Terms of Service and Privacy Policy
1. Operator and service
1.1. The service marketed under the name Evil Twin AI is operated by Piotr Liszka, a natural person based in Poland, operating the service under the Evil Twin AI brand ("Operator", "Evil Twin AI", "we", "us", "our").
1.2. Service address: Mikołaja Kopernika 1661-846 Poznań.
1.3. Electronic contact address: [email protected].
1.4. Evil Twin AI is an international online service. The fact that the Operator is based in Poland does not restrict the Service to Polish users.
1.5. The Service includes the website, registration and account system, subscription access, AI chat interface, conversation history, model-routing infrastructure, generated responses, account controls and related functionality made available under the Evil Twin AI brand.
1.6. These Terms are made available before conclusion of the electronic-services agreement in a form capable of being stored and reproduced.
2. Definitions
Account means an Evil Twin AI user account.
AI Output means text, code, analysis, suggestions, summaries or other machine-generated material returned through the Service.
Conversation Content means prompts, messages, attachments where supported, and AI Outputs associated with a chat.
Evil Twin ID means the login identifier created from the username selected by the User and an automatically generated suffix consisting of four letters followed by four digits, for example username#ABCD1234.
Plan means a paid Basic, Pro or other subscription tier displayed at checkout.
Provider means a third party supplying infrastructure, network, payment, model-inference or other functionality used to operate the Service.
User means any person or entity accessing or using the Service.
3. Eligibility and age
3.1. The Service is intended only for persons aged 18 or older.
3.2. By creating an Account or purchasing a Plan, you represent that you are at least 18 and legally capable of entering into the agreement.
3.3. If you use the Service on behalf of an organisation, you represent that you have authority to bind that organisation.
4. Account creation and identity model
4.1. Evil Twin AI does not require an email address to create an Account.
4.2. Registration requires a username and password. After registration, the Service generates an Evil Twin ID used for login.
4.3. Passwords are not stored in plaintext. They are stored using one-way password hashing appropriate for authentication.
4.4. Evil Twin AI does not provide Google, social-network or third-party OAuth login unless expressly introduced in the future and reflected in the applicable privacy notice.
4.5. Because the Account may have no email address or other conventional recovery identifier, Users are responsible for preserving their login credentials and Evil Twin ID. Loss of credentials may make recovery impossible unless a recovery mechanism is expressly provided in the Service.
4.6. Users must not impersonate another person, claim rights they do not possess, or use an identifier for unlawful deception.
5. Technical requirements
5.1. Use of the Service requires a functioning internet connection, a reasonably current web browser, JavaScript, TLS support and storage technologies necessary for authentication and session continuity.
5.2. The User bears ordinary costs of internet access and compatible hardware.
5.3. The Service may be temporarily unavailable because of maintenance, upstream-provider outages, security incidents, capacity limits, software faults or events beyond the Operator's reasonable control.
6. Nature of the AI service
6.1. AI Outputs are generated probabilistically and may be inaccurate, incomplete, outdated, fabricated, inconsistent, offensive, unsuitable or technically unsafe.
6.2. A confident tone does not make an AI Output true. Users must independently verify information before relying on it where accuracy matters.
6.3. Unless separately agreed in writing, the Service does not provide regulated professional legal, medical, tax, investment, accounting, engineering or other licensed professional services.
6.4. The Service is not an emergency service and must not be relied on where delay, error or unavailability could create a serious risk of death, bodily injury or major property damage.
6.5. Evil Twin AI may route requests through one or more external AI model or inference providers. The identity of a specific upstream AI provider is not a guaranteed feature of the Plan and may change without changing the nature of the Service.
7. Branding and promotional language
7.1. Evil Twin AI uses provocative branding, satire, black comedy, fictional crime imagery and exaggerated slogans to communicate a less restrictive conversational style.
7.2. Promotional phrases such as "uncensored", "no refusals", "doesn't refuse", "anything", "no filters", "evil", "unrestricted", "forbidden", "sketchy" or similar wording are expressive marketing language. They are not a literal contractual promise that every prompt will always receive every requested answer.
7.3. Fictional imagery, jokes, slogans, model personality or promotional material do not authorise unlawful conduct and do not constitute an offer to facilitate crime.
7.4. Concrete factual statements about paid functionality remain subject to mandatory consumer-conformity law where applicable.
8. Refusals, restrictions and model behaviour
8.1. The Service may refuse, redirect, truncate, filter, block, rate-limit, delay or otherwise decline some requests or Outputs.
