Is Candy AI Safe? What Happens to Your Chats and Your Card

Who runs Candy AI

Candy AI belongs to EverAI Limited, a company incorporated in Malta and registered with the Malta Business Registry under number C107181. Its terms give a business address in Santa Venera and say Maltese law applies. That matters, because Malta is in the EU: the GDPR covers what Candy does with your personal data, including your right to see it and to ask for it to be deleted.

What happens to your chats

This is the part worth reading slowly. Candy's privacy notice says your exchanges with its AI characters, your messages and her replies, can be used to train and develop its AI models and moderation tools once they have been aggregated, anonymized or de-identified. Preparing that training data can include a person reviewing de-identified conversations.

Two more points from the same notice:

• Candy works with outside providers, at its discretion including third-party AI model providers and hosts, and says these may receive the content of your messages.
• Content flagged by its moderation systems, or reported by another user, can be looked at by a human moderator.

None of this is unusual for an AI chat service, but it means your conversations aren't sealed. Write them as if a stranger might one day read a version with your name taken out.

How long Candy keeps your data

Account data is generally kept for three years after your last activity, and the notice says that period can be shortened for technical reasons. If you ask Candy to delete your personal data, it says account data is deleted without undue delay. Payment records are the exception: they are kept for ten years because of tax and accounting law. Server logs are deleted after 30 days.

Your card and your bank statement

Candy's plans page says the charge shows as EverAI on your bank statement, not as Candy AI. That's handy if you'd rather keep it discreet, and confusing if you forget about it, so there is a separate guide to the EverAI charge. Every plan renews automatically. You can switch renewal off any time in Settings, under Unsubscribe, and the plan stays active until the end of the period you've paid for.

Refunds are tight

Candy's refund window is short: you have 24 hours after paying to ask, and the request is refused if more than 20 tokens have been used. Refunds only go back to cards. In the EU and UK you also have 14 days to withdraw, minus a share for what you've already used. So use the 5 free messages before you pay, and if you pay and change your mind, write to support the same day.

How to use Candy AI safely

• Use a nickname and an email address you don't use for work or banking.
• Keep identifying details out of the chat: your full name, address, employer and photos of real people. Candy's own terms tell you not to share financial details, addresses, contact information or passwords.
• Sign up on candy.ai itself. Candy AI runs in the browser, so if you find an app with its name in a store, check who publishes it before you install anything.
• Pay with a card you keep an eye on, and set a reminder a few days before the renewal date.
• If you want everything gone, ask support to delete your personal data rather than just leaving the account behind.

The verdict

Candy AI is a real company with published terms, a billing name you can look up and a cancel option in your settings. I'm comfortable recommending it, and it's my top pick in the AI girlfriend ranking. Just go in knowing that chats can feed its AI after de-identification, and keep your real-world details to yourself.