Key takeaways
- Candy AI is operated by EverAI Limited, a company registered in Malta.
- Its July 30, 2026 Privacy Notice says chats may be used to train AI and moderation systems.
- Third-party AI and moderation providers may also process your messages.
- Subscriptions renew automatically. Outside the EU and UK, refund requests must be made within 24 hours.
- Candy AI is strictly for adults aged 18+, and its Terms classify it as entertainment, not emotional support.
Introduction
A subscription that nobody read about, a conversation history that was assumed to be private and a card that keeps renewing is how most AI tool regrets begin
Candy AI seems to be a legitimate business operated by a registered company, which means safety concerns don’t have to point to scams, but rather choices one has to make when they sign up. Official documentation states that chatlogs can be used for model training, contents of messages sent may be shared with outside parties and subscriptions are made to renew by default. Skipping over those details may result in data being extracted from the user as either private information, unwanted charges or access given to someone else who shouldn’t have it.
Adopting a tool before reading its terms is also a root cause of failed AI adoption inside businesses. The terms change, so recheck them before you pay.
Candy AI
Candy AI is an AI companion platform where adults can create personalized virtual characters and interact with them through AI-powered conversations. The platform supports text chat, AI-generated images, videos, voice notes, character customization, and interactive experiences.
Quick verdict: is Candy AI safe?
Candy AI is usable for informed adults, but not private by default. Safety depends on which risk you mean.
| Safety area | Practical verdict | What to do |
|---|---|---|
| Legitimacy | Registered operator with published policies | Use only the official domain |
| Privacy | Chats may be used for training and moderation | Keep sensitive details out |
| Billing | Auto-renewal on, tight refund window | Screenshot terms, set a reminder |
| Age safety | Adults only | Keep minors away |
| Emotional well-being | Entertainment product, not support | Set boundaries |
Is Candy AI legit or a scam?
Candy AI seems legitimate as a business, but you know, legitimate can still have its risks. The Privacy Notice cites EverAI Limited, Malta, registration number C107181, as the company behind the service. It also names a Data Protection Officer, provides contact information for their UK representative, an email to contact support and lists the payment processors used by them: Emerchantpay, TrustPay, Volt, Coingate and UpGate.
Those are the red flags that a scammer will use. The rest is counterfeiting: fake sites and ads. To contact the company, type the address yourself and look for all policies on the official legal information page.
This is the same legitimacy test used when checking whether ClipTalk is real: who operates it, where the policies live, and who handles your data.
Candy AI privacy: what happens to your chats?
Consider chats as pieces of information processed by a company and its vendors, not as a personal journal. Note that Terms specify that conversations are generally private, but qualify that condition with several exceptions.
First, according to the Privacy Notice, your conversations might be “used, aggregated, and/or disclosed” to train AI algorithms and moderation systems, with preparation of training data potentially involving manual analysis of de-identified conversation transcripts. Notice also item 6 “Other Permitted Uses,” which specifies that third-party language model providers and hosts can receive the contents of your messages. Finally, the document mentions no opting out of training data.
In addition, moderation practices item 11.1 state that chats and other content can be manually reviewed by personnel or contracted partners and reported to authorities. Item 9 grants the company a perpetual, sub-licensable right to your input, including but not limited to using it for training and marketing.
Regarding retention, item 5.1 states that account data is generally retained for three years after your last message, although it can be truncated upon request. Item 5.2 specifies that deletion on request is performed “without undue delay,” while financial data is retained for ten years and debug logs for 30 days.
Notably, Terms of Service 4 tell you not to send payment information, addresses, contact details, or passwords. I would add government IDs, work-related documents, medical or legal records, selfies, and details of other persons to this list.
What safe use actually looks like operationally
A secure setup takes 15 mins, done before the payment, not after. Here is an example from a Sunday evening, as a reminder rather than a case study.