8.2. Restrictions may result from applicable law, provider restrictions, safety controls, abuse prevention, fraud prevention, intellectual-property concerns, privacy concerns, technical limitations, capacity, automated classification, security incidents or changes in upstream services.
8.3. Purchasing a Plan does not create a guarantee that a specific prompt will be answered in a specific way.
8.4. Evil Twin AI may change routing, moderation, safety, abuse-prevention or provider logic where reasonably necessary for legal compliance, service security, provider compatibility or continued operation.
9. User responsibility
9.1. Users are responsible for their prompts, instructions, uploaded material, decisions, downstream use of Outputs and compliance with laws applicable to them.
9.2. Users must obtain any permission required before submitting third-party personal data, confidential information, copyrighted material, trade secrets or other protected content.
9.3. Users must use appropriate human judgment before deploying generated code, automation, security configurations, financial calculations, legal wording or other material capable of causing significant harm if incorrect.
10. Prohibited use
10.1. The Service must not be used to commit, materially facilitate, procure, organise or conceal unlawful acts.
- credible threats, targeted violence, terrorism, kidnapping, murder, assault or other unlawful physical harm;
- unlawful construction, acquisition or deployment of weapons, explosives, incendiary devices, chemical or biological agents or poisons;
- unauthorised system access, credential theft, phishing, malware deployment, ransomware, botnet operation, destructive exploitation, data exfiltration or denial-of-service attacks;
- fraud, scams, unlawful impersonation for gain, payment-card fraud, forged identity documents, laundering of criminal proceeds, sanctions evasion or deliberate tax evasion;
- unlawful manufacture, trafficking or distribution of controlled substances;
- sexual exploitation, trafficking, grooming or any sexual content involving minors;
- stalking, doxxing, unlawful surveillance, unlawful interception, identity theft or unauthorised disclosure of private information;
- concealment or continuation of active unlawful conduct through evasion of law enforcement;
- circumvention of legally required access or safety controls for the purpose of causing harm;
- spam, fraudulent advertising, deceptive mass outreach or unlawful direct marketing;
- knowing unlawful infringement of intellectual-property rights;
- automated decisions or uses prohibited by applicable AI, employment, credit, housing, insurance, biometric, equality or data-protection law;
- other conduct prohibited by applicable law or a binding order of a competent authority.
10.2. Discussion, analysis, fiction, academic work, defensive cybersecurity, compliance, journalism, historical analysis, safety research and other lawful contexts are not automatically prohibited merely because a topic is sensitive.
10.3. Attempts to defeat restrictions through obfuscation, encoding, prompt injection, fragmented requests, proxy users or repeated reformulation may result in rate limits, suspension or termination.
11. Account security
11.1. Users must keep credentials secure and must not share an Account in a manner inconsistent with the purchased Plan.
11.2. Evil Twin AI may revoke sessions, require re-authentication or temporarily restrict access where compromise is reasonably suspected.
12. User content
12.1. As between the User and the Operator, the User retains rights the User lawfully holds in submitted material.
12.2. The User grants the Operator a non-exclusive, worldwide, limited licence to host, reproduce, transmit, transform and process submitted material only to the extent reasonably necessary to provide, secure, maintain, support and legally operate the Service.
12.3. Users represent that they have the rights and permissions required to submit their material.
13. AI Output rights
13.1. To the extent permitted by law and subject to third-party rights, Evil Twin AI does not claim ownership over AI Output solely because it was generated for a User.
13.2. Similar or identical Outputs may be generated for multiple Users. Exclusivity is not promised.
13.3. Copyright or other legal protection may not arise in machine-generated material in every jurisdiction.
13.4. Evil Twin AI does not warrant that Output is unique, non-infringing, registrable, patentable or trademark-clear.
14. Plans and monthly usage
14.1. The standard Basic Plan price is USD 19.99 per month.
14.2. The standard Pro Plan price is USD 49.99 per month.
14.3. Basic includes a standard allowance of 50 User messages per billing month. Pro includes a standard allowance of 220 User messages per billing month.
14.4. Individual messages may be excluded from usage counting, restored, re-counted or otherwise adjusted where reasonably necessary because of failed generations, provider errors, retries, duplicate submissions, technical faults, abuse prevention, promotional adjustments or other exceptional service-integrity reasons. Evil Twin AI will not use this clause to arbitrarily reduce the core paid allowance.
14.5. Unused monthly usage expires at the end of the applicable billing period and does not roll over or create stored monetary value.
