PRIVACY POLICY

Effective Date: June 30, 2026 Last Updated: September 16, 2026

This Privacy Policy explains how AITEST SRL ("we", "us", "our", or "AskInward") collects, uses, shares, and protects information about you when you use our website, mobile applications, and related services (collectively, the "Service").

This Privacy Policy forms an integral part of our Terms of Use and our Cookie Policy. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. SUMMARY (PLAIN-LANGUAGE OVERVIEW)

We've structured this Privacy Policy to be as transparent as possible. Here is what matters most:

• Your individual answers to our check-ins stay on your device. When you answer questions in an AskInward check-in (e.g., a mood check-in or focus check-in), those individual answers are stored only in your browser, never transmitted to our servers. This means even we cannot see your specific answers.
• We only collect data when you choose to give it. If you complete a check-in but do not provide your email, we have essentially no information about you. If you provide your email and subscribe, we collect what we need to operate your account: your email, your name (if you provide it), your subscription state, and which modules you completed at a high-level summary (e.g., "Mood — Marked").
• If your answers suggest you may be in crisis, we collect nothing about that session. The crisis support page collects no data, displays no email gate, and runs no analytics.
• Payment card data never reaches us. If you subscribe on our website, your credit/debit card information flows to Stripe, Inc., our PCI-DSS-compliant payment processor, and AITEST SRL (the Romanian limited-liability company that operates AskInward) is the merchant of record. If you subscribe inside our iOS or Android app, the purchase is handled by Apple or Google under their own terms and privacy policies, and that platform is the merchant of record. Either way, we never see or store your full card details.
• You have rights. You can request access, deletion, correction, or export of your data at any time. EU and UK residents have GDPR rights; California residents have CCPA rights.

2. WHO WE ARE

AITEST SRL is the data controller responsible for your personal information processed in connection with the Service.

Registered office: Str. Constanței nr. 15, Bl. E1, Sc. D, Et. 3, Ap. 59, Năvodari 905700, Constanța County, Romania

Contact for privacy inquiries: 📧 [email protected]

3. INFORMATION WE COLLECT

3.1 Information you provide directly

We collect information that you voluntarily provide when you use the Service:

At the email gate (after completing a check-in):

• Email address
• First name (optional)
• Marketing communications opt-in (explicit, granular)

When you arrive from an ad or a link:

• If you reach us through a campaign link, the campaign tags in that link (source, medium, campaign name) and the website that referred you. We record this only if you go on to give us your email at the gate, and we keep the first one — it tells us which channel introduced you to AskInward. It is not used to track you across other websites.

When you subscribe:

• The same information above, plus:
• Subscription tier selected
• Subscription state (active, cancelled, refunded, paused)
• Payment confirmation (NOT card details — those go directly to Stripe, or to Apple or Google for purchases made inside our mobile apps)

When you contact support:

• Your email address, name, and any information you choose to include in your message

When you submit reviews or feedback:

• The content of your review or feedback
• Any associated identifiers (e.g., publicly displayed username on third-party review platforms)

3.2 Information collected automatically

When you use the Service, we automatically collect certain technical information:

• IP address (truncated for analytics; full IP retained only for fraud prevention)
• Browser type and version
• Operating system
• Device type (desktop, mobile, tablet)
• Approximate geographic location (country and region, derived from IP)
• Pages visited and actions taken on the Service
• Referring URL (the website you came from, if any)
• Date and time of access
• Session duration

We collect this information using cookies and similar technologies. For details, see our Cookie Policy.

3.3 Information about your check-ins — what we collect and what we don't

This is the most important section of this Privacy Policy. AskInward's privacy architecture is specifically designed to minimize the data we hold about your responses.

What we DO NOT collect when you complete a check-in:

• Your individual answers to specific questions
• The text of any free-form responses
• Any answer-level data

What we DO collect ONLY IF you provide your email at the email gate:

• The module you completed (e.g., "Mood check-in", "Focus check-in")
• The date you completed it
• Your severity bucket — a high-level summary score categorized into one of four bands (e.g., "Low", "Noticeable", "Marked", "Pronounced")

Your individual answers — every choice you made on a reflection prompt — are stored exclusively in your browser's localStorage. They never leave your device unless you explicitly export them. We do not have the technical ability to retrieve them.

