Privacy Policy
Version 2.0 · Published 27 October 2026. Earlier versions are available on request.
Summary
- Who we are. SirenDM is a small software business in the Czech Republic.
- What we do. SirenDM CRM is software that creators and agencies use to chat with their fans, with AI and with their own team.
- If you are a customer, we decide how your account data is used (section 3).
- If you chat with a creator or agency that uses SirenDM, that creator or agency is in charge of your data, not us. Ask them first (section 4).
- AI providers see messages. To write replies we send messages to AI providers, mostly in the United States (section 5).
- Your rights. You can ask for a copy, a correction or deletion, and you can object. Write to support@sirendm.app. You can complain to the Czech data protection authority (ÚOOÚ) or your local one.
1. Who we are and how to reach us
1.1 The controller is SirenDM ("we", "us").
1.2 For privacy questions, rights requests, reports of illegal content and requests from authorities, write to support@sirendm.app. You can write in English or Czech.
2. Whose data this policy covers, and our role
| Who you are | Our role | Section |
|---|---|---|
| A customer of SirenDM CRM (creator, agency, partner) or one of their team members | Controller | 3 |
| A fan of a creator or agency who uses SirenDM CRM, on Telegram, Fanvue, 4Based, f2f.com, a web chat page or a partner's app | Processor for the customer, who is the controller. Controller only for the purposes in 4.4 | 4 |
| A visitor to sirendm.app or the dashboard | Controller | 6 |
"Controller" means we decide why and how your data is used and we answer to you directly. "Processor" means we only handle the data for someone else, on their instructions.
3. Customers and team members
3.1 What we collect
| Data | Where it comes from |
|---|---|
| Name, email, password (stored as a hash by our login provider) or Google sign-in identity | You |
| Company or trading name, country, account type, contact handles you give us | You |
| Team members: name, email, role, which agents they can access, shifts, sales credited to them, their actions in the dashboard | The customer who invited them, and the dashboard |
| Platform connections: the Telegram login session and the phone number of the connected Telegram account; Fanvue access tokens; 4Based and f2f.com login details and session | You |
| Proxy settings for your connected accounts | Us or you |
| Media you upload (photos, videos, captions, prices), agent settings (persona, scripts, example replies, prices, rules) | You |
| Voice samples you upload to create an agent voice, and the API key for your own Fish Audio or ElevenLabs account | You |
| Billing: plan, invoices, VAT ID, billing address, payment status, credit balance. Card details stay with Stripe; we never see the full card number | You and Stripe |
| Crypto top-ups: amount, currency, payment status | CoinGate |
| Card sales of your content through Lustify: sales amounts and our fee | Lustify |
| When you accepted our Terms | You |
| Support messages and feedback you send | You |
| Referral data: who referred you, and the email of anyone you refer | You and our referral link |
| Technical data: log-in times, IP address, browser, errors | Your device |
You must give us the data needed to open and pay for an account. Without it we cannot provide the service. Everything else is optional.
3.2 Why we use it and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Run your account and the service, take payment, give support | Contract, Art. 6(1)(b) |
| Invoices, accounting, tax | Legal obligation, Art. 6(1)(c) |
| Keep the service secure, stop fraud and abuse, enforce our Terms | Legitimate interest, Art. 6(1)(f) |
| Keep a record that you accepted our Terms and the promises in them, and keep what we need to establish or defend legal claims | Legitimate interest in proving the contract and defending claims, Art. 6(1)(f) |
| Tell you about changes to the service and the Terms | Contract, Art. 6(1)(b) |
Team members. The customer who invited you decides how you work in its workspace. We handle your shifts, sales credit and activity for that customer as its processor. We are the controller only for your login and for keeping the service secure.
3.3 Voice samples
Voice samples you upload are sent to the voice provider you chose (Fish Audio or ElevenLabs) under your own account with that provider, using your API key. That provider's terms apply to the voice model it builds. You must have the speaker's written consent before you upload a voice that is not yours.
4. Fans of SirenDM CRM customers
4.1 Who is in charge of your data. If you chat with a creator or agency that uses SirenDM CRM, that creator or agency decides how your data is used. They are the controller. We provide the software and handle your data on their instructions, under a data processing agreement. Their privacy notice applies, and you should send rights requests to them. If you write to us, we pass your request on to them.
4.2 What we handle for them. Your platform ID, name, username and profile photo; for Telegram, the country Telegram reports for your phone number (not the number itself) and groups you share with the creator's account; your messages and the replies; media you send, and transcripts and descriptions of it; what you were offered, bought and paid; and notes and labels the software keeps about the chat, such as your language, your city if you mentioned it, the stage of the conversation, your mood and interests, and facts you mentioned.
4.3 AI. Creators and agencies decide whether AI writes replies to you and how it replies. We provide the AI technology to them. We urge them to tell fans that AI is used, and doing so is their duty under their own privacy notice and the law. We do not control how they use it.
4.4 What we do on our own account. For a few purposes we are a controller even for fan data:
- to detect and act on child sexual abuse material and other clearly illegal content, and to report it to authorities (section 8);
- to answer orders from courts and authorities that bind us;
- to calculate the fee our customers pay us on their sales;
- to establish or defend legal claims.
Our legal basis is legal obligation (Art. 6(1)(c)) or our legitimate interest in protecting people, our service and our rights (Art. 6(1)(f)), and for sensitive data Art. 9(2)(f) and (g).
