Privacy Policy
Effective: November 9, 2026
Bansung Labs ("we", "us"), a business registered in the Republic of Korea, runs Tturi at tturi.app and through our Discord bots. This policy explains what personal data we process, why, who we share it with, how long we keep it, and your rights. We collect only what we need to run the Service.
1. What we process
| Data | What exactly | Why | Kept for |
|---|---|---|---|
| Account | An internal account ID, your Google account ID (the "subject" identifier only), your Discord user ID and display name, sign-up time, account status | Create and identify your account, link Discord, prevent duplicate accounts | Until you delete your account, then 30 days |
| Sign-up abuse checks | A random device ID stored in a cookie, and a keyed hash of your IP address (we do not store the IP itself here) | Limit how many accounts can be made from one device or network | 12 months |
| Region | Country and state/region code supplied by our network provider (Cloudflare) | Apply the right regional rules (availability and age checks) | Until you delete your account |
| Age check | Whether you passed, the method (self-declaration, facial age estimate, ID check), date, and the provider's session reference | Unlock adult conversations, keep minors out | Until you delete your account, then 30 days. If the result was under 18 or a minor signal led to a lock: 3 years, to stop re-registration |
| Call audio | Your voice during a call | Speech recognition, so the character can answer | We do not record or store call audio |
| Call transcripts | Text of what you and the character said, with call and character IDs and times | Continue conversations and remember context, handle reports, check policy violations | Until you delete your account or ask us to delete them |
| Memory notes | Short summaries of past calls and a list of lasting facts you shared with a character (for example your name, job or plans). We leave out details about health, sex, religion and politics | Let each character remember you between calls | Until you delete your account or ask us to delete them |
| Usage | Call start/end times, duration, minutes granted and used, end reason | Minutes and limits, abuse prevention, disputes, service quality | Until you delete your account, then 1 year |
| Safety records | Results of automated checks (minor signal, crisis signal, prohibited content), the short excerpt that triggered them, time, and any action taken (call ended, account locked) | Protect users, enforce our policies, respond to disputes and lawful requests | 3 years |
| Technical logs | Server event logs (for example sign-in, call started/ended, errors) with account IDs | Operate and secure the Service, fix problems | 90 days (safety events: as above) |
| Support | Your email address and what you write to us | Answer you and keep a record of the request | 3 years |
Cookies: we use only cookies needed for the Service (a sign-in session, a short-lived sign-in state, and the device ID above). We do not use advertising or analytics cookies.
We do not receive your Google or Discord email address, password, contacts or messages. When you link Discord we ask Discord whether your email is verified, but we do not keep the address.
We do not receive photos of your face, ID documents or your date of birth from the age check provider, only the result.
2. Legal bases (EEA, UK and similar laws)
- Contract: to provide the Service you signed up for (account, calls, transcripts, minutes).
- Legitimate interests: abuse prevention, security, safety enforcement, keeping minors off the Service, and improving quality. We balance these against your rights.
- Legal obligation: where the law requires age checks, record keeping or responses to authorities.
- Consent: where we ask for it. You can withdraw consent at any time without affecting earlier processing.
3. Who we share data with
We do not sell or rent your personal data, and we do not share it for cross-context behavioral advertising. We use these service providers, who process data on our instructions:
| Provider | Country | Data | Purpose |
|---|---|---|---|
| Discord Inc. | United States | Discord ID, call audio in the voice channel | Account linking, voice calls (Discord carries the call) |
| Google LLC | United States | Google ID; call text when Google models are used | Sign-in; AI responses, speech and classification |
| Deepgram, Inc. | United States | Call audio | Speech recognition |
| xAI Corp. | United States | Call text | Character responses |
| Hanabi AI Inc. (Fish Audio) | United States | Character lines (text) | Character voice |
| ElevenLabs, Inc. | United States | Character lines (text) | Character voice |
| Cloudflare, Inc. | United States | IP address, request data | Network delivery, security, country/region lookup |
| Yoti Ltd (when age verification is enabled for your region) | United Kingdom | The selfie or ID you give to Yoti | Age estimation and ID checks. Yoti sends us only the result |
We may also disclose data when required by law, to protect someone's safety, or as part of a merger or sale of the business (with this policy continuing to apply).
4. Where data is stored and international transfers
Our servers are located in the Republic of Korea. Data is also processed by the providers above, mostly in the United States. Where the law requires, we rely on safeguards such as standard contractual clauses or the provider's own transfer mechanisms.
5. Your rights
Depending on where you live, you can ask us to:
- access or get a copy of your data;
- correct it;
- delete it (including your account and transcripts);
- restrict or object to some processing;
- move it to another service (portability);
- withdraw consent.
Write to [email protected] from any address and tell us your Discord user ID or username so we can find your account. We will confirm that the request comes from the account owner, then answer within 30 days (sooner where the law requires). Deleting your account removes your transcripts right away and the rest on the schedule in section 1.
If you are in the EEA or UK you may complain to your data protection authority. California residents have the right to know, delete and correct, and to not be discriminated against for using these rights. We do not sell or share personal information as those terms are defined in California law.
6. Children
Tturi is only for adults 18 or older. We do not knowingly collect data from anyone under 18. If we learn an account belongs to a minor, we lock it and delete the data except the minimum needed to keep the person from signing up again (see section 1). If you believe a minor is using Tturi, tell us at [email protected].
7. Security
We use encryption in transit, signed session cookies, keyed hashing of IP addresses for abuse checks, access limited to staff who need it, and we keep the least data we can. No system is perfectly secure, and we will notify you and the authorities of a breach where the law requires.
8. Changes
If we change this policy in a way that matters to you, we will post the new version here with a new effective date and, where appropriate, tell you in the Service before it applies.
9. Contact
Controller: Bansung Labs (반성랩스) · Business registration no. 857-54-00923
801-S59, 8F, 16 Inha-ro 489beon-gil, Namdong-gu, Incheon, Republic of Korea
Privacy contact: [email protected]