If you clear your browser data or use a different device, your previous individual answers are gone forever.

3.4 Information we do NOT collect during crisis-detected sessions

If your answers to a check-in include a response indicating active self-harm risk or crisis (per the per-module crisis rule for that check-in), the Service immediately routes you to a crisis support page. During and after a crisis-detected session, we collect NO information about that session at all. Specifically:

• No email gate is displayed
• No analytics events are recorded for that session
• No marketing pixels fire
• No session identifier is persisted server-side
• Your individual answers remain only in your browser (and you may clear them)

This is a deliberate, non-negotiable design choice to ensure that users in crisis encounter no friction, no data capture, and no monetization. The crisis page exists to direct you to professional help.

3.5 Information from third parties

We may receive information from third parties in limited circumstances:

• Stripe, Inc. (our payment processor) shares with us your subscription confirmation, billing status, and refund/chargeback notifications via webhook events. Stripe does NOT share your full payment card details. AITEST SRL is the merchant of record for the underlying transaction.
• Apple App Store and Google Play Store share with us subscription lifecycle events (purchase, renewal, cancellation, refund) if you subscribe inside our mobile app, so we can unlock and maintain your access. We receive these events through RevenueCat, Inc., which operates our in-app subscription infrastructure. We never receive your Apple Account or Google Account credentials or your payment card details.
• Email service providers (e.g., Resend) share with us delivery status (delivered, bounced, opened) for emails we send you.

4. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

4.1 To operate the Service

• Process your subscription and provide access to subscriber-only content
• Authenticate your account
• Send transactional communications (subscription confirmations, renewal reminders, password resets)
• Provide customer support

4.2 To improve the Service

• Understand aggregate usage patterns (which modules are most used, where users drop off)
• Diagnose and fix technical issues
• Develop new features and modules
• Conduct A/B tests on non-clinical content (e.g., copy variants on the homepage)

4.3 To communicate with you

• Send the welcome email sequence after you subscribe (8 emails over 3 weeks)
• Send periodic newsletter emails IF you have opted in (separate from transactional communications)
• Notify you of changes to our Terms, Privacy Policy, or Service

4.4 To prevent fraud and ensure security

• Detect and prevent fraudulent subscriptions
• Investigate suspicious activity
• Comply with legal obligations

4.5 To comply with legal obligations

• Respond to lawful requests from authorities
• Enforce our Terms of Use
• Defend against legal claims

5. LEGAL BASES FOR PROCESSING (GDPR — EU AND UK USERS)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information based on the following legal bases:

Special categories of data (GDPR Article 9): AskInward's severity buckets may, in certain interpretations, constitute "data concerning health" under Article 9 GDPR. Where applicable, we process this data based on your explicit consent (Article 9(2)(a)), provided when you submit your email at the email gate.

You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We share your information only in the following limited circumstances:

6.1 Service providers

We share information with trusted third parties that process data on our behalf, under contractual confidentiality and data protection obligations:

If you subscribe inside our mobile app, Apple or Google processes the payment as merchant of record under its own privacy policy — not as our processor. From that transaction we receive only the subscription status and transaction identifiers described in Section 3.5.

6.2 Business transfers

If we are involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change and provide options regarding your data.

6.3 Legal requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, including in response to:

• Court orders, subpoenas, or warrants
• Lawful requests from public authorities
• Requests to protect the rights, property, or safety of AskInward, our users, or the public

6.4 With your consent

We may share your information with third parties when you give us explicit consent to do so.

7. INTERNATIONAL DATA TRANSFERS

AskInward is based in Romania. If you access the Service from outside Romania, your information may be transferred to, stored, and processed in Romania or other countries where our service providers operate.

