This is a final draft prepared for review by qualified counsel before publication. It is not legal advice.
1. Controller and contact
Vantage Loop LLC, 30 N Gould St #51295, Sheridan, WY 82801, USA, is the controller of personal data processed through the Service at noiretta.com.
Privacy enquiries: [email protected]. Data-subject requests: [email protected]. Content removal requests: [email protected].
The Service is not offered in the European Economic Area, the United Kingdom, or Switzerland, and access from those territories is blocked (see Section 7). We therefore do not appoint a GDPR Article 27 representative or a Data Protection Officer. [If that geographic position ever changes, both appointments must be reconsidered before launch in those markets — Article 37(1)(c) is likely engaged by large-scale processing of data concerning sex life.]
2. The sensitive nature of this data
Using this Service necessarily reveals information about your sexual preferences and interests. Under the GDPR and similar laws this is "special category" data concerning your sex life or sexual orientation, and under several US state laws it is "sensitive personal information".
Where we rely on consent to process such data, that consent is explicit, is requested separately, and may be withdrawn at any time by deleting the relevant content or your account. Withdrawal does not affect processing already carried out.
We apply heightened protections to this data: it is stored in private, non-public storage; it is not used for advertising; it is never sold; and it is not used to train general-purpose models.
3. What we collect
Account data: email address, a hashed password, age and adult-content attestations, account status, and preferences.
Character and reference data: images you upload, the characters you create, appearance notes and traits, and the consent attestations you make about real-person references.
Generation data: your prompts and instructions, generation settings, the images and video produced, quality and safety assessments of that content, and timestamps.
Transaction data: credit balance and ledger, purchase records, refunds and chargebacks, and the processor's transaction references. We do not receive or store full payment card numbers.
Technical data: IP address, device and browser characteristics, session identifiers, and security and audit logs.
Support and reports: correspondence you send us, and reports made about content.
4. Biometric data — written notice and retention schedule
This section is our publicly available written policy for biometric identifiers and biometric information, provided to satisfy the Illinois Biometric Information Privacy Act (740 ILCS 14/) and comparable laws. We treat the data described here as biometric wherever you live, not only in Illinois.
What we collect. To keep a character's appearance consistent and to run the safety checks in Section 5, the Service computes a numeric representation (an "embedding") derived from the geometry of faces appearing in the reference images you upload and in the images the Service generates.
Why. Two purposes only: (a) to measure whether a generated image resembles your character's references, so output stays consistent and we can detect a failed generation; and (b) to screen uploads and output for apparent minors. We do not use these representations to identify you, we do not match them against any external or government database, we do not disclose them to any third party for identification, and we never sell, lease, trade, or otherwise profit from them.
Consent. We ask for your separate, express written release before any reference image is processed in this way. You may decline, but the Service cannot establish a character without it. You may withdraw the release at any time by deleting the reference images or your account.
Retention schedule. We do not store biometric representations at all. The embedding exists only in memory for the moment the comparison runs and is discarded immediately afterwards; it is never written to disk, to our database, or to any backup. The only thing we keep is the resulting similarity score — a single number, such as 0.72, from which no person can be identified and no face can be reconstructed. That score is retained with the generation record and deleted with it (see Section 8).
If we ever change this and begin storing embeddings, they would be destroyed at the earliest of: the purpose being satisfied, 12 months after your last interaction with us, or your account closure — within 30 days of any of those events, and within 35 days from backups. We would update this policy and seek your consent before making such a change.
Photographs. The reference images themselves are photographs, which the Illinois Act expressly excludes from the definition of a biometric identifier. They are retained and deleted under the ordinary schedule in Section 8.
Storage and safeguards. These representations are stored with the same or greater care than we apply to other confidential information: encrypted at rest and in transit, access-restricted, and never served to any party other than the account that owns the source image.
5. Why we process it, and our legal bases
To provide the Service — creating characters, generating content, maintaining your library and credit balance. Legal basis: performance of a contract; and, for special-category data, your explicit consent.