14.6. Usage limits, model access and other Plan characteristics shown at checkout form part of the purchase information.
15. Subscription billing
15.1. Paid Plans are recurring monthly subscriptions unless the checkout expressly states otherwise.
15.2. The subscription renews automatically for successive monthly billing periods until cancelled.
15.3. Users may cancel renewal using the available subscription-management tools. Cancellation normally prevents the next renewal while access continues until the end of the already-paid billing period, unless applicable law or the payment provider requires a different result.
15.4. Deleting an Evil Twin AI Account does not itself create a refund right and does not, by itself, reverse transactions already processed by the Merchant of Record.
16. Stripe Managed Payments and Merchant of Record
16.1. Checkout and transaction processing for paid Plans are provided through Stripe Managed Payments. For transactions processed through that service, the applicable Stripe/Link entity acts as Merchant of Record for the transaction as described in its checkout terms.
16.2. Stripe/Link may calculate, collect, file and remit applicable indirect taxes such as sales tax, VAT or GST for Managed Payments transactions where covered by that service.
16.3. Evil Twin AI receives transaction status and limited payment metadata needed to activate and administer the purchased Plan. Evil Twin AI does not receive or store full payment-card numbers or card security codes.
16.4. Evil Twin AI creates a random checkout reference used to associate a successful checkout result with the Account that initiated the purchase.
16.5. Stripe/Link may independently request and process information such as an email address, billing information, device or network information for checkout, receipts, fraud prevention, regulatory compliance, subscription administration or transaction support.
16.6. An email address requested by Stripe/Link is not required for Evil Twin AI account registration and is not ordinarily imported into Evil Twin AI's Account database or used as the Evil Twin AI login identifier.
17. Refunds, immediate performance and withdrawals
17.1. Paid access begins immediately after successful payment confirmation. By completing a purchase after being presented with and accepting the applicable immediate-performance notice at checkout, the User expressly requests that performance of the paid Service begin immediately, including before expiry of any statutory withdrawal period that may otherwise apply.
17.2. Immediate activation may trigger provisioning, allocation, reservation or procurement of third-party computational, inference or service capacity required to make the purchased Plan available. These actions may create immediate and non-reversible costs for the Operator.
17.3. Except where required by applicable law or where Stripe Managed Payments or the applicable Merchant of Record exercises a refund right available under its own terms, purchases are final and non-refundable.
17.4. Where applicable mandatory law permits the Operator or Merchant of Record to charge for performance supplied before withdrawal, the User remains liable for the portion of the Service already performed up to the time a valid withdrawal notice is received. Any amount retained or charged must be determined in accordance with mandatory law and proportionately to the scope and value of the Service already supplied.
17.5. For transparency, the commercial structure of the Plans attributes a substantial part of each Plan price to immediate provisioning and activation of the paid Service. The current provisioning value is USD 15.99 for the Basic Plan and USD 41.99 for the Pro Plan.
17.6. The provisioning values stated in section 17.5 do not override mandatory consumer law and are not an automatic penalty, cancellation fee or forfeiture. Following a valid statutory withdrawal, those amounts may be retained or charged only to the extent that the corresponding Service has actually been performed and applicable law permits that amount to be retained or charged.
17.7. Where a distinct service component has been fully performed following the User's prior express request for immediate performance and the acknowledgements required by applicable law, the User may lose the statutory right of withdrawal in relation to that fully performed component where applicable law so provides.
17.8. Cancellation of automatic renewal is different from withdrawal from an already concluded purchase. Cancellation prevents future renewal in accordance with section 15 but does not itself create a refund right for an already activated billing period.
17.9. Deleting an Evil Twin AI Account does not itself constitute withdrawal from a purchase, cancellation of a processed transaction or grounds for a refund.
17.10. Stripe Managed Payments or the applicable Merchant of Record may issue refunds, resolve transaction disputes or apply mandatory consumer remedies under its own terms and legal obligations even where Evil Twin AI's ordinary refund policy is more restrictive.
17.11. Nothing in these Terms removes any mandatory right of withdrawal, digital-service conformity remedy, statutory refund right or other consumer remedy that cannot lawfully be excluded or limited.
17.12. Users should contact [email protected] for product-specific billing issues. Transaction-specific support may also be available through Stripe/Link.
18. Digital-service conformity
18.1. Mandatory rules concerning supply and conformity of digital services apply where the User is protected by such rules.
18.2. Disclaimers concerning AI accuracy do not eliminate mandatory obligations concerning the Digital Service itself where applicable law requires conformity with contract.
