GDPR Notice
CLOVERA GDPR NOTICE
Last updated: October 21, 2026
Contact: kitteniversestudios@gmail.com
1. Applicability
This section is intended to support Clovera's privacy disclosures for users in the European Economic Area and similar jurisdictions.
2. Controller
For purposes of applicable data protection law, Clovera acts as the controller of personal data processed in connection with the service. Kitteniverse Studios is not a registered company; the controller is therefore the natural person who operates the project, from Türkiye, and is reached at the address in Section 11. There is no establishment in the Union and no establishment in the United Kingdom.
No representative has been designated under Article 27 GDPR or under the equivalent provision of the UK GDPR. That Article applies where a controller outside the Union processes the personal data of people in the Union in connection with offering goods or services to them or monitoring their behaviour. Clovera does not offer its services to any Member State in that sense and does not monitor behaviour there: the landing page, the descriptions offered to search engines and the rest of the promotional material are published in English only, no advertising is placed in any Member State, no national domain is used, no price is quoted in euro, and the service is not distributed through a national app store. The interface can be displayed in other languages at the choice of someone who has already found Clovera and created an account, which is a function of the service rather than an approach to a market. Section 1 of the DSA Information document sets the same assessment out at greater length. The position is kept under review as the service grows, and a representative is designated and named here if it changes. Nothing in this paragraph is a reason to delay an answer: a data subject in the Union or the United Kingdom may write to the address in Section 11 and will be answered.
3. Lawful Bases
Clovera may rely on contract necessity, legitimate interests, consent, and legal obligations, depending on the processing involved.
3a. Account Data Collected
Registration requires a username, a password and a date of birth, of which only the first two are kept. Clovera does not ask for and does not hold an email address or telephone number for any account; an internal, non-deliverable placeholder address is generated so that the account record has a unique identifier. Beyond that, an account holds what its holder chooses to put in it: a display name, pronouns, a short biography, a custom status, an accent colour, a profile photo, a banner, a language preference, and, for the marker shown on a profile, the day and month of a birthday. Two consequences follow and are stated here because they affect data subject rights: service communications reach users only inside the service (on-screen notices, the policy re-acceptance screen, and push notifications where enabled), and identity verification for a rights request is performed through the account itself rather than through a registered contact address. The date of birth given at registration is used within that request to check the minimum age stated in the Terms of Service and is then discarded; it is written to no record, so Clovera holds no date of birth for any account and cannot later verify or derive a user's age. A browser refused for being below the minimum age is refused again for twenty-four hours by a value held in its own session cookie and nowhere else. The year of a birthday is never asked for in the profile.
4. Login Records, Browser Identifier and Address Digests — Processing Details (GDPR Article 13/14 Notice)
Each successful login or registration causes Clovera to record which account signed in, when, the User-Agent string of the browser, and a digest of the browser identifier described in (a-bis) below. Nothing derived from the IP address of the connection is written to that record.
The following information is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR):
(a) Data processed in the login record: The associated user account identifier, the date and time of the login, the User-Agent string, and a digest of the browser identifier. The login record holds no IP address, no digest of one, no digest of the surrounding network range, no autonomous system number and no network category. Clovera formerly recorded those and no longer does, because behind proxies and carrier-grade network address translation the address reaching the server was frequently not the user's own and the record therefore associated unrelated accounts. No geographic location is derived from any address at any point.
(a-bis) Browser identifier: When a user signs in or registers in a browser that does not already carry one, and when a signed-in user's browser is found without one, Clovera places a random value in a cookie in that browser. It is generated by Clovera, describes nothing about the device or the person, expires five years after it is set, and is not removed on signing out. Only a one-way digest (SHA-256) of it is stored: on each login record, and in a list held against each account of the browsers it has been used from, with the time each was first and last seen. It is used for two purposes only: (i) to show Clovera's administrators which accounts have signed in from the same browser, in order to detect ban evasion, several accounts operated by one person to manipulate or harass, and sign-ins from a browser an account has never used; a shared browser is treated as a lead and never as proof, because people who share a computer share it too, and no account is restricted automatically on that ground; and (ii) when an administrator terminates an account, to record the digests of the browsers it used, and of any persistent-session tokens under Section 6, as banned browsers, so that requests presenting them are refused. No fingerprint of the browser or the device is taken. Clearing the site's cookies removes the identifier, and the next sign-in is then treated as coming from a new browser.
