Effable

法律

隐私政策

最近更新： . Effable 由 Wish-Machine 运营。

数据控制者

The data controller for personal information collected through Effable (effable.me) is Wish-Machine, Inc., a Delaware C-corporation and the operator of the Effable product. You can reach us at andrewwang@wish-machine.com for any question, request, or complaint about how your personal information is handled.

We have not appointed an EU or UK representative under GDPR Art. 27 because we do not yet meet the thresholds requiring one. We will update this section if that changes.

我们收集什么

To run Effable we collect:

  • Account data: email, OAuth identity (Google), display handle.
  • Authored content: the AI clone you author or distill.
  • Source materials you upload: blog posts, PDFs, image and video recordings, URLs.
  • Usage data: requests to your clone, MCP tool calls, page views, error logs.
  • Payment data: payout addresses (Base wallet, Stripe Connect account), invoice records.

Knowledge items you mark as Public on/dashboard/knowledgeare visible to anyone visiting your profile page (humans and agents alike); private items, which are the default, are visible only to you and your AI clone.

生物特征数据

This is the section that mattered to you when you signed up.

When you upload video as a source material, our distill worker may extract visual features as a technical step in producing your AI clone:

  • facial keypoints if video is involved (used to identify the creator in their own footage, never for identification of third parties),
  • embeddings derived from the above.

We commit to:

  • Purpose limitation. Biometrics are used solely to render your clone — never sold, never shared with advertisers, never shared with other Effable creators.
  • Storage minimization. Raw biometric features (facial / visual) are encrypted at rest and discarded after distillation completes; only the distilled clone is retained long-term.
  • Revocation. Withdraw consent in Settings → your clone is paused, biometric features are purged, and we retain only what’s legally required.
  • No cross-creator linkage. We never use one creator’s biometric data to identify another person who appears in third-party content.

Where applicable jurisdictions require explicit biometric consent (e.g., Illinois BIPA, Texas CUBI, GDPR Article 9), the Welcome screen and this section serve as that consent record.

聊天访客（effable.me/<handle>）

当你在 effable.me/<handle> 与创作者的 AI 分身对话时，我们会收到：

  • 你发送的每条消息的文本内容。
  • 你的 IP 地址（在存储前我们会用 HMAC 哈希处理——不会保留原始 IP）。
  • 本地生成的匿名会话 ID（cookie + localStorage）。
  • AI 的回复内容（用于审查与改进质量）。

我们如何使用这些数据

  1. AI 回复生成。你的消息会连同创作者蒸馏出的人格一起发送给 Anthropic Claude（底层 LLM 服务）。Anthropic 按其商业条款处理数据（https://www.anthropic.com/legal/privacy）。按我们的合同条款，Anthropic 不会使用 Effable 的数据训练模型。
  2. Lead 分类。每次对话结束后，另一次 AI 调用会判断你的消息属于高意向（投资询问、招聘外联、合作提议、客户兴趣）还是低意向（普通粉丝闲聊）。若为高意向、或你分享了联系方式（邮箱 / LinkedIn / handle 等），我们会将对话摘要呈现在创作者的 /dashboard/leads 收件箱。这是创作者唯一能看到你身份信息的途径。
  3. 频率限制与防滥用。我们按 IP（经 HMAC 哈希后）统计聊天量以防滥用。哈希 IP 计数器 24 小时后过期。
  4. 聚合分析。我们为每位创作者的仪表板计算每周聚合数据（总对话数、意向分布）。这些聚合数据不包含你的具体消息或联系方式。

我们保留多久

  • 聊天消息：保留 12 个月，除非创作者更早删除。
  • Lead 记录（高意向对话 + 联系方式）：由创作者决定保留时长（创作者可在收件箱删除）。
  • 频率限制计数中的哈希 IP：24 小时。

作为聊天访客的权利

  • 访问权：发送邮件至 andrewwang@wish-machine.com 申请获取我们持有的关于你的数据副本（由于我们不保留原始 IP 和真实身份，你需要提供事实线索来识别记录）。
  • 删除权：同样邮箱；我们将在 30 天内删除所有出现你信息的 lead 记录。
  • 退出分类器：你可以关闭同意弹窗以拒绝 lead 分类——但此时聊天功能将被停用。
  • 欧盟 / 英国访客（GDPR）：将你的消息发送至 Anthropic 以生成你请求的 AI 回复，依第 6(1)(b) 条「履行合同」（即你发起的对话）进行处理；Lead 分类与将联系方式呈现到创作者收件箱，依第 6(1)(a) 条「明确同意」（你点击「我已了解」时给出）进行处理。依第 7 条，该同意为自愿、具体、知情且明确的——你可一键拒绝，并可随时通过 andrewwang@wish-machine.com 撤回，不影响此前的合法处理。
  • 加州访客（CCPA）：我们不出售你的个人信息；只将其作为服务提供方分享给 Anthropic；你享有 §1798.100、§1798.105、§1798.121 下的知情权、删除权和限制权。

