--- title: "App Privacy Policy - DokuAI" description: "Privacy Policy for the DokuAI app: data processed, legal bases, recipients, retention and your rights (GDPR, CCPA). Controller: DigitalFreedom Global LLC." url: "https://dokuai.app/legal/privacy-policy/" language: "en" last_updated: "2026-10-17" --- # PRIVACY POLICY ## Global Data Protection and Privacy Notice **Effective Date:** 14 October 2026 **Service operated by:** DigitalFreedom — a brand of DigitalFreedom Global LLC **Data Controller (legal entity):** DigitalFreedom Global LLC (trading as DigitalFreedom) 30 N Gould St, Ste N Sheridan, WY 82801 United States Contact (general): [hello@digitalfreedom.co.za](mailto:hello@digitalfreedom.co.za) Contact (data protection): [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za) Data protection request form: [https://data-protection.digitalfreedom.co.za](https://data-protection.digitalfreedom.co.za/) Website: [https://digitalfreedom.co.za](https://digitalfreedom.co.za/) * * * ## 1\. INTRODUCTION This Privacy Policy explains how DigitalFreedom (a brand of DigitalFreedom Global LLC, collectively “we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use our applications, software, websites, and related services (“the Services”). ### 1.1 Global scope Our applications are distributed via the Apple App Store and the Google Play Store and are therefore made available in every country and territory those platforms serve. This Privacy Policy applies globally to all users of the Services, regardless of the country in which the Service is downloaded, accessed or used. ### 1.2 GDPR as the global baseline We adopt the **European Union General Data Protection Regulation (GDPR)** and related EU data-protection law as the baseline and apply it as a **global floor** — every user, in every country, benefits from at least the GDPR-level protections set out in this Policy. We additionally respect and comply with any applicable local data-protection law of the user’s jurisdiction, and where that local law is more protective for the user, the more protective standard applies. We are committed to protecting your privacy and complying with applicable data-protection laws, including but not limited to: - EU General Data Protection Regulation (GDPR) — applied as the global baseline - German Federal Data Protection Act (BDSG) - UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 - Swiss Federal Act on Data Protection (FADP) - California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) and other US state privacy laws - Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) - Australian Privacy Act 1988 - Brazilian General Data Protection Law (LGPD) - Japanese Act on the Protection of Personal Information (APPI) - South Korean Personal Information Protection Act (PIPA) - Indian Digital Personal Data Protection Act (DPDP Act) and IT Act - South African Protection of Personal Information Act (POPIA) - All other applicable national data-protection regimes in jurisdictions in which the Services are made available via the Apple App Store or Google Play Store * * * ## 2\. DATA CONTROLLER The Services are offered under the **DigitalFreedom** brand. The legal entity responsible for processing your personal data (the “data controller” under Art. 4(7) GDPR) is: DigitalFreedom Global LLC (trading as DigitalFreedom) 30 N Gould St, Ste N Sheridan, WY 82801 United States For data protection inquiries (GDPR Art. 13/14, access, rectification, erasure, portability, objection requests): Request form: [https://data-protection.digitalfreedom.co.za](https://data-protection.digitalfreedom.co.za/) Email: [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za) You may use either route, and you are free to reach us by any other channel — we act on your request however it arrives. For general inquiries: Email: [hello@digitalfreedom.co.za](mailto:hello@digitalfreedom.co.za) Website: [https://digitalfreedom.co.za](https://digitalfreedom.co.za/) * * * ## 3\. DATA WE COLLECT ### 3.1 Data You Provide - Account information (name, email address, username) - Communication data (support requests, feedback) - Payment information (processed via third-party payment providers) - User-generated content ### 3.2 Data Collected Automatically - Device information (device type, operating system, version) - Usage data (features used, interaction patterns) - Log data (IP address, access times, error logs) - Analytics data (aggregated usage statistics) ### 3.3 Data from Third Parties - Authentication data from social login providers (if applicable) - Platform-specific data from app stores (Apple, Google) ### 3.4 Sensor, Device and Biometric Data Where the app uses sensors or biometrics on your device: - **Biometric authentication** (Face ID / Touch ID / Android BiometricPrompt): the biometric template never leaves your device. The app only receives a yes/no result from the operating system. - **Camera, microphone, location, photos, contacts, calendar, motion, health**: accessed only when you actively use the feature that needs them. Each access is prompted by the OS with our usage-description text explaining why. - **Health & Fitness data** (HealthKit / Health Connect): processed only for the specific feature you use; not shared with third parties for advertising; not used to train AI models. - **App Tracking Transparency (iOS) / AAID controls (Android)**: by default, DigitalFreedom apps do not track you across other companies’ apps and websites. We do not present the