Privacy Policy
Last updated: March 2026
What information will you find in this Policy?
In this Privacy Policy, we describe the principles governing the processing of your personal data in connection with your use of our mobile game – LivingEchos, where you can create, manage and participate in game worlds, communicate with other users, visit our website, and contact us in connection with the services we provide.
We explain what data we collect, for what purposes we use it, on what legal basis we process it, how long we retain it, and what rights you have in relation to the processing of your data.
This Policy is not the same as the terms and conditions for using the mobile application. Information in this regard can be found in the separate LivingEchos Terms and Conditions.
In a separate document – the Cookie Policy – you can also learn how we use cookies and manage your preferences related to them.
In this Policy, we use the following definitions:
Policy – this Privacy Policy,
data – personal data,
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC,
website – https://www.livingechos.com/,
services – the services we provide consisting of making available a mobile application that enables users to create, develop and share interactive game worlds using a game assistant based on AI models.
Who is your data controller?
The controller of your personal data is the team behind LivingEchos — the creators and operators of the game and the application.
You can contact us by e-mail at: contact@the-living-echoes.com.
How, on what legal basis, and what types of personal data do we process?
| When do we process data? | What data do we process? | For what purpose and on what legal basis? |
| Collection of data in connection with account registration | • e-mail address, Do not use your real first and last name as your username. |
The data are processed for the purpose of creating and maintaining a user account, including registration, identification, and ongoing administrative support. Processing is also necessary to enable you to use the application’s functionalities in accordance with its intended purpose, including providing access to offered tools and services. The data are also used to perform the agreement for the provision of electronic services, including handling requests, communicating with the user, and fulfilling obligations arising from the agreement. Legal basis: |
| Use of the website | • IP address, • device and browser data, • data regarding website activity (e.g., visited subpages, duration of visit), • data stored in cookies or similar technologies. |
Personal data are processed in order to: Legal basis: |
| Payment-related data (subscription) | • identification data (first and last name), • billing data provided to the payment operator (e.g., e-mail), • information on transactions and payment status. |
Personal data are processed for the purpose of handling payments for services provided, including transaction authorisation, recurring charges, payment status verification and documenting completed operations. Processing also includes subscription management and verification of user entitlement to paid functionalities. Data are also used for accounting and tax purposes, maintaining revenue records, archiving financial documentation and fulfilling obligations arising from tax and accounting laws. Legal basis: |
| Data generated within the application (user content) | Data processed within the application include information made available directly or indirectly by the user, in particular: • content created and saved in the application, such as scenarios, character descriptions and other editorial materials, • text communications entered during interaction with the application, • data preserved in exports or screenshots generated from the application, • voice recording samples, if the user uses features enabling recording or processing and such data are available. |
Data are processed to ensure proper functioning of the game world, including enabling it to operate in accordance with settings and content entered by the user. Processing also includes using data to generate responses and interactions by AI models, within the scope and context of a given session. Data may also be used for content moderation, abuse prevention and enforcement of the Terms and Conditions. To a limited extent, data may be processed for analytical and development purposes in anonymised or aggregated form so as not to enable user identification. Legal basis: |
| Voice communication data (microphone) | • audio data (voice samples – if available), • user-provided data in processed text form (transcriptions). |
Data are processed to enable voice interaction features, including receiving, processing and transforming audio messages for application purposes. Processing also includes using such data to generate responses by AI models in accordance with the content and context of the user’s statement. Additionally, data may be used to ensure quality and security of communication, including detecting abuse and preventing unauthorised use of voice features. Legal basis: |
| Data processed in connection with moderation and violations | • data made available by the user in content reported to the Controller, • user account data. |
Data may be processed in situations involving suspected or confirmed violations of applicable rules, in particular in cases of publication of unlawful content. Processing serves to verify reports, analyse content and circumstances, and determine whether a violation occurred. Processing may also be necessary to fulfil legal obligations, including those arising from the Digital Services Act (DSA), as well as to establish, pursue or defend claims. Legal basis: |