(b) Address digests kept elsewhere: While a request is being handled the server necessarily sees the IP address, and uses it at that moment for rate limiting, for checking the address against a ban already in force, where bot protection is enabled for the challenge verification described in Section 8(b), and for the Kitguard counts described in Section 4a, which are held in memory only, apart from the measures in force described in (viii) below. Afterwards the address is retained only as a one-way keyed cryptographic digest (HMAC-SHA-256) (taken, for an IPv6 connection, of the /64 network the address belongs to rather than of the single address, since that network is what identifies the subscriber), and only as follows: (i) a digest of the address used at registration, stored on the account record, to limit the number of accounts that can be created from one address; (ii) a digest of the address and the User-Agent string on every active session record, which is what allows a user to review and revoke their sessions in settings — created for every session, independently of the optional feature in Section 6; (iii) a record of each failed login attempt — and of a recovery key offered and refused — consisting of a digest of the address, the username attempted, the reason for the failure, and the User-Agent string, kept to detect password-guessing and account-takeover attempts, and carrying no account identifier because the username attempted need not belong to an existing user; (iv) a digest of the address stored with a persistent-session token under Section 6; (v) a digest recorded as a banned address when an account is banned, derived from the digests held under (iv), which may be retained after the account itself is erased; (vi) a digest of the address, with the User-Agent string, on a request to reset a password that is to be approved from a device still signed in to the account, compared with the digests held under (ii) so that the person deciding on the request is shown whether it came from an address the account has signed in from before, and deleted when the account is erased; (vii) the counters that enforce rate limits, each holding a digest of the address, the name of the action limited, a count reset when the window passes, and the times the window opened and was last touched, carrying no account identifier; and (viii) while a Kitguard stop, waiting period or temporary address block is in force, a record of it holding the digest of the address, or a value identifying the browser, or the account identifier, with the reference code, the kind of behaviour, the times it began and ends and how often it has been repeated, kept so that a restart does not lift it, deleted when it ends or with the account, and never kept longer than a day. The raw address is not stored in any of these.
(c) Purpose and legal basis: The purpose of this processing is to support account security, detection of unauthorized or suspicious access, abuse prevention, and enforcement of platform rules. The legal basis is legitimate interests (Article 6(1)(f) GDPR). Clovera has assessed that users have a reasonable expectation that login activity is monitored for security, and that this processing does not override users' fundamental rights given the pseudonymous nature of the data (hashed IP, no raw address).
(d) Retention: Login records, the list of browsers held against an account, session records, recovery requests and the registration digest are retained for as long as reasonably necessary for the security and enforcement purposes described above; they are not deleted on a fixed schedule, and those tied to an account are deleted when the account is erased under Section 9. Failed login records and rate-limit counters are retained independently of any account, since they are not linked to one. A digest recorded as a banned address or a banned browser may be retained after erasure, for as long as the enforcement purpose requires.
(e) No automated profiling: This processing does not involve automated decision-making or profiling within the meaning of Article 22 GDPR.
(f) No third-party disclosure: Login records are not shared with, disclosed to, or accessible by any third party except where required by law or necessary to investigate a serious safety or legal matter. This is separate from the disclosure of the IP address itself to a bot-protection provider on the login and registration pages and on the Kitguard check page, which is described in Section 8(b).
(g) Security: The digest is derived using a keyed one-way function (HMAC-SHA-256) with a secret key held only by Clovera. The key is required because the space of possible IPv4 addresses is small enough that an unkeyed digest could be reversed by exhaustive search; keying the digest removes that possibility for anyone who does not hold the key.
(h) Right to object: Users have the right to object to processing based on legitimate interests under Article 21 GDPR. Objection requests may be sent to kitteniversestudios@gmail.com. Clovera may decline to cease processing where it can demonstrate compelling legitimate grounds, such as ongoing security investigations.
4a. Kitguard — Processing Details (GDPR Article 13/14 Notice)
Kitguard is an automated check that stops a connection or an account whose behaviour strongly suggests automated abuse and asks it to pass a verification before continuing. Section 12 of the Privacy Policy describes it in full; the following information is provided in accordance with Articles 13 and 14 GDPR.
