorothy app launches, we store your email solely to send that one notification. It is never used for marketing and you can remove it anytime by contacting us.

3. How we use your data and our legal bases

• To provide the service (contract): generating replies, applying your quotas, and unlocking purchases.
• Legitimate interests: keeping Dorothy secure, preventing fraud and abuse, and improving reliability — balanced against your rights.
• Consent: optional usage analytics and anonymous theme counters. You can withdraw consent at any time without losing core access.
• Legal obligation: transaction and accounting records we must keep under consumer and tax law.

4. You are always talking to an AI

Every Dorothy surface — including its personas and readings — is an AI system, and we say so in the product. Replies are generated by commercial AI models reached through vetted providers under zero-data-retention terms: providers do not keep your conversation content beyond what is technically needed to generate the reply, and it is never used to train their models or ours. Under the EU AI Act we clearly disclose AI interaction and label AI-generated content, and we do not build psychological profiles about you.

5. Sensitive conversations

Companion conversations naturally touch on emotions and relationships. We treat what you write as private content: it is encrypted at rest, kept only as long as described in section 8, and never sold. We do not ask you for health data and do not use Dorothy to infer medical conditions. Please share only what feels comfortable, and avoid unnecessary sensitive details about other people.

6. How we share data

We use trusted processors that handle data only on our instructions:

• Supabase — hosting, sign-in, database, and server functions.
• OpenRouter — routes AI requests to model providers that operate under zero data retention and no-training terms.
• Anthropic — AI inference for legacy and game surfaces.
• Stripe — payment processing.
• Cloudflare — website hosting and the Turnstile human-verification check.
• Telegram — if you choose to use Dorothy inside Telegram.

We do not sell your personal data, and we run no advertising trackers. We may disclose data if legally required or to protect rights and safety, and in connection with a business transfer.

7. International data transfers

Dorothy is operated by a UK company, and our providers use infrastructure in the UK, EU, and US. Personal data from the EEA may flow to us in the UK under the EU–UK adequacy decision. Where data is transferred to other countries — for example to US-based providers — we rely on recognised safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the encryption and short-retention measures described in this policy.

8. How long we keep your data

• Relationship and Duo chat content on our servers expires after at most 90 days.
• Growth Cards and Room content on our servers expires after at most 30 days.
• Required payment, fraud-prevention, and legal transaction records may be kept separately for as long as the law requires.
• Local, browser-only records (for example device-side journal entries) stay on your device until you delete them in the product.

9. Security

Requests use TLS in transit and sensitive server content uses application-level encryption at rest. This is not end-to-end encryption, because readable text must briefly be processed in memory to generate a response. We apply rate limiting and human-verification checks to protect the service from abuse.

10. Cookies and local storage

We use browser local storage — not advertising cookies — for your sign-in session, your visitor key, and your privacy choices. Optional analytics are set only after you allow them. You can clear this storage at any time from your browser; clearing it signs you out and resets optional choices to off.

11. Your privacy rights

United Kingdom and EEA (UK GDPR / GDPR)

You can ask us to access, correct, delete, restrict, or export your personal data; object to processing based on legitimate interests; and withdraw optional consent at any time. We respond within one month. If you are unhappy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

United States

If you are a US resident — including California under the CCPA/CPRA and residents of states with similar laws — you can ask to know what personal data we hold, and to access, correct, delete, or take a copy of it. We do not sell or share personal information for cross-context advertising, and we never discriminate against you for exercising your rights.

How to exercise your rights

Signed-in users can export or delete associated personal content directly from the product where it was created, or delete personal data at account level. For anything else, email [email protected] with your account email and the request type. We may ask a small verification step so we never act on the wrong account.

12. Children

Dorothy is for adults: you must be at least 18 years old, and we ask you to confirm this when you sign in. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy as Dorothy evolves. If a change is significant, we will notify you in the product before it takes effect. The "Last updated" date above always shows the current version, and earlier versions are available on request.

14. Contact us

Questions, privacy requests, or account help: email [email protected]. For billing or access help, include your order identifier; for a privacy request, include the account email and the request type (for example access, export, correction, or deletion). Postal: Atlantic SQ Ltd, Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom.

Terms of Service

What Dorothy is — and is not

Dorothy is an AI companion for reflection, conversation, and tarot-inspired readings, provided to you by Atlantic SQ Ltd under these terms. It is not a human, not therapy, not crisis care, and not medical, legal, financial, or guaranteed predictive advice. Readings and personas are creative interpretations, and AI replies can be wrong or incomplete — you stay responsible for your decisions.

If you are struggling

If you are in crisis or thinking about harming yourself, please stop here and contact your local emergency number or a crisis line — for example 988 in the US, Samaritans on 116 123 in the UK and Ireland, or 112 in the EU. Trained people are there to help, and Dorothy cannot replace them.

Who may use Dorothy

You must be 18 or older. Do not use Dorothy to harass, coerce, stalk, or endanger anyone, to seek sexual content involving minors, or for anything illegal. Do not present Dorothy's replies as professional advice.

Fair use

Quotas, rate limits, and single-device sessions exist to keep the service available and safe for everyone. Abuse, automated scraping, or attempts to bypass payment may lead to suspension of access.

Billing

One-time products

• Growth Pack (3 card readings + 1 Deep Love report): $29.90
• Curiosity Pack (5 Astro Dice + 30 replies): $29.90
• Healing Room Active Minutes: $0.50 per active minute · 10 min $5.00 · 30 min $15.00 · 60 min $30.00

Subscriptions

Dorothy Gold Membership is $299 per month and includes 10,000 Dorothy experiences each month. Renewal, cancellation, and refund terms are shown before payment. As a consumer in the UK or EU you also keep any statutory cancellation and refund rights that apply to you.