What we could verify

House rules: is Candy AI safe to pay and to use?

Is Candy AI safe? Based on what its own Privacy Notice and Terms say, it is a real, adults-only service that handles payments through payment providers, keeps just partial card details and encrypts passwords. The charge shows as EverAI on your bank statement. We cannot audit Candy from outside, so this page reports what Candy says and marks what we cannot verify.

The facts we checkedFrom Candy's Privacy Notice and Terms, read November 12, 2026.

Company	EverAI Limited, Malta
On your bank statement	EverAI
Card data kept by Candy	brand and last 4 digits
Payment providers named	Emerchantpay, TrustPay
Passwords	stored encrypted
Selling your data	not without consent, Candy says
Who can sign up	adults of legal age only

Payments and the billing name

Payments run through payment service providers. The Privacy Notice names Emerchantpay and TrustPay. Candy says it stores only the card brand and the last four digits, not the full card number, and that passwords are stored encrypted. Those are Candy's statements, and we have no means of testing them.

Expect the charge to appear as EverAI on your statement, not as Candy. EverAI Limited is the company behind Candy and it is registered in Malta. Knowing the name saves a worried call to your bank when the line shows up.

Candy accepts credit and debit cards, crypto, Apple Pay, Google Pay and bank transfer. Plans renew automatically, so read the plan on screen before you pay. Candy asks that a payment method stay saved while a plan runs.

Data and privacy

Candy says it does not sell or transfer personal data to third parties without consent, where consent is required. Under GDPR it names a Data Protection Officer, and technical log files are deleted after thirty days, it says. These are the points we found in the Privacy Notice.

Candy runs in the browser, with no native app. A home screen shortcut as a web app is possible, which doesn't change how your data is handled. As with any account, pick a password that is unique to this account.

None of this tells you how well the promises are kept in practice. We read documents, not servers. If privacy matters a lot to you, read the Privacy Notice yourself and use the contact route that it describes.

Adults only, and what we cannot verify

Candy is for adults. Users must be of legal age where they live, according to the Terms, and it says it has an policy on age limits and content moderation. Everyone in the series is an adult AI character, and the licensed twins appear with the performer's consent and license.

So is Candy legit? It is an operating service with published terms, and the money and data practices it describes are ordinary for the sector. That is not a guarantee. We cannot verify how moderation works, how fast support replies or how any refund request plays out.

Our advice is practical. Check the price on screen, set a reminder before the renewal, keep your login private and know how to cancel before you pay. Our how-to-cancel and refunds pages cover those two steps.

Questions people ask

Is Candy AI safe to pay for?

Candy says payments go through payment providers and that it keeps partial card details only. We cannot test that, so check the price on screen and watch your statement.

What will the charge look like on my statement?

Look for EverAI on your statement. That is the company behind Candy, and EverAI Limited is registered in Malta. Knowing the name early saves a needless call to your bank.

Is Candy AI legit?

It is a real service with published Terms, a Privacy Notice and a Help Center. That makes it legitimate in the ordinary sense, but we cannot audit its practices from outside.

Is Candy Shorts safe for under eighteens?

No. Candy is for adults only, and everyone using it has to be a legal adult in their own country. All the characters in the series are adult AI creations, but the service itself is still not meant for anyone under eighteen.

Does Candy sell my data?

Candy states that personal data is not sold or passed on to third parties without prior consent in the cases the law covers, and it has a Data Protection Officer under GDPR.