Workflow & Automation · trycandle.appCandle
Graded against 811 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
No lens is bandable yet — banding requires fully verified documents with on-criteria findings. The gap is shown honestly, never estimated.
“Candle uses AI to power certain content and personalization features within the Services, such as generating conversation prompts and rephrasing custom questions you write to your Partner for clarity or tone. We do not use your photos, intimate content, or private conversations to train AI models, and we do not share this content with third-party AI…”
Partially verified: no core document fully assessed yet. Everything below comes only from what was read in full.
Watch: Data retention
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
This segment imposes an obligation on the platform to retain Personal Data only for as long as necessary to fulfill collection purposes, provide services, comply with legal obligations, resolve disputes, and enforce agreements, establishing a necessity-based retention standard.
Establishes the procedure for mutual data sharing between paired users, specifying that shared content is visible and downloadable by the partner, and that upon unpairing all shared content is archived, becomes inaccessible through the service, and may be permanently deleted, defining the data lifecycle for paired relationship content.
This segment grants the platform permission to create aggregated, de-identified, or anonymized data from collected Personal Data by removing personally identifiable information, and to use and share such data with third parties for business purposes including service improvement and business promotion.
How to read this page: Overall risk rates what Candle's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Partially verified — core documents pending. Findings below are from fully-read, verified documents only; remaining core documents are pending capture.
Terms not yet captured
AIRIN has not yet captured a gate-verified Terms of Service document for this platform.
- ai_addendumVerified - read in full - 65 citationsLast captured 2026-07-19
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Enumerates the specific circumstances under which personal data is collected directly from the user — including account creation, purchases, surveys, free-form text, contact, and automatic collection via cookies — defining the scope of direct collection triggers.
" When you sign up for our Services or request more information. When you provide such information directly to us. When you create an account or use our Services. When you make a purchase or complete a transaction. When you participate i..."
Grants the provider permission to use personal data for a range of purposes including account management, order processing, service delivery, research, analytics, product development, personalization, fraud protection, security, and debugging, establishing the permissible scope of internal data processing.
" Creating and managing your account. Processing orders; billing. Providing you with the products, services or information you request. Assessing your service and product needs and preferences. Meeting or fulfilling the reason you provid..."
This segment grants the platform permission to disclose Personal Data to government authorities or law enforcement when required by law, regulation, valid legal process, or when necessary to protect personal safety.
" We may disclose Personal Data to government authorities or law enforcement officials when required by law, regulation, or valid legal process (such as a subpoena, court order, or search warrant), or when necessary to protect the safety of ..."
This segment grants the platform permission to create aggregated, de-identified, or anonymized data from collected Personal Data by removing personally identifiable information, and to use and share such data with third parties for business purposes including service improvement and business promotion.
" We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or ..."
Continues the enumeration of service provider categories that may receive personal data, including hosting, technology, and communications providers, establishing the scope of subprocessor data sharing.
" The categories of Personal Data described above may be shared with the following recipients for the purposes described in this Policy. We disclose your Personal Data to the categories of service providers and other parties listed in this s..."
This segment grants permission to transfer all collected Personal Data to a third party in the event of a merger, acquisition, bankruptcy, or similar transaction in which that third party assumes control of the business.
" All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part)."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" Candle is designed for paired users (“ Partners ”). When you pair with another user: Mutual Data Sharing : You and your Partner will have mutual access to shared content, including photos, responses to prompts, activity data, and conversations. Content you share with your Partner is visible to them and can be viewed, downloaded, or screenshot by them. Unpairing and Data Deletion : If either you or your Partner unpairs your accounts, all Shared Content associated with that pairing will be archived and will no longer be accessible through the Services. Archived data may become permanently deleted in accordance with the Terms . This design protects both partners’ privacy and prevents continued access after a relationship ends. Partner Communication : You are solely responsible for communications with your Partner through our Services. We do not monitor communications between paired users except when content is reported for Terms of Service violations."
