"Is Candy AI safe?" is really three questions. Is it a real business that won't steal your card? What happens to the things you type? And will it bill you in ways you don't expect? Candy AI's own documents answer most of this, if you read past the marketing. We did, on October 7, 2026, and this guide sets out what they say, with links to every source.
Safe from fraud, yes. Private, only partly. Candy AI is run by a registered Malta company, publishes a detailed GDPR privacy notice, and ScamAdviser rates candy.ai "very likely safe." But its privacy notice says third-party AI providers "may receive the content of your messages," de-identified chats can be reviewed by humans for AI training, and account data is kept for up to three years after your last activity. Treat every chat as something a company can store and read.
Sources: Candy AI Privacy Notice (revised Jul 30, 2026), Terms of Service (revised Sep 22, 2026) and ScamAdviser, all read Oct 7, 2026.
Who runs Candy AI
Candy AI is owned and operated by EverAI Limited, registered in Malta as C107181, at 56 Central Business Centre, Triq Is-Soll, Santa Venera.[1] EverAI is also the data controller under the EU GDPR, UK GDPR and Swiss data protection law. It names a Data Protection Officer ([email protected]) and a UK representative, Shoosmiths Privacy Services Limited.[2] That's more formal privacy structure than many apps in this category publish.
A named company in Malta means EU data protection law applies, and you have rights you can actually exercise: access, correction, deletion and objection. It also means disputes under the terms go to the courts of Malta.[1] For the corporate record and what it does and doesn't prove, see Is Candy AI legit or a scam?
What Candy AI collects about you
The privacy notice lists the data categories in detail. The ones that matter most for an adult companion app:[2]
| Data | What the notice says |
|---|---|
| Account | Email, encrypted password, login method |
| Age checks | Results of third-party age estimation or ID verification, where your location requires it |
| Location | Country and city derived from your IP address |
| Your chats | Prompts, messages and calls to AI characters, and the outputs, "to the extent these contain Personal Data" |
| Preferences | The looks, personality and relationship type you choose for companions |
| Voice | Voice call data when you use calls |
| Device and logs | Device, browser and technical logs; log files are deleted after 30 days |
| Payments | Transaction records; card data is handled by payment processors |
The notice also says that your gender, combined with your companion preferences, "may constitute sensitive personal data" under data protection law, and that it will ask for consent where that applies.[2] The practical point is simple: on an app like this, your preferences are sensitive data, even if you never type your name.
Can anyone read your Candy AI chats?
Yes, in three situations that Candy AI describes itself:
- Moderation. The terms say chats are "generally private," but if moderation controls flag something, "we or authorized partners may access and manually review the flagged content and/or other content associated with the account."[1]
- Third-party AI providers. The privacy notice lists moderation tool providers and, "at our discretion third-party LLM providers and/or hosters," then adds: "these third parties may receive the content of your messages exchanged with our chatbot."[2] It doesn't name those providers.
- Training data preparation. Candy AI may "prepare datasets for further training," which "may include human review of de-identified and/or anonymized interactions."[2] It also randomly queries content for quality assurance.
None of this is unusual for a chatbot business, and the notice deserves credit for saying it plainly. But it rules out the idea that your chats are sealed. On the other side of the ledger, the notice says EverAI "will not disclose, sell, trade, or otherwise transfer" your personal data to third parties without consent "where required" or "unless otherwise stated" in the notice.[2]
Does Candy AI train its AI on your chats?
Its documents say it can. The terms grant EverAI a "non-exclusive, royalty-free, fully paid-up, transferable, sub-licensable, worldwide, perpetual license" to your content, including for "training, developing, enhancing, evolving and improving" its AI models and moderation tools.[1] The privacy notice describes the de-identification step that comes before training.[2]
"Perpetual" is the word to notice. Deleting your account removes your account data, but a licence to content already used for training doesn't obviously end with it. We found no opt-out from training in the documents we read. Unverified We'll check the in-app settings during hands-on testing.
How long Candy AI keeps your data
| Data | Kept for |
|---|---|
| Account data | Three years after your last activity (may be shortened to one year after last activity or after your subscription ends), or until you ask for deletion |
| Financial and transaction records | Ten years (tax and accounting law) |
| Log files | 30 days |
So an account you abandon isn't gone. If you've stopped using Candy AI, delete the account rather than just walking away (steps below).
Is it safe to pay Candy AI?
Card details go to payment processors, not to Candy AI's chat systems. The privacy notice names them: Emerchantpay and TrustPay for card payments, Volt for bank payments, CoinGate for crypto, and UpGate, which receives card and payment-token details.[2] The help center lists cards, crypto, Apple Pay, Google Pay and bank transfer (Volt, Pix) as payment options, varying by location.[4]
The billing risks are about rules, not theft:
- The charge says "EverAI," not Candy AI.[3] If that confused you, read our EverAI charge explainer.
- Backup cards can be charged. If you designate a saved card as a backup and a renewal fails on your main card, Candy AI can charge the backup "for the same amount and on the same terms."[1]
- You can't remove your only card while subscribed. The help center says you must keep at least one payment method on file during an active subscription.[5] Cancel first, then remove it.
- Refunds are narrow. 24 hours from payment, card payments only, and no refund once more than 20 tokens are used.[7]
Every plan and its true yearly cost is in our Candy AI pricing guide.
Is candy.ai a safe website?
