EphemI12Y Ltd · Limassol

Privacy Policy

Last updated 13 October 2026

Effective from __.__.2026

Welcome to Our Application!

This Privacy Policy has been developed taking into account Our awareness of the importance and significance of Your Personal Data. Maintaining Your privacy is Our top priority. The main purpose of this Policy is to help You understand how We Process and protect Your Personal Data when You use the Application.

We strive to ensure that You can use the Application with confidence that Your Personal Data is properly protected and Processed in accordance with legal requirements and standards. We promise to treat any Personal Data You provide to Us with the utmost care and strive to ensure that it is stored securely.

This Privacy Policy is developed and operates taking into account the General Data Protection Regulation (GDPR), as well as other regulations and practices on the protection of Personal Data.

In order to make the most of Our Application, please carefully read this Policy before using the Application.

By using the Application, providing any of Your Personal Data to Us, and agreeing to the terms of the Privacy Policy, You confirm that:

(I) You have read, understood, and agree to this Policy;

(II) You have reached the age from which the legislation of the country of Your stay allows You to give Consent to the Processing of Your Personal Data. In any case, in order to use the Application, You must be at least 16 years old (at least 13 years old in certain regions) or one of Your legal representatives or guardians must have read and agreed to the terms of the Privacy Policy on behalf of You;

(III) You understand that We Process Personal Data under different legal bases described in Section 5, and We will request Your Consent separately only where required (e.g., for optional analytics/diagnostics).

If You do not agree or cannot confirm the above, You must immediately stop using the Application. In this case, You must (a) contact Us and request the deletion of Your Personal Data; (b) delete Your Account from the Application and not use it.

TABLE OF CONTENTS:

1. For convenience, We use the following terms:

“Privacy Policy” – this document, which is available at the following link: https://ephem.i12y.studio/privacy/ (hereinafter — “Privacy Policy”, “Policy”).

“Terms & Conditions” – document, which sets out the rules, rights, and responsibilities for using the Application. The latest version of the Terms is always available at: https://ephem.i12y.studio/terms/ (hereinafter referred to as “Terms & Conditions”, “Terms”).

“Company” – I12Y Ltd, a company duly incorporated and existing under the laws of the Republic of Cyprus, with its registered office at Vasili Michailidi, 9, 3026, Limassol, Cyprus, registration number HE442933 (hereinafter referred to as “Company”, “We”, “Us”, “Our”).

“Application” - a digital mobile application developed and owned by the Company, accessible via https://ephem.i12y.studio/, and distributed through the Apple App Store, which provides Users with access to the Services (hereinafter referred to as “Application”, “Ephem”).

“Account” - a personal user profile created by the User within the Application, including through Third Party authentication mechanisms (such as Apple ID or Google Sign-In), which enables access to the Application’s functionalities in accordance with Terms.

“Services” – digital informational and entertainment services provided through the Application, including, without limitation, personal energy insights, energy chart calculations and interpretations, timing analyses and shared time windows, access to explanatory energy content, as well as any Paid Services made available by the Company through the Application.

“Paid Services” – certain features, functionalities, or access options within the Application that are made available for a fee. Access to Paid Services is granted only upon successful payment and in accordance with the pricing, payment, and access conditions displayed in the Application and/or in the Apple App Store purchase flow at the time of purchase, as well as Apple’s applicable rules and policies.

“Personal Data”, “Data” — any information relating to a natural person who is identified or can be identified using this information.

“Processing of Personal Data” – any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (hereinafter — “Process”, “Processing”, “Processing of Personal Data”).

“Subject of Personal Data” – any natural person who downloads, accesses, or otherwise uses the Application by setting up an Account (hereinafter — “Subject of Personal Data”, “User”, “You”, “Your”).

“Password” - an alphanumeric string required to authorize access to the Account, which is set by the User when creating the Account.

“Consent” — any freely given, specific, informed, and unequivocal indication of the Subject of Personal Data wishes by which he or she, through clear affirmative actions, signifies agreement to the Processing of his or her Personal Data.

“Third Party” — a legal person, public authority, agency, or body other than the Subject of Personal Data, and persons who is authorized to Process Personal Data, other services which are integrated into the Application and individuals who can receive User lists or other information from the Application.