ATT prompt unless a specific feature requires it; if a future feature does, you can decline without losing access to the rest of the app. ### 3.5 Data NOT Collected Unless explicitly disclosed for a specific feature in the per-app addendum, we do **not** collect: - precise location in the background - contacts / address book - SMS / email contents from your device - browsing history outside the app - behavioural-advertising identifiers - payment-card data (payment is collected by Apple or Google; we never receive card details) * * * ## 4\. LEGAL BASIS FOR PROCESSING (GDPR) We process your personal data based on the following legal grounds: | Legal Basis | Purpose | | --- | --- | | **Contract performance** (Art. 6(1)(b) GDPR) | Providing the Services, account management | | **Legitimate interests** (Art. 6(1)(f) GDPR) | Security, fraud prevention, service improvement | | **Consent** (Art. 6(1)(a) GDPR) | Marketing communications, optional analytics | | **Legal obligation** (Art. 6(1)(c) GDPR) | Tax records, regulatory compliance | * * * ## 5\. HOW WE USE YOUR DATA We use your personal data to: - Provide, operate, and maintain the Services - Process transactions and manage subscriptions - Communicate with you (support, updates, notices) - Improve and personalize the Services - Ensure security and prevent fraud - Comply with legal obligations - Conduct analytics (where permitted or consented) * * * ## 6\. DATA SHARING AND DISCLOSURE We may share your data with: ### 6.1 Service Providers Third-party providers who assist in operating the Services, including: - Cloud hosting providers - Payment processors - Analytics providers - Customer support tools ### 6.1.1 Named Sub-processors The following sub-processors are currently engaged for processing your personal data: | Processor | Role | Location | | --- | --- | --- | | Civo Ltd. | Cloud infrastructure (Kubernetes, virtual machines, object storage, DNS) — primary infrastructure provider; workloads distributed across both regions | Frankfurt am Main, Germany (`fra1`) and London, United Kingdom (`lon1`) | | Migadu-Mail GmbH | Email hosting (inbound/outbound mail for support and contact addresses) | Servers in France (EU); company established in Switzerland | | Google Ireland Limited (Google Cloud / Workspace) | Ancillary Google Cloud Platform / Workspace services consumed by applications and tooling | EEA data-centre regions (with onward transfer to other Google entities under EU SCCs / UK Addendum) | | OpenAI Ireland Ltd. | OpenAI API Services (model inference, embeddings) for AI-assisted application features | Ireland (with onward transfer to OpenAI OpCo, LLC in the United States under EU SCCs / UK Addendum) | | RevenueCat, Inc. | Subscription and in-app-purchase management (receipt validation, entitlement state) for Flutter apps | United States (governed by RevenueCat’s published DPA framework / EU SCCs) | | Storj (Storj Labs Inc.) | Off-provider copy of our server backups (helpdesk, file storage and document management data), stored through Storj’s hosted gateway | United States (company); encrypted pieces on storage nodes in the EU (EU-placed bucket); location of Storj’s hosted gateway not verified | Workloads on Civo are distributed across the `fra1` and `lon1` regions for redundancy and migration purposes. The list of sub-processors may change; the current list is maintained in our internal sub-processor register and is available on request via the data protection contact below. ### 6.1.2 Platform and Distribution Channels The following parties act as **independent controllers** for processing carried out in connection with platform distribution, payment, and platform-level services — not as our processors under Art. 28 GDPR. They are disclosed here for transparency: | Party | Role | Location | | --- | --- | --- | | Apple Distribution International Ltd. | App Store and TestFlight distribution; In-App Purchase / StoreKit — **seller of the purchase in the EU/EEA, UK, Switzerland and Türkiye**, and our agent elsewhere; optional Sign in with Apple. **Not** push delivery: the apps use local notifications only and register no push token. | Ireland (with intra-group processing by Apple Inc. in the United States under Apple’s internal safeguards / SCCs) | | Google Ireland Limited / Google LLC | Google Play distribution and Google Play’s billing system; **seller of the purchase only in the markets where the Play terms name a Google entity** — otherwise the Provider is the seller and Google processes the payment; Play Install Referrer for install attribution. | Ireland / United States (under Google’s own safeguards / SCCs) | For data processed by Apple under its own controllership (Apple ID, payment details, App Store analytics), Apple’s own Privacy Policy applies: [https://www.apple.com/legal/privacy/](https://www.apple.com/legal/privacy/). For data Google processes under its own controllership (Google account, Play billing, Play analytics), Google’s Privacy Policy applies: [https://policies.google.com/privacy](https://policies.google.com/privacy). ### 6.2 Legal Requirements We may disclose data when required by law, legal process, or government request. ### 6.3 Business Transfers In the event of a merger, acquisition, or sale of assets, your data may be transferred. ### 6.4 No Sale of Personal Data We do not sell your personal data to third parties. * * * ## 7\. INTERNATIONAL DATA TRANSFERS Your data may be transferred to and processed in countries outside your country