1) Who we are (Data Controller)
2) Information we collect
We collect information in the following categories:
- Information you provide: name, username, email address, customer support content, and content you create.
- Automatically collected: device information, usage statistics, crash and diagnostics logs.
- Location (optional): precise or approximate location if you allow it.
- Cookies (where applicable): for login and preferences (may include web beacons).
- Photos / face-related: no facial recognition or biometric identification; one-time processing and deletion for generation features.
3) How we use information
- Provide and maintain the Service.
- Personalize your experience (including reflection prompts).
- Improve features, reliability, and quality.
- Protect security and integrity.
- Provide customer support.
- Comply with legal obligations and enforce our terms.
We do not sell your personal information.
4) Legal bases (where required)
- Contract, legitimate interests, consent (for optional features), and legal obligations.
5) Sharing and disclosure
We share information only as needed and in the minimum amount required:
- With your consent.
- Service providers acting as processors under contractual obligations.
- Legal and safety disclosures when required by law or to protect rights and safety.
- Business transfers (e.g., merger/acquisition) with appropriate safeguards.
International transfers: we may transfer data across borders and use safeguards such as Standard Contractual Clauses (SCCs), where required.
6) AI & generation processing (optional)
Candio may offer optional AI-assisted features to generate personalized reflection prompts or insights. If you choose to upload text or images for generation:
- User control: you decide whether to upload and generate.
- Processing: uploads are processed on Candio’s own servers.
- No third-party sharing: we do not share uploads with third parties for AI processing.
- Deletion: uploads used for generation are deleted promptly after processing (subject to short-term retention only as needed for reliability, security, or legal compliance).
- No marketing training: we do not use uploads for ad targeting or marketing profiling.
7) Data security
- Encryption in transit and, where applicable, at rest.
- Access controls and least-privilege practices.
- Regular reviews/audits and backups.
8) Data retention
- Account information and content: for the duration of your account.
- After account deletion: deleted or anonymized within 30 days (subject to legal requirements).
- Usage analytics and diagnostics: up to 12 months.
- Customer support records: up to 6 months.
9) Your rights and choices
- Access, correction, deletion, restriction/objection, and consent withdrawal (where applicable).
- Request via email: yfxqamakro3844@outlook.com (response within 5 business days).
10) Children’s privacy
Candio is intended for users aged 17+. We do not knowingly collect personal information from children under 17.
11) Changes to this policy
We may update this Privacy Policy from time to time and will update the Effective Date when appropriate.
12) Dispute resolution
Disputes related to privacy will be handled according to the dispute resolution and arbitration provisions described in the Candio User Agreement and governed by the law of our principal place of business, except where prohibited by applicable law.