“Similar Technologies” – technologies used in mobile applications that are functionally similar to cookies (for example, app local storage, device or app identifiers, tokens, and diagnostic/analytics identifiers) and that help operate, secure, and measure the performance of the Application.

“Controller” – the Company, which determines the purposes and means of Processing of Personal Data, establishes the composition of this Personal Data and the procedures for its Processing.

“Processor” – the Company or other persons that are authorized by the Controller or by law to Process Personal Data on behalf of the Controller.

“General Data Protection Regulation” - European Parliament and Council Regulation № 2016/679 as of 27.04.2016 On the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such Data, and repealing Directive 95/46/EC (hereinafter - “GDPR”).

“CCPA” – California, USA Consumer Privacy Act of 2018.

“CalOPPA” – The Internet Privacy Protection Act of 2003 of the State of California, USA.

2. Personal Data We Process when You use the Application

2.1. Personal Data You provide to Us personally:

By completing the registration procedure and filling out the registration form on the Application, You may provide the following Personal Data:

Some of the information listed above is optional. If You choose not to provide certain optional data, some features may be limited or less personalized.

If You decide to register or log in to the Application using a Third Party authentication service (such as Google or Apple ID), the Company may receive certain Personal Data from the relevant provider (for example, Your name, profile picture, and email address), limited to what is necessary for Account creation, authentication, and providing the Services.

You have the right to change or update most Personal Data You provided during registration in the Application settings. However, the email address linked to Your Account cannot be changed. If You need to use a different email address, You may be required to create a new Account.

If You contact Us through the communication tools available in the Application (for example, via the support functionality or by email), You may provide additional Personal Data that may be necessary to resolve Your request or issue. You decide what information to share with Us in such communications.

The Application includes compatibility features that allow You to generate compatibility-related content based on information about another person. When using these features, You may enter certain Data relating to that person (for example, name and birth details) solely for the purpose of generating compatibility-related content within the Application. By providing such Data, You confirm and represent that You have a lawful basis to provide it (and, where required by applicable law, the necessary Consent of that person). You also agree not to use the compatibility features in a manner that violates applicable law or the rights of any Third Party. We do not use such Data to contact that person, build profiles about them for Our own purposes, or disclose it to Third Parties. Where technically feasible, We minimize storage of such Data and retain it only as part of Your Account content.

2.2. Personal Data We Process automatically:

When You use the Application, We (and Our service providers used to operate the Application, such as analytics/diagnostics providers) may Process certain information automatically. This may include, without limitation:

In all cases, We apply Data minimization and Process only what is necessary for the purposes described in this Policy.

3. Children's Privacy

We knowingly do not Process the Personal Data of children under the age of 13 (applies to Users who are residents of countries with a reduced minimum age for Personal Data Processing) and children under 16, and We also do not offer them to use the Application.

If We become aware that a person who has not reached the age from which it is permitted to Process their Personal Data has provided Us with their Personal Data without the Consent of a legal representative, guardian, or other person authorized to provide such Consent, We will take all necessary measures to delete such Data. If You believe We might have any information from or about a child under 16 (or 13 if applicable), please contact Us at hello@i12y.studio.

4. Purposes of Personal Data Processing

We Process the Personal Data provided by You only for the specific and limited purposes specified below:

Keep things up & running (i.e., operate, deliver, and maintain Our Services). We Process Personal Data to create and manage Your Account, authenticate You, provide access to the Application, and deliver the requested Services. This includes using the Data You provide (such as date/time/place of birth and related inputs) to generate personal energy insights, energy chart calculations and explanations, and shared time windows etc., as well as to display content in the format and language You select.

Personalization and content delivery. We Process Personal Data to personalize the Services and deliver content that depends on Your settings and inputs, including: generating individualized forecasts and interpretations; showing calendar-based or daily insights; and sending forecasts/notifications at the preferred time selected by You (where such notifications are enabled).

Manage subscriptions and purchases (Apple App Store). We Process Personal Data and related technical identifiers to enable access to Paid Services and to manage entitlement to premium features where You purchase a subscription or a specific Paid Service via the Apple App Store. This may include verifying purchase status, restoring purchases, preventing abuse of free trials, and maintaining records necessary to handle subscription-related inquiries. Please note that payments are Processed by Apple; We do not receive Your full payment card details.

