<strong>Privacy Policy (Personal Data Processing)</strong>
<br/>
<br/><strong>1. General provisions</strong>
<br/>This Privacy Policy is prepared in accordance with applicable requirements, including Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006 (the “Personal Data Law”) where it applies, and describes how personal data is processed when you use the Impulse Shield mobile application (the “Application”) and related services operated by the Operator.
<br/>1.1. The Operator’s priority is to respect human and civil rights and freedoms in processing personal data, including the protection of privacy and confidentiality.
<br/>1.2. This Policy applies to all information about users of the Application that the Operator may obtain in connection with providing the service.
<br/>
<br/><strong>2. Key definitions</strong>
<br/>Terms such as personal data, processing, operator, automated processing, blocking, depersonalization, destruction, and cross-border transfer shall be understood in accordance with applicable law (including the Personal Data Law where relevant).
<br/>The “Application” means the Impulse Shield mobile client and related backend services used to provide features such as impulse logging, statistics, goals, notifications, export, and optional analysis features.
<br/>
<br/><strong>3. Operator’s main rights and obligations</strong>
<br/>3.1. The Operator processes personal data lawfully and implements organizational and technical measures to protect data against unauthorized access, alteration, disclosure, or destruction.
<br/>3.2. The Operator responds to data subjects’ requests in accordance with applicable law (including, where applicable, within 30 calendar days for requests under Russian law, unless a different period applies).
<br/>3.3. The Operator maintains this Policy in a publicly accessible form (including via stable URLs served by the Application backend).
<br/>
<br/><strong>4. Data subjects’ rights</strong>
<br/>Depending on your jurisdiction, you may have rights to access, rectify, delete, restrict processing, object, data portability, and to withdraw consent. You may exercise these rights via the Application (where available) and/or by contacting support using the channels indicated in the Application or store listing.
<br/>
<br/><strong>5. Principles of processing</strong>
<br/>5.1. Processing is lawful, fair, and limited to stated purposes.
<br/>5.2. Data is adequate, relevant, and not excessive in relation to the purposes.
<br/>5.3. Data is stored no longer than necessary for the purposes, subject to legal retention requirements.
<br/>
<br/><strong>6. Purposes, categories of data, and legal bases</strong>
<br/>6.1. <strong>Purposes</strong> may include:
<br/>— Creating and maintaining a user account and authentication (including via email/password and/or OAuth providers such as Google, Yandex, VK ID, or similar, depending on the build);
<br/>— Providing core features: recording impulses and related details (including categories, optional amounts/currency, descriptions, links, decisions, feedback, and comments/arguments where supported);
<br/>— Computing and displaying statistics and motivational aggregates (for example, counts of stopped impulses and “conditionally saved” amounts for personal reflection);
<br/>— User goals, reminders, and notifications (including push notifications where enabled);
<br/>— Export of your data (for example, CSV) when you initiate export;
<br/>— Customer support and handling support tickets;
<br/>— Service improvement, security, fraud prevention, and compliance with legal obligations;
<br/>— Optional automated or AI-assisted analysis of your entries to generate prompts or summaries for reflection inside the Application.
<br/>6.2. <strong>Categories of personal data</strong> may include:
<br/>— Identity and account data: email (if used), display/public name, internal user identifiers;
<br/>— Authentication data: password hashes (if applicable), OAuth tokens/identifiers as required by the sign-in provider workflow;
<br/>— Impulse-related content: text you enter, optional monetary amounts, categories, decisions, comments;
<br/>— Usage and technical data: device/app identifiers, IP address, timestamps, locale/time zone, diagnostic logs as needed for security and reliability;
<br/>— Push notification tokens where you enable notifications;
<br/>— Payment-related identifiers and subscription status as provided by app stores (<strong>Google Play</strong>, <strong>RuStore</strong>, <strong>Apple App Store</strong>, depending on your build): the stores or their payment partners process card and wallet data; the Operator typically receives purchase/subscription identifiers and status needed to unlock features, not your full card number;
<br/>— Support communications: messages you send to support and contact details you provide.
<br/>6.3. <strong>Legal bases</strong> (depending on jurisdiction) may include: performance of a contract (providing the service), consent (where required), legitimate interests (security and service improvement), and legal obligations.
<br/>6.4. <strong>Profiling</strong>: the Application may derive statistics and recommendations for you based on your usage (for example, impulse patterns). This is intended to support self-reflection and is not used to make legally significant solely automated decisions about you without human involvement, except as required by applicable law.
<br/>6.5. <strong>Artificial intelligence (analysis of your entries)</strong>: optional analysis of impulses — including free-text descriptions, categories, amounts, and related context you provide — is performed using <strong>automated systems based on artificial intelligence</strong>, including <strong>third-party AI providers</strong> (generative / language models) acting as <strong>subprocessors</strong>. Your content may be transmitted to such providers solely to generate in-app prompts, summaries, structured commentary, or similar outputs intended for personal reflection. <strong>These outputs are not produced by a human</strong>, may be incomplete or inaccurate, and <strong>do not constitute professional</strong> medical, psychological, legal, tax, or financial <strong>advice</strong>. The Operator selects providers and applies contractual and technical safeguards where feasible. Further detail on recipients and international transfers appears in Section 8.