(a) Data processed: the keyed digest of the address a request comes from, for a signed-in user the account identifier, and for a browser that has passed the verification a value derived from the address digest and the User-Agent string; a score for each, made of fixed weights for the following events and halving every fifteen minutes: requests that keep arriving above the per-second limit for an address or an account, at least thirty refused within a minute, with images and the site's own files counting for very little and refusals caused only by many people sharing an address not counted against anyone; collisions with the rate limits of actions that publish something or reach other people, not of typing indicators, edits, live updates or translations; sign-in, registration or recovery attempts refused because too many have already failed or been made, and failed bot-protection checks or arithmetic questions on the login or registration page, but not a single wrong password; registration attempts beyond the limit for one address; requests for paths only vulnerability scanners ask for, more than thirty requests within a minute for pages that do not exist (images and other files aside), bursts of changing requests for such pages, and sequential fetching of numbered pages; following the hidden link every page carries, which no person can see or reach and which crawlers are told not to follow, and which on its own leads to a stop; well-known attack patterns, such as database, script, template or command injection, reading files outside the site or sending the visitor to another site, in the path, the query string other than fields people type text into, or the User-Agent string, of which only the presence is noted; request methods no browser sends; requests for the administration pages by anyone who is not an administrator; requests larger than the service accepts; more than twelve different pages refused to one address within a minute for lack of access; and content submitted by an account in its first period after registration, or a username chosen at registration, that the automated moderation described in Section 7 blocks. Content of an established account is not counted, and the serious-crime screen is never counted. Apart from requests only machines make, an event of the same kind is counted at most once every five to thirty seconds. Nothing about the content or the request involved is kept, only that an event of one of these kinds occurred and when. Where a person is stopped: a random reference code, whether and when they passed or failed the verification, and any waiting period. For the operator of the service only, a list of the most recent decisions, holding the time, the kind of decision and of behaviour, the reference code and, where the person was signed in, the account identifier, but no address and no digest of one.
(b) Whose score is used: a visitor who is not signed in is assessed by the address digest until their browser has passed the verification, and afterwards by that browser's own score; a signed-in account by its own score and, while the account is new (24 hours after registration unless the operator changes it), also by the part of the address's score that comes from requests arriving too fast or from probing — not by sign-in failures, limits or blocked content, which on a shared address may be other people's. An established account is never assessed by its address. Administrators, the service's own bot accounts, and search engine crawlers verified as such are not scored.
(c) The verification and the cookie: where bot protection is enabled, the hCaptcha challenge under Section 8(b), together with a short calculation performed by the browser that reads nothing from the device; otherwise, or where the provider cannot be reached, holding a button down while the browser performs that calculation. Passing ends the stop and sets a cookie that holds only an expiry time and a signature derived from the address digest and the User-Agent string, of which Clovera keeps no copy; it expires after six hours. While it is valid, the browser is judged on its own score rather than on the address's, and is not asked again while attack mode is on. Where the stop was on an address, the address keeps its score, so that whatever caused it is not let through by someone else passing.
(d) Purpose and legal basis: protecting the availability of the service and the security of accounts and communities against automated abuse. Legal basis: legitimate interests (Article 6(1)(f) GDPR).
(e) Retention: apart from a referral under (f), and the stops, waiting periods and temporary address blocks still in force, which are kept in the database as described in Section 4(b)(viii) until they end so that a restart does not lift them, everything listed in (a), and the five-minute clock kept for each stop, is held in the server's working memory and never written to the database or to disk, and is lost whenever the service restarts. A score that has fallen back to almost nothing is discarded; an entry untouched for three hours is discarded the next time the service handles a request, unless a stop or a waiting period is in force; the list of decisions is limited to its last 200 entries and to the last 24 hours. The operational log records when the operator releases a stop, with the reference code and the operator's account, and when an address is temporarily blocked, with the reference code but without the address. The one exception is a referral under (f): a case for an administrator holding the account identifier, the number of passes within the hour, the kind of behaviour and the reference code, and no address or digest of one, stored encrypted in the database and kept, with its contents erased on erasure of the account, as the review cases described in Section 7 are.
(f) Automated decision-making: Kitguard evaluates behaviour automatically and is therefore a form of profiling. The decisions it can take are limited to asking for the verification within five minutes, imposing a wait of at most sixty minutes after repeated stops of a browser used without signing in, failed attempts or a verification not passed within those five minutes — counted per browser where the stop is on an address — and refusing requests from an address that keeps sending them while stopped for a limited time, never more than a day, never against a session already signed in, and never where someone has passed the verification from that address within the last hour. A signed-in account that is stopped again after passing the verification three times within an hour is not made to wait but referred to a human administrator, who decides whether anything is done under the Terms of Service. It does not restrict, suspend or terminate an account and does not remove content, and these decisions do not produce legal effects or similarly significantly affect the person concerned within the meaning of Article 22 GDPR. A person who believes they were stopped wrongly can send the reference code shown on the page to kitteniversestudios@gmail.com and have the stop looked at and released by the operator of the service, a person.
