Privacy Notice
Controller: dFusion AI Labs inc., , Republic of Seychelles EU representative (GDPR Art. 27): Contact: service@dfusion.ai Address: Unit GV07-OF-02, Level 7, Gate Village Building 10, Dubai International Financial Centre
Version 1.0 · Oct 2, 2026
1. In short
To build a Persona we process a lot of information about the person it emulates — potentially their voice, face, writing, opinions and conversations. That is sensitive, and some of it is biometric data, which has stronger legal protection.
The headlines:
- We act only on consent for the core feature, and you can withdraw it at any time.
- Only the Subject can consent to their own Persona. If someone else wants to make a Persona of you, we ask you personally. We do not take their word for it.
- The Subject can request to disable their Persona at any time, even if someone else paid for it. On request, data is retained and disabled, and no longer used for the Persona.
- Persona outputs may be wrong about you. That is inherent to the technology and we explain it below.
- We do not sell your data and we do not use Persona data for advertising.
- Models trained on your data cannot fully unlearn it. This is the one limit on deletion you should understand before you start. Section 7 explains it plainly.
2. What we collect
| Category | Examples | Sensitive? |
|---|---|---|
| Identity and verification | Name, date of birth, identity document, verification result, liveness capture | Yes |
| Voice | Recordings, speech samples, voiceprints, acoustic features, synthesised voice models | Biometric |
| Image and video | Photographs, video, facial-geometry templates, avatar and likeness models | Biometric (templates) |
| Written and behavioural | Writing samples, correspondence, documents, posts, transcripts, style features | Sometimes |
| Personality and inference | Inferred traits, preferences, opinions, beliefs, values, habits, relationships, expertise | Often |
| Interaction | Prompts, conversations with the Persona, feedback, ratings, session and device metadata (Persona owners can read visitor conversations from the last 90 days with the visitor’s identity hidden) | Sometimes |
| Consent records | Subject identity and contact details, consent artefacts, timestamps, version signed | Yes |
| Derived artefacts | Embeddings, vectors, indexes, fine-tuned weights, adapters | Derived |
Note on photographs and writing. Photographs and writing samples are not themselves biometric identifiers under Illinois law. A facial-geometry template or voiceprint derived from them is. We only generate those where the Subject has personally executed a Biometric Data Consent & Release.
Inferred sensitive information. Conversations and writing can reveal political opinions, religious or philosophical beliefs, health information, sexual orientation or trade union membership, and a Persona may infer such things. We treat inferences of this kind as special category data.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (EU/UK/CH) |
|---|---|
| Creating and operating a Persona | Consent — Art. 6(1)(a) |
| Processing voiceprints and facial templates; processing special category data and sensitive inferences | Explicit consent — Art. 9(2)(a), taken separately and before collection |
| Identity verification of Creators and Subjects | Legal obligation and legitimate interests — Art. 6(1)(c)/(f): preventing impersonation. Where biometric, explicit consent |
| Using Persona data to train and improve models | Separate, optional explicit consent — refusing does not affect your access to the feature |
| Detecting impersonation, fraud, abuse and harassment | Legitimate interests — Art. 6(1)(f): protecting Subjects and third parties; Art. 9(2)(f) or (g) where special category data is involved |
| Responding to takedown notices; retaining consent records | Legal obligation — Art. 6(1)(c); legal claims — Art. 9(2)(f) |
| Billing, tax and accounting | Contract and legal obligation — Art. 6(1)(b)/(c) |
Consent for Personas is separate from, and additional to, your acceptance of any dFusion terms. Withdrawing it does not affect your access to the rest of dFusion's services.
4. If someone makes a Persona of you
You decide, not them. When a Creator tells us they want to build a Persona of you:
- We contact you directly at a contact point you control.
- We give you the disclosures and ask you to execute the consents personally, at your own verified identity.
- Nothing is generated until you do. No voiceprint, no facial template, no Persona. If you decline or do not respond, we do not build it.
- You can request to disable your Persona at any time afterwards; upon request, we will retain and disable the data so it is no longer used for the Persona.
In data protection terms, for a Persona of you created by someone else, that Creator determines some of the purposes and acts as a controller alongside us; we are a controller for our own security, abuse-prevention, legal-compliance and model-improvement purposes. You can exercise all of your rights directly with us and we will not require you to approach the Creator first.
If you believe a Persona of you exists without your consent, email service@dfusion.ai and we will treat it as urgent.
5. Automated processing, profiling and accuracy
Personas involve automated processing and profiling. The system generates inferences about a Subject's personality, opinions, style and knowledge, and produces output based on them.
Those inferences and outputs may be wrong. A Persona may misstate, distort or fabricate your views, statements, characteristics or conduct. Persona outputs are not a record of what you said, believe or would say, and should not be treated as evidence of anything about you.
We do not use Personas to make decisions producing legal or similarly significant effects about anyone, and our terms prohibit you from doing so.