<br/>
<br/><strong>7. Cookies and similar technologies</strong>
<br/>The Application may use local storage on the device and similar mechanisms to keep you signed in and store preferences. Website properties (if any) may use cookies as described in their respective notices.
<br/>
<br/><strong>8. Sharing and subprocessors</strong>
<br/>8.1. The Operator does not sell your personal data.
<br/>8.2. Personal data may be disclosed to third parties only where necessary to provide the service or comply with law, including:
<br/>— Infrastructure and hosting providers;
<br/>— Authentication providers (OAuth) as chosen by you;
<br/>— App store platforms for purchases and subscription status;
<br/>— Analytics or reliability tools acting on the Operator’s instructions, subject to contractual safeguards where required;
<br/>— <strong>Third-party generative AI providers</strong> that process the text and context of your impulse entries to deliver analysis, prompts, or summaries inside the Application (typically as subprocessors under written terms).
<br/>8.3. Payment card processing is performed by app stores/payment platforms under their terms; the Operator does not receive your full card number for store purchases in the typical model.
<br/>
<br/><strong>9. International transfers</strong>
<br/>If data is processed in countries other than your country of residence, the Operator will apply appropriate safeguards as required by applicable law (including contractual clauses where applicable).
<br/>
<br/><strong>10. Retention and account deletion</strong>
<br/>10.1. Personal data is stored as long as your account is active and as needed to provide the service, unless a longer retention period is required by law.
<br/>10.2. When you delete your account using the in-app deletion feature (where available), the Operator applies anonymization and/or deletion measures described in internal procedures (including revoking sessions and replacing identifiers where needed). Some records may be retained in aggregated or depersonalized form where permitted by law.
<br/>10.3. Backups may persist for a limited period consistent with security practices.
<br/>
<br/><strong>11. Security and breaches</strong>
<br/>The Operator implements administrative, technical, and organizational measures to protect personal data. In case of a personal data breach likely to affect your rights, the Operator will notify you and/or regulators as required by applicable law.
<br/>
<br/><strong>12. Children</strong>
<br/>The service is not directed to children under the age required by these Terms (typically 16+). If you believe we have collected data from a child without appropriate consent, contact support.
<br/>
<br/><strong>13. Sources of personal data</strong>
<br/>13.1. <strong>Directly from you</strong>: account registration, profile fields, impulse entries, goals, support messages, and any consents or preferences you set in the Application.
<br/>13.2. <strong>Automatically</strong>: technical logs, device/app identifiers, approximate location derived from IP where processed for security, timestamps, crash or diagnostic data limited to what is needed to operate and secure the service.
<br/>13.3. <strong>Third parties</strong>: when you sign in with an OAuth provider, we receive identifiers and profile elements permitted by that provider’s consent screen. App stores may provide subscription status, transaction identifiers, and refund/chargeback signals needed for billing support and fraud prevention.
<br/>13.4. We do not require you to disclose special categories of data (health, political opinions, etc.). If you voluntarily include such information in free-text fields, you do so under your control; we process it only to provide the service you requested and recommend avoiding unnecessary sensitive details.
<br/>
<br/><strong>14. Marketing communications</strong>
<br/>Unless you opt in where required, the Operator does not use your personal data to send third-party marketing. Service-related messages (security alerts, subscription receipts via the store, critical product notices) may be delivered as part of providing the service. You can manage push notifications in device settings and in-app toggles where available.
<br/>
<br/><strong>15. Automated processing and human review</strong>
<br/>Analytics, statistics, and optional AI summaries are intended to support self-reflection. They do not replace professional advice. Where the law grants you rights related to solely automated decisions with legal or similarly significant effects, the Application is not designed to make such decisions without appropriate human involvement, except where required by law.
<br/>
<br/><strong>16. Regional rights (EEA/UK and similar)</strong>
<br/>If you are in the European Economic Area, the United Kingdom, or other regions with comprehensive privacy laws, you may have additional rights (including to lodge a complaint with a supervisory authority). Nothing in this Policy limits mandatory consumer rights in your country. The Operator will respond to verifiable requests in line with applicable law and may need to confirm your identity before disclosing or deleting data.
<br/>
<br/><strong>17. U.S. state privacy (summary)</strong>
<br/>Depending on your U.S. state of residence, you may have rights to know, delete, correct, and opt out of certain “sales” or “sharing” for cross-context behavioral advertising. The Operator does not sell personal data for money as a business model. For rights requests, use the support channel in the Application; we may verify your request as permitted by law.
<br/>
<br/><strong>18. Changes to this Policy</strong>
<br/>The Operator may update this Policy. The current version is published at <a href="https://cleaum.com/core/policies/privacy-policy/en">Privacy Policy</a>. Material changes may be communicated via the Application or other reasonable means.
<br/>
<br/><strong>19. Contact and supervisory complaints</strong>
<br/>Operator: <strong>Sole Proprietor LATAREVICH YAUHENI IOSIFOVICH, UNP 591378924</strong>. Contact email: <strong>contact@speakylex.com</strong>.
<br/>Support: use the contact method indicated in the Application and/or the official app store listing.
<br/>If you believe processing infringes applicable law, you may also contact your local data protection authority where such a right exists.