User support. We Process the information You provide when You create or submit feedback, leave reviews, or otherwise communicate with Us. This is used to enable the relevant feature, improve the Services, and respond to Your requests. You control what information You choose to submit in such content. All the time, We try to improve the functions that support the operation of the Application. This allows Users to use the Application smoothly, quickly and efficiently.

Improve the Application. We Process certain usage, device, and diagnostic information to understand how Users interact with the Application, measure performance, and improve features, stability, and User experience. This may include aggregated statistics, crash reports, and analytics that help Us identify what to build next and how to improve the Services.

Performance of a contract. The development, compliance, conclusion, and execution of the services contract for the services You have purchased on the Application or of any other contract with Us through the Services. The Processing of Personal Data is necessary to ensure the performance of the contract between the User and the Company, thereby enabling the provision of the agreed-upon Services.

Analytics. In order to understand what to build or how to improve the Services, We need to understand trends and demand for Our features. We perform analytics in order to identify, monitor, and analyze trends and usage.

Personalized content. The Application uses automated processing to generate personalized energy content based on the Data You provide (such as birth details). This Processing is used solely to provide entertainment and self-reflection features and does not produce legal or similarly significant effects about You. You remain responsible for how You use the content, and it should not be relied upon for medical, psychological, legal, or financial decisions.

Enhance the safety and security of Our Services. We may use Your Personal Data to enhance the safety and security of Our Services, and prevent fraud or other unauthorized or illegal activity. This includes monitoring for abnormal activity (e.g., repeated failed logins, abuse of trial periods, or suspicious behavior) and maintaining logs necessary to investigate incidents.

No marketing emails. We do not send marketing or promotional emails. If this changes in the future, We will request Your Consent in advance where required by applicable law.

We may send service-related emails necessary to operate the Application (for example, security notices, Account messages, important technical updates, or replies from support).

Compliance and security. Personal Data Processing is essential for ensuring compliance with legal obligations, such as tax regulations and consumer protection laws, as well as for implementing security measures to protect against unauthorized access, fraud, and other security threats.

Enforce Our Terms & Policies. We use the Data We collect to enforce Our Terms of Service, Policy and the law. This includes enforcing, investigating, and reporting conduct that violates Our Terms & Conditions, Policy, or the law, responding to requests from law enforcement, and complying with legal requirements. In some cases, We may also use or share Your Personal Data to cooperate with law enforcement requests, escalate safety issues to law enforcement, industry partners, or others, or comply with Our legal obligations.

5. Legal basis for Processing Your Personal Data

To Process Your Personal Data, We rely on the following lawful bases:

We do not use Your Personal Data to make decisions producing legal or similarly significant effects about You.

6. Storage of Personal Data

6.1. How long do We keep Your Personal Data?

We keep Your Personal Data for as long as Your Account remains active. This means that, as a general rule, We store the Personal Data associated with Your Account until You delete Your Account or request deletion of Your Personal Data.

After deletion of Your Account (or after We fulfill a valid deletion request), We delete or anonymize Your Personal Data within a reasonable period of time, unless We are required or permitted to retain certain information for a longer period to comply with applicable law, resolve disputes, enforce Our agreements, or protect Our legal rights.

Copies of certain Data may remain in backups for a limited period of time. We use Hetzner Online GmbH as Our hosting and infrastructure provider. Where backups are enabled for Our servers, Hetzner Cloud Backups are created automatically on a daily basis and each server has a total of 7 backup slots. Once this limit is reached, the oldest backup is automatically deleted as soon as a new backup is created. Accordingly, after You delete Your Account, residual copies of certain Data may remain in backups until they are overwritten as part of this backup rotation. For more information on Hetzner Cloud Backups (including retention and backup rotation), please refer to Hetzner’s applicable documentation and policies.

Analytics/diagnostics data (if enabled by You where required) is retained in accordance with Our configuration and the retention tools provided by Our analytics vendors.

6.2. Where do We store Your Personal Data?

We adhere to generally accepted industry standards to protect Your Personal Data both during transmission and after receipt. Storage of Personal Data is facilitated through servers operated by Hetzner Online GmbH, located in Germany.

Processing of Personal Data is carried out using computers and/or automated means in accordance with procedures and methods that correspond to the purposes of collecting Personal Data.