Establishes the procedure for mutual data sharing between paired users, specifying that shared content is visible and downloadable by the partner, and that upon unpairing all shared content is archived, becomes inaccessible through the service, and may be permanently deleted, defining the data lifecycle for paired relationship content.
AI-generated interpretation, not legal advice.
" We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Services and promote our business."
This segment grants the platform permission to create aggregated, de-identified, or anonymized data from collected Personal Data by removing personally identifiable information, and to use and share such data with third parties for business purposes including service improvement and business promotion.
AI-generated interpretation, not legal advice.
" You can control location permissions through your device settings at any time. If you disable location services, location-based recommendations may not be available, some features may not function properly, and we will no longer collect location information from your device. We do not share your precise location with third parties except as described in the “How We Share Your Personal Data” section (such as with mapping or venue database providers necessary to deliver the feature)."
This segment grants users the right to control or disable location permissions at any time through device settings, discloses the functional consequences of doing so, and restricts sharing of precise location with third parties except as described in the data sharing section for necessary feature delivery purposes — partially protective of user location privacy.
AI-generated interpretation, not legal advice.
" We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements."
This segment imposes an obligation on the platform to retain Personal Data only for as long as necessary to fulfill collection purposes, provide services, comply with legal obligations, resolve disputes, and enforce agreements, establishing a necessity-based retention standard.
AI-generated interpretation, not legal advice.
" The categories of Personal Data described above may be shared with the following recipients for the purposes described in this Policy. We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a “sale” of your Personal Data. For more information, please refer to the state-specific sections below. Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include: Hosting, technology and communication providers."
Continues the enumeration of service provider categories that may receive personal data, including hosting, technology, and communications providers, establishing the scope of subprocessor data sharing.
AI-generated interpretation, not legal advice.
" We may share any Personal Data that we collect with third parties in conjunction with any of the activities set forth under “Meeting Legal Requirements and Enforcing Legal Terms” in the “How We Use Your Data” section above."
This segment grants the platform permission to share any collected Personal Data with third parties when required to meet legal obligations or enforce legal terms, incorporating by cross-reference a separately defined set of activities.
AI-generated interpretation, not legal advice.
" Candle uses AI to power certain content and personalization features within the Services, such as generating conversation prompts and rephrasing custom questions you write to your Partner for clarity or tone. We do not use your photos, intimate content, or private conversations to train AI models, and we do not share this content with third-party AI providers."
This segment explicitly prohibits the use of user photos, intimate content, or private conversations to train AI models, and prohibits sharing such content with third-party AI providers — a user-favorable restriction that protects against training use of sensitive personal content.
AI-generated interpretation, not legal advice.
" We do not sell your Personal Data. If our privacy practices change materially, we will notify you in accordance with applicable law."
This segment prohibits the sale of Personal Data and imposes a procedural obligation to notify users if privacy practices change materially, constituting a user-favorable restriction on commercial exploitation of data.
AI-generated interpretation, not legal advice.
" Marketing and Advertising Partners. We work with advertising partners to promote Candle on third-party platforms. However, these partners receive only technical identifiers (such as device IDs or hashed email addresses) to measure campaign effectiveness and conduct other similar marketing activities. However, we do not share your private messages, partner conversations, shared photos, or responses to personal prompts with any marketing or advertising partner. Analytics Partners. These parties provide analytics on web traffic or usage of the Services. They include: Companies that track how users found or were referred to the Services. Companies that track how users interact with the Services."
Restricts the scope of data shared with marketing and advertising partners to only technical identifiers such as device IDs or hashed email addresses for campaign measurement purposes, and explicitly prohibits sharing private messages, partner conversations, shared photos, or responses to personal prompts with any marketing or advertising partner — user-favorable restriction on sensitive data sharing; also identifies analytics partners as a category of recipient receiving web traffic and usage data.
AI-generated interpretation, not legal advice.
