Candy.AI

Trains by default with only a general objection right

Under legitimate interest the notice says it will train and develop its AI models and moderation technologies and prepare datasets for further training, which may include human review of de-identified or anonymized interactions. The only relief is the general right to object to legitimate-interest processing.

Full slate of GDPR rights

Section 9 grants access under Article 15, rectification, erasure, restriction, portability in a machine-readable form, free withdrawal of consent, and the right to object to legitimate-interest processing and to direct marketing.

Short log retention, long account retention

Debug log files are automatically deleted after 30 days, while account data is kept for three years after the last account activity and financial data for ten years.

Does not sell, but silent on synthetic-image marking

The notice states it will not disclose, sell, trade, or otherwise transfer personal data to third parties without consent. Despite generating images, videos, and voice notes, it says nothing about watermarking or labelling AI-generated media.