of residence. Specifically with regard to our named sub-processors: - **Civo `fra1` (Frankfurt am Main, Germany)** — within the EU, no transfer outside the EEA. - **Civo `lon1` (London, United Kingdom)** — covered by the EU Commission adequacy decision for the UK pursuant to Art. 45 GDPR. - **Migadu-Mail GmbH** — mail is stored on servers in France (EU), so storage involves no transfer outside the EEA. Migadu is established in Switzerland; access by the Swiss company is covered by the EU Commission adequacy decision for Switzerland pursuant to Art. 45 GDPR. - **Google Cloud / Workspace** — primary processing in EEA data-centre regions. Onward transfers to Google entities outside the EEA (including the United States) are governed by the **EU Standard Contractual Clauses** (Commission Implementing Decision (EU) 2021/914), the **UK International Data Transfer Addendum** issued by the ICO, and supplementary technical measures (encryption in transit and at rest, key management). The contractual basis is Google’s Cloud Data Processing Addendum (Customers). - **OpenAI Ireland Ltd. (Ireland) and OpenAI OpCo, LLC (United States)** — Customer Data submitted to the OpenAI API is processed by OpenAI Ireland Ltd. in the EEA. Onward transfers to OpenAI OpCo, LLC in the United States are governed by the **EU Standard Contractual Clauses** (Module Three — Processor to Sub-Processor), the **UK International Data Transfer Addendum**, and intra-group safeguards. API Customer Data is retained for a maximum of 30 days and then deleted, unless retention is required by law. The contractual basis is the OpenAI Data Processing Addendum. - **RevenueCat, Inc. (United States)** — subscription / in-app-purchase data is transferred to the United States. Transfers are covered by the **EU Standard Contractual Clauses** referenced in RevenueCat’s publicly published DPA framework and supplementary technical measures (encryption in transit and at rest, pseudonymous App User IDs, no payment-card data — card data is processed by Apple or Google, never by us). - **Storj (United States company; storage in the EU)** — a nightly copy of our server backups is uploaded through Storj’s hosted gateway, which encrypts it on Storj’s side with keys handed to Storj, so Storj can access the data in readable form there; the location of that gateway is not verified. The encrypted pieces are stored on storage nodes in the EU, because our bucket is placed in Storj’s EU region. As Storj is a US company with access to the data, this is a transfer to a third country. **No data processing agreement and no Standard Contractual Clauses with Storj are in place at the date of this Policy**, and we do not rely on an adequacy decision for it. A request to Storj for a data processing agreement, the EU Standard Contractual Clauses (Module Two) and the UK Addendum was prepared on 14 October 2026. - **Apple (Apple Distribution International Ltd., Ireland; intra-group processing by Apple Inc., United States)** — Apple acts as **independent controller**. Intra-group transfers to Apple Inc. in the United States are governed by Apple’s internal Binding Corporate Rules / SCCs as disclosed in the Apple Privacy Policy. The Controller is established outside the EEA. Where personal data of users in the EEA is processed by the Controller itself, that processing takes place outside the EEA; the Controller applies the GDPR standard to it as a global baseline, as set out in section 1.2. For onward transfers to the sub-processors named above that are not covered by an adequacy decision, other than Storj (see above): - We rely on EU Standard Contractual Clauses (SCCs) - We ensure adequate safeguards under GDPR Chapter V - We assess the data protection laws of the recipient country (Transfer Impact Assessment) For transfers from other jurisdictions, we comply with applicable cross-border transfer requirements. * * * ## 8\. DATA RETENTION We retain personal data only as long as necessary for the purposes described in this Policy. Criteria for retention periods: - Duration of your account or use of the Services - Legal obligations — **the retention periods of the law that actually binds the Controller and the transaction**, not the longest period found anywhere: for billing records that means up to 10 years of statutory tax and accounting retention; where an EU-law retention duty attaches to a specific record, that duty; never a foreign period applied to a user it does not cover - Legitimate interests (e.g., dispute resolution) Concrete periods per category: account data — while the account is active plus 30 days after deletion; billing records — up to 10 years; support tickets — 3 years from closure; logs — 30 days hot, 90 days cold; marketing subscriber data — until unsubscribe, with a suppression-list entry retained. Upon expiration, data is securely deleted or anonymized. Jurisdiction-specific retention statements are in § 17. * * * ## 8a. SPECIAL CATEGORIES — HEALTH AND FITNESS DATA Where an app offers a health or fitness feature, it processes data about your body or condition. That is a **special category** under Art. 9(1) GDPR and is treated separately from everything else in this Policy. - **We ask for your explicit consent before the first read or write**, on a screen that carries no other subject. Art. 9(2)(a). - The screen names the **concrete data types** the app reads and writes — not “health data” as a category. - The data is stored on your device, or on our servers in Frankfurt