At 8:00 pm you enter the site’s official URL address directly in your browser and review Terms sections 8 and 9 and Privacy Notice sections 2, 5 and 6. You also capture a screenshot of the checkout page showing the offer price, renewal schedule and the number of tokens allocated per renewal cycle. You proceed to pay by card with transaction alerts enabled, as Terms only allow card payments for refund purposes. You set a calendar alert the day before the next renewal.
The above process breaks down at three points, where the billing cycle repeats itself, unused tokens decay at the end of every billing period, and the offer price increases with a notice period of 30 days or more. The most common reason for a billing dispute would be missing the calendar reminder.
This is what I have noticed while consulting enterprise-level billing practices, most subscription disputes originate from terms and conditions not reviewed at the beginning of the cycle. The same applies to the example given.
Candy AI billing, cancellation and refunds
Candy AI renews automatically, and you can unsubscribe through your Settings, Unsubscribe. Your access will be available until the end of the billing period, and then – tokens will be depleted.
A free account allows sending a maximum of 5 messages. The paid subscription plans are billed monthly, quarterly or annually and usually provide about 100 tokens per month, as indicated on the checkout page.
Refunds are processed on a case-by-case basis. However, if you are outside the EU and the United Kingdom, the refund request must be made within 24 hours after the payment has been processed, and it will only be possible if no more than 20 tokens have been spent. For users from the EU and the UK, a refund request can be sent 14 days after the first transaction, excluding payment renewals.
A chargeback cancels the subscription immediately and revokes access and tokens, so contact support at support@candymail.ai first.
Is Candy AI safe for minors?
No. Candy AI is an adult service and has an Underage Policy which requires that you are 18 or of legal age where you are located. The age gate relies on users to confirm that they are adults, with the policy stating that additional verification measures could be introduced. Consider the age gate a speed bump and keep underage users out of the service.
Emotional boundaries
The Terms state that the service is for entertainment purposes only, and that any exchange is fictional and that the characters portrayed in the service are not capable of providing emotional support. If you or someone you know is struggling and considering self-harm or suicide, please contact a trusted professional or your local emergency services.
Wrong approach vs right approach
Safe tool use is a repeatable process, which is what AI workflow infrastructure is built around.
WRONG APPROACH
↓
Sign up through an ad or search result
↓
Treat chats as completely private
↓
Skip checkout and renewal terms
↓
Pay without transaction alerts
↓
Cancel through a chargeback
↓
RIGHT APPROACH
↓
Visit the official website
↓
Treat chats as processed content
↓
Screenshot price and renewal terms
↓
Pay by card with alerts enabled
↓
Cancel in Settings, then contact support
Self-audit checklist
- Official domain confirmed
- Privacy Notice and Terms read on today’s date
- No financial, identifying or work data shared
- Renewal and refund terms screenshotted
- Payment method has alerts
- Reminder set before renewal
- Minors have no access
Pause and think: would you sign this vendor agreement for a business tool without reading it? Enterprise AI vendor evaluation applies the same rules.
Faq
The Privacy Notice says personal data won’t be sold, traded or transferred to third parties without consent where required, unless the notice states otherwise. It does list providers that may receive data, so “not sold” isn’t the same as “not shared.”
Yes, by request through the Privacy Team at support@candymail.ai. Account data is deleted without undue delay, though financial records are kept for ten years.
Avoid it. The Terms warn against sharing contact details and credentials, and work accounts or networks add exposure you don’t need.
Outside the EU and UK, no. Inside them, the 14-day withdrawal right covers only the initial purchase.
Final verdict
Candy AI is not unsafe as an AI companion service, but rather an adult entertainment product with privacy, billing, and boundary trade-offs that you must accept before using.
Expect consumer terms to change constantly. Terms were updated for Candy AI on September 22, 2026, and Privacy Notice on July 30, 2026. Which AI services is your company paying for that you or your team haven’t read the terms for?
Your next move
Spend 10 minutes running the AI Tool Safety Checklist against the Candy AI Privacy Notice. Then run it on one tool you already pay for, starting from an AI stack audit.
