Privacy notice
Last updated 8 September 2026
This notice explains how Erissa handles personal data under the UK GDPR, the EU GDPR and the Data Protection Act 2018. Caan Consultancy Ltd is the controller for the personal data described in this notice, including your account data, your conversations, and your companion's memories.
Where your data actually lives
On our servers: your email address, your password as a cryptographic hash, your display name and timezone, your plan and subscription status, your conversation history, your companion's memories, emotional readings derived from your messages, a monthly message count, security events, and technical connection data such as IP address and browser type. Conversations and memories are stored so that your companion remembers you and your history is available when you sign in, including on a new device.
On your device: a local copy of your conversation and memories is also kept in your browser's own storage so the app responds quickly and works before you sign in. Signing out on this device clears that local copy.
Passed to our AI provider: to write a reply, Erissa needs a model to write it. When you send a message, that message — plus whichever memories are selected as relevant — is sent to our AI provider to produce the reply. Our AI provider is contractually barred from training on it or keeping it beyond the request.
Looking after your data
You can inspect, correct, pin, lock or delete every memory, and delete your conversation history, in the app. You can request a copy of your data or full erasure at any time — most of these are one click in Settings → Data and privacy, and anything else is handled under "Your rights" below.
Who we are
Erissa is a trading name of Caan Consultancy Ltd, registered in England & Wales. Contact: privacy@erissa.ai. Our EU representative under Article 27 is listed on request for users in the EEA. We are not required to appoint a Data Protection Officer, but privacy@erissa.ai reaches the person responsible.
What we process, why, and on what legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, password hash, display name, timezone | Run your account and sign you in | Contract (Art. 6(1)(b)) | Life of account + 30 days |
| Conversations and companion memories | Let Erissa remember you, personalise replies, and show your history when you sign in | Contract (Art. 6(1)(b)) | Until you delete them or close your account |
| Emotional readings inferred from your messages | Help Erissa respond appropriately to how you seem to be feeling | Explicit consent (Art. 9(2)(a)) | Until you delete them or close your account |
| Your message and selected memories, passed to our AI provider | So the model can write the reply you asked for | Contract (Art. 6(1)(b)) | Not retained by the provider |
| Message counts | A number per month, so we can apply your plan's limits | Contract (Art. 6(1)(b)) | Life of account |
| Billing records | Take payment and meet tax law | Contract and legal obligation | 7 years |
| Product analytics | Improve the product | Consent (Art. 6(1)(a)) | 14 months |
| Security and abuse logs | Keep accounts safe | Legitimate interests (Art. 6(1)(f)) | 12 months |
Automated decision-making and profiling
Erissa builds a memory profile of you to personalise conversation. That profile is stored with your account on our servers. It is profiling, but it produces no legal or similarly significant effects, so Article 22 does not apply. You can inspect, correct, pin, lock or delete every inference, switch inference off entirely, and pause learning at any time.
Model providers and training
Your messages are sent to our model providers purely to generate a reply. They are processors bound by contract and your content is not used to train their models. We do not sell personal data and do not share it for cross-context behavioural advertising.
International transfers
Some processors operate outside the UK/EEA. Those transfers rely on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, plus a transfer risk assessment. A copy of the safeguards is available on request.
Your rights
You can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time without affecting past processing. Most of these are one click in Settings → Data and privacy; anything else, email us and we will respond within one month.
Complaints
You can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, to your local supervisory authority. We would rather you told us first so we can fix it.
Children
Erissa is not for under-16s (or the local digital-consent age where that is higher).
Security and breaches
Your account data, conversations and memories are encrypted in transit and at rest on our servers, and access to them is role-limited — only you can read your own conversations and memories. A local copy also sits in your browser's storage, so anyone with access to your unlocked device can read that copy; sign out before selling or giving away a device. If a breach risks your rights we notify the regulator within 72 hours and you without undue delay.
Caan Consultancy Ltd, a company registered in England and Wales, company number 09178365. Registered office: Lytchett House, 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, Dorset BH16 6FA, United Kingdom. Erissa is a trading name of Caan Consultancy Ltd.
Contact us: privacy@erissa.ai for data requests and your rights, support@erissa.ai for general questions and complaints, and security@erissa.ai for responsible disclosure. We answer data requests within one month, as required by the UK GDPR and EU GDPR.