In certain cases, depending on the Third Party service providers We use to operate the Application (for example, email delivery, customer support tools, analytics, crash reporting, or advertising partners), some Personal Data may be Processed in countries outside the EEA. Where such transfers occur, We implement appropriate safeguards required under applicable data protection law. In particular:

We take the protection of Personal Data seriously and implement appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. However, no method of transmission over the Internet or method of electronic storage is completely secure, and therefore We cannot guarantee absolute security.

6.3. Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

We apply a variety of security measures appropriate to the possible risks.

Organizational measures

Staff training on Data security and confidentiality

Internal policies and procedures for Processing Personal Data

Access management procedures (including the “need-to-know” / least-privilege principle)

Technical measures

Restrictions on access to Data

Encryption technologies

Regular backups

Network security perimeter (firewalls)

In the event of a Personal Data breach, We are committed to responding swiftly and in accordance with applicable Data protection laws, including the GDPR and relevant local regulations, by promptly assessing the breach, notifying the relevant supervisory authority within 72 (seventy-two) hours of becoming aware of the breach, and providing all necessary details. Where the Personal Data breach is likely to result in a high risk to the rights and freedoms of natural persons, We will also inform the affected Data Subjects without undue delay, in clear and plain language, describing the nature of the breach, its likely consequences, and the measures taken or proposed to address it. Where the notification is not made within 72 hours, it will be accompanied by reasons for the delay.

7. Do We transfer Your Personal Data to Third Parties?

In some cases, Personal Data may be available to certain categories of Company’s responsible persons (officials), whose activities are related to ensuring the proper functioning of the Application, or to Third Party organizations (such as independent providers of technical services, postal organizations, hosting service providers, companies — providers of information technologies, communication services), contractors and partners of the Company, whom We entrust to perform the functions of the Processor if necessary. You can additionally ask Us for a list of the above-mentioned persons.

IT service providers. We may engage other companies (including foreign ones) that provide administrative and IT services, including hosting services, the use of cloud services, and databases, which will Process the User's Personal Data on Our behalf in order to provide technical support and proper functioning of the Application. Such companies may access the User's Personal Data only if it is necessary to carry out the above purposes and in accordance with the provisions of the agreements with these companies on the non-disclosure of confidential information, and such companies are not entitled to use it for any other purpose.

Data processing agreements. Where Third Party service providers Process Personal Data on Our behalf as Processors, We enter into data processing agreements / data processing terms with such providers (as required under Article 28 GDPR). These arrangements require Our Processors to Process Personal Data only on Our documented instructions, to apply appropriate technical and organizational security measures, and not to use Personal Data for their own independent purposes.

Information about the Data Processing terms used by certain key providers is publicly available.

We use the services of Hetzner Online GmbH to store Personal Data. The policy of Hetzner Online GmbH can be found here: https://www.hetzner.com/legal/privacy-policy/.

To support the operation of the Application and improve reliability and user experience (for example, app stability, diagnostics, analytics, and similar functions), We may use Google Firebase services. The specific Firebase services used may change over time depending on technical needs and updates to the Application. When We use Firebase, Google generally acts as a Data Processor under the GDPR and Processes Personal Data on Our behalf, and Firebase includes Data Processing and Security Terms describing these responsibilities. Certain Firebase services governed by the Google Cloud Platform (GCP) Terms of Service are covered by the Cloud Data Processing Addendum. You can review Google/Firebase privacy and related data processing information here: https://firebase.google.com/support/privacy, https://firebase.google.com/terms/data-processing-terms, and https://policies.google.com/privacy.

We use Amplitude for product analytics to understand how Users interact with the Application (e.g., feature usage and performance of user flows) and to improve the Services. Amplitude’s Data Processing Addendum (DPA) applies to all Amplitude services and is incorporated by reference into Amplitude’s Terms of Service and Main Services Agreement. You can review Amplitude’s privacy and related Data Processing information here: https://amplitude.com/privacy and https://amplitude.com/security-and-privacy.

Authorities (of the United Kingdom of Great Britain and Northern Ireland, the European Union, or other countries). We reserve the right to disclose and/or report any Personal Data of the User, if this is required by any law of the UK or the European Union or another normative legal act, or a confirmed legal requirement of state authority and/or local authorities, for the purpose of compliance with the requirements of the laws of the UK and the legislation of the European Union, protection of the integrity of the Application, to fulfill the requests of Users, state authorities and/or local authorities, or for the purpose of facilitating any investigation by law enforcement agencies or an investigation aimed at guaranteeing public (national) security. In some cases, We may also provide the User's Personal Data to the authorities of the European Union (both national and supranational) and to the authorities of other countries, if such provision of Personal Data is required by law, or in the event of an official request from such an authority as part of a criminal investigation.

