GLOBAL PRIVACY POLICY FOR INNERIO

GLOBAL PRIVACY POLICY FOR INNERIO
Effective Date: July 20, 2026

Last Updated: July 20, 2026

This Privacy Policy describes how Szymon Wojdat ("Company", "We", "Us", or "Our"), operating as a sole proprietorship (Jednoosobowa Działalność Gospodarcza) registered in Poland (EU), collects, uses, discloses, and protects your personal data when you use the Innerio mobile application and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. DATA CONTROLLER & CONTACT INFORMATION
The Data Controller responsible for your personal information is:

Entity / Business Name: Szymon Wojdat (Sole Proprietorship)

Address: Ul. Międzynarodowa 51-72, 03-922 Warszawa, Poland (EU)

Website: https://innerio.app/

Contact & Privacy Email: gabrielastaszak1@gmail.com

2. INFORMATION WE COLLECT AND HOW WE COLLECT IT
We collect several types of information from and about users of our Service:

A. Personal Information You Provide Directly
Account Information: Name, email address, password, and account preferences when you create an account.

User Content & Inputs (Prompts): Text, queries, commands, or messages you type or input into the Service to interact with the AI features.

Voice and Audio Data: Voice recordings, audio samples, or spoken inputs uploaded or streamed to the Service to enable voice recognition, conversational AI, and text-to-speech functionality.

B. Automatically Collected Technical & Analytics Data
When you use the Service, we and our third-party service providers automatically collect device and usage data, including:

Device identifiers (e.g., IDFV for iOS, Android Advertising ID).

Operating system version, hardware model, device settings, and language preferences.

Usage metrics, crash logs, performance diagnostics, and interaction event data (e.g., features used, session duration).

IP address and rough location data (country/city level).

3. HOW WE USE GENERATIVE AI & THIRD-PARTY PROCESSORS
To provide core interactive features, the Service integrates advanced third-party Artificial Intelligence (AI) and analytics toolkits. By using the Service, you acknowledge that your inputs are transmitted to and processed by these providers:

OpenAI, L.L.C. (ChatGPT API): Text prompts and conversation history are processed to generate contextual text responses.

ElevenLabs Inc.: Voice inputs and generated text are processed to generate voice synthesis and audio playback.

Analytics Providers (e.g., Google Analytics for Firebase / Mixpanel / Amplitude): Technical and interaction data are processed to evaluate app performance, optimize user experience, and detect technical glitches.

Important Legal Disclaimer regarding AI: We do not use your private voice inputs or prompts to train our own proprietary models without your explicit consent. Third-party API providers are bound by contractual obligations to process data solely to deliver the Service in accordance with their respective privacy standards.

4. LEGAL BASES FOR PROCESSING (EEA / UK / GDPR)
If you reside in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, our legal bases for processing your personal data under the General Data Protection Regulation (GDPR) are:

Performance of a Contract (Art. 6(1)(b) GDPR): To provide, maintain, and deliver the core functionality of the Innerio application.

Explicit Consent (Art. 6(1)(a) GDPR & Art. 9 GDPR): For processing voice/audio data and non-essential analytical tracking where applicable.

Legitimate Interests (Art. 6(1)(f) GDPR): To prevent fraud, ensure network and information security, and improve application features.

Legal Obligation (Art. 6(1)(c) GDPR): To comply with applicable legal laws and regulations.

5. INTERNATIONAL DATA TRANSFERS
Because we operate globally and utilize infrastructure provided by companies based in the United States (such as OpenAI and ElevenLabs), your personal data may be transferred to, stored, and processed in jurisdictions outside your country of residence.

When transferring personal data outside the EEA/UK, we ensure an adequate level of protection by relying on:

Standard Contractual Clauses (SCCs) approved by the European Commission.

The EU-U.S. Data Privacy Framework (and UK Extension), where applicable.

6. DATA RETENTION AND ACCOUNT DELETION
Retention: We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required or permitted by law.

Account Deletion: You have the right to request the deletion of your account and associated personal data at any time. You can delete your account directly inside the app settings via the "Delete Account" button or by emailing us at gabrielastaszak1@gmail.com. Upon request, all personal data will be permanently deleted or anonymized within 30 days, except where legal compliance obligations require retention.

7. YOUR PRIVACY RIGHTS
Depending on your geographic location, you possess specific legal rights regarding your personal data:

A. European Union (EEA), UK & Switzerland (GDPR / UK GDPR)
You have the right to:

Access, rectify, or erase your personal data.

Restrict or object to the processing of your data.

Request data portability.

Withdraw consent at any time without affecting prior lawful processing.

Lodge a complaint with a supervisory authority (In Poland: Prezes Urzędu Ochrony Danych Osobowych - PUODO).

B. United States (California CCPA/CPRA & Other State Laws)
Right to Know / Access: Request details on categories and specific pieces of personal information collected.

Right to Delete: Request erasure of your personal information.

Do Not Sell or Share: We do not "sell" your personal information for monetary value. However, sharing data for cross-context behavioral analytics may be defined as "sharing" under California law. You may opt out of non-essential tracking at any time via in-app settings.

Biometric Data Notice (BIPA / State Rules): Audio data used solely for real-time speech processing is not stored for biometric identification purposes.

C. Brazil (LGPD - Lei Geral de Proteção de Dados)
Brazilian users have rights to access, anonymization, blocking, deletion, portability, and revocation of consent by reaching out to our contact email.

D. Australia & New Zealand
We process personal data in compliance with the Australian Privacy Principles (APPs) and NZ Privacy Act 2020 regarding cross-border disclosure and access.

8. CHILDREN'S PRIVACY
Our Service is not directed to individuals under the age of 16 (or 13 in certain jurisdictions). We do not knowingly collect personal information from children. If we become aware that a child under the minimum required age has provided us with personal data, we will take immediate steps to delete such information from our servers.

9. SECURITY OF YOUR DATA
We implement appropriate technical, administrative, and physical security measures designed to safeguard your personal data against unauthorized access, loss, alteration, or disclosure. However, please note that no electronic transmission over the internet or data storage system can be guaranteed to be 100% secure.

10. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect legal, technical, or business developments. We will notify you of material changes by posting the updated Privacy Policy on this page and updating the "Last Updated" date at the top. We encourage you to review this page periodically.

11. HOW TO CONTACT US
If you have any questions, concerns, or legal requests regarding this Privacy Policy or your personal data, please contact us:

By Email: gabrielastaszak1@gmail.com

By Mail: Szymon Wojdat, Ul. Międzynarodowa 51-72, 03-922 Warszawa, Poland.