聊天次级处理方（每条消息的数据流转）

当访客发送聊天消息时，这些外部服务会看到该消息（或其衍生物）。每方只接收完成其职能所需的数据：

  • Anthropic（Claude API）——聊天时接收你的消息文本和创作者人格。
  • Supabase（Postgres + 存储）——接收我们持久化的数据库行（消息、leads）。
  • Resend（事务性邮件）——当 lead 被捕获时，仅接收创作者邮箱和通知主题；绝不接收访客消息内容。
  • Vercel（web 托管）——接收用于渲染页面的 HTTP 请求；将消息文本转发给我们的 API。

我们如何使用收集到的数据

Strictly to operate Effable: authenticate you, render your clone, settle payments, prevent abuse, comply with law. We don’t train foundation models on your content. We don’t sell or rent your data.

次级处理方

We use the following processors. Each has its own privacy commitments; we DPA them where applicable.

  • Anthropic — LLM inference for clone rendering.
  • Supabase — database, auth, storage (US region).
  • Modal — compute for distill worker.
  • Cloudflare — edge cache for MCP traffic.
  • Stripe — fiat metered billing and creator payouts.
  • Coinbase Commerce / x402 facilitator — USDC settlement on Base.
  • Resend or equivalent — transactional email delivery.

你的权利

Across all jurisdictions, you can:

  • access your data,
  • correct or update it,
  • export your raw uploads and clone configuration,
  • delete your account (data tombstoned in 30 days, purged from backups in 90),
  • withdraw biometric consent specifically (separately from account deletion).

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following additional rights regarding your personal data, under the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection:

  • Right of access — you can request a copy of the personal data we hold about you.
  • Right to rectification — you can ask us to correct inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”) — you can ask us to delete your data, subject to legal retention obligations.
  • Right to restriction — you can ask us to suspend processing in certain circumstances.
  • Right to data portability — you can request a machine-readable export of the data you provided.
  • Right to object — you can object to processing based on legitimate interests, including direct marketing.
  • Right to withdraw consent — where processing relies on consent, you can withdraw it at any time without affecting prior lawful processing.
  • Right to lodge a complaint — you can complain to your national data protection authority. EEA residents can find their authority at edpb.europa.eu/about-edpb/about-edpb/members_en. UK residents can contact the Information Commissioner’s Office at ico.org.uk. Swiss residents can contact the Federal Data Protection and Information Commissioner at edoeb.admin.ch.

To exercise any of these rights, email andrewwang@wish-machine.com. We will respond within one calendar month, which we may extend by up to two further months where strictly necessary, with notice.

加州居民

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt out of the sale or sharing of personal information. Effable does not sell your personal information. Submit a CCPA request to andrewwang@wish-machine.com.

数据保留

Account data: while your account is active. Raw uploads and clone configuration: until you delete them. Logs: 90 days. Payment records: 7 years (tax / legal hold). Biometric features: discarded post-distill (not retained).

数据处理协议

We have a Data Processing Agreement (DPA) with Anthropic that contractually restricts their use of your messages to delivering the chat service — they may NOT train foundation models on Effable data per our contract. We also have or are pursuing equivalent processor agreements with our other subprocessors listed above, each of which limits their use of your data to the specific function they perform for us.

跨境数据传输

Our subprocessors operate in the United States (Anthropic, Vercel, Modal, Resend, Stripe, Cloudflare) and in Europe / global regions (Supabase, Coinbase Commerce). For visitors located in the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (SCCs) with our US-based subprocessors, and on the EU-US Data Privacy Framework where the recipient is certified under it. You can request a copy of the relevant transfer safeguards by contacting us at the address below.

Cookie 与浏览器存储

We use a small amount of first-party browser storage to operate the service:

  • effable.chat-consent.<handle> — localStorage key recording the date you accepted the chat consent notice for a given creator.
  • An anonymous session ID used to maintain your chat session.
  • A first-party cookie set by our auth provider (Supabase) when you sign in as a creator.

We do not use third-party advertising or analytics cookies. We do not run cross-site trackers.

未成年人隐私

Effable is not intended for users under 16 in the EEA / UK, or under 13 in the United States (per COPPA). We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, contact us at andrewwang@wish-machine.com and we will delete it.

本政策的更新

We may update this policy. The “Last updated” date at the top of this page shows the current version. Material changes — for example adding a new subprocessor or introducing a new use of your data — will be announced on this page at least 30 days before they take effect, and where required by law we will also notify you by email.

联系我们

For privacy questions, data subject requests, or complaints, contact andrewwang@wish-machine.com. We are not required to appoint a Data Protection Officer under GDPR Art. 37 (we do not process special-category data at scale and we are not a public authority), but the founder handles all such requests personally.

Effable is a product of Wish-Machine, Inc., a Delaware C-corporation, United States.