Advertising / ad mediation. The Application may display advertising. We may use an advertising mediation provider and, depending on inventory and configuration, Third Party ad networks to select and deliver ads and measure basic performance. These partners may receive limited technical data such as device identifiers, IP address, approximate location derived from IP (if applicable), and ad performance events.

We do not provide these partners with Your birth details for ad targeting.

7.1. Cross-border transfer of Personal Data

In the course of Our business operations, We may transfer Your Personal Data to Third Parties, including, but not limited to service providers and partners, located in countries outside of Your country of residence, including countries outside the European Union (EU), European Economic Area (EEA), Switzerland, and the United Kingdom of Great Britain and Northern Ireland, or which Process Personal Data there. This may occur when We use Third Party services like Firebase, Amplitude, which may store and Process Personal Data on servers located in various jurisdictions.

Please be aware that when Your Personal Data is transferred to third countries, such countries may have Data protection laws that differ from, and in some cases provide less protection than, the Data protection laws in Your country. Nevertheless, We are committed to ensuring that any such transfer of Your Personal Data is conducted in full compliance with applicable Data protection regulations, including but not limited to the GDPR. Specifically, We use one of the following safeguards:

Where Personal Data is transferred to third countries, We rely on the transfer safeguards described above (e.g., adequacy decisions, the EU-U.S. DPF where applicable, and/or SCCs). We do not rely on Сonsent for routine cross-border transfers; if explicit Consent is required for a specific transfer, We will request it separately.

We will take all necessary measures to ensure that Your Personal Data is treated securely and in accordance with this Policy.

8. How can You exercise Your right to privacy?

You, as a Subject of Personal Data, have the right to interact with Your Data directly or through a request to Us. This section describes these rights and how You can exercise them:

To exercise Your rights, please contact Us using the following e-mail address: hello@i12y.studio. Please note that before providing the information according to Your request, We may ask You to provide additional Data to confirm Your identity.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA Member State of Your habitual residence, place of work, or the place of the alleged infringement.

If You are in Cyprus, You may contact the Office of the Commissioner for Personal Data Protection (Cyprus).

9. Similar Technologies

9.1. What are Similar Technologies?

Because the Application is a mobile application (and not a website accessed via a web browser), it generally does not use traditional browser HTTP cookies in the same way as websites do. Instead, the Application may use Similar Technologies to operate, remember preferences, measure performance, and improve reliability. These Similar Technologies may include, for example, local storage on the device (such as app settings), identifiers and tokens (such as device identifiers, push notification tokens), and analytics or diagnostic identifiers used for crash reporting and performance measurement.

In limited cases, when You open external links through the Application, third-party websites You visit may use cookies and Similar Technologies in accordance with their own privacy policies. The Company does not control such third-party cookies.

9.2. Consent to the use of Similar Technologies

Strictly necessary technologies. Certain similar technologies are required for the Application to function securely (for example, authentication tokens, security-related storage, and core settings). These are always enabled because without them the Application may not work properly.

Optional analytics/diagnostics. Where required by applicable law, analytics/diagnostics collection is disabled by default until You enable “Analytics & Diagnostics” in the Application settings (or explicitly opt in during onboarding). Until You opt in, We will not enable or will configure optional analytics/diagnostics so that analytics/diagnostics data is not collected/sent from Your device (as applicable to the chosen configuration). You can withdraw this choice at any time in the Application settings.

No browser cookies. As a mobile application, We do not use traditional browser cookies. If You open external links, third-party websites may use cookies under their own policies.

9.3. The types of Similar Technologies We collect:

Essential technologies (strictly necessary). We use certain Similar Technologies that are strictly necessary to provide the Application and the Services (for example, to maintain security, authenticate sessions, remember core settings, and deliver essential functionality). These Similar Technologies cannot be switched off via an in-app toggle, because without them the Application may not function properly.

Analytics and diagnostics technologies. We may also use analytics and diagnostics Similar Technologies to understand how Users interact with the Application, to troubleshoot crashes, and to improve stability and performance. Where required by applicable law, We will request Your Consent before enabling such analytics/diagnostics collection, and You will be able to withdraw such choice later via the Application settings.