(g) Right to object: under Article 21 GDPR, by writing to kitteniversestudios@gmail.com.
5. Public Visibility of Content — Processing Details (GDPR Article 13/14 Notice)
Some personal data a user publishes on Clovera is made available to the public at large, and part of it is offered to search engines. Because that audience is wider than the service's signed-in users, it is described here as a separate processing operation.
(a) Data processed and recipients: Content a user marks public — a public feed post and the files attached to it, a published blog article, the front page of a community the owner has listed publicly — together with the author's username, display name, profile photo, banner, and the reactions and comments on the item, is served to any visitor without an account and is listed in Clovera's sitemap, so that search engines and AI crawlers may fetch and index it. The recipients are therefore the general public and the operators of those crawlers, and this constitutes a transfer to any country from which the pages are fetched.
(b) Readable but not indexed: In a community the owner has listed publicly and left open to guests, the text and announcement channels, the forum listing and the forum threads are readable by any visitor holding the link. Those pages are excluded from the sitemap and are served with a "noindex" instruction in the page and in the response headers, so that they are not placed in a search index unless the operator switches indexing on for the deployment. Voice, mission, counting and showcase channels are never readable in this way, and permissions that hide a channel from everyone hide it from visitors as well.
(c) Purpose and legal basis: To publish what the user has chosen to publish and to allow a community to be found. The legal basis is performance of the contract with the user for content the user has actively marked public (Article 6(1)(b) GDPR), and Clovera's legitimate interest in making publicly listed communities discoverable (Article 6(1)(f) GDPR) for the community pages, the owner having chosen to list the community publicly. Guest reading of a publicly listed community is on unless the owner turns it off in Community settings → Visibility.
(d) Limits of erasure: Once content has been fetched by another person, by a search engine or by a crawler, Clovera can stop serving it but cannot recall the copy already taken. Deleting an item or making it private removes it from Clovera and is what causes search engines to drop it in time. Users should treat anything marked public as published.
(e) Right to object: A user may make a post or a blog article private or delete it at any time, and a community owner may close guest reading, at which point the processing under this Section ceases for that content. Objections under Article 21 GDPR may be sent to kitteniversestudios@gmail.com.
6. Persistent Session — Processing Details (GDPR Article 13/14 Notice)
Clovera offers users an optional feature presented at login as "Keep me signed in on this network". When a user opts in, Clovera places a random device token in a cookie on that browser and stores a digest of that token, together with a one-way keyed cryptographic digest (HMAC-SHA-256) of the address the user was connecting from, against the user account, so that the session can be restored without the credentials being re-entered.
The following information is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR):
(a) Data processed: A digest of the device token, a one-way keyed cryptographic digest of the user's IP address, and the associated user account identifier. The raw IP address is not stored.
(b) How the session is actually restored: By the device cookie alone. A returning browser that presents the token has the session restored whatever address the request comes from; the stored address digest is not consulted for that purpose, despite the wording of the option. This is stated because it bears both on the security risk a user takes by enabling the feature and on the basis for keeping the address digest at all.
(c) Purposes and legal bases: Two purposes, with two different bases. Restoring the session at the user's request rests on consent (Article 6(1)(a) GDPR), expressed through the voluntary selection of the option at login and withdrawable at any time. Keeping the address digest rests on Clovera's legitimate interest in making an enforcement decision effective (Article 6(1)(f) GDPR): where the account is banned, the digests held with its persistent-session tokens are recorded as banned addresses so that the same address can be refused. That second purpose is not covered by the consent and is not ended by its withdrawal, though it cannot arise for a token that has already been deleted. Users who do not select this option have no persistent token and no digest stored under this Section. This is a distinct record from the session address digest described in Section 4(b)(ii), which is created for every session regardless of this choice.
(d) Retention: A token that is not revoked is retained for as long as the user account exists; it is not deleted on a fixed schedule. The accompanying device cookie expires five years after it is set. Tokens are removed when the account is erased under Section 9 and when the account is banned; a digest already recorded as a banned address is governed by Section 4(d).