18.3. Consumers may have statutory remedies including bringing the service into conformity, price reduction, termination or other remedies subject to applicable legal conditions.
19. Service changes
19.1. Evil Twin AI may modify features, models, interface, infrastructure, routing, usage-accounting implementation or security controls for legitimate reasons including improvement, provider changes, legal compliance, security, cost management and interoperability.
19.2. Material changes to an ongoing paid digital service will be handled subject to mandatory consumer rules that apply to the User.
20. Suspension and termination
20.1. Evil Twin AI may suspend or terminate access for material breach, prohibited use, fraud, security risk, repeated attempts to defeat controls, sanctions restrictions, legal orders, attacks on the Service or conduct creating material risk to Users, Providers or the Operator.
20.2. Immediate action may be taken where reasonably necessary for urgent legal, fraud, abuse or security reasons.
20.3. Mandatory consumer rights relating to prepaid periods and statutory remedies remain unaffected.
21. Third-party dependencies
21.1. Evil Twin AI depends on third-party infrastructure, network, payment and AI inference services that are not fully controlled by the Operator.
21.2. Outages, API limits, provider policy changes, capacity shortages, regional restrictions, technical faults or security events may affect availability.
21.3. Evil Twin AI may replace Providers where reasonably necessary. Access to a specific upstream AI company, model host or infrastructure vendor is not a contractual entitlement unless expressly stated at purchase.
22. Intellectual property of the Service
22.1. The Evil Twin AI brand, original artwork, website design, software, interfaces, databases and documentation are protected by applicable intellectual-property law.
22.2. Except as permitted by law, Users may not copy, sell, sublicense, scrape, reverse engineer, reproduce or create confusingly similar branding from protected Operator materials.
23. No warranties beyond mandatory law
23.1. To the maximum extent permitted by law, the Service is supplied without warranties that every Output will be accurate, complete, lawful for a User's intended purpose, uninterrupted, unique, non-infringing or fit for a purpose not expressly accepted by the Operator.
23.2. Evil Twin AI does not warrant that the Service will answer every prompt, preserve a particular model indefinitely or never produce an error.
23.3. Mandatory statutory rights that cannot lawfully be excluded remain unaffected.
24. Limitation of liability
24.1. Nothing in these Terms excludes or limits liability where exclusion or limitation is prohibited by law.
24.2. For business Users, to the maximum extent permitted by law, the Operator is not liable for indirect, consequential, special or punitive damages, lost profits, lost revenue, lost opportunity, loss of goodwill or loss of data arising from use of AI Output.
24.3. For business Users only, aggregate contractual liability arising from the Service during a 12-month period is limited, to the maximum extent permitted by law, to the fees actually paid by that User for the Service during the preceding 12 months.
24.4. Mandatory consumer rights remain unaffected.
25. Complaints
25.1. Complaints concerning access, billing, subscription functionality or digital-service conformity may be submitted to [email protected].
25.2. A complaint should identify the relevant Account or Evil Twin ID, describe the issue, state the requested resolution and include information reasonably necessary to investigate.
25.3. Complaints will be handled without undue delay and within any mandatory statutory period.
26. Governing law and disputes
26.1. These Terms are governed by Polish law.
26.2. A Consumer is not deprived of mandatory protection granted by the law of the country in which that Consumer has habitual residence where such protection applies notwithstanding a choice of law.
26.3. Consumer disputes are heard by courts determined under applicable mandatory jurisdiction rules.
26.4. Business-user disputes are subject to the competent courts determined under applicable law unless a valid written agreement provides otherwise.
27. Changes to these Terms
27.1. Evil Twin AI may amend these Terms for legitimate reasons including legal changes, provider changes, security, billing changes, feature changes and clarification.
27.2. Material changes affecting an ongoing paid relationship will be notified where and to the extent required by applicable law.
27.3. Updated Terms apply prospectively from the stated effective date.
28. Severability and priority
28.1. If a provision is invalid or unenforceable, the remaining provisions continue to apply to the extent legally possible.
28.2. Mandatory law prevails over inconsistent contractual language.
28.3. Plan information presented at checkout forms part of the agreement for the purchased Plan.
29. Privacy Policy - scope
29.1. This Privacy Policy explains how Evil Twin AI processes personal data in connection with the website, Accounts, subscriptions, support and AI chat service.
29.2. Where the Operator determines the purposes and means of processing, Piotr Liszka acts as controller within the meaning of the GDPR where the GDPR applies.
