A processor list is a map of responsibility
An intimate AI service can have a company that decides why data is processed, a model provider that generates a reply, a host that stores files, a delivery network, a payment processor and an age-verification vendor. Calling the whole arrangement “private” does not tell a reader who sees which data. EroLove AI’s Privacy Policy identifies its Portuguese operator as controller, names Amazon Web Services and Cloudflare for hosting and delivery, and identifies AgeVerif for certain age checks. It says the payment processor is named at checkout. It does not list the current AI model providers on the public policy page; users are invited to ask for that list.
That omission is especially relevant because the policy says relevant conversation content is sent to those AI providers to produce replies, images and voice when played. The policy also says it does not send a user’s email or identity with that content. Both statements matter. A model processor can receive sensitive words without receiving the account email, and a message can itself contain identifying details if the user types them. We have not tested traffic or obtained the private provider list; this is a document review as of 5 November 2026.
The eight fields worth asking for
| Field | Why it helps a reader | Example of a precise answer |
|---|---|---|
| Legal entity and role | Separates controller, processor and independent controller. | “Company X processes text as our processor.” |
| Service function | Reveals whether the vendor handles chat, images, voice, storage or payment. | “Text generation only.” |
| Data categories | Shows whether raw content, metadata or identifiers are passed. | “Relevant prompt text without account email.” |
| Processing location | Places cross-border claims in a real workflow. | “Requests are processed in region Y.” |
| Retention | Explains whether the vendor stores prompts and for how long. | “Transient processing plus N-day abuse log.” |
| Training use | Clarifies whether content can improve third-party models. | “Contract prohibits training for this service.” |
| Subprocessors | Shows whether a named provider delegates part of the path. | “A current subprocessor list is maintained.” |
| Deletion propagation | Explains how a user request reaches copies beyond the first-party account. | “Deletion instruction reaches processors within N days.” |
The examples are requests for specificity, not claims about EroLove’s actual vendor contracts. In particular, the checked Privacy Policy says it chooses no-training terms where such terms are available. A reader should preserve that limitation instead of assuming a universal contractual ban for every model path.
Make the request narrow enough to answer
Start with one modality. “Which current companies receive the relevant text of a chat reply, and what is their retention period?” is easier to answer than “Tell me everything you do with data.” If you use image or voice features, ask separately whether different model processors receive different payloads. Ask when the list was last updated, since a model stack can change while a generic policy sentence stays the same.
The user can also limit what they send while waiting. Use fictional details, omit real names and addresses, and avoid disclosing another person’s intimate information. This is not a claim that the service sells data; its policy says it does not. It is a sensible response to an incomplete public processor map for sensitive conversation content.
Our technical verdict
EroLove AI names some infrastructure actors and offers a route to request the AI provider list. That is better than silence, but a reader must do extra work to see the model-processing actors that matter most to an intimate conversation. A public, dated inventory with roles, modalities and retention would make the privacy promise testable. Until then, the responsible label is “documented in part, provider detail requested”—not “secure,” “insecure,” or “illegal.”
Evidence boundary
Document titles checked 2026-11-05: EroLove Privacy Policy, updated 2026-10-23 and checked 2026-11-05. Vendor document names are given without a vendor link. Public policies describe intentions and obligations; they do not independently verify implementation or compliance.