9.4. The purposes of collecting Similar Technologies

We use these technologies to:

9.5. Services used to collect Similar Technologies

We may use the following Third Party services that rely on Similar Technologies:

The specific services and configurations may change over time depending on technical needs and updates to the Application.

9.6. How You can manage Similar Technologies settings?

You can manage analytics and diagnostics collection in the Application settings. If You enable “Analytics & Diagnostics”, We may collect and send certain usage and diagnostic events to Firebase and/or Amplitude to help Us understand how the Application is used, improve stability, and fix errors. If You disable “Analytics & Diagnostics”, We will stop (or significantly limit, to the extent technically feasible) analytics/diagnostics collection on this device, while continuing to use strictly necessary Similar Technologies required for the Application to function and remain secure. Push notification permissions can also be managed via Your iOS device settings.

Tracking / IDFA (where applicable): if the Application engages in “tracking” as defined by Apple (e.g., linking Your Data with third-party data for advertising measurement / targeting across companies), iOS will request Your permission via the AppTrackingTransparency prompt before the Application accesses the device advertising identifier (IDFA). You can also manage this in iOS Settings → Privacy & Security → Tracking.

10. Sending informational materials to the User

We may send You to the email address linked to Your Account service-related communications that are necessary to operate the Application and provide the Services. These communications may include, for example: security notifications, account-related messages, important technical updates, changes to these Terms or this Policy, responses from customer support, and other operational notices.

In addition, the Application may send You in-app notifications and/or push notifications related to the Services (for example, notifications about energy insights, reminders, or other content available in the Application).

These notifications are intended to support the delivery of the Services and are not promotional or direct marketing communications.

During registration (or in the Application settings), You may be offered to select a preferred time for receiving such notifications. You may skip this step while registering an Account. If You do not select a notification time, the Application will not schedule forecast/prediction notifications. You can set or change the preferred time later in the Application settings.

If You do not want to receive push notifications, You can disable notifications for the Application at any time in Your device settings. Please note that in-app notifications may still be shown while You are using the Application.

Promotional communications. If We decide to send promotional or marketing emails, We will request Your prior consent (opt-in) where required by applicable law. You can withdraw Your consent and unsubscribe from promotional emails at any time by using the “unsubscribe” link included in each promotional email (or by contacting Us at hello@i12y.studio). Please note that unsubscribing from promotional emails does not affect service-related communications that are necessary to operate the Application or provide the Services.

11. Links to other sites

The Application may contain links to third-party websites or services that are not owned or controlled by the Company. This may include links displayed in advertisements.

We may integrate third-party advertising technology and/or mediation services to display ads in the Application. As part of this integration, advertisements may be served by third parties, and the destination links, websites, or services associated with such advertisements may be determined by third-party advertising partners. Accordingly, the Company may not control, endorse, or assume responsibility for the content, availability, security, or privacy practices of any third-party websites, services, or advertisers accessed through such links.

When You click an advertisement or a third-party link, You may be redirected outside the Application (for example, to a browser or an in-app web view). Any Data You provide to third parties, and any Processing performed by them, is governed by their own privacy policies and terms. We encourage You to review the privacy policies of any third-party site You visit.

We take reasonable measures to maintain a safe and respectful user experience, including handling reports about suspicious, misleading, or inappropriate advertisements. You may report an advertisement or an advertising link by using the support functionality in the Application (or by contacting hello@i12y.studio). Where reasonably practicable, We may cooperate with Our advertising partners to restrict or remove reported ads; however, We cannot guarantee that all third-party advertisements or links will be reviewed in advance or will be error-free.

12. Dispute resolution

If You have any questions, concerns, or complaints regarding this Privacy Policy or the Processing of Your Personal Data, We encourage You to contact Us first so We can try to resolve the matter informally. You may submit a written notice to hello@i12y.studio. We will make reasonable efforts to respond without undue delay and, as a general rule, within 30 (thirty) calendar days of receipt.

In case of failure to reach a compromise, the dispute will be referred to the competent court of the Republic of Cyprus. The Policy is governed by and construed in accordance with the law of the Republic of Cyprus.

13. Changes to the Policy

We have the right to make changes to this Policy at any time and for any reason by posting a new version of the Policy at the above link. We strongly recommend that You check the Policy and the date of the last change from time to time to stay informed of the latest changes.

