Privacy Policy

The short version

Privacy policies are usually written to be skimmed past. This one is written to be read, because the data you trust us with is sensitive. Here is the honest summary before the detail:

• We collect what we need to run the service. Your name and email from your Google account, the messages and content that sync from your connected OnlyFans or Fansly account, the short voice recording you give us, the rules and settings you write, your billing status, and standard usage logs.
• We never sell your data. We never share it for advertising. Your messages are used only to run the service for you.
• Everything is encrypted in transit and at rest.
• We never store your OnlyFans or Fansly password.
• You own your content, your message history, and your voice clone. You can disconnect and delete your data whenever you like. When you leave, your data leaves with you. We'll remove it out of our active systems within 30 days, and out of our encrypted backups within 90, except records the law makes us keep.

The rest of this policy explains each of those points properly. If anything is unclear, email hello@peachandcherry.com and a human will answer.

Who we are

Peach & Cherry is operated by Essence AI, Inc., a Delaware corporation. When this policy says "we", "us", or "our", it means Essence AI, Inc.

This policy covers our website at peachandcherry.com and the app at app.peachandcherry.com. It applies to solo creators, to agencies and their team members, and to visitors to the website.

Essence AI, Inc. is the data controller for the personal data we process for our own purposes: your account, your billing details, your support conversations, and the logs and diagnostics described below. For everything that syncs from your connected platform, including your own messages, your content library, and your sales and pricing history, for your fans' messages and context, for your voice recording and the voice clone built from it, and for the rules, personas, and settings you write, we act as your service provider (a "processor" under the GDPR): we handle that data only under your instructions, to run the service for you. The sections "What syncs from your connected platform" and "Your fans' data" explain what that means in practice, and our data processing addendum governs that processing.

Peach & Cherry is not affiliated with, endorsed by, or sponsored by OnlyFans or Fansly. Those names are trademarks of their respective owners.

Pricing, trials, and acceptable use are covered by our Terms of Service.

What we collect

What you give us directly

• Account data. You sign in with Google, so we receive your name, email address, and account identifiers from Google. If you are part of an agency, we also keep your organization membership and your role in it.
• Your rules and settings. The plain-English rules you write for autopilot, your price floors, your do-not-send lists, and your personas. These are your instructions to the AI, and we store them so it can follow them.
• Support messages. If you email us, we keep the conversation so we can help you and pick up where we left off.

What syncs from your connected platform

You connect your OnlyFans or Fansly account by signing in to the platform yourself. We never see or store your platform password. What you authorize is the ability to sync messages and media and to act on the connected account (send replies, attach content, set prices) according to the mode and rules you choose. Once connected, the service syncs:

• Your direct messages, including the messages fans send you.
• Fan profile and spending context: what a fan has bought, what they respond to, and what they can spend.
• Your content library items and their metadata.
• Your sales and pricing history.

This is the data the AI needs to draft replies in your voice, pick the right PPV content, and price it. We use it only to run the service for you. Fan messages and fan context are handled on your behalf; see "Your fans' data" below.

Your voice recording and voice clone

If you use voice notes, you record or upload about two minutes of audio. We use that clip to create your voice clone, which sends voice notes as you. Your clone is private to you. It is never shared with, or reused for, anyone else, and you can delete it whenever you like. Because a voice is biometric data, we apply extra protections, described just below.

Biometric data: your voice

A voice clone can identify a person, so we treat your recording and your clone as biometric data, processed on your behalf under our data processing addendum, and hold ourselves to strict rules:

• Consent first.We build a voice clone only with the express written consent of the person whose voice it is, captured in the product before the clone is created. If you are an agency, the recording and the clone are that creator's personal data, and you must have the creator's documented consent, as our Terms of Service require.
• One purpose.The recording and the clone exist solely to send that creator's voice notes. Nothing else.
• Destruction schedule. We permanently destroy the raw audio clip and the derived voice clone when you ask us to delete them, when the account is deleted, or no later than three years after your last interaction with the service, whichever comes first. The 30-day active-system and 90-day backup windows described under "Retention and deletion" apply.
• Never sold. We never sell, lease, or trade biometric identifiers. We disclose them only to the voice provider that runs your clone, under contract, for that purpose alone. It is listed at /subprocessors.

Payments

Payments are processed by Stripe. Your card details go straight to Stripe; we do not store full card numbers. We receive your billing status and limited card metadata, like the card brand and last four digits, so we can show you what is on file and keep your subscription running.