The outside signals are mixed, and worth reading precisely:
- ScamAdviser gives candy.ai a trust score of 100, "very likely safe," citing high traffic, a valid SSL certificate, a several-years-old domain and payment methods with "money back services." Its negatives: the owner's identity is hidden on WHOIS, and reviews are "either very positive or negative."[8]
- Trustpilot shows no reviews at all. Its candy.ai page says the profile "has been removed" because the business "goes against our guidelines," without saying why.[9]
- PissedConsumer shows 1.7 out of 5 from 17 reviews (updated Oct 4, 2026), mostly about billing, refunds and support.[10]
A high automated trust score says the website is unlikely to be a fraud. It says nothing about privacy or how billing disputes go. Those are the risks with Candy AI.
Age checks and adult content
Candy AI is adults-only. The privacy notice says the service is for users 18 and over, and that accounts found to belong to minors are deleted and blocked.[2] Depending on where you are, it may run a third-party age estimation or ID check, and it keeps the result.[2] The terms describe a zero-tolerance policy on child sexual abuse material and say known CSAM is reported to the National Center for Missing and Exploited Children.[1]
Emotional safety: what the terms admit
Candy AI's terms are unusually direct. The service is "for entertainment purposes only" and "not intended as emotional or other forms of support." The characters "do not possess genuine emotions, intentions, or the ability to fulfill promises in the real world," and any offer of a real-life meeting is fiction.[1] If a companion asks you for money, a gift card or a meeting, that's either the model improvising or someone impersonating Candy AI. Neither is real.
How to use Candy AI more safely
- Use a separate email that doesn't include your real name.
- Never type identifying details in chats. Candy AI's own terms say not to share "financial details, addresses, contact information, or passwords."[1]
- Don't save a backup card unless you want it charged when the main one fails.
- Pay with something you can control: a virtual card or a card you can freeze.
- Note the payment time. The refund window is 24 hours.
- Delete the account when you're done rather than leaving it dormant for three years.
We haven't yet tested a data access request, the in-app privacy settings, or how long deletion takes. We'll add dated results after testing rather than guess.
How to delete your Candy AI account and data
- Log in to Candy AI and open My Profile.
- Click Settings and scroll to the "Danger Zone."
- Click Delete Account and confirm.[6]
Candy AI says deletion makes your preferences, usage history and personal information "permanently unavailable," but that it must keep some data for legally mandated periods.[6] Under the privacy notice you can also ask for deletion by email ([email protected]), and EverAI says it deletes account data "without undue delay" on request.[2] If you're subscribed, cancel first and screenshot the confirmation. The help center says deleting before renewal also cancels the subscription,[11] but a cancellation confirmation is easier to prove if a charge appears later.
Want to see how other apps handle this? Our Candy AI alternatives compare refund and privacy terms side by side, and the full Candy AI review scores privacy alongside price.
Frequently asked questions
Is Candy AI safe?
It is a real, registered business with a detailed GDPR privacy notice, and ScamAdviser rates candy.ai "very likely safe" with a trust score of 100. The risks are about data, not fraud: your messages can go to third-party AI providers, de-identified chats can be reviewed by humans for training, and account data is kept for up to three years after you stop using it.
Is Candy AI safe to use with my real name or card?
Paying is handled by named payment processors, and charges appear as "EverAI." Candy AI itself tells users not to share financial details, addresses, contact information or passwords in chats. Use a separate email if you want the account kept apart from your main identity.
Can Candy AI staff read my chats?
In some cases, yes. The terms say chats are "generally private," but flagged content and other content on the same account can be manually reviewed by EverAI or authorized partners. The privacy notice also allows human review of de-identified chats when preparing training data, and says third-party LLM providers "may receive the content of your messages."
Does Candy AI use my chats to train its AI?
Yes, according to its own documents. The terms grant EverAI a perpetual licence to use your content for "training, developing, enhancing" its AI models, and the privacy notice describes preparing training datasets from de-identified interactions.
Is Candy.ai trustworthy with payments?
The privacy notice names its payment processors: Emerchantpay and TrustPay for cards, Volt for bank payments, CoinGate for crypto, and UpGate, which receives card and payment-token details. Two terms are worth knowing: a saved backup card can be charged if your main card fails at renewal, and you can't remove your only payment method while subscribed.
How do I delete my Candy AI data?
Go to My Profile → Settings, scroll to the "Danger Zone," and click Delete Account. Candy AI says some data must still be kept for legally mandated periods; its privacy notice keeps financial records for ten years. Deleting the account before renewal also cancels the subscription, according to the help center.
Is Candy AI safe for teenagers?
No. Candy AI is an adults-only service. Its privacy notice says it is for users 18 and over and that it deletes and blocks accounts it finds belong to minors. Depending on location, it may use third-party age estimation or ID verification.
Sources
- Candy AI Terms of Service, revised Sep 22, 2026 (read Oct 7, 2026)
- Candy AI Privacy Notice, revised Jul 30, 2026 (read Oct 7, 2026)
- Candy AI subscriptions page, read Oct 7, 2026
- Candy AI Help Center: What are the accepted payment methods?
- Candy AI Help Center: How can I remove my payment method?
- Candy AI Help Center: How can I delete my account with you?
- Candy AI Help Center: Am I eligible for a refund?
- ScamAdviser: candy.ai, read Oct 7, 2026
- Trustpilot: candy.ai (profile-removed notice, Oct 7, 2026)
- Candy AI reviews on PissedConsumer, updated Oct 4, 2026
- Candy AI Help Center: I've deleted my account. Why do you keep on charging me?