For transfers of personal information from the EU, UK, or Switzerland to the United States, we rely on appropriate safeguards, including:

• EU-U.S. Data Privacy Framework (DPF) participation, where applicable
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other lawful transfer mechanisms

8. DATA RETENTION

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

Upon expiration of the retention period, we will delete or anonymize your information securely.

You may request deletion of your information at any time (see Section 9, "Your Rights").

9. YOUR RIGHTS

Depending on your jurisdiction, you have certain rights regarding your personal information.

9.1 Rights available to all users

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your information (subject to legal retention requirements).
• Marketing opt-out: Unsubscribe from marketing emails at any time via the unsubscribe link in any marketing email.

9.2 Rights for EU, UK, and Swiss residents (GDPR)

In addition to the rights above, you have:

• Right to restrict processing: Request that we limit how we use your information.
• Right to data portability: Receive your information in a machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Withdraw consent at any time for processing based on consent.
• Right to lodge a complaint: File a complaint with your local data protection authority. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

9.3 Rights for California residents (CCPA / CPRA)

In addition to the rights above, you have:

• Right to know: What categories of personal information we collect, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete: Request deletion of personal information collected from you.
• Right to correct: Request correction of inaccurate personal information.
• Right to limit use of sensitive personal information: Limit our use of "sensitive personal information" as defined under CCPA.
• Right to opt-out of sale or sharing: We do not sell or share your personal information for cross-context behavioral advertising. To confirm or change this status, contact [email protected].
• Right of no retaliation: We will not discriminate against you for exercising your CCPA rights.

To submit a "Do Not Sell or Share My Personal Information" request, email [email protected].

9.4 Rights for residents of Virginia, Colorado, Connecticut, Utah, and other US states with comprehensive privacy laws

You have rights similar to those listed under CCPA. Submit requests to [email protected].

9.5 Health-specific privacy rights (Washington, Nevada, Connecticut)

If you are a resident of Washington (under My Health My Data Act), Nevada (under SB 370), or Connecticut, you may have additional rights regarding "consumer health data". To exercise these rights:

• Confirm whether we are processing your consumer health data
• Access your consumer health data
• Delete your consumer health data
• Withdraw consent for processing of your consumer health data

Submit requests to [email protected].

9.6 How to exercise your rights

To exercise any of these rights, email [email protected] with:

• Your name and email address (used to identify your account)
• The specific right you wish to exercise
• Any additional details needed to fulfill your request

We will respond within 30 days. We may extend this period by an additional 60 days where necessary, in which case we will notify you of the extension within 30 days.

We may need to verify your identity before fulfilling your request, typically by sending a confirmation link to your account email.

10. CHILDREN'S PRIVACY

The Service is intended for users 18 years of age and older. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will delete that information promptly.

If you believe a child under 18 has provided us with personal information, please contact [email protected].

11. DATA SECURITY

We implement technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit (TLS 1.2 or higher for all data transmitted to/from our servers)
• Encryption at rest for sensitive data fields
• Access controls limiting employee and contractor access to personal information on a need-to-know basis
• Regular security audits and vulnerability assessments
• Incident response procedures for suspected data breaches

Despite these measures, no system is 100% secure. We cannot guarantee absolute security of your information. If we become aware of a data breach affecting your information, we will notify you and applicable regulators in accordance with applicable law.

12. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to operate the Service, analyze usage, and (where you consent) for marketing purposes. For details, see our Cookie Policy.

13. DO NOT TRACK

Some browsers offer a "Do Not Track" (DNT) signal. Our Service does not currently respond to DNT signals because no industry standard for DNT has been adopted. However, we minimize tracking by default and provide cookie consent controls.

14. THIRD-PARTY LINKS AND SERVICES

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party website or service you visit.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last Updated" date at the top of this Privacy Policy indicates when it was last revised.

For material changes, we will notify you via email (to the address associated with your account) or via a prominent notice on the Service before the changes take effect.

Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes.

16. CONTACT US

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

📧 [email protected]

Postal address: AITEST SRL Str. Constanței nr. 15, Bl. E1, Sc. D, Et. 3, Ap. 59, Năvodari 905700, Constanța County, Romania