Automatic data and cookies

• Logs and diagnostics. Like most services, we collect logs, diagnostics, and telemetry to keep the service healthy and secure.
• Cookies. We use essential cookies for sign-in and your session. We do not use advertising cookies or third-party ad trackers.
• Browser privacy signals. Because we do not sell or share personal information and use no advertising trackers, there is nothing for browser opt-out signals like Do Not Track or Global Privacy Control to switch off. We treat every visitor as opted out by default.

How we use your information

Each purpose, plainly stated:

• To run the service. Drafting replies in your voice, picking PPV content from your library, setting prices, and sending messages, either in draft mode (where every reply waits for your approval) or on autopilot (within the rules you wrote).
• To personalize your AI. Your messages teach the AI your voice, your style, and how your conversations work, so replies sound like you.
• To make your voice clone work. Your audio clip is used to create and run your private voice clone, nothing more.
• To bill you. Managing your subscription and trial through Stripe.
• To keep the service secure. Monitoring, debugging, preventing abuse, and protecting accounts.
• To support you. Answering your emails and fixing your problems.
• To meet legal obligations. Tax, accounting, and responding to valid legal requests.

We do not use your data for advertising, and we do not sell it. Ever.

AI processing

Peach & Cherry drafts messages with large language models, so it matters who touches your data and under what rules. Every AI and voice provider that processes your data does so under contract, and only to provide the service to us. The full, current list of providers lives at /subprocessors.

Your fans' data

When the service syncs your inbox and drafts replies, it is handling your fans' messages and context on your behalf. That deserves its own explanation.

For fan data, you (the creator or agency) are the one with the direct relationship to the fan. We act as your service provider, or "processor" in GDPR terms: we process fan messages and fan context only to draft and send your replies, under your instructions (your mode, your rules, your do-not-send lists).

What that means in practice:

• Fans with questions or requests about a conversation should contact the creator they were talking to, since the creator or agency controls that relationship.
• If a fan contacts us directly, we will help route the request to the relevant customer, and we honor any legal obligations that apply to us directly.
• You are responsible for making sure you have the right to connect the accounts you use with the service, and for your own obligations to your fans.

How we share information

We share personal data only in these situations:

• Service providers (subprocessors). Companies that help us run the service: cloud infrastructure, monitoring, email, and the AI providers described above. Each one is bound by contract to use the data only to provide services to us. The full list, kept current, is at /subprocessors. Payments go straight to Stripe, as described under "Payments".
• Inside your organization. If you are part of an agency, your organization controls who on the team can see what, using role-based permissions.
• Legal reasons. If we are required to by law, a court order, or other valid legal process; where necessary to protect the rights, safety, or security of our customers, the public, or the service; and to report suspected violations of the absolute prohibitions in our Terms of Service, such as content involving minors or non-consenting persons, to law enforcement or child-safety authorities, where the law requires or permits.

And to say it one more time: we never sell your data, and we never share it for advertising. No exceptions.

Retention and deletion

We keep your data while your account is active, because the service needs it to do its job.

When you delete your account, or when we receive a verified deletion request:

• Your data is deleted from our active systems within 30 days.
• Copies in encrypted backups are purged within 90 days.
• We keep some billing records longer where the law requires it (tax and accounting rules).

If you cancel your subscription but keep your account, your data stays in place so you can come back; delete the account, or ask us to, and the timelines above apply. If we end your account under our Terms of Service, the same timelines apply from the day it closes, except where the law requires us to preserve specific records, including material we must preserve for reports to authorities.

Logs and diagnostics are kept on a rolling short-term basis, and support emails for as long as needed to help you and handle any follow-up; after that, the same deletion rules apply. Retention of your voice recording and voice clone is covered under "Biometric data: your voice".

You can also disconnect your platform account at any time, and you can delete your data and your voice clone whenever you like, without deleting your whole account. When you leave, your data leaves with you: out of active systems within 30 days, out of backups within 90, except the records the law makes us keep.

Security

Security is the foundation the rest of this policy stands on:

• Messages and content are encrypted in transit and at rest.
• We never see or store your platform password; you sign in to OnlyFans or Fansly yourself.
• Access to customer data is controlled and audited.
• For agencies: role-based access control, SAML single sign-on, SCIM provisioning, two-factor authentication, granular permissions, and full audit logs.

