PRIVACY POLICY

Last updated: September 6, 2026

1. ACCEPTANCE & LEGAL SCOPE

This Privacy Policy details the personal data we collect, how it is processed, and the legal rights available to you. By accessing or using the Service, you promise that (i) you have read, understood, and agreed to this Privacy Policy, and (ii) you are at least 18 years of age. If you do not agree, you must immediately cancel active subscriptions, request data deletion, and delete the Service from your devices.

Minors Policy: We do not knowingly process personal data from individuals under 18 years of age. If you suspect a minor has provided us with personal data, please report it immediately to hello_app@rhythmix.tech.

2. PERSONAL DATA CONTROLLER

3. CATEGORIES & SOURCES OF PERSONAL DATA

3.1 Data Directly Provided by You

• Identifiers: Email address provided during registration, newsletter sign-up, or support correspondence.
• Support Communications: Email content, attachments, refund requests, or inquiries sent to our support team.

3.2 Data Collected Automatically

• Device & Geolocation: IP address, language settings, time zone, device model/type, OS version, hardware ID, mobile carrier, and unique identifiers (IDFA, GAID).
• Usage & Log Data: Page views, feature interactions, session frequency, and duration within the Service.
• Diagnostics: Crashlytics, performance metrics, and system log monitoring.
• User Acquisition: Referring app, URL, or advertisement leading to app installation.
• Cookies & SDKs: Cookies, SDKs, and tracking tools to enhance functionality and analyze traffic.
• Meta Pixel & Opt-Out Instructions: We use Meta Pixel to collect data about your actions on our Service (including pages visited, time spent, and actions taken) to measure ad campaign effectiveness and personalize content. Data collected is transmitted to Facebook, establishing a direct connection between your browser and Facebook servers upon consent. Data processing takes place within Facebook's Data Policy. To opt-out from Facebook's interest-based ads, follow these instructions from Facebook

3.3 Data Received from Third Parties

• Subscription Details: Subscription terms, ID, purchase date/time/amount, payment method type, and masked card digits. (We do not store full credit card numbers).
• App Store Consumption Info: Account tenure, App Account Token (UUID), consumption status, lifetime purchases/refunds, platform, play time, and refund preferences provided by Apple.

3.4 Excluded Data & Data Minimization

We do NOT collect sensitive personal data regarding race, ethnicity, political opinions, religious beliefs, trade union membership, genetic/biometric data, health, sex life, or criminal history. We strictly adhere to data minimization, collecting only data necessary for stated processing purposes.

4. PROCESSING PURPOSES & LEGAL BASES

We process personal data based on four primary legal bases: (1) Performance of Contract, (2) Legitimate Interests, (3) Compliance with Legal Obligations, and (4) User Consent.

Legitimate Interest Scope: Our legitimate interests include: promoting our Service appropriately, analyzing user preferences to enhance UX, personalizing ad campaigns, defending against legal claims, and enforcing our Terms of Use.

5. CONNECTION TO THIRD-PARTY CLOUD STORAGE SERVICES

5.1. The Service allows you to connect your third-party cloud storage accounts, including Google Drive and Dropbox, in order to import files stored there and print or edit them. Connecting such an account is entirely optional and the Service remains usable without it.

5.2. Redirect and Authorization: When you connect such an account, you are redirected to the provider's own authorization page, where you grant the Service access. Passwords: We never receive, request or store the password to your third-party account. Revoking Access: You may revoke this access at any time in the settings of the relevant provider — for Google, at https://myaccount.google.com/permissions, and for Dropbox, in the connected applications section of your account — or by disconnecting the account within the Service.

5.3. We access only those files and folders that are necessary to display them to you within the Service and to carry out the action you request, such as opening, printing or editing a file. We do not browse, index or scan the remaining contents of your storage account.

5.4. Google API Services User Data Policy Compliance (Limited Use Disclosure): The Service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not use data obtained through Google APIs to serve advertisements.
• We do not sell data obtained through Google APIs.
• We do not transfer Google API data to third parties, except as necessary to provide or improve requested functionality, comply with applicable law, or as part of a merger or acquisition.
• We do not allow humans to read Google API data unless we have your explicit consent for specific files, it is necessary for security purposes, to comply with applicable law, or the data has been aggregated and anonymized.

5.5. Third-Party Governance: Your use of a connected third-party account remains governed by that provider's own terms and privacy policy. We are not responsible for the availability of such services, for changes to their functionality, or for the loss of data stored within them.

6. THIRD-PARTY VENDORS & DATA DISCLOSURES

We share data with trusted third-party service providers to support app functionality, analytics, infrastructure, and marketing. All vendors are strictly bound by data protection obligations.

Legal & Corporate Disclosures: We disclose data to public/law enforcement authorities when legally required to enforce our legal rights or comply with judicial orders. In corporate transactions (mergers, acquisitions, asset sales), user data may be transferred as a business asset.

7. CROSS-BORDER TRANSFERS & DATA SECURITY

When transferring personal data outside the EEA to countries lacking equivalent data protection laws, we deploy recognized safeguards including European Commission Standard Contractual Clauses (SCCs) or adequacy decisions.

Security Safeguards: We employ administrative, physical, and technical safeguards (including SSL encryption and restricted access controls) to prevent unauthorized data access, loss, or alteration. Suspected breaches will be notified to users and regulators as legally required.

Data Retention: Personal data is retained as long as reasonably required to fulfill operational purposes, maintain active accounts, satisfy legal obligations, and resolve disputes.

8. REGIONAL LEGAL PRIVACY RIGHTS

8.1 EEA & UK Resident Rights (GDPR / UK GDPR)

Residents of the EEA and UK enjoy specific statutory rights:

• Right to Access: Request confirmation and explanation of personal data processing.
• Right to Rectification: Correct inaccurate or incomplete personal records.
• Right to Erasure ('To Be Forgotten'): Request deletion of personal data from our systems.
• Restriction & Objection: Restrict or object to specific processing activities.
• Data Portability: Obtain and transfer data to another controller in a structured format.
• Right to Complain: Lodge complaints with local Data Protection Authorities (e.g., UK ICO at ico.org.uk).

8.2 United States Consumer Privacy Rights

State-specific privacy rights apply across CA, CO, CT, IN, IA, MT, TN, TX, UT, VA, and other jurisdictions:

• No Sale of Personal Info (CCPA): We do not sell personal information or use it as a standalone business model. California consumers may submit opt-out requests for future protection.
• Shine the Light Disclosure: California residents may request annual disclosures regarding data shared with third parties for direct marketing.
• US State Rights Overview: Consumers hold rights to Access, Correct, Delete, Port Data, and Opt-Out of targeted advertising/profiling. Requests are fulfilled within 30-60 days.
• Do-Not-Track (DNT) Notice: We currently do not possess technical capabilities to respond to automated browser DNT signals.

8.3 Canadian Resident Rights

Canadian residents hold privacy rights under federal (PIPEDA) and provincial laws, with the right to lodge complaints with the Office of the Privacy Commissioner of Canada.

9. AMENDMENTS & CONTACT INFORMATION

We reserve the right to update this Privacy Policy. Material revisions will be communicated in-app or via email prior to becoming effective. Continued use signifies acceptance.

Contact Us: For privacy inquiries, rights verification, or minor protection concerns, contact our privacy team at hello_app@rhythmix.tech.