If there are material changes to the Policy or the Application that affect Your data privacy rights, We will provide notice where reasonably practicable and, where possible, in advance by displaying an in-app banner or notification and/or by sending an email to the address associated with Your Account and, if necessary, ask for Your Consent.

If You do not agree with any changes made to the Policy, You must stop using the Application, and You can also request the deletion of Your Personal Data.

14. Contact information

If You have any comments, doubts, or questions regarding this Policy, please contact Us at hello@i12y.studio.

We will try to answer You as soon as possible, but no longer than within 30 (thirty) calendar days.

15. Additional information for residents of the United States of America

This section applies only if You are a resident of certain U.S. states that have implemented state-level privacy laws. You, as a Subject of Personal Data, have some special privacy rights. To use them, please contact Us at hello@i12y.studio.

Please note! Depending on the state and legislative requirements, We have from 30 to 60 days to exercise Your request, with the right to postpone it for 30 days more.

If Your complaint is not satisfied, You can file a complaint with the Federal Trade Commission.

Your rights vary depending on the laws that apply to You, but may include:

Right

Description

Area

Right to access

You can request an explanation of the Processing of Your Personal Data.

Right to correct

You can change the Data if it is inaccurate or incomplete.

Right to delete

You can send Us a request to delete Your Personal Data from Our systems.

Right to portability

You can request all the Personal Data You provided to Us and request to transfer Data to another Controller.

Right to opt out of sales

The right to opt out of the sale of Personal Data to Third Parties.

Right to opt out of certain purposes

The right to opt-out of Processing for profiling / targeted advertising purposes.

Right to opt out of Processing of sensitive Data

The right to opt-out of Processing of sensitive Data.

Right to opt in for sensitive Data Processing

The right to opt in before Processing of sensitive Data.

Right against automated decision-making

A prohibition against a business making decisions about a consumer based solely on an automated Process without human input.

Private right of action

The right to seek civil damages from a Controller for violations of a statute.

Please note! Some states do not have privacy laws. The rights of residents of such states are governed by U.S. federal law. If Your state is not on the list, please contact Us, hello@i12y.studio.

Access to specific Data and the right to transfer Data

With certain exceptions, if You are a resident of the state of California, USA, You have the right to request a copy of the Personal Data (defined as Personal information for the purposes of this section) We have collected about You in the 12 (twelve) months prior to Your request. After receiving Your request and establishing Your identity, We will inform You of:

– categories of Personal information that We have collected about You;

– Our business or commercial purpose for collecting such Personal information;

– categories of Third Parties with whom We share this Personal information.

Non-discrimination

We will not discriminate against You for exercising Your rights related to the Processing of Your Personal information, as well as Your right to refuse to receive Our services in the future, or for refusing to receive further marketing, informational / advertising materials from Us.

Do not sell my Personal information

California residents have the right under the California Consumer Privacy Act to opt out of the “sale” of their Personal information by a company governed by CCPA. We do not and will not “sell” Your Personal information, but We recognize that the CCPA defines “Personal information” in such a way that providing access to identifiers associated with You may be considered a “sale”. In the event that these Application visitor identifiers and inferences may be identified as a sale under the CCPA, please use the “Do Not sell or share My Personal Information” control available in the Application under settings. After receiving Your request through this control, the Company will record Your preference in its systems and will honor it going forward, including by limiting disclosures of identifiers where such disclosures could be considered a “sale” or “sharing” under the CCPA/CPRA. Also, if You would like to record Your preference that We will not “sell” Your Personal information in the future, please contact Us via hello@i12y.studio.

Sensitive Personal information

The Application may Process certain Personal information You choose to provide for the personal energy features of the Application, such as your date of birth, time of birth, place of birth, and gender. We use this information solely to provide and personalize the Services, including generating personal energy insights, energy chart explanations, and shared time windows within the Application. We do not use this to infer or derive protected characteristics about You, and We do not use it for cross-context behavioral advertising.

To the extent any Data We Process could be considered “sensitive personal information” under the CCPA/CPRA, We use and disclose it only to the extent necessary to provide the Services, ensure security, prevent fraud, and comply with applicable law.

COPPA (Children Online Privacy Protection Act)

When it comes to the collection of Personal information from children under 13, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation’s consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online.