5. Our service providers and where data goes
5.1 We use carefully selected service providers to run SirenDM. They process data only to provide their service to us.
| Type of provider | What it does | Data |
|---|---|---|
| Cloud hosting and infrastructure | Database, file storage, login, servers, network and website hosting | All data in this policy |
| AI and language model providers | Write replies, classify and summarise messages, transcribe voice notes, describe photos and videos fans send, search | Messages, chat context, notes about the chat, voice notes, photos, videos |
| Connectivity providers | Securely connect customers' platform accounts | Encrypted connection traffic and connection metadata |
| Payment providers | Customer subscriptions, top-ups and invoices; fan purchases | Billing and payment data |
| Voice providers, on the customer's own account | Voice notes | Voice samples, reply text |
| Sign-in, content and embedded tools | Sign-in with Google, fonts, tutorial videos and booking links in the dashboard (section 6.2) | Sign-in identity, IP address, device data |
5.2 Platforms you connect. Customers connect messaging and creator platforms such as Telegram and Fanvue. These platforms act under their own terms and privacy policies.
5.3 Contracts. We put data processing terms in place with providers wherever possible; some offer only their standard terms. External sites and services linked from SirenDM are not covered by this policy.
5.4 AI providers. We do not sell your data. Some AI providers keep requests for a limited time under their own terms, for example for abuse monitoring.
5.5 Transfers outside the EEA. Several providers, including our AI providers, are in the United States or elsewhere outside the EEA. These transfers rely on an EU adequacy decision (including the EU–US Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses.
5.6 Full list. Customers can ask for our current list of sub-processors at support@sirendm.app. It is also part of our data processing agreement.
6. Website visitors and cookies
6.1 sirendm.app.
- Campaign tags. If you arrive from an ad or a referral link, we keep the campaign tags (
utm_*,fbclid,ref) in your browser for this visit and pass them to the sign-up page. - No tracking. We do not use analytics or advertising trackers on sirendm.app.
6.2 Dashboard. We use your login session and security tokens, and, if you came from a referral link, we keep the referrer's code in your browser for 7 days. The dashboard loads fonts from Google and can show tutorial videos (YouTube, Loom) and a booking calendar (Notion). These send your IP address and device data to those companies. We do not use analytics or advertising trackers in the dashboard.
6.3 Web chat pages. We store a random visitor ID in your browser so you can come back to your chat. We use your IP address briefly to limit abuse and do not store it.
7. Your rights
7.1 You have these rights under the GDPR, and the same rights under UK law:
| Right | What it means |
|---|---|
| Access (Art. 15) | Get a copy of your data and information about how we use it |
| Correction (Art. 16) | Have wrong data corrected |
| Deletion (Art. 17) | Have your data deleted, unless we must or may keep it (for example for tax or a legal claim) |
| Restriction (Art. 18) | Have us pause using your data while a complaint is checked |
| Portability (Art. 20) | Get data you gave us in a machine-readable file |
| Objection (Art. 21) | Object to use based on our legitimate interest. You can always object to marketing, and we stop |
| Withdraw consent (Art. 7(3)) | At any time. Withdrawing may mean you can no longer use features that need it |
| Complain | To the Czech data protection authority (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or the authority where you live or work. In the UK: the Information Commissioner's Office, ico.org.uk |
7.2 How to ask. Email support@sirendm.app. Some rights apply only under certain conditions. We may ask for something that proves the data is yours, and we may refuse requests that are manifestly unfounded or excessive, for example repetitive ones. We answer within the time the law sets.
7.3 Customers can also delete their account in the dashboard. Deletion is permanent. We may keep invoices, payment records, the record that you accepted our Terms, and data needed for a legal claim, for the periods in section 9.
7.4 Fans of SirenDM CRM customers. Please contact the creator or agency first (section 4).
8. Child safety, illegal content and authorities
8.1 Adults only. SirenDM is for adults. Customers must be 18 or older and may only upload content of adults who consented to it.
8.2 We act on reports sent to support@sirendm.app and on what we see ourselves. We do not scan every file on the service. We may remove access to illegal content, suspend the account involved, keep content and records as evidence, and report apparently illegal content to the competent authorities, without telling the account holder first. Where the law requires us to report, we do. Legal basis: legal obligation and our legitimate interest in protecting children and others (Art. 6(1)(c) and (f)).
8.3 Authorities. We give data to courts, police and authorities when the law requires it, or where it is needed to protect someone's life or safety.
9. How long we keep data
| Data | How long |
|---|---|
| Telegram chat messages and scheduled message records | 45 days from each message, deleted automatically |
| Chat messages on Fanvue, 4Based, f2f.com, web chat and the API | 180 days from each message, deleted automatically |
| Chat summaries, labels, notes, memory and spend totals for customers' fans | Until the customer deletes the agent or the account |
| Customer account, agents, media and settings | Until the customer deletes them or the account |
| Record that a customer accepted our Terms | As long as needed to prove the agreement and defend claims |
| Invoices and payment records | As long as Czech accounting and tax law requires |
| Data needed for a legal claim or an investigation | Until the matter is closed |
| Server logs | 7 days |
| Database backups | As long as our database provider keeps them, then overwritten |
10. Security
We use appropriate technical and organisational measures for a business of our size, including encryption by our hosting provider, separation of each customer's data and restricted staff access. No system is completely secure and we cannot guarantee security. You are responsible for keeping your logins, keys and connected accounts secure. If a breach puts your data at risk, we tell the supervisory authority, customers and you where the law requires it.
11. Children
SirenDM is not for anyone under 18. We do not knowingly collect data from children. If you believe a child is using our service, write to support@sirendm.app.
12. People in the United States
We are a Czech business. If you live in a US state with a privacy law that applies to us, write to us about your rights under it. We do not sell personal information. We do not share personal information for cross-context behavioural advertising.
13. Changes to this policy
We may change this policy from time to time. The latest version is always on this page with its date, and we tell you about significant changes where the law requires it.
14. Contact
SirenDM. Email: support@sirendm.app.