This is the guide nobody in this category writes, which is strange, because data protection is the single most consequential thing about these apps and the only area where you have enforceable legal rights.
Why this matters more here than almost anywhere else
Think about what is actually in your chat logs with an AI companion. Not browsing history. Not purchases. Things you have said to something you believed was private, often at two in the morning, frequently about loneliness, sex, or people you know by name.
Now consider the 2024 Muah AI breach, which exposed a large volume of user email addresses alongside chat prompts. The damage was not the email addresses. It was the pairing — intimate material attached to identifiable people. That is the specific risk in this category, and it is why our rubric weights privacy and jurisdiction at 20%.
What UK GDPR gives you
UK GDPR and the Data Protection Act 2018 give you a set of rights over personal data held about you. Your chat logs qualify: they are information relating to an identified or identifiable person, which is the test.
| Right | What it means in practice |
|---|---|
| Access (Art. 15) | A copy of what they hold, plus what they use it for, who they share it with, and how long they keep it |
| Rectification (Art. 16) | Correction of anything inaccurate |
| Erasure (Art. 17) | Deletion — the “right to be forgotten” |
| Restriction (Art. 18) | Stop processing it while a dispute is resolved |
| Portability (Art. 20) | Your data in a machine-readable format you can take elsewhere |
| Object (Art. 21) | Stop processing based on legitimate interests, including profiling |
All free. All with a one-month deadline, extendable to three for genuinely complex requests, but only if they tell you inside the first month.
Special category data — which includes data concerning sex life and sexual orientation — attracts additional protection, and it is difficult to argue that the content of an AI girlfriend conversation does not frequently touch it.
How to actually make a request
The process is less formal than people expect. There is no form and no fee. A clear email is a valid request, and the clock starts when they receive it.
Send it to the privacy or data protection address in the app’s privacy policy. If there is not one, use the general support address and say in the first line that this is a request under UK GDPR, so that it cannot be mistaken for a support ticket.
A template that works
Subject: Subject access and erasure request — UK GDPR
I am a user of [service] with the account registered to this email address.
Under Article 15 of the UK GDPR I request a copy of all personal data you hold about me, including the full content of my conversations, any profile or inferred data you have generated about me, and my payment and account records. Please also confirm the purposes of processing, the categories of recipient, your retention period, and whether my data has been used to train or fine-tune any model.
Under Article 17 I additionally request erasure of all of the above following your response.
Please confirm receipt and respond within one month as required.
Keep a copy and note the date you sent it. That date is the only thing you need if you later complain.
What to expect
A well-run company acknowledges within days and responds inside the month. A badly run one ignores you, or sends a support reply that does not engage with the request. Both outcomes are informative.
Pay attention to the answer on training. Ask it explicitly, because it is the question policies are most often vague about, and because deletion of your account does not necessarily reverse the inclusion of your conversations in a training set.
Why the operator matters so much
Here is the part that changes the answer entirely.
Your rights are identical regardless of which app you are dealing with. Your ability to enforce them is not.
Against a UK-registered company, you have a named legal entity, a registered address on Companies House, and the ICO as a supervisory authority with statutory powers over them. The route is short and it is free.
Against a company that does not identify itself anywhere on its website, you have an email address and hope. You cannot name a data controller in a complaint. The ICO’s practical leverage over an operator with no UK or EU establishment is limited, however clear your entitlement.
Four of the ten apps we reviewed do not clearly identify an operating company anywhere on their site: Candy AI, FantasyGF, EVA AI and Muah AI. That is not a paperwork quibble. It is the difference between having rights and having the appearance of rights, and it is the main reason those four score between 2.5 and 6.5 on our privacy criterion.
Two have a UK link. SweetDream AI is operated by Tetractys Development Ltd, registered in England as company number 17171203 — though it was only incorporated in April 2026, so there is no trading history to assess. Joi AI is provided by Novi Ltd, named by Ofcom in its age-check investigation.
You can check any of this yourself, free, on the Companies House register. If an app claims a UK presence that does not appear there, that tells you something.
Complaining to the ICO
If an app ignores you or refuses without a proper reason, you can complain to the Information Commissioner’s Office at ico.org.uk. It is free, it is done online, and you do not need a solicitor.
You will need: who you contacted, when, what you asked for, and what happened. This is why keeping the date matters.
The ICO will generally expect you to have raised it with the company first, so send the request properly and give them their month before escalating.
Practical precautions that matter more than any policy
Rights are a remedy after something has gone wrong. These reduce the chance of needing them:
- A dedicated email address. Not your work address, not the one attached to your bank. This single step would have substantially limited the harm from the Muah AI breach for most of the people in it.
- A password you have used nowhere else. Assume the database will leak eventually and plan accordingly.
- A virtual or disposable card. Monzo, Revolut and several others issue them. It limits exposure and makes cancelling far easier if the app makes that difficult.
- Read the training clause before the pricing. It is the one term that cannot be undone later.
- Assume permanence. Not because these companies are malicious, but because backups exist, breaches happen, and companies get acquired. Write accordingly.
The uncomfortable summary
UK GDPR is genuinely strong law and it genuinely applies here. But a legal right is worth what you can enforce, and enforceability in this category depends almost entirely on one question: can you name the company?
Before you type anything into one of these apps that you would not want read back to you, spend two minutes finding out who is on the other end of it. If you cannot find out, that is the answer.