Short answer: Candy AI is run by a registered company with a detailed privacy notice, and we found no public data breach. Privacy is the weak point. Your chats can train its models, parts of them can go to outside AI providers, and your account data can be kept for up to three years after you stop logging in. Its refund window is 24 hours.
Everything below comes from Candy AI’s own documents, first read on 18 October 2026 and re-checked on 31 October 2026. We have not tested Candy AI hands-on, so this page covers what Candy AI says it does, not what we observed.
Who runs it
Candy AI is operated by EverAI Limited, registered with the Malta Business Registry under number C107181. The address is 56 Central Business Centre, Triq Is-Soll, Santa Venera SVR 1833, Malta. Both the privacy notice and the terms name the same company, and Maltese law governs disputes.
You can look the company up in the Malta register, and EU data protection law applies to it. Candy’s own help centre says a payment shows on your bank statement as “EverAI”, so the name you see on the card matches the company in the documents.
What it collects
Per the privacy notice, revised on 19 October 2026:
- Account details: email, password, nickname, gender and name.
- What you send and get back: your prompts and the generated replies, plus generated images and voice calls. The terms also cover generated videos and voice notes.
- Payment details: card brand, the last four card digits, transaction date and time, and IP address. The full card number is not on the list, because its payment processors, Emerchantpay and TrustPay, handle it.
- Age checks: where local law requires one, the “successful results” of a third-party age estimation or age and identity verification.
What it does with your chats
- Training: Candy AI uses data to “train and develop our AI models and moderation technologies”.
- Human review: building training datasets “may include human review of de-identified and/or anonymized interactions”.
- Outside AI providers: it shares data with “third-party LLM providers and/or hosters”, which “may receive the content of your messages”.
- No sale without consent: it says it will not “sell, trade, or otherwise transfer your Personal Data to any third parties without your Consent”, apart from the cases the notice lists.
- If the company is sold: your data can pass to the buyer or successor and stays covered by the same notice.
Data can also be moved outside the EU, “including but not limited to the United States”.
How long it keeps your data
| Data | Kept for |
|---|---|
| Account data | 3 years after your last account activity, or less (see below) |
| Financial and transaction records | 10 years from issue |
| Marketing data | Up to 2 years after your last interaction |
| Log files | 30 days |
The 19 October revision adds that the 3-year account period “may be shortened” to one year after your last activity or after your paid subscription ended, whichever is later.
You can delete your account sooner. Candy’s help centre puts a Delete Account button under My Profile, Settings, in the “Danger Zone”, and says Candy keeps “some data for legally mandated periods” afterwards. The privacy notice also accepts requests by email to support@candymail.ai, aims to answer within one month and deletes account data “without undue delay”. You cannot clear a single chat without also resetting the companion’s memory.
Billing rules that catch people out
From the terms of service (revision dated 22 September 2026):
- Auto-renewal: subscriptions renew automatically. You cancel under Settings, and the plan runs to the end of the period you paid for.
- Refunds: you can request one within 24 hours of payment, by card payment only. It is refused if you have used more than 20 tokens. Token packs bought separately are refunded only if unused.
- EU and UK buyers: you can withdraw within 14 days of the first purchase, with a pro-rated deduction. Renewals do not count.
- Tokens: a subscription includes a monthly allowance, “generally 100 per month”. Tokens cannot be moved to another account.
Candy’s documents disagree on what happens to tokens when you cancel. The terms say remaining tokens “will expire” and will not carry over or be refunded. A help article says “Canceling your subscription does NOT delete your tokens”. If you hold unused tokens, spend them or get a written answer from support before you cancel.
Age rules
The privacy notice says the service is for adults “at least 18 years of age”, or older where the local age of majority is higher. Its underage policy says users “must affirm that they are above 18”, and that Candy may add further checks “in accordance with local requirements”. In most places that makes it a self-declared age gate, with third-party verification only where the law demands it.
Breaches and reputation
Candy AI and EverAI do not appear among the 1,048 breaches listed in Have I Been Pwned on 31 October 2026. We also searched for regulator action naming either company and found none. Trustpilot has removed Candy AI’s profile, saying the business “goes against our guidelines”, so there is no live public rating to check.
Our read
Candy AI is a real company with clear documents, and nothing in them points to a scam. The safety question is about privacy, not fraud. Expect your conversations to be stored, used for training and processed by outside AI providers, and expect your account data to stay around for up to three years unless you delete the account.
If that is fine with you, use a separate email address, keep real names and locations out of chats, and set a reminder to cancel before renewal. If you want an app that says it does not train on chats, compare the privacy policies of eight AI girlfriend apps. If you want to try Candy AI, visit Candy AI.
We earn a commission if you subscribe to Candy AI through our link, at no extra cost to you. It does not affect what we publish. Affiliate disclosure
A scored Candy AI review will appear only after a hands-on test, with the price at checkout and a memory score after seven days.
For Candy AI ranked against other apps on published facts, see our AI girlfriend app ranking.
What changed on 31 October 2026
We re-read every document and added a source for each claim. Candy’s help centre now shows a Delete Account button and publishes the “EverAI” bank statement name, so we removed two lines that said neither was available. The privacy notice was revised on 19 October and can now shorten the 3-year account retention. We added Candy’s token contradiction, its age-check wording, its removed Trustpilot profile and the current breach-list count.