and London. It leaves neither for analytics, nor for crash reporting, nor for the AI feature, nor to any advertising recipient. - It is **never** used for a secondary purpose: no personalisation, no model training, no profiling. - Refusing costs you only the health feature. Everything else works. - Withdrawing your consent stops the processing for the future and is done in the app’s settings. - On account deletion it goes with the account, immediately. Where health data would reach an AI feature, that requires its own separate consent. The health consent does not cover it. * * * ## 8b. ACCESS TO INFORMATION ON YOUR DEVICE (APPS) Independently of data protection law, § 25(1) TDDDG and Art. 5(3) of Directive 2002/58/EC require your consent for storing information on your device or reading information already stored there — regardless of whether that information is personal data. | What | When it happens | Basis | | --- | --- | --- | | Analytics identifier and event store | Only after you enable analytics | Consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR | | Crash reporting installation identifier | Only after you enable crash reporting | Consent for the device access under § 25(1); the subsequent processing rests on our legitimate interest in fixing defects | | Attribution token (Apple AdServices) and Play Install Referrer | Once, if you enable install attribution | Consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR | | Local storage the app needs to work — your settings, your content, your session | Always | Strictly necessary; § 25(2) no. 2 TDDDG | **No advertising identifier is read.** The apps display no advertising, and attribution uses the platform tokens above rather than IDFA or the Android advertising ID. Every one of these is a separate switch, all off by default, and each can be changed at any time in the app’s settings. * * * ## 9\. DATA SECURITY We implement appropriate technical and organizational measures to protect your data, including: - Encryption in transit (TLS 1.3) and at rest (AES-256 or equivalent) - Access controls (RBAC, MFA for administrative access, principle of least privilege) - Regular security assessments and sub-processor audits - Audit logging restricted to authorised personnel - Daily backups with off-site replicas - Documented incident response per our internal Breach Response Plan (Art. 33/34 GDPR) No system is completely secure. We cannot guarantee absolute data security. ### 9.1 Breach Notification to You In the event of a personal data breach **likely to result in a high risk** to your rights and freedoms (Art. 34 GDPR), we will notify you without undue delay using the email address associated with your account, including: - nature of the breach - categories and approximate number of records concerned - likely consequences - measures taken or proposed to address the breach and mitigate adverse effects - contact details for further information If individual notification would involve disproportionate effort, we make a public communication on [https://digitalfreedom.co.za/](https://digitalfreedom.co.za/). * * * ## 10\. YOUR RIGHTS ### 10.1 The GDPR catalogue, as the global floor Wherever you live, you can exercise at least: - **Access** to your personal data (Art. 15 GDPR) - **Rectification** of inaccurate data (Art. 16) - **Erasure** (“right to be forgotten”) (Art. 17) - **Restriction** of processing (Art. 18) - **Data portability** (Art. 20) - **Objection** to processing (Art. 21) - **Withdrawal of consent** at any time, as easily as it was given (Art. 7(3)) - **A complaint** to a supervisory authority ### 10.2 What your jurisdiction adds Several jurisdictions grant rights beyond this floor or attach different deadlines and procedures — appeal routes, shorter response periods, named officers. **§ 17 is the single place where those are stated, per jurisdiction.** Nothing in § 17 reduces the floor above. ### 10.3 How to exercise any of them Email `data-protection@digitalfreedom.co.za` or use the request form at [https://data-protection.digitalfreedom.co.za](https://data-protection.digitalfreedom.co.za/). We respond within one month (Art. 12(3) GDPR) — or within the shorter period your jurisdiction prescribes, as stated in § 17. * * * ## 11\. CHILDREN’S PRIVACY Our Services are not directed to children under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly. * * * ## 12\. COOKIES AND TRACKING Our use of cookies and similar technologies is described in our separate Cookie Policy. * * * ## 13\. AUTOMATED DECISION-MAKING AND AI ### 13.1 Automated decisions with legal or similarly significant effect We do not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, unless: - You have given explicit consent - It is necessary for contract performance - It is authorized by applicable law Where any such processing occurs, you have the right under Art. 22(3) GDPR to obtain human intervention, to express your point of view, and to contest the decision. ### 13.2 AI-assisted features Where the Services include AI-assisted features (for example, content generation, summarisation, classification powered by third-party AI APIs such as OpenAI), the AI Transparency Notice describes: - which features use AI - which AI provider is engaged - what data is sent to the AI - retention at the AI provider (30 days for OpenAI API by default) - that the feature runs only after your **consent**, given before the first use, and that you can withdraw it at any time in the app’s