" If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your Personal Data: Right to Know : You have the right to request information about the categories and specific pieces of Personal Data we have collected about you, the sources of that data, the purposes for collecting it, and the third parties with whom we share it. Right to Delete : You have the right to request that we delete your Personal Data, subject to certain exceptions (such as data needed to complete a transaction or comply with legal obligations). Right to Correct : You have the right to request that we correct inaccurate Personal Data we maintain about you. Right to Opt-Out of Sale/Sharing : You have the right to opt out of the “sale” or “sharing” of your Personal Data for cross-context behavioral advertising. We do not sell your Personal Data to third parties for monetary consideration. However, our use of certain analytics and advertising services (including Meta Pixel, TikTok SDK, AppsFlyer, and Amplitude) may constitute “sharing” under California law. You can opt out by adjusting your privacy settings in your account or by enabling Global Privacy Control (GPC) in your browser. Right to Limit Use of Sensitive Personal Information : If we collect sensitive personal information, you have the right to limit its use to what is necessary to provide the Services. Right to Non-Discrimination : We will not discriminate against you for exercising any of your privacy rights. To exercise these rights, please contact us at support@trycandle.app . We will respond to verifiable requests within the timeframes required by applicable law."
Enumerates specific privacy rights granted to California residents, including the right to know about categories, sources, purposes, and third-party sharing of personal data, and the right to delete personal data subject to certain exceptions, establishing legal entitlements under named state statutes.
AI-generated interpretation, not legal advice.
" If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties who intend to license or sell that Personal Data. You can exercise this right by contacting us at support@trycandle.app with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account."
Grants Nevada residents the right to opt out of the sale of certain personal data to third parties who intend to license or sell it, and specifies the procedure for exercising that right via email with a designated subject line.
AI-generated interpretation, not legal advice.
"For clarity, a user’s private messages and photos shared within the Services are not deemed Marketing Data. Social Media Data (if you connect third-party accounts) If you sign in using Google or Apple, we receive only the authentication credentials needed to verify your identity (e.g., account identifier and email address) We do not auto-populate your name, profile photo, or other profile information from these services"
Clarifies that private messages and photos shared within the Services are excluded from the marketing data category; further restricts the data received via third-party sign-in to authentication credentials only, and prohibits auto-populating profile information from those services — user-favorable restrictions limiting data collection scope.
AI-generated interpretation, not legal advice.
"Geolocation Data (collected only with your device permission for location-based features) User Uploaded Images Photos and images you upload may contain biometric information such as facial features. We do not extract or store biometric templates or use facial recognition technology for identification purposes. "
Reiterates that geolocation is collected only with device permission and that biometric templates are not extracted or stored and facial recognition technology is not used for identification purposes — user-favorable restrictions limiting sensitive data processing.
AI-generated interpretation, not legal advice.
" Active Account and Profile Data Duration of account + 30 days after closure To provide Services and allow reasonable account recovery period User-Generated Content (photos, messages, posts) Duration of account; deleted within 30 days of account closure Core service functionality; privacy protection after departure Purchase and Transaction History 7 years after transaction Order history, refund eligibility, and legal compliance Payment Information Duration of account or as required by payment processor; card details may be retained for 180 days to address chargebacks To process transactions, refunds, and handle payment disputes Account & Billing Records 7 years after account closure Tax, accounting, and legal compliance requirements Customer Service Records 3 years after resolution Customer service quality, dispute resolution, and legal claims Consent Records 3 years after consent given or withdrawn Demonstrating compliance with consent requirements under applicable law Communication Logs and Metadata 1 year Legal data retention obligations; security and fraud investigation Identity Verification Data Retained as part of account data and support records; verification codes are temporary and expired after use Account security and support purposes "
Sets specific retention periods for multiple data categories (active account data, user-generated content, purchase/transaction history, payment information), establishing binding timelines and rationale for how long each category is kept and when it must be deleted.
AI-generated interpretation, not legal advice.