You can read more about our security practices at /security. If you ever spot something that worries you, email hello@peachandcherry.com.

Your rights and choices

Wherever you live, the basics are the same: you can see your data, correct it, take a copy of it, and delete it. Email hello@peachandcherry.com and we will make it happen.

If you are in the European Economic Area or the United Kingdom

Under the GDPR and UK GDPR you have the right to access your personal data, to have it corrected (rectification), to have it erased, to restrict or object to processing, and to receive a portable copy.

Our legal bases, purpose by purpose:

• Contract (Article 6(1)(b)): running the service you signed up for, billing, and support.
• Legitimate interests (Article 6(1)(f)): keeping the service secure, preventing abuse, and monitoring and diagnostics.
• Legal obligation (Article 6(1)(c)): tax, accounting, and responding to valid legal process.

Those bases cover the data we control. Your voice recording and voice clone, fan messages and context, and the other content that syncs from your connected platform are processed only as your processor, on your instructions, under our data processing addendum; the legal basis for that processing, including the explicit consent for a voice clone that our Terms of Service require, is yours to establish. If the consent behind a voice clone is withdrawn, tell us and we will delete the recording and the model.

We do not make automated decisions about you that have legal or similarly significant effects. The AI's drafting, content selection, and pricing act on your fans' messages and context only on your behalf and within your rules; you control the mode and can require approval of every message.

You also have the right to complain to your data protection supervisory authority. We would appreciate the chance to sort it out with you first, but the right is yours either way.

If you are in California

Under the CCPA/CPRA you have the right to know what personal information we collect, to delete it, to correct it, and to receive a portable copy. We do not sell or share personal information as defined by the CCPA, so there is nothing to opt out of. We will never discriminate against you for exercising your rights.

In the preceding 12 months, the categories of personal information we have collected are: identifiers (your name, email address, and Google account identifiers); commercial information (billing status, card metadata, and sales history); internet or other electronic activity (logs and diagnostics); audio and biometric information (your voice recording and voice clone); sensitive personal information (described below); and inferences (fan spending and preference context, which we process as a service provider on your behalf). The sources are you, Google, Stripe, your connected platform, and automatic collection. The purposes are the ones listed under "How we use your information". The recipients are the service providers listed at /subprocessors.

Some of what we handle is sensitive personal information under the CCPA: your voice recording and voice clone, message content that may reveal information about sex life, and the contents of communications we process on behalf of our customers. We use and disclose sensitive personal information only for the purposes the CCPA regulations permit (section 7027(m)), such as providing the service you asked for, security, and quality, and never to infer characteristics about you. Because of that, the "Limit the Use of My Sensitive Personal Information" right does not apply.

Other US states

If you live in a state with a comprehensive privacy law, such as Virginia, Colorado, Connecticut, or Texas, you have similar rights to access, correct, delete, and port your data. Exercise them by emailing hello@peachandcherry.com. If we refuse a request, you can appeal by replying to our decision, and we will respond as your state's law requires.

How to exercise your rights

Email hello@peachandcherry.com. We will verify your identity before acting on a request, usually by confirming you control the email on the account. Authorized agents may submit requests on your behalf; we will verify the agent's authority and your identity before acting.

If a request concerns a fan conversation, remember the split described in "Your fans' data": for fan data we act on the creator's or agency's behalf, and we will route the request to them.

International transfers

We are a US company and we process data in the United States. If you use the service from somewhere else, your data will be transferred to and processed in the US. Where the law requires safeguards for those transfers, such as for data from the EEA or the UK, we use the EU Standard Contractual Clauses, and for UK data the UK Addendum or the International Data Transfer Agreement, as applicable.

Children

Peach & Cherry is for adults. You must be 18 or older to use it, the service is not directed to minors, and we do not knowingly collect personal data from anyone under 18. The platforms it connects to are 18+ platforms. If you believe someone under 18 has given us personal data, email hello@peachandcherry.com and we will delete it.

Changes to this policy

We will update this policy as the product and the law evolve. When we do, we will update the "Last updated" date at the top of this page. If a change is material, we will tell you first, by email or in the app, before it takes effect.

Contact

Peach & Cherry is operated by Essence AI, Inc., a Delaware corporation.

• Privacy questions and requests: hello@peachandcherry.com

Our data processing addendum applies automatically, for every customer, to the extent we process personal data on your behalf. There is nothing to sign or request.