(e) Right to withdraw consent, and to object: Consent may be withdrawn at any time by logging out, by signing out of all other devices, or by revoking an individual token in Settings → Sessions; each of these deletes the stored token and the digest held with it. Withdrawal does not affect the lawfulness of processing prior to withdrawal. The right to object under Article 21 GDPR applies to the legitimate-interests purpose in (c).
(f) No automated profiling: This processing does not involve automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR. A ban is imposed by a human administrator; the address digest only gives effect to that decision.
(g) No third-party disclosure: The hashed IP address and session token are not shared with, disclosed to, or accessible by any third party.
(h) Security: The digest is derived using a keyed one-way function (HMAC-SHA-256) with a secret key held only by Clovera, so the original address cannot be recovered by exhaustive search.
7. KittenAI Features and Automated Moderation — Processing Details (GDPR Article 13/14 Notice)
Clovera's built-in AI features ("KittenAI") — conversation summaries, message translation, Live Translation, reply suggestions, Catch-Up digests, the KittenAI chat assistant, writing assistance, the translation of live captions in voice channels, and automated content moderation — are powered by Anthropic's Claude models, accessed through the Claude API.
The following information is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR):
(a) Data processed: The content submitted to or covered by the relevant feature. Depending on the feature, this may include the text of direct messages, group messages, and channel messages together with participants' display names; posts, post comments, and blog articles; usernames and profile text; the name, description, welcome message, and channel names of a community and the name of a group chat; messages sent to the KittenAI chat assistant, together with the earlier messages of that assistant conversation and, where the user attaches one of their own direct or group conversations to it as context, the last forty messages of that conversation with the sender names; the text of a line of live captions in a voice channel, without the name of the person who said it, where someone in the channel reads another language; and images (profile photos, banners, server icons, and post attachments) submitted for automated moderation; together with limited context such as the target language. No account identifier is transmitted; the user identifier is used only within Clovera to apply per-user rate limits.
(b) Recipient and processor: Anthropic, PBC, acting as a processor on Clovera's behalf via the Claude API. Content is decrypted on Clovera's servers before transmission to Anthropic and is processed by Anthropic subject to Anthropic's Commercial Terms of Service and the data processing terms incorporated in them. Under those terms, content submitted through the API is not used to train Anthropic's models. Content that Anthropic's automated safety systems flag as breaching its usage policy may be retained for longer and reviewed by Anthropic's trust and safety staff for that purpose alone.
(c) Purpose and legal basis: For user-initiated features and Live Translation (an opt-in setting, off by default), the purpose is to provide the assistance the user has requested; the legal basis is the user's consent (Article 6(1)(a) GDPR) and, where the feature forms part of the requested service, performance of a contract (Article 6(1)(b) GDPR). For automated content moderation, the purpose is protection of users, prevention of abuse and illegal content, and enforcement of platform rules; the legal basis is legitimate interests (Article 6(1)(f) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR).
(c-bis) Web search in the chat assistant: unless the operator has switched it off, the KittenAI chat assistant can search the web while answering, which means the model forms a search query from what the user asked and Anthropic runs the search, which may involve a search provider Anthropic engages, so the substance of that question reaches that search service as well as the model; the pages the answer was drawn from are kept with the reply and shown under it. It runs only in the chat assistant and only in an exchange the user starts. No other feature can search, so no direct message, group message, community message, summary, translation, Catch-Up digest or moderation check is ever turned into a search query. Legal basis: the user's request for the feature and the performance of the service they asked for (Article 6(1)(b) GDPR) and, so far as it goes beyond that, legitimate interests in answering accurately rather than from memory (Article 6(1)(f) GDPR). How Anthropic, and any search provider it engages, handles a query is governed by Anthropic's terms for the Claude API.
(c-ter) Live captions in voice channels: where someone who can configure a voice channel has switched captions on (they are off by default), each speaker's own browser writes down what they say, using the speech recognition built into the browser, and only while that speaker's microphone is on. Where the browser can do this on the device it does; otherwise the browser sends the sound to its vendor's speech service (for Google Chrome, Google), which is a feature of the browser governed by its vendor's terms; Clovera's servers neither send nor receive the sound. Clovera receives only the resulting text, stores it encrypted for at most six hours, shows it to the people in the channel, and deletes it, with its translations, when captions are switched off for the channel or the speaker's account is erased. A line is sent to Anthropic only to translate it for someone in the channel who reads another language, and without the name of the person who said it. Legal basis: legitimate interests (Article 6(1)(f) GDPR) of the people in the channel in following what is said in a language they read or that they cannot hear, balanced by captions being off unless the channel enables them, by the short retention, and by the absence of any identifier in what is sent for translation.