settings without losing anything else - AI-generated content labelling (Art. 50 EU AI Act, in force 2026-08-02) ### 13.3 Fair Use enforcement The [Fair Use Policy](https://dokuai.app/legal/fair-use-policy/) describes how operational telemetry is used to detect abuse and to apply throttling, rate-limiting, restriction or suspension where appropriate. Automated detection informs human review; no automated decision under the Fair Use Policy produces legal effects on you without human involvement, except where strictly necessary to mitigate an immediate threat. ### 13.4 Marketing communications Marketing emails are sent only with your **explicit, separate opt-in**, which you can withdraw at any time without affecting the rest of the Services. There are no marketing push notifications: the apps schedule notifications locally on your device and nothing is sent to them from a server. For recipients in Australia, the Spam Act 2003 standard applies to every commercial electronic message: prior consent, accurate sender identification, and a functional unsubscribe. ### 13.5 Account deletion You can delete your account and request erasure of your data at any time. See the Account Deletion Notice for the in-app, email and postal paths. * * * ## 14\. THIRD-PARTY LINKS AND SERVICES The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of third parties. * * * ## 15\. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. - Material changes will be communicated via the Services or by email - Where a change to the processing requires your consent under applicable law, we will obtain that consent before the change applies to you; we do not rely on continued use alone as consent - The “Effective Date” at the top reflects the latest revision * * * ## 16\. CONTACT For privacy-related inquiries or to exercise your rights: DigitalFreedom A brand of DigitalFreedom Global LLC 30 N Gould St, Ste N Sheridan, WY 82801 United States Data protection: [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za) Data protection request form: [https://data-protection.digitalfreedom.co.za](https://data-protection.digitalfreedom.co.za/) General inquiries: [hello@digitalfreedom.co.za](mailto:hello@digitalfreedom.co.za) Website: [https://digitalfreedom.co.za](https://digitalfreedom.co.za/) For EU residents, you may also contact the competent supervisory authority in your member state. * * * ## 17\. REGIONAL PROVISIONS What each jurisdiction adds to the global baseline of this Policy. § 10.1 states the floor that applies everywhere; nothing below reduces it. Requests for any of the rights in this section: `data-protection@digitalfreedom.co.za` or [https://data-protection.digitalfreedom.co.za](https://data-protection.digitalfreedom.co.za/). ### 17.1 European Union and EEA - Processing complies with the GDPR, which also applies in Norway, Iceland and Liechtenstein through the EEA Agreement. - No lead supervisory authority applies: the Controller is not established in the Union, so the one-stop-shop under Art. 56 GDPR does not apply. - You may lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR) — in the EEA EFTA states (Norway, Iceland, Liechtenstein) that is Datatilsynet (Norway), Persónuvernd (Iceland) or the Datenschutzstelle (Liechtenstein). - Data Protection Impact Assessments are conducted where required. - For the age of digital consent, which Member States set between 13 and 16, see the Children’s Privacy Notice — this Policy states no single number because none exists. ### 17.2 United Kingdom - Processing complies with the UK GDPR and the Data Protection Act 2018. - The supervisory authority is the Information Commissioner’s Office (ICO). ### 17.3 Switzerland - The revised Federal Act on Data Protection (revFADP) applies to circumstances that have an effect in Switzerland regardless of where the Controller sits. The GDPR baseline of this Policy covers its substance. - **Right to information (Art. 25 revFADP):** substantially the access right of Art. 15 GDPR; we respond within 30 days. - **Breach notification (Art. 24 revFADP):** owed to the FDPIC “as soon as possible”. Our internal plan runs on the shorter of the applicable periods, so the GDPR’s 72-hour clock governs in practice. - Switzerland is recognised as adequate by the EU and recognises the EEA; transfers between them need no additional safeguard. - The competent authority is the Federal Data Protection and Information Commissioner (FDPIC). ### 17.4 United States **The state-law common core.** The comprehensive state statutes (Virginia, Colorado, Connecticut, Texas, Oregon and the wider family) grant substantially the rights in § 10.1, and add two things: - **Appeal.** If we deny your request, you may appeal to us; our appeal response tells you how to complain to your State Attorney General. **Exception: Utah** (Utah Code § 13-61-203 provides no appeal process). - **Deadlines.** We respond within **45 days**, extendable once by a further 45 with notice. **Exception: Iowa**, where the statute allows 90 days plus a 45-day extension (Iowa Code § 715D.3(3)) — in practice we apply the shorter period. **Biometrics (Illinois BIPA).** No biometric identifier is collected. Face ID and Touch ID are handled by the operating system on your device; the app receives only a yes/no. If a feature ever collects a biometric identifier, BIPA’s written-release, retention-schedule and destruction duties apply **before** the first collection. **Consumer health data (Washington, Nevada).