Is Candy AI safe? Here is what is actually documented
Safety in this category usually gets answered with a vibe. This page answers it with paperwork: the registered company, the billing descriptor, the payment processors, the retention periods in the privacy policy, and the eight categories the content rules ban. Where the documents are silent — and on a few important points they are — we say that instead of inventing reassurance.
Unofficial fan guide. We earn a commission if you subscribe through our link.
Candy.ai is operated by a named, registered European company rather than an anonymous website, publishes a full set of legal documents, uses established payment processors and states a clear 18+ policy with a content ban list. That is a meaningfully better paper trail than much of this category offers. What it does not tell you is how long deletion actually takes, whether the service is available in your country, or what happens to conversation data in practice — those questions are genuinely unanswered in the public documents.
EverAI Limited, registered in Malta
Candy.ai's terms of service state the service is owned and operated by EverAI Limited, incorporated in the Republic of Malta with registration number C107181, at 56 Central Business Centre, Triq Is-Soll, Santa Venera SVR 1833. The same company name and number appear in the site footer. The terms of service and the blocked content policy both carry an effective date of 30 July 2026, and the brand is written with a registered trademark symbol.
Why this matters more than it sounds: a registered EU operator gives you a legal counterparty, a jurisdiction and a statutory consumer-rights floor. A large share of platforms in this category publish no company details at all, which leaves you with nothing to point at if something goes wrong.
Who is behind the company
We verified the registration number as published in Candy.ai's own terms. We did not independently pull the Maltese registry, and we found no verifiable names of directors or founders. Aggregator sites that list founder names for this brand returned obvious placeholder data, so we name nobody.
Registration number as stated in candy.ai terms of service; registry not independently checkedA similarly named UK company
A separate entity called Candy AI Limited exists on the UK register under a different number. We could not establish any relationship between it and the Maltese operator, so do not read one into search results that mix them up.
UK companies register listing; relationship to EverAI Limited unestablishedWhat appears on your bank statement
The charge shows as EverAI, not Candy.ai. This is stated in two independent first-party places: the subscriptions page itself and a dedicated help centre article about the billing statement.
Money is handled by named third-party processors rather than by the platform directly — the privacy policy lists Emerchantpay, TrustPay, Volt, Coingate and UpGate. Accepted methods are credit and debit cards, cryptocurrency, Apple Pay, Google Pay and bank transfer through Volt and Pix. Cryptocurrency being on that list is worth noting in both directions: it is the most private way to pay, and it is also the one the published refund clause does not cover.
The statement descriptor is documented specifically for card payments. We could not confirm what appears for crypto, wallet or bank-transfer payments.
How long Candy AI says it keeps things
The privacy policy publishes explicit retention periods, which is more than most platforms in this category do. Here they are as written.
| Data type | Stated retention |
|---|---|
| Account-related personal data | 3 years after last activity |
| Financial records | 10 years from issuance |
| Marketing data | 2 years after last interaction |
The three-year account clock runs from your last activity unless you request deletion, and the ten-year financial retention is a legal-compliance period that survives account deletion — that is normal for an EU company, and it does mean deleting your account is not the same as erasing every trace.
Deletion is self-service
You delete the account yourself from your profile settings, in a section the platform labels the danger zone. Deleting before a renewal date also cancels an active subscription.
Candy.ai help centre, account deletion articlesHow fast deletion happens
The privacy notice commits only to acting without undue delay. There is no published number of days, so we cannot give you one.
candy.ai privacy policy — no timeframe publishedChat history and memory are linked
There is no way to clear a chat history while keeping the character's memory of you. Memory is tied to the active chat, so resetting a chat starts the relationship over. If privacy from your own household is the concern, that is the only lever available.
Candy.ai help centre, chat history articleInactivity can cost you content
The terms allow the platform to remove account content after defined periods of inactivity, with no reimbursement and no restoration of anything you paid for. A dormant paid account is not a safe archive.
candy.ai terms of serviceThe 18+ policy and what the platform bans
Candy.ai states that it does not provide services to, or collect personal data from, anyone under 18. Access is controlled by an age gate on entry plus self-affirmation that you are over 18, and the underage policy notes that further verification may be added where local rules require it. In plain terms: the current check is a declaration, not identity verification, and the platform reserves the right to tighten that.
The blocked content policy — effective 30 July 2026 — names eight prohibited categories. The ones most relevant to whether a platform is responsibly run include:
- Child exploitation, with a stated zero-tolerance position.
- Content resembling minors, which is the separate and important one, because it covers stylised or ambiguous output rather than only real imagery.
- Impersonation and celebrity content.
- Non-consensual intimate imagery and deepfakes, banned outright.
Two related mechanics follow from this. The character creation form defaults a new character's age to 18. And there is no refund for content that gets moderated or removed for a policy violation — enforcement and your money are separate questions.
Country availability
We looked for a published list of countries where Candy.ai is or is not available, including whether age-verification laws block it anywhere, and found no primary source at all. Nobody else answers this either. If access matters to you, test it before paying rather than trusting any list you find online — including ours, which is why we do not publish one.
No primary source located as of 1 August 2026Public review scores
Candy.ai has a live review profile on a major review platform, but the summaries we could reach flatly contradicted each other — one claimed most reviewers rate it highly, another claimed nearly all rate it lowest. We could not read the underlying page directly, so we publish no score.
Review platform page not readable; third-party summaries contradictoryIf you decide to use it, do these four things
- Start on the monthly term, not the annual one. The 70% saving is real, but the refund window is 24 hours and the annual plan takes €47.88 in a single charge. Prove you will use it first.
- Pay by card if you might want a refund. The published refund clause covers card purchases. Crypto is the private option, not the recoverable one.
- Watch the token balance, not the subscription. Chat is unlimited, but images, video and voice run down the 100 monthly tokens — that is where an unexpected second bill comes from.
- Know the exit before you enter. Cancelling is self-service and takes a minute, but it does not refund anything and it is a different action from deleting your account.