(d) Scope of automated moderation: Moderation runs without being requested on feed posts and post comments — including posts that are not public — blog articles, usernames chosen at registration or changed later, profile text, profile photos, banners, server icons, messages sent by creator bots, the name, description, welcome message, and channel names of a community, the name of a group chat, and messages and forum posts in the channels of communities that have enabled moderation. Where a community has not enabled it, nothing written in its channels is measured against the platform rules by an automated process; it remains within the serious-crime screen described in (d-bis) below, which asks a different and narrower question and which a community owner cannot switch off. A user's own direct messages and group messages are not read by that general moderation, by the serious-crime screen in (d-bis), or by any other automated review; they are transmitted under this Section only where a conversation participant uses one of the user-initiated features or Live Translation on the conversation.
(d-bis) Serious-crime screen: Clovera puts the text of a single item to KittenAI with a single question — whether it is itself a step in organised or other grave crime. Only the messages, forum threads, and forum replies written in a community's channels are within it, wherever they are written; a community's moderation setting decides only whether the general moderation in (d) runs there and does not reach this screen, and only the operator of the service can switch this screen off, for the whole service. It never reads a direct message or a group message, and no setting extends it to them. The categories are closed and are listed in Section 15(e) of the Privacy Policy: running a criminal organisation; trafficking or smuggling people, forced labour, and forced prostitution; terrorism; dealing in drugs, firearms, or explosives; the sexual abuse of children; arranging violence for another party; and laundering money, trading stolen payment or identity data, or producing counterfeit money or documents. It is not general moderation: insults, threats made in anger, hate, harassment, sexual talk between adults, jokes, roleplay, fiction, personal drug use, and discussion of crime as a subject are outside it and are not flagged. Only the text of the single item is transmitted, with no username, display name, identifier, or anything else written around it, and a file attached to it is never opened or transmitted by the screen; messages already deleted are not read. Where no category is found, nothing is recorded and no trace of the reading is kept. Where one is found, a case is opened for a human administrator holding the date, the category, the account that wrote it, the community and channel, and an encrypted excerpt of at most 200 characters. Nothing the screen reads is used for profiling, ranking, targeting, or any other purpose, and a finding is excluded from the counts the account, community, and group review below works from. Legal basis: legitimate interests in preventing the service from being used for serious crime and in protecting its users (Article 6(1)(f) GDPR), and compliance with legal obligations to act against illegal content and to cooperate with lawful orders (Article 6(1)(c) GDPR). The screen removes nothing, restricts nothing, and places no community on hold of its own motion; every consequence for a user follows from a human decision on the case. Until 15 October 2026 the operator could also enable the screen for direct and group messages; that switch has been removed, and a case opened over such a message while it was enabled stays with a human administrator until it is decided.
Account, community, and group review: at intervals Clovera also reviews accounts, communities, and groups for spam, deception, and coordinated attacks. Beyond the texts listed above, this review relies on counts derived on Clovera's own servers from usage data — publishing frequency, the number of distinct direct-message recipients who never replied or who blocked the sender, group additions, friend requests, blocks, reports, earlier automated removals, community invite links and membership bursts, and a match between an account's address digest and a ban record — none of which is transmitted to Anthropic and none of which involves reading a private or group message. Legal basis: legitimate interests (Article 6(1)(f) GDPR) in protecting users and the service from spam, fraud, and abuse.
(e) Third-party processing note: Content a user sends to others may be processed under this section when another conversation participant uses a KittenAI feature on the conversation, or when the content is subject to automated safety moderation.
(f) International transfers: Anthropic processes this content on servers located outside the EEA, including in the United States. Transfers rely on the safeguards provided under Anthropic's data processing terms, namely the standard contractual clauses incorporated in them and, where Anthropic is certified under it, the EU–U.S. Data Privacy Framework.
(g) Retention: Clovera caches translation results in encrypted form to reduce repeat processing and retains AI-related records only as long as reasonably necessary. A conversation with the KittenAI chat assistant is an exception worth stating: it is kept in plain text on Clovera's servers so that it can be displayed again and sent back as context for the next question, until the user clears it on that page or the account is erased. Anthropic's retention of API request data is governed by Anthropic's Commercial Terms of Service and data processing terms.