Persona owner visibility into visitor chats. Persona owners are able to read every visitor conversation with their Persona from the last 90 days. To protect visitor privacy, the identity of the person asking questions is kept hidden. A notice under the public chat interface informs visitors that their conversations are visible to the Persona owner.
You can ask us to correct inaccurate Persona Inputs. We cannot guarantee correction of Persona Outputs, because they are generated anew each time rather than stored as fixed statements. Where a Persona is materially misrepresenting you, your effective remedies are to request that its data be retained and disabled so it is no longer used.
6. Who we share it with
- Protocol Network participants — independent node operators, validators, storage providers and indexers in multiple jurisdictions, not owned or controlled by us
- Infrastructure and model providers — hosting, compute, inference, speech synthesis, transcription, storage
- Identity verification providers
- Payment processors
- Trust and safety, moderation and legal advisers
- Law enforcement, regulators and courts where legally required or necessary to protect any person
- An acquirer, on a merger, acquisition, financing or asset sale
We do not sell personal information. We do not share it for cross-context behavioural advertising.
On decentralised processing, plainly: data handled through a decentralised network is processed by independent parties over whom our practical control is limited. We impose contractual and protocol-level requirements where we can, but we cannot guarantee that every participant complies, and we are not responsible for their acts or omissions.
Immutable storage. Persona data may be written to an immutable distributed ledger or content-addressed storage layer. While data on these layers can be disabled, it may not be deletable and it may be impossible for us to recall or delete once written, though we will select a protocol with a privacy-preserving and governance layer.
7. Model training, and the honest limit on deletion
With your separate, optional consent we use Persona Inputs and Outputs to train and improve models operated by us and by the Protocol Network. You can decline or withdraw at any time without losing access to Personas.
Read this before you consent. Once data has contributed to a trained model, removing that specific contribution from the model is generally not technically possible. If you withdraw consent we will stop using your data for future training and delete the underlying source data as described in Section 8 — but training already performed is not reversed, and models already trained stay in service. Where the law requires it we will assess whether retraining or withdrawing a model is feasible and proportionate, and we will tell you the outcome.
This is a real limitation on the right to erasure and we would rather you knew it now than discovered it later.
8. How long we keep it
| Data | Retention |
|---|---|
| Persona Inputs and Outputs | While the Persona is active; retained and disabled within 30 days of a Persona deletion request, account closure or withdrawal of consent, and no longer used |
| Voiceprints and facial-geometry templates | Destroyed on the earliest of: purpose satisfied; one (1) year after your last interaction with us; or withdrawal of consent. |
| Consent records | Kept with the order record |
| Billing and tax records | As required by law, currently 7 years |
| Backups | Purged on our ordinary cycle, no longer than 90 days |
| May persist after source data is retained and disabled — see Sections 6 and 7 | May persist after source data is disabled — see Sections 6 and 7 |
We may retain data where necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.
9. Your rights
Depending on where you live, you can:
- Withdraw consent at any time, without detriment
- Request disabling of your Persona and underlying inputs so that data is retained and no longer used
- Access the Persona Inputs held about you, and information about who created the Persona
- Correct inaccurate inputs
- Port data you gave us, in a machine-readable format
- Object to processing based on legitimate interests
- Restrict processing, including limiting the contexts in which a Persona may be used
- Limit use of sensitive personal information (California), including biometric information
- Opt out of profiling and, where applicable, ask for human review
- Complain to your supervisory authority, attorney general, or the Seychelles authority. EU and UK residents may complain to their national authority or to our Article 27 representative directly.
To exercise any of these, email service@dfusion.ai. We respond within one month (extendable by two months for complex requests, with notice). We do not charge, and we will not treat you worse for asking.
We will not require a Subject to go through the Creator to exercise rights over a Persona of themselves.
10. International transfers
Persona data, including biometric data, is transferred to and processed in countries outside your own, including by Protocol Network participants whose locations may change over time and may not be individually known to us in advance. Where required we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism, and we carry out transfer risk assessments.
Candidly: we cannot guarantee an equivalent level of protection in every jurisdiction in which a network participant operates. Our mitigations are contractual terms, encryption, minimisation and protocol-level controls. You should take this into account in deciding what to supply.
11. Security
We use encryption in transit and at rest, access controls, logging and vendor due diligence. Because the feature is experimental and operates partly through a decentralised network, do not supply Persona Inputs you would not accept being disclosed. No system is completely secure, and we will notify you and the relevant authority of a breach where the law requires.
12. Children
Personas are restricted to people aged 18 or over, both as buyers and as Subjects. We do not knowingly process Persona data about anyone under 18. If we learn that we have, we delete the Persona and the data.
13. Changes
We will tell you by email at least 30 days before any material change to this notice, with the reason, and will obtain fresh consent where the law requires it. We will not apply a materially different purpose to data already collected without asking you first. Past versions are archived at https://testnet.dfusion.ai/persona/privacy.
14. Contact
service@dfusion.ai · dFusion AI Labs inc.