The Companion Lab, a new transparency project, has documented the actual merchant descriptors appearing on bank statements for seven popular AI companion applications. The findings, published on October 22, 2026, reveal that none of the tested apps bill under the brand names users see on their websites. However, the level of discretion varies significantly: while some descriptors are nearly impossible to identify without prior knowledge, others explicitly name the service or its domain, contradicting the assumption that all AI companion billing is opaque.

The Spectrum of Discretion

The lab categorizes the descriptors into two groups: those that are 'discreet' and those that are 'identifiable.' For instance, 'Candy AI' bills as 'EverAI candy.ai MT' and 'DreamGF' bills as 'Dream AI dreamgf.ai RO.' The source notes that these are 'not discreet at all' because they include the app's web address, allowing users to easily identify the charge by searching the string. In contrast, 'Secrets AI' is described as 'the most discreet of the seven that are not obviously the app,' billing as 'S LABS INC 604-3295224 CA US.' While the entity is identified in the source as 'Secret Labs Inc., Dover, Delaware,' the descriptor itself contains the suffix 'CA US,' which typically refers to the payment processor's location or billing address rather than the corporate headquarters. The source does not flag this as a contradiction, but notes that 'Nothing in the string suggests an AI companion app.'

Shared Infrastructure and Billing Quirks

A notable technical finding is the shared billing infrastructure between 'SpicyChat AI' and 'GirlfriendGPT.' Both services produced statements carrying the same phone number, 514-2860020, and similar domain-based descriptors ('NDAI.CC' and 'NDAI.CHAT'). The lab confirmed that both are operated by NextDay AI, with listed locations in Montreal, Delaware, and Limassol. The source notes that the descriptors for both apps show 'DE US,' and they are 'very discreet' because 'NDAI.CC means nothing to someone who has not seen it before.' Despite being separate subscriptions, they share this backend billing identity, meaning a user disputing one charge might inadvertently flag the other if not careful.

Why This Matters for Developers and Users

For developers building subscription-based AI tools, this data serves as a practical guide to payment processor configuration and user trust. The lab's data shows charges ranging from $9.99 to $24.99, all cancelled during the test period. The source explicitly states that 'Xotic AI' (billed as 'Xotic.ai Tallinn EE') 'names the site outright, so it is not discreet at all,' challenging the narrative that all AI billing is obscure. Similarly, 'Ourdream AI' bills as 'DREAMSTUDIOS.CO Limassol CY,' which the source describes as 'middle of the group' and 'close enough that the app is easy to identify.' The transparency project argues that clearer merchant names help users track recurring costs, especially since many of these apps rely on additional in-app purchases like coins or tokens that further obscure the total cost of ownership.

Key Takeaways

  • Discretion varies widely: Apps like Candy AI, DreamGF, and Xotic AI include their domain in the descriptor, while Secrets AI and NDAI services use opaque legal entity names.
  • SpicyChat AI and GirlfriendGPT share the same billing entity (NextDay AI) and phone number (514-2860020), requiring users to check the domain suffix to distinguish them.
  • Country suffixes in descriptors (e.g., CA, DE, RO, EE, CY) often reflect the payment processor's location rather than the company's registered headquarters.

The Bottom Line

If your AI app’s billing descriptor looks like a shell company in the Caymans, you’re not just hiding the brand—you’re hiding the value. Clarity builds trust; obfuscation builds refunds.

Practical Advice for Builders

If you are shipping a subscription product, ensure your merchant descriptor matches your brand or at least includes a recognizable keyword. The Companion Lab’s methodology—photographing actual card notices—is the gold standard for verification. Don’t rely on your checkout page promises; check what the bank actually sees. As the lab notes, merchant names can change when a company switches payment processors, so continuous monitoring is essential for maintaining a clean financial footprint.