** Where an app touches health data, the separate Consumer Health Data Policy applies — it is its own document because Washington’s My Health My Data Act requires one, linked separately and prominently. **“Do Not Sell or Share” link.** Not required here: no personal information is sold or shared for cross-context behavioural advertising — no advertising runs in the apps, and install attribution uses platform tokens rather than an advertising identifier. If that changes, the link becomes mandatory. #### California — Notice at Collection (CCPA/CPRA) Provided to California residents at or before the point of collection, as required by Cal. Civ. Code §§ 1798.100(a) and 1798.130(a)(5)(A). The full Privacy Policy this notice belongs to: [https://dokuai.app/legal/privacy-policy/](https://dokuai.app/legal/privacy-policy/). **Categories collected in the past 12 months:** | Category (CCPA § 1798.140(v)) | Examples we collect | Purpose | Disclosed for business purpose? | Sold or shared? | | --- | --- | --- | --- | --- | | A. Identifiers | Email address; pseudonymous account / user ID; IP address; device identifiers | Account, support, security | Yes — to sub-processors per § 6 of the Privacy Policy | **No** | | B. Customer records (Cal. Civ. Code § 1798.80(e)) | Name (optional); subscription state | Account, billing | Yes | **No** | | C. Characteristics of protected classifications | None | — | — | — | | D. Commercial information | Subscription / IAP purchase history | Service delivery, billing | Yes — to RevenueCat / Apple / Google | **No** | | E. Biometric information | None (Face ID / Touch ID is on-device only; we receive yes/no) | — | — | — | | F. Internet / electronic network activity | Product-interaction events; in-app feature usage | Service delivery, analytics | Yes — to analytics provider | **No** | | G. Geolocation | Approximate / precise location (only if you grant the OS permission to a feature that needs it) | Specific feature delivery | Limited | **No** | | H. Sensory information | Microphone / camera input only when you actively invoke a feature that uses it | Specific feature delivery | Limited | **No** | | I. Professional / employment information | None (unless you enter it in a profile field) | — | — | — | | J. Education information | None | — | — | — | | K. Inferences from the above | Engagement patterns for product improvement | Analytics | Limited | **No** | | L. Sensitive personal information (CCPA § 1798.140(ae)) | Account credentials (password hash); precise location (only if granted); **health data**, where an app offers a health or fitness feature — § 1798.140(ae)(2)(B) counts personal information concerning health as sensitive | Authentication; the specific feature | Limited; health data is additionally governed by the Consumer Health Data Policy | **No** | We have **not** sold or shared personal information of California residents in the past 12 months and do not intend to. The opt-out of sale or sharing therefore has no operative effect — but is available on request. **Retention per category:** account data — while active + 30 days after deletion; billing records — up to 10 years (statutory tax and accounting retention); support tickets — 3 years from closure; logs — 30 days hot, 90 days cold; marketing subscriber data — until unsubscribe, plus the suppression-list entry. **Sensitive personal information — limit of use (§ 1798.121).** We use sensitive personal information only for the purposes permitted under CPRA Regs § 7027(m) — performing the services, security, fraud prevention, service quality. Not for inferring characteristics, not for targeted advertising. The opt-out therefore has no operative effect — but is available on request. **Your CCPA/CPRA rights:** | Right | How to exercise | | --- | --- | | Know | Email `data-protection@digitalfreedom.co.za`, subject “CCPA Right to Know” | | Delete | Same address, or the in-app deletion route | | Correct | Edit in-app or email the same address | | Opt out of sale/sharing | Not applicable (we do neither) — confirmation on request | | Limit sensitive-PI use | Not applicable (use is already limited) — confirmation on request | | Non-discrimination | We do not discriminate for exercising rights | | Portability | Included in the Right-to-Know response, machine-readable | | Authorized agent | Accepted with proof of authorisation and your written permission | We verify requests proportionate to sensitivity and risk (CCPA Regs §§ 7060–7063) and respond within **45 days**, extendable once by 45 with notice. **Shine the Light (§ 1798.83):** we disclose no personal information to third parties for their direct-marketing purposes; the annual response is “none disclosed”. **Global Privacy Control:** honoured as a valid opt-out signal (CPRA Regs § 7025). Because we neither sell nor share, it does not change our processing, but it is acknowledged. **Complaints:** California Privacy Protection Agency, 2101 Arena Boulevard, Sacramento, CA 95834 — [https://cppa.ca.gov/webapplications/complaint](https://cppa.ca.gov/webapplications/complaint) — or the California Attorney General. ### 17.5 Canada - **Consent (PIPEDA Principle 3):** express consent where information is sensitive or the purpose not obvious; implied consent where it is obvious and not sensitive. Withdrawal at any time, subject to legal or contractual restrictions and reasonable notice. - **Your PIPEDA rights:** access and a copy, accuracy challenge and correction, withdrawal of consent, and complaint to the Office