(h) Automated decision-making: Automated moderation may result in content being blocked, removed, or restricted without prior human review, and may place a community on hold — hidden from discovery and closed to new members — pending human review; the hold is reversible. The account, community, and group review and the serious-crime screen each produce a case for a human administrator and do not themselves suspend an account, close a community, dissolve a group, or remove a message; those decisions, which could have a significant effect on the person concerned, are taken by a human, so the review does not constitute a decision based solely on automated processing within the meaning of Article 22 GDPR. Users may contest a moderation decision and request human review by contacting kitteniversestudios@gmail.com.
(i) Right to object and withdraw consent: Users may withdraw consent for user-initiated features by not using them, and for Live Translation by disabling it in settings at any time. Users may object to processing based on legitimate interests under Article 21 GDPR by contacting kitteniversestudios@gmail.com; Clovera may continue processing where it can demonstrate compelling legitimate grounds, such as safety and abuse prevention.
8. Other Recipients — Processing Details (GDPR Article 13/14 Notice)
Beyond Anthropic's role under Section 7, the following recipients receive personal data when Clovera is used.
(a) Hosting and infrastructure. Clovera's application and database run on a third-party hosting platform, which processes all data stored or transmitted by the service in order to operate it, as a processor acting on Clovera's instructions.
(b) Bot protection — Cloudflare, Inc. (Turnstile) and Intuition Machines, Inc. (hCaptcha). Where the operator has enabled bot protection, the login and registration pages, and the Kitguard check page described in Section 4a, load the provider's challenge script, and Clovera transmits the challenge token together with the visitor's IP address to the provider in order to verify the result. The address is transmitted in full for this check, even though Clovera stores only a digest of it. The provider may set its own cookies or browser storage and collect browser signals in order to distinguish automated traffic. Purpose: prevention of automated account creation, credential-guessing and other automated abuse. Legal basis: legitimate interests (Article 6(1)(f) GDPR). This applies only to those three pages and only while the protection is enabled; the script is not loaded anywhere else. Clovera's server may also contact the provider with a placeholder value carrying no data about any visitor, to find out whether it can be reached.
(c) Typefaces (no recipient). The typefaces Clovera's pages use are served from Clovera's own server. No request for a font goes to Google or to any other third party, and no transfer outside the EEA arises from them. Until 20 October 2026 they were loaded from Google's font servers, which received the visitor's IP address and User-Agent string on every page view.
(d) Push notification delivery. If a user enables push notifications, their browser registers with the push service operated by the browser's vendor (for example Google, Mozilla, Apple, or Microsoft). Clovera stores the resulting subscription endpoint and encryption keys and sends notifications through that service, which therefore learns that a notification was sent to that subscription and when; the content is encrypted in transit to the browser. Purpose: delivery of the notifications the user has asked for. Legal basis: consent (Article 6(1)(a) GDPR), given by enabling push notifications, which are off by default and can be turned off at any time in settings.
(e) Browser speech recognition. Where a voice channel has switched on live captions and a speaker's browser cannot recognise speech on the device, the browser sends that speaker's sound directly to the speech service operated by its vendor (for Google Chrome, Google) to have it written down, as Section 7(c-ter) describes. Clovera's servers neither send nor receive that sound; Clovera receives only the resulting text.
Clovera does not use analytics, advertising, tag-management, or audience-measurement services, and embeds no third-party content other than what is listed in this Section and Section 7.
8a. Calls, Voice Channels and Screen Sharing — Processing Details (GDPR Article 13/14 Notice)
Clovera offers one-to-one calls, started from a direct message and carrying sound only, and voice channels inside a community, carrying sound and, where a member shares a screen, the picture of that screen or window with its sound where the sharer includes it.
(a) How the media travels: not between the participants and not through any third party. Each participant's stream travels over an encrypted connection to Clovera's own server, which forwards it to the other participants from memory. No STUN, TURN, or other relay operated by anyone else is used, and no recipient beyond the other participants receives it. Because it is forwarded by Clovera's server it is not end-to-end encrypted, and that server is technically in a position to read it while it passes.
(b) Data processed and retained: the sound and the shared picture are held only for the moment they are being forwarded. Nothing is recorded and nothing is written to disk. The set-up messages the two browsers exchange to start a call, which carry their network addresses, are held on the server only while the call is being set up and are deleted the moment it ends or goes unanswered. No transcript is produced, except that in a voice channel that has switched on live captions, the lines each speaker's browser writes down are kept encrypted for at most six hours, as Section 7(c-ter) describes. What is retained is a record that a call took place, between which two accounts, whether it was answered, and when it began and ended; and, while a user is in a voice channel, that they are in it, together with whether they are muted, deafened, or sharing a screen, and by whom they were muted where a moderator muted them. Those records are deleted when the account is erased under Section 9.