Fair Information Practices

The Fair Information Practices Principles form the backbone of privacy law in the United States, and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect Personal information.

In order to be in line with Fair Information Practices We will take the following responsive action, should a data breach occur:

We also agree to the individual redress principle, which requires that individuals have a right to pursue legally enforceable rights against data Collectors and Processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or a government agency to investigate and / or prosecute non-compliance by Data Processors.

16. Additional information for residents of Ukraine

The conditions of this section apply only to residents of Ukraine, which is contained in the Privacy Policy and relates to specific requirements, in accordance with the provisions of the legislation of Ukraine, in particular, the Law of Ukraine “On Personal Data Protection” №2297-VI dd. 01.06.2010.

Each User’s personal non-proprietary rights regarding Personal Data are inalienable and inviolable.

The User, resident of Ukraine, has the following rights in relation to the provided Personal Data:

In order to exercise any of the above rights, the User shall contact the Company in writing at the following e-mail address: hello@i12y.studio.

The Subject of Personal Data is obliged to submit a request for access to Personal Data to the Controller, in accordance with the requirements provided for in part 3 of article 16 of the Law of Ukraine “On Personal Data Protection” №2297-VI dd. 01.06.2010. The period for examining the request for its satisfaction will not exceed 10 (ten) business days from the date of its receipt. During this period, the Controller will inform the User submitting the request that the request will be granted, or the relevant Personal Data will not be provided, indicating the grounds specified in the relevant regulatory legal act. The request shall be satisfied within 30 (thirty) calendar days from the date of its receipt, unless otherwise provided by law.

The Controller will notify the Ukrainian Parliament Commissioner for Human Rights of the Processing of Personal Data that poses a particular risk to the rights and freedoms of Personal Data Subjects within 30 (thirty) business days from the date of commencement of such Processing.

17. Additional information for residents of Canada

This section applies only to residents of Canada. The Company Processes Personal Data in accordance with the Personal Information Protection and Electronic Documents Act, Personal Information Protection Act of British Columbia, Personal Information Protection Act of Alberta, and Act respecting the protection of personal information in the private sector of Quebec have the right to interact with its data directly or through a request to Us regarding privacy issues.

This section describes the privacy rights of Canadian residents and how they can exercise them:

Right

Description

Right to access

You can request an explanation of the Processing of Your Personal Data.

Right to rectification

You can change the Data if it is inaccurate or incomplete via request or profile settings on the Application.

Right to delete

You can send Us a request to delete Your Personal Data from Our systems or delete Your account via Application settings. We will remove all Data unless some of them We have to store in compliance with the law requirements.

Right to Data portability

You can request all the Personal Data You provided to Us and request to transfer Data to another Controller.

Right to object opt-out

You may object to the Processing of Your Personal Data.

Right to withdraw Consent

You can withdraw Your Consent at any time.

Right not to be subject to automated decision-making

You can object to being subject to automated-based Processing to know if there are consequences of them due to such Processing.

Right to lodge a complaint

If Your request is not satisfied, You can file a complaint to the regulatory body.

To exercise Your rights, contact Us at the following e-mail address: hello@i12y.studio. We have 30 (thirty) days to exercise Your request from the moment it is received on Our contact email.

We have the right to extend the 30-day period for providing an answer to the request for another 30 (thirty) days in the event that:

You have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) if We do not respond to Your request within the first 30 (thirty) days.

In the event of a leak of Your Personal Data, We will promptly notify You of such a case and the degree of threat to Your Personal Data. In accordance with PIPEDA, We will immediately notify the Office of the Privacy Commissioner of Canada (OPC) and keep a record of the leak that has occurred.

We may disclose Personal Data to Third Party service providers and related corporations located outside of Canada for the purposes described in the Policy. The Policy requires that the Company share Your Personal Data abroad in a manner that requires the highest standards of confidentiality and security when transferring Personal Data abroad. Please note that when Personal Data is transferred abroad, it may be accessed by courts, law enforcement agencies, and national security agencies. Before disclosing Personal Data, We will assess possible risks that may adversely affect the protection of Personal Data. We ensure the appropriate level of integrity and protection of Personal Data when transferred to Third Parties, which is required by the provisions of PIPEDA, by entering into agreements with such companies, which provide for the limitation of the use of Personal Data by the Third Party solely for the purposes provided for in the agreement.