of the Privacy Commissioner of Canada ([https://www.priv.gc.ca](https://www.priv.gc.ca/)). Response generally within 30 days (PIPEDA § 8(4)). - **Quebec (Law 25):** - Person responsible for the protection of personal information: **Marcel R. G. Berger**, `data-protection@digitalfreedom.co.za`, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. - Before personal information of Quebec residents is transferred outside Quebec, a privacy impact assessment (EFVP) is conducted (Law 25 § 17). Destinations: EEA, UK and Switzerland (adequate), and the US under EU SCCs, the UK Addendum and, where applicable, the EU-US DPF. - You may request your data in a structured, commonly used technological format (§ 27), request cessation of dissemination or de-indexing where dissemination seriously injures your reputation or privacy, and are informed of any decision based exclusively on automated processing with the right to human review — no such decisions are currently made. - Confidentiality incidents presenting a risk of serious injury are notified to the Commission d’accès à l’information and to you without delay. - A French version of any document is available on request; for Quebec residents the French version governs where Quebec law so requires. - **CASL:** commercial electronic messages only with express opt-in, sender identification and a working unsubscribe processed within 10 business days. - Provincial laws (BC PIPA, Alberta PIPA) apply where more protective. Complaints also to the OIPC BC and OIPC Alberta. ### 17.6 Australia and New Zealand - **Australia:** the Privacy Act 1988 and the Australian Privacy Principles apply to an overseas entity carrying on business in Australia. APP 12 sets a **30-day** response period for access. APP 8 makes us accountable for an overseas recipient’s handling of your data — stricter than a transfer analysis, and part of why recipients are named in § 6. Complaints: Office of the Australian Information Commissioner (OAIC). - **New Zealand:** the Privacy Act 2020 applies to an overseas agency carrying on business in New Zealand. IPP 12 restricts disclosure outside New Zealand; access requests are answered within **20 working days**. Complaints: Office of the Privacy Commissioner (NZ). ### 17.7 Brazil (LGPD) - **Encarregado (Art. 41 LGPD):** **Marcel R. G. Berger**, `data-protection@digitalfreedom.co.za`, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. ANPD Resolution CD/ANPD No. 18/2024 permits the role to be performed for a foreign controller through the channels above; this Policy is the public publication of the Encarregado’s contact details it requires. - **Legal bases (Art. 7 and 11):** consent (I) for marketing; contract performance (V) for account, billing, AI features and service delivery; legal obligation (II) for the retention duties that bind the Controller under the law applicable to it; legitimate interest (IX) for security and fraud prevention. Sensitive data only on explicit consent or another Art. 11 ground. - **Your Art. 18 rights:** confirmation, access, correction, anonymisation/blocking/deletion of unnecessary or non-compliant data, portability, deletion of consent-based data, information about sharing and about the consequences of refusing consent, and revocation of consent. Response within **15 days** (Art. 19 § 3). - **Transfers (Chapter V, Art. 33):** adequacy (EEA, UK, Switzerland), contractual safeguards for the US legs, or your consent given with prior information about the international character — the AI feature names its US recipient before you enable it. - **Children (Art. 14):** processing of a child’s data (under 12) requires specific and prominent parental consent; no such mechanism is operated — consent-based processing is withheld instead. See the Children’s Privacy Notice. - **Incidents (Art. 48):** the ANPD and affected data subjects are notified; our target is 72 hours, aligned with Art. 33 GDPR. - **Complaints:** Autoridade Nacional de Proteção de Dados — [https://www.gov.br/anpd](https://www.gov.br/anpd). A Portuguese version of this section is available on request. ### 17.8 India (DPDP Act, 2023) - DigitalFreedom Global LLC is the Data Fiduciary; it is not designated a Significant Data Fiduciary. - **Consent (§ 6):** free, specific, informed, unconditional and unambiguous, by clear affirmative action, limited to what the purpose needs, withdrawable as easily as given. Service is not conditioned on consent the purpose does not need. - **Your rights (§§ 11–14):** access to what is processed and with whom it is shared; correction, completion and erasure; grievance redressal; and nomination of another person to exercise your rights in case of death or incapacity. - **Grievance Officer (§ 8(10), IT Rules 2021):** **Marcel R. G. Berger**, `data-protection@digitalfreedom.co.za`. Acknowledgement within 24 hours; resolution within 15 days, extended to 30 for complex grievances with explanation. Escalation: the Data Protection Board of India, once constituted. - **Children (§ 9):** data of a person under 18 is processed only with verifiable parental or guardian consent; no tracking, behavioural monitoring or targeted advertising directed at children. - **Transfers (§ 16):** permitted save to destinations notified as restricted; none of the destinations used (EEA, UK, Switzerland, US) is currently restricted. - Notices are available in English; a Hindi or other Eighth-Schedule-language version can be requested at `hello@digitalfreedom.co.za`. ### 