| Contact (direct or via messaging platforms) | We process data provided during contact, including identification data, voice data and message-related information (e.g., first and last name, gender, phone number, e-mail address). | Data are processed to respond to your message and maintain further contact related to it. Legal basis: |
| Data collected via third parties | If you register or log in via a third-party service, that entity will provide us with your data for account creation. This may include data from:
|
Legal basis: • Article 6(1)(b) GDPR – performance of a contract, • Article 6(1)(c) GDPR – legal obligation, • Article 6(1)(f) GDPR – legitimate interest (service development), • Article 6(1)(a) GDPR – consent where required. |
| Marketing purposes | We process data necessary to send you marketing information, such as first and last name, e-mail address or phone number. | We process your data in order to send you information about our services and products for marketing purposes. Legal basis: Article 6(1)(a) of the GDPR – your consent. |
| Business planning and reporting |
We may analyse data such as the number of newly registered accounts or intensity of service usage. | We process your data for research and planning purposes so that we can develop and tailor our service to users’ needs. Legal basis: Article 6(1)(f) of the GDPR – the controller’s legitimate interest. |
| Fulfilment of other legal obligations | We process data required by national or EU law, such as identification data or user age data. | Personal data may also be processed for the purpose of fulfilling other legal obligations incumbent upon the Controller, arising from national law and European Union law, such as maintaining accounting records or ensuring consumer protection. Legal basis: Article 6(1)(c) of the GDPR. |
Providing your data is voluntary, but necessary for the purposes described above.
Data may be used to personalize gameplay and tailor game content to your preferences as part of the provision of the service. Data concerning in-game activity may also be used for profiling for marketing purposes, in particular to tailor communications to your interests – on the basis of the User’s consent or our legitimate interest, where permitted by law. We do not make decisions concerning you that produce legal effects or similarly significantly affect you based solely on automated processing.
We obtain data primarily from you and from distribution service providers.
Data recipients
In certain cases, we are entitled to transfer data where this is necessary for the proper performance of services, fulfillment of obligations, and compliance with applicable laws. For this purpose, we use external service providers.
We may transfer data to:
accounting or legal service providers,
cloud infrastructure providers,
telecommunications service providers,
providers of speech-to-text (STT), language models (LLM), and text-to-speech (TTS) technologies,
payment and invoicing system providers,
analytics or communication tool providers,
public authorities.
Third parties providing services to us include, among others: Google Cloud (Google Cloud Polska sp. z o.o. and Google LLC), Anthropic PBC, Eleven Labs Inc., Innworld AI, GitLab Inc., GitHub, Inc., and Squarespace Inc.
Data may be transferred outside the European Economic Area (EEA) due to the international nature of some of our service providers. Outside the EEA, data protection regulations are not always as strict as those applicable within the EEA; therefore, when transferring data outside the EEA, we exercise particular caution.
If your data is transferred to external service providers in countries not recognized by the European Commission as ensuring an adequate level of protection, we apply appropriate contractual, organizational, and technical safeguards. These include, among others, the use of Standard Contractual Clauses approved by the European Commission, verification of the countries to which data may be transferred (including checking whether a given country has received an adequacy decision from the European Commission), and the implementation of additional technical and organizational safeguards.
Links to other websites
The application may contain links to third-party websites and services. After clicking such a link, the user is redirected to an external website that is not under our control. We are not responsible for its content or data processing practices – we recommend reviewing the privacy policy of the relevant entity.
Social media plugins and tools (e.g., LinkedIn, Facebook) may be used on the website or in the application. If a user clicks a link to such a service while logged in, the respective platform may receive information about the visit and associate it with the user’s account.
The application is distributed via the Apple App Store and Google Play. Apple and Google act as independent data controllers and may process, among other things, account data (Apple ID / Google Account), device information, application downloads, payments, and subscriptions – in accordance with their own terms and privacy policies.
In accordance with the requirements of these platforms, we provide transparent information on data processing, indicate the scope and purposes of processing, and obtain the required consents for access to device features (e.g., the microphone).