(c) Purpose and legal basis: to provide the call the user has asked for, which is performance of the contract for the service (Article 6(1)(b) GDPR). The record of who is present in a voice channel exists so that the channel can show its participants and so that a moderator can act on what happens in it, which rests on the same basis and, for the moderation part, on legitimate interests (Article 6(1)(f) GDPR).
(d) No AI processing of sound or pictures and no moderation: no automated review is applied to a call, a voice channel, or a shared screen, and Clovera transmits nothing spoken or shown to Anthropic or to any other processor. The only part of Section 7 that reaches a voice channel is the translation of live caption text described in Section 7(c-ter).
(e) Consequence for a complaint: since nothing is retained, Clovera cannot produce what was said in a call. A complaint about conduct in one is assessed on what the person complaining can show.
9. Erasure and How to Exercise It
A data subject may exercise the right to erasure under Article 17 GDPR directly in the service: the account settings contain a "Delete account" control that erases the account at once. The erasure is irreversible and has no waiting period; confirming it requires the account password and the account's own username. Where the account owns a community that other members are still in, that community must first be handed to another member or closed, so that erasing one person's account does not destroy a group of other people's content. A user who cannot reach the control may instead write to kitteniversestudios@gmail.com from, or while signed in to, the account concerned, and the controller will carry the erasure out manually; because no email address is held for any account, such a request must contain enough information for the controller to be satisfied that it comes from the account holder.
Erasure removes the account record, its login records, the list of browsers it was used from, session records, persistent-session tokens, any recovery request made for it, the account's direct, group, and channel messages, its posts, comments, blog articles, polls, reactions, and uploaded files, its conversation with the KittenAI assistant, the records of its calls and of its presence in voice channels, the recovery keys issued to it, any bots it created together with those bots' own accounts, and the registration IP digest. Failed login records and rate-limit counters are not removed, because they carry no account identifier; content other recipients have received may remain in their own conversation history; and records Clovera must keep to comply with a legal obligation, to defend a legal claim, or to prevent the recurrence of serious abuse may be retained for as long as that purpose requires, with any link to the erased account removed where the record can stand without it. Clovera keeps a record that an erasure occurred — its date, whether the account holder or the controller carried it out, and how much was removed — which identifies no account.
Several rights can be exercised directly in the service: the account and its data can be erased from settings as described above, profile details and the username can be corrected in settings, individual messages, posts, comments, and blog articles can be deleted by their author, active sessions on other devices can be revoked, Live Translation can be disabled, and push notifications can be turned off. Note that deleting a message hides it from the participants but does not destroy the stored copy immediately; that copy is retained so that reports about content deleted moments after it was sent remain capable of assessment, and is destroyed as part of an erasure carried out under this Section. Since 14 September 2026 that stored copy is encrypted only where the message is a direct message between two people; a group message or a community channel message is held in plain text, for the reasons Section 8 of the Privacy Policy gives. A file attached to a message is not encrypted in either case, and neither are the other items that Section lists.
9a. Personal Data Breaches
Where a breach of security leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, Clovera assesses it as soon as it becomes aware of it, records it, and notifies the competent supervisory authority under Article 33 GDPR without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of the people affected. Where the breach is likely to result in a high risk to them, Clovera also communicates it to them under Article 34 GDPR.
Clovera holds no email address or telephone number for any account, so such a communication cannot be sent out of band. It is given inside the service — an on-screen notice to every account, and a push notification where the user has enabled them — and on the public site, which is the route Article 34(3)(c) contemplates where individual communication would involve disproportionate effort. A person who has stopped using the service, or whose account has been erased, cannot be reached at all; this follows from Section 3a and is stated here rather than discovered during an incident.
10. Rights
Subject to applicable law, users may request access, correction, deletion, restriction, objection, or portability. Users may also lodge a complaint with a competent supervisory authority.
11. Contact
Data protection requests may be sent to kitteniversestudios@gmail.com.
12. Limits
Some rights are subject to exceptions, including where retention is necessary for security, fraud prevention, legal compliance, defense of legal claims, or protection of other users.