" We use third-party services to operate Candle, including, without limitation: Cloud Hosting Providers : PlanetScale provides database hosting (MySQL/Vitess) with SSL/TLS encryption in transit and encryption at rest. Authentication : Clerk (SOC 2 compliant) manages user login and account security. Learn more: Clerk Privacy Policy AI Services : OpenAI powers our AI features, including question generation, debate topics, date recommendations, and question rewording. When you use AI features, your prompts may be sent to OpenAI for processing. We do not share your photos or private conversations with OpenAI. Learn more: OpenAI Privacy Policy Analytics : Amplitude provides product analytics to understand how users interact with our Services. Learn more: Amplitude Privacy Policy AppsFlyer provides mobile attribution to measure advertising effectiveness. Learn more: AppsFlyer Privacy Policy "
This segment identifies specific third-party service providers used to operate the platform, disclosing their roles (database hosting, authentication, AI processing) and noting that user prompts may be sent to an AI provider for processing while explicitly stating photos and private conversations are not shared — a partially protective disclosure regarding data sharing scope.
AI-generated interpretation, not legal advice.
" Identity Verification Data Account information and verification codes used to confirm your identity for support and account recovery purposes"
Defines identity verification data as a category of Personal Data, specifying that account information and verification codes are collected to confirm identity for support and account recovery purposes.
AI-generated interpretation, not legal advice.
" We recognize the deeply personal nature of this content and treat it with the heightened care described in this Policy."
Imposes an obligation on the provider to treat sensitive personal content with heightened care as described in the policy, creating a protective commitment in favor of users regarding how their deeply personal data is handled.
AI-generated interpretation, not legal advice.
" Advertising, marketing and selling the Services."
Grants the provider permission to use personal data for advertising, marketing, and selling the services, establishing a permissible commercial data use purpose.
AI-generated interpretation, not legal advice.
Common questions about Candle's policies
- Does Candle train its AI models on your data?
- No training on your content by default — based on 1 verified finding from Candle's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Candle's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
0 verified clausesClauses in Candle's policies that work in your favour — commitments the platform made to you.
No protective clause has been verified in Candle's published policies yet. That means we did not find one in the documents we read — not that the platform offers nothing.
📋 Rules you must follow
0 verified clausesWhat Candle requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
No user-conduct rule has been verified in Candle's published policies yet.
What the policies actually cover
0 topicsNone of Candle's verified clauses has been assigned a topic yet. The clause-trust review has not reached this platform's findings.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the policy document, AI Addendum › “General Retention Principles” addresses how long content is retained, and the policy document, AI Addendum › “AI-Assisted Features” addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
Verified retention clauses point in different directions: the policy document, AI Addendum › “General Retention Principles” describes broad or open-ended retention, while the policy document, AI Addendum › “Dispute resolution and Terms of Service enforcement” describes deletion or erasure. Which clause controls in a given situation is not resolved by the documents' text alone — this is surfaced as an ambiguity, treated as Caution.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements.”Open source citation
The clause provides a deletion or time-bounded retention path.
“Active Account and Profile Data Duration of account + 30 days after closure To provide Services and allow reasonable account recovery period User-Generated Content (photos, messages, posts) Duration of account; deleted within 30 days of account closure Core service functionality; privacy protection after departure Purchase and Transaction History 7 years after transaction Order history, refund eligibility, and leg...”Open source citation
The clause permits sale of personal data or information.
“We do not sell your Personal Data. If our privacy practices change materially, we will notify you in accordance with applicable law.”Open source citation
The clause permits sale of personal data or information.
“If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your Personal Data: Right to Know : You have the right to request information about the categories and specific pieces of Personal Data we have collected about you, the sources of that data, the purposes for collecting it, and the third parties with whom w...”Open source citation
The clause permits sale of personal data or information.