29.3. Providers may act as processors, independent controllers, sub-processors or separate service providers depending on their role and contractual relationship.
30. Privacy-first and data-minimisation design
30.1. Evil Twin AI is designed to minimise the amount of identifying information required to use the Service.
30.2. Evil Twin AI does not require a real name, email address, postal address, Google account or social-login identity to create a standard Account.
30.3. Privacy-first does not mean that no data are ever processed. Account credentials, chat content, session data, short-lived technical logs, usage records and payment-status metadata may still be processed as described below.
30.4. Payment information independently requested by Stripe/Link as Merchant of Record is governed by the payment provider's role and privacy documentation in addition to any limited data Evil Twin AI receives for subscription administration.
31. Categories of data processed by Evil Twin AI
| Category | Examples | Main purpose |
|---|---|---|
| Account data | username, Evil Twin ID, hashed password, account status, Plan | registration, login, authentication and account administration |
| Conversation data | prompts, AI Outputs, chat titles or related thread data | generate responses and provide chat history |
| Usage data | message allowance, counts, timestamps required for billing-period usage, model-routing status | enforce Plan limits and operate the Service |
| Payment-status metadata | random checkout reference, payment success/failure, Plan, subscription state, transaction or subscription identifiers made available by Stripe | activate, maintain, cancel or troubleshoot paid access |
| Session/security data | session identifiers, authentication events and strictly necessary security state | keep Users logged in and protect Accounts |
| Short-lived server logs | request time, requested resource, technical response information and network address where present in infrastructure access logs | server operation, troubleshooting and security |
| Support data | messages and information a User voluntarily sends to support | answer support requests and resolve issues |
32. IP addresses and network logs
32.1. Evil Twin AI does not store a User's IP address in the Account database and does not build an application-level IP history linked to the Evil Twin Account.
32.2. Web-server and infrastructure access logs may contain IP addresses as an ordinary consequence of internet communication and server security.
32.3. Evil Twin AI's own server-side access logs containing IP addresses are retained for up to 3 days and then removed through log rotation.
32.4. Cloudflare, OVHcloud, Stripe/Link and other network-layer or infrastructure Providers may independently receive or process IP addresses or equivalent network identifiers under their own systems, retention rules and legal obligations.
32.5. Evil Twin AI does not use IP addresses for advertising profiles or third-party behavioural tracking.
33. Conversation history
33.1. Conversation Content is stored in Evil Twin AI's database so Users can return to their previous chats.
33.2. Users can delete individual chats using the available deletion control.
33.3. When a chat is deleted through that control, Evil Twin AI removes that chat from its primary database rather than placing it in a user-accessible archive or soft-delete state.
33.4. Evil Twin AI does not maintain separate backup copies of deleted chat history as part of the described production architecture.
33.5. Conversation Content must be transmitted to one or more third-party AI inference Providers to generate a response.
33.6. Authorised administration technically permits database access where necessary for service operation, security, debugging, support requested by a User or legal compliance. Evil Twin AI does not routinely read Users' conversations for advertising, profiling or curiosity.
33.7. Users should not submit secrets or highly sensitive information unless they are comfortable with the processing required to generate an AI response.
34. Account deletion
34.1. Users may delete their Evil Twin AI Account using the available account-deletion functionality.
34.2. On deletion, Evil Twin AI removes the Account data and associated Conversation Content held in its own primary database in accordance with the deletion request.
34.3. Account deletion does not retroactively erase data held independently by third parties such as Stripe/Link, Cloudflare, OVHcloud or an AI Provider where those parties have their own lawful basis, retention obligations or independent-controller role.
34.4. Account deletion does not itself create a refund entitlement and does not erase payment obligations or transaction records that a Merchant of Record or other Provider is legally required or entitled to retain.
35. Payment and checkout privacy
35.1. Evil Twin AI does not request an email address for Account creation and does not store payment-card credentials in its database.
35.2. Stripe/Link may request an email address and other transaction information during checkout or subscription management. Such information may be visible within the Stripe environment to the extent Stripe makes it available, but Evil Twin AI does not ordinarily import that email into its Account database or use it to identify the User's Evil Twin login.
35.3. Evil Twin AI uses a random checkout reference to link a completed checkout result to the initiating Account. The reference is not intended to expose the User's password or full payment credentials.
35.4. Stripe/Link independently manages payment-related cookies, fraud-prevention tools, transaction communications, receipts, subscription transaction support and tax processing associated with Managed Payments.