To keep the Service and people safe — screening uploads and output for depictions of minors and other prohibited content, detecting abuse, investigating reports, and enforcing our policies. Legal basis: legitimate interests in protecting people and the Service; compliance with legal obligations; and substantial public interest where applicable.
To take payment and prevent fraud. Legal basis: performance of a contract; legitimate interests; legal obligations.
To communicate with you about your account, security, and purchases. Legal basis: performance of a contract; legitimate interests.
To comply with law, respond to lawful requests, and establish or defend legal claims. Legal basis: legal obligations; legitimate interests.
We do not use your content for behavioural advertising, and we do not engage in automated decision-making producing legal or similarly significant effects, other than the automated safety screening described above, which a human reviews on request.
6. Who we share it with
Infrastructure and hosting providers that store data and run the generation workers on our instructions.
Payment processors, which handle card data directly and provide us transaction results. Their processing is governed by their own privacy notices.
Email delivery providers, for account, security, and receipt messages.
Professional advisers, and parties to a merger or acquisition, under confidentiality.
Law enforcement and other authorities, where we are legally required to disclose, or where disclosure is necessary to prevent serious harm. We assess each request and disclose only what is legally required.
We do not sell personal data, and we do not share it for cross-context behavioural advertising, as those terms are defined under US state privacy laws.
7. Where the Service is offered, and international transfers
The Service is not offered to, and may not be used from, the European Economic Area, the United Kingdom, or Switzerland. We take reasonable measures to prevent access from those territories and do not direct the Service at people located there. If you are in one of them, please do not use the Service.
Elsewhere, we may process data in the United States and in other countries where our providers operate, including the United States and the Netherlands. Where a transfer requires a specific safeguard under the law of your country, we put an appropriate mechanism in place.
Access is also blocked from territories where this material is unlawful.
8. Retention and deletion
We keep personal data only as long as necessary for the purposes above.
Characters, references, and generated media are retained until you delete them or close your account.
On account deletion we delete or irreversibly anonymise your content and account data within 30 days, except where we must retain specific records: transaction and tax records for the period required by law; consent attestations and safety-incident records for the period necessary to establish or defend legal claims; and records we are legally obliged to preserve.
Encrypted backups are rotated on a defined schedule and deleted content is removed from backups within 35 days.
Content removed because it depicted a minor is handled under the separate procedure in our Content Removal Policy, including any mandatory reporting and preservation obligations.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you, and receive a copy in a portable format;
- correct inaccurate data;
- delete your data ("right to erasure");
- restrict or object to certain processing, including processing based on legitimate interests;
- withdraw consent at any time, where processing is based on consent;
- not be discriminated against for exercising your rights;
- lodge a complaint with your supervisory authority (EEA/UK) or your state attorney general (US).
To exercise any right, contact [email protected]. We respond within the period required by applicable law — generally one month under GDPR and forty-five days under US state laws — and we may need to verify your identity first. Because of the sensitivity of this data, we verify carefully; this protects you.
If you are a California resident, you may also designate an authorised agent to act for you.
10. Security
We protect data with encryption in transit and at rest, strict access controls, private non-public media storage, hashed credentials, session management with revocation, encrypted backups, and audit logging of administrative actions.
Generated media and references are served only to the authenticated account that owns them, through access-controlled endpoints rather than public URLs.
No system is perfectly secure. If a breach affects your personal data and presents a risk to you, we will notify you and the relevant authorities as required by law.
11. Cookies
We use strictly necessary cookies for authentication, session integrity, and security. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details.
12. Children
The Service is strictly for adults. We do not knowingly collect personal data from anyone under 18. If we learn that we hold data from a minor, we delete it and terminate the account immediately. If you believe a minor is using the Service, contact [email protected] at once.
13. Changes
We will post any change here and update the version and effective date. For material changes we will give notice by email or in-product notice before the change takes effect, and where the law requires it we will seek your renewed consent.