“If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties who intend to license or sell that Personal Data. You can exercise this right by contacting us at support@trycandle.app with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account.”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | data retention | conditional | MEDIUM | 2 |
| All applicable tiers | privacy data use | worsens | HIGH | 5 |
| All applicable tiers | subprocessors data sharing | conditional | MEDIUM | 2 |
| All applicable tiers | training use | improves | LOW | 1 |
| Team / Business | privacy data use | conditional | MEDIUM | 1 |
| Team / Business | subprocessors data sharing | conditional | MEDIUM | 1 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
Latest stance: third party or vendor sharing on privacy data use
“Candle is designed for paired users (“ Partners ”). When you pair with another user: Mutual Data Sharing : You and your Partner will have mutual access to shared content, including photos, responses to prompts, activity data, and conversations. Content you share with your Partner is visible to them and can be viewed, downloaded, or screenshot by them. Unpairing and Data Deletion : If either you or your Partner unpairs your accounts, all Shared Content associated with that pairing will be archived and will no longer be accessible through the Services. Archived data may become permanently deleted in accordance with the Terms . This design protects both partners’ privacy and prevents continued access after a relationship ends. Partner Communication : You are solely responsible for communications with your Partner through our Services. We do not monitor communications between paired users except when content is reported for Terms of Service violations.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“The categories of Personal Data described above may be shared with the following recipients for the purposes described in this Policy. We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a “sale” of your Personal Data. For more information, please refer to the state-specific sections below. Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include: Hosting, technology and communication providers.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“Marketing and Advertising Partners. We work with advertising partners to promote Candle on third-party platforms. However, these partners receive only technical identifiers (such as device IDs or hashed email addresses) to measure campaign effectiveness and conduct other similar marketing activities. However, we do not share your private messages, partner conversations, shared photos, or responses to personal prompts with any marketing or advertising partner. Analytics Partners. These parties provide analytics on web traffic or usage of the Services. They include: Companies that track how users found or were referred to the Services. Companies that track how users interact with the Services.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“We may share any Personal Data that we collect with third parties in conjunction with any of the activities set forth under “Meeting Legal Requirements and Enforcing Legal Terms” in the “How We Use Your Data” section above.”Open timeline citation
Latest stance: sale or sell on privacy data use
“We do not sell your Personal Data. If our privacy practices change materially, we will notify you in accordance with applicable law.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Services and promote our business.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“You can control location permissions through your device settings at any time. If you disable location services, location-based recommendations may not be available, some features may not function properly, and we will no longer collect location information from your device. We do not share your precise location with third parties except as described in the “How We Share Your Personal Data” section (such as with mapping or venue database providers necessary to deliver the feature).”Open timeline citation
Latest stance: sale or sell on privacy data use
“If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your Personal Data: Right to Know : You have the right to request information about the categories and specific pieces of Personal Data we have collected about you, the sources of that data, the purposes for collecting it, and the third parties with whom we share it. Right to Delete : You have the right to request that we delete your Personal Data, subject to certain exceptions (such as data needed to complete a transaction or comply with legal obligations). Right to Correct : You have the right to request that we correct inaccurate Personal Data we maintain about you. Right to Opt-Out of Sale/Sharing : You have the right to opt out of the “sale” or “sharing” of your Personal Data for cross-context behavioral advertising. We do not sell your Personal Data to third parties for monetary consideration. However, our use of certain analytics and advertising services (including Meta Pixel, TikTok SDK, AppsFlyer, and Amplitude) may constitute “sharing” under California law. You can opt out by adjusting your privacy settings in your account or by enabling Global Privacy Control (GPC) in your browser. Right to Limit Use of Sensitive Personal Information : If we collect sensitive personal information, you have the right to limit its use to what is necessary to provide the Services. Right to Non-Discrimination : We will not discriminate against you for exercising any of your privacy rights. To exercise these rights, please contact us at support@trycandle.app . We will respond to verifiable requests within the timeframes required by applicable law.”Open timeline citation
80 findings first captured First scan: July 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Candle's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Know where the missing document lives?
We haven't yet verified Candle's Terms of Service and Privacy Policy. Point us at the official page and our pipeline will attempt to capture and read it in full. Submissions are candidates only — nothing is published until it passes the same verification gates as every other document on this site.
Every finding above is a verbatim quote from Candle's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.