Social media
The Controller maintains social media profiles for the purpose of communicating with users, providing information about its activities, and promoting services. In connection with user activity on these profiles, we may process data such as first and last name or nickname, profile picture, content of comments and messages, and other information made publicly available within the relevant service.
With regard to statistical data, the Controller may act as a joint controller together with the operator of the respective social media platform. Detailed rules on data processing are set out in the privacy policies of those platforms.
How long do we retain data?
The data retention period depends on the legal basis for processing:
Performance of a contract (Article 6(1)(b) GDPR)
We retain data for the duration of the contract or negotiations and actions necessary to conclude the contract, and subsequently until the expiry of the limitation period for claims arising from the contract (usually 3 years in the case of claims between businesses).
Legitimate interest (Article 6(1)(f) GDPR)
We retain data for the duration of our legitimate interest or until you effectively object to further processing. For example, data concerning the use of services may be retained for analytical purposes for a maximum of 2 years from the date of collection.
Consent (Article 6(1)(a) GDPR)
We process data until consent is withdrawn. Upon withdrawal, data are deleted or anonymized unless another legal basis for further processing exists (e.g., a legal obligation).
Legal obligation (Article 6(1)(c) GDPR)
We retain data for the period required by law, for example accounting and tax records for at least 5 years from the end of the calendar year in which the relevant economic event occurred.
Your rights
In connection with the protection of personal data, you are entitled to a number of rights under the GDPR. Below you will find information on how you can exercise them.
| What right do you have? | What does this right mean? |
| Access to data | You have the right to obtain information about what personal data we process and how we process it, and, where possible, to receive a copy of such data. |
| Rectification of data | If the data are incorrect or incomplete, you may request that they be corrected or updated. |
| Erasure of data | You may request the deletion of your data if we no longer need them for the purposes for which they were collected, if you raise a justified objection to the processing, or if the processing is based on your consent and you withdraw it. |
| Restriction of processing | You may request a temporary or permanent restriction of the processing of your personal data, in whole or in part, if: the data are inaccurate, the processing is unlawful, the data are no longer necessary for a specified purpose, or you have raised a justified objection and it is still being assessed. |
| Data portability | In certain situations, you may request that we provide you with specific personal data so that you may transfer them to a third party. |
| Right to object | You have the right to object to the processing of your data based on legitimate interest or for direct marketing purposes. Once an objection has been raised, we will cease processing the data unless we demonstrate compelling legitimate grounds for the processing (e.g., for the establishment, exercise, or defense of legal claims). |
| Withdrawal of consent | If we process data on the basis of your consent, you may withdraw that consent at any time. |
If you wish to exercise your rights, you may contact us by email at contact@the-living-echoes.com.
You also have the right to lodge a complaint with the competent supervisory authority (the President of the Personal Data Protection Office) if you believe that the processing of your personal data violates the law.
Data protection
We use appropriate physical, technical, and organizational measures to ensure proper protection of personal data. Despite our safeguards and efforts to protect your data, no electronic transmission over the Internet or information storage technology is completely secure. Therefore, we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not circumvent our security measures and unlawfully access, collect, steal, or modify your data.
To further protect your data:
use a strong, unique password for your account,
do not share your password with others,
limit access to your device and browser.
Children’s personal data protection
Our services may not be used by children, i.e., individuals under the age of 18. Accordingly, we do not knowingly collect or use their data.
However, if we become aware that personal data of a person under the age of 18 have been provided to us, we will promptly take steps to delete or anonymize such data, unless their further processing is required by law. The account of such a person may be blocked or deleted.
Parents or legal guardians who become aware that a minor has provided us with personal data are requested to contact us immediately so that such data can be deleted.
Policy updates
This Policy will be updated regularly, including in connection with new legal requirements, guidelines, or technological changes. Updates may also concern the manner in which data are processed and protected, the purposes for which they are used, the categories of data collected, and the legal bases for processing.
If significant changes are made to the Policy, you will be notified (e.g., via a notification within the service or by email).