36. Cookies and local storage
36.1. Evil Twin AI uses cookies or equivalent browser storage required for authentication, session continuity, security and keeping Users logged in for convenience.
36.2. Evil Twin AI does not currently use Google Analytics, Meta Pixel, TikTok Pixel or comparable third-party advertising trackers.
36.3. Evil Twin AI does not currently use third-party behavioural advertising cookies.
36.4. Stripe/Link may use its own cookies or similar technologies on payment pages under its own role and policies.
36.5. If Evil Twin AI later introduces non-essential analytics or advertising tracking, the Privacy Policy and any consent controls required by applicable law will be updated before or when such processing begins.
37. Purposes and legal bases under GDPR
| Purpose | Typical legal basis where GDPR applies |
|---|---|
| Create and operate the Account, authenticate the User, provide chat and history, enforce Plan allowances | Art. 6(1)(b), performance of contract or steps requested before contract |
| Receive payment status and administer paid access | Art. 6(1)(b), performance of contract |
| Security, abuse prevention, short-lived server logging, service integrity and defence of legal claims | Art. 6(1)(f), legitimate interests, balanced against User rights |
| Compliance with binding legal duties or orders | Art. 6(1)(c), legal obligation |
| Support requested by the User | Art. 6(1)(b) and/or Art. 6(1)(f), depending on context |
| Non-essential storage or tracking introduced in the future where consent is legally required | Art. 6(1)(a), consent |
38. Providers and recipients
38.1. Personal data may be disclosed only as reasonably necessary to categories of Providers used to operate the Service.
- OVHcloud, for server and hosting infrastructure;
- Cloudflare, for domain, DNS, proxy, network-delivery and security functionality;
- Stripe/Link, for Managed Payments, Merchant-of-Record transaction processing, subscriptions, tax handling, transaction support and related payment functions;
- third-party AI inference Provider or Providers, for processing prompts and returning AI-generated responses;
- competent public authorities where disclosure is required by valid law.
38.2. Evil Twin AI does not disclose the identity of every upstream AI inference vendor as a product feature where doing so would expose competitively sensitive infrastructure information, provided that applicable data-protection transparency requirements are otherwise satisfied.
39. International transfers
39.1. Some Providers may process data outside Poland or the European Economic Area.
39.2. Where GDPR Chapter V applies, transfers must rely on a lawful mechanism such as an adequacy decision, Standard Contractual Clauses or another legally permitted transfer mechanism.
40. Retention
40.1. Account and Conversation Content are retained while needed to provide the Account and chat-history functionality, unless the User deletes the relevant chat or Account earlier.
40.2. Deleted chats are removed from Evil Twin AI's primary database as described in section 33.
40.3. Evil Twin AI's server access logs containing IP addresses are retained for up to 3 days.
40.4. Evil Twin AI does not maintain separate chat-history backups in the described production architecture.
40.5. Third-party Providers may retain transaction, security, tax, network or legal-compliance data under their own retention rules and legal obligations.
40.6. Information required for legal claims, fraud investigation or binding legal obligations may be preserved where and for as long as applicable law requires or permits.
41. Security
41.1. Evil Twin AI uses technical and organisational measures intended to provide security appropriate to the risk.
41.2. Measures include transport encryption, hashed password storage, access controls, database input sanitisation and validation, session protections, restricted administrative access and short retention of infrastructure logs.
41.3. No internet service can guarantee perfect security. Users must protect their credentials and devices.
42. Personal-data breaches
Where GDPR applies and a personal-data breach occurs, the Operator will assess the incident and make any notifications to supervisory authorities or affected data subjects required by applicable law.
43. Automated processing
43.1. AI generation necessarily involves automated processing of prompts to produce responses.
43.2. Evil Twin AI is not intended to make solely automated decisions producing legal effects or similarly significant effects about Users within the meaning of GDPR Article 22 unless separately disclosed.
43.3. Automated mechanisms may be used for rate limits, security, abuse prevention, fraud signals or service-integrity checks.
44. Data-subject rights
44.1. Where GDPR applies, Users may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent subject to statutory conditions.
44.2. Requests may be submitted to [email protected].
44.3. Because Evil Twin AI deliberately collects little conventional identity information, the Operator may need reasonable information sufficient to verify that a requester controls or is associated with the relevant Account before fulfilling certain requests.
44.4. Rights are not absolute. Legal obligations, competing rights, fraud prevention, claims preservation and statutory exemptions may apply.
45. Supervisory authority
Where GDPR applies, data subjects have the right to lodge a complaint with a competent supervisory authority. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).