Privacy Policy

1. Data Controller

• Entity: SHADY SQUID INK
• Address: ZAE Les Quatre Moulins — Maison des Entreprises, 17190 Saint-Georges-d'Oléron, France
• Personal data contact: [email protected]

The Data Protection Officer (DPO) is Maxime DARRAS, reachable at [email protected].

2. Data Collected and Legal Bases

Meduz collects the following data for the purposes indicated:

3. Note on the Nature of Persona Data

In Meduz, the user creates a fictional character (persona) to interact with the game universe. The information provided during onboarding (fictional first name, gender, date of birth, orientation, relationship preferences, personality traits, interests) is data attributed to this fictional character and does not constitute personal data of the actual user — it may not correspond to them.

This game data is processed on the basis of performance of the service contract. Providing it is voluntary: the persona can be configured freely and does not necessarily reflect the user's real identity.

The user can delete their persona at any time from the settings. Deletion results in the erasure of all associated data (conversations, memories, relationships).

4. Recipients and Processors

Your data may be shared with the following processors, who act in accordance with our instructions and GDPR requirements:

5. Transfers Outside the European Union

Several of our processors are established in the United States. These transfers outside the EU are governed by:

• The EU-U.S. Data Privacy Framework (DPF) — European Commission adequacy decision of July 10, 2023, applicable to certified processors (Google LLC, OpenAI LLC)
• Standard Contractual Clauses (SCCs) adopted by the European Commission (implementing decision 2021/914), for processors not certified under the DPF

These mechanisms ensure an adequate level of protection for your data.

Some conversational data (messages, AI context) is processed by servers located outside the European Union as part of AI response generation.

6. Data Retention Period

• Active account: data retained for the duration of the subscription, then 1 year of inactivity before automatic deletion
• Messages and conversational memories: retained for the duration of the account
• Advertising data: 13 months maximum (CNIL recommendation)
• Accounting and billing data: 10 years (legal obligation)

7. Your Rights

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure: request the deletion of your data ("right to be forgotten")
• Right to data portability: receive your data in a structured format
• Right to object: object to certain processing
• Right to restriction: restrict the processing of your data
• Right to withdraw consent: at any time, for processing based on consent

To exercise your rights, contact us at: [email protected]
We will respond within a maximum of one month (Art. 12 GDPR).

If you believe that your rights are not being respected, you may lodge a complaint with the CNIL:
Commission Nationale de l'Informatique et des Libertés — 3 Place de Fontenoy, 75007 Paris — www.cnil.fr

8. Data Security

SHADY SQUID INK implements appropriate technical and organizational measures to protect your data:

• Encrypted communications (HTTPS/TLS 1.2+)
• Secure authentication via Firebase
• Signed JWT tokens for sessions
• Partitioned database not directly exposed to the internet
• Data access limited to authorized personnel only

9. Automated Decisions

Meduz uses automated algorithms to calculate affinity scores (trust and desire) based on your interactions. These scores influence the evolution of relationships with AI characters, in accordance with the game mechanics.

These automated processes have no legal effect on you nor do they significantly affect you outside of the gaming experience.

10. Protection of Minors and Prevention of Child Sexual Abuse and Exploitation (CSAE)

Meduz, developed by SHADY SQUID INK, is an application reserved for persons aged 18 and over. When creating a persona, the user must declare an age of 18 or above. Any declaration of an age below 18 results in the refusal to create the profile.

The application is rated 17+ on the App Store and Mature Content on Google Play, which activates the platforms' native parental controls.

SHADY SQUID INK strictly prohibits any content related to Child Sexual Abuse and Exploitation (CSAE). No such content may be created, shared, or solicited through the Meduz application. Any user identified as attempting to generate, share, or solicit CSAE content will be immediately banned and reported to the relevant authorities in accordance with applicable law.

Meduz implements technical moderation measures to automatically detect and block attempts to generate content involving minors. These measures include server-side moderation filters applied to every interaction.

11. Note on OpenRouter and the AI Subprocessor Chain

OpenRouter Inc. is an aggregation service that routes requests to various AI model providers. Conversational data transmitted via OpenRouter may be processed by model providers hosted on this platform, in accordance with their own privacy policies and applicable data processing agreements.

SHADY SQUID INK exclusively selects models whose providers offer data protection guarantees compliant with the GDPR.

12. Changes to This Policy

This policy may be updated in the event of legal changes or modifications to our practices. You will be notified by email or in the application of any substantial changes.