17.9 Japan (APPI) - The APPI applies to a foreign operator that acquires personal information in connection with supplying goods or services to persons in Japan; this Service is therefore covered. - **Purpose specification:** the purpose of use is specified as narrowly as possible and notified or published at acquisition. A change of purpose is limited to what remains relevantly connected to the original purpose; a larger change requires fresh consent. - **Third-party provision, and provision to third parties in a foreign country:** provision to a third party requires your consent as a rule. For a third party in a foreign country, consent is obtained only after providing you with **(1) the name of the country, (2) information on that country’s personal-information protection system, and (3) the measures the recipient takes to protect personal information.** This applies to OpenAI Ireland Ltd. (Ireland) and the onward transfer to OpenAI OpCo, LLC (United States); the AI feature’s consent screen carries exactly this information. - **Publicly available matters (Art. 32):** the operator’s name and address and its representative’s name, the purposes of use, the procedures for disclosure requests and the complaint contact are kept in your reach — through this Policy and the [Impressum](https://dokuai.app/imprint/). Representative: **Marcel R. G. Berger**. - **Breach reporting:** for the reportable categories, a preliminary report to the Personal Information Protection Commission within roughly 3–5 days and a final report within 30 days (60 for breaches caused by wrongful access); you are notified. Our internal plan runs on the shortest applicable deadline. - No advertising email is sent (特定電子メール法 — opt-in, sender identification, unsubscribe — would otherwise apply). ### 17.10 Korea (PIPA) - PIPA applies to a foreign operator processing personal information in the course of offering goods or services to data subjects in Korea; this Service is therefore covered. - **Itemised, separated consent:** consent is obtained separately per item, with required and optional items distinguished; refusing an optional item never blocks the service; each request states the items collected, the purpose, the retention period, your right to refuse and the consequence of refusal. The per-purpose toggles in the apps implement exactly this. - **Cross-border transfer:** transferring personal information abroad requires notice of **the recipient, the destination country, the date and method of transfer, the items transferred, the recipient’s purpose and retention period**, and your separate consent. This applies to OpenAI Ireland Ltd. and the onward US transfer; the AI consent screen carries these items. - **Under 14:** processing a child’s data requires the legal representative’s consent, with only the minimum information collected to verify it. No app is directed at children; the age gate handles the case. - **Response period:** access, correction/deletion and suspension requests are acted on within **10 days**, or you are told the reason and schedule. That is shorter than the GDPR month, and the shorter period governs. - **Breach:** you are notified without delay; above the statutory scale, the Personal Information Protection Commission or the designated agency is notified within **72 hours**. ### 17.11 Türkiye (KVKK) - The KVKK (Law No. 6698) resembles the GDPR in concept but leans harder on explicit consent as the general basis; each processing activity is assessed against Turkish law separately rather than assumed to carry over from an Art. 6(1)(f) analysis. - **Transfers abroad:** for the US transfer the AI feature relies on, the basis is your **explicit consent**, given after the transfer is disclosed to you. - **Response period:** requests are answered within **30 days**. You may complain to the Kişisel Verileri Koruma Kurumu after applying to us first — within 30 days of our response or 60 days of your application. - The Turkish version of the published documents governs for consumers resident in Türkiye. ### 17.12 South Africa (POPIA) POPIA § 3(1) applies to a responsible party domiciled in the Republic, or processing by means located there. Neither is the case — the Controller is domiciled in Wyoming and processes on servers in Frankfurt and London, with an off-provider backup copy on Storj storage nodes in the EU (§ 7), and a `.co.za` domain name is a name, not a processing means. **The Act therefore does not apply on the present facts.** Every POPIA-style enquiry is nonetheless answered through the same channels and on the same clock as everywhere else — a service commitment, not an admission that the Act applies. Two points where POPIA would differ from the GDPR floor, stated rather than papered over: POPIA treats everyone under 18 as a child, and § 22(1) requires breach notification without the GDPR’s high-risk threshold — the breach plan operates on the GDPR standard. The Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — [https://inforegulator.org.za](https://inforegulator.org.za/). ### 17.13 All other countries Everywhere the stores distribute and no section above applies: the GDPR baseline of this Policy is your floor (§ 1.2), any more protective mandatory local law prevails over it, and every request goes through `data-protection@digitalfreedom.co.za` or [https://data-protection.digitalfreedom.co.za](https://data-protection.digitalfreedom.co.za/). * * * (c) 2025-2026 DigitalFreedom Global LLC. All rights reserved.