Privacy Policy

Effective date: June 12, 2026
Last updated: June 12, 2026
Applies to: Arboris AI mobile application (Android and iOS) and related services

1. Who We Are

Arboris AI is operated by MyLifeInDev (“we,” “us,” or “our”).

• Product: Arboris AI
• Website: https://www.mylifeindev.com/
• Privacy contact: privacy@arboris.app
• Support: support@arboris.app
• Data protection contact (LGPD / GDPR): privacy@arboris.app

For the purposes of applicable privacy laws, MyLifeInDev is the data controller (or equivalent) for personal information processed through Arboris AI, except where a third-party store or payment provider acts as an independent controller for payment data.

2. Scope

This Privacy Policy applies when you:

• Download, install, or use the Arboris AI mobile app;
• Create or manage an account;
• Subscribe to Plus or Premium plans;
• Participate in social, community, or ambassador/referral features;
• Contact us for support; or
• Visit our hosted legal pages linked from the app or app stores.

This policy does not cover third-party websites, app stores, authentication providers, or payment processors except as described below.

3. Information We Collect

3.1 Information you provide

• Account and identity data: name, email address, username, profile photo, authentication identifiers, and language preferences.
• Profile and onboarding data: age, focus area, answers to onboarding questions, goals, preferences, and self-reported situation in life areas such as career, relationships, finance, health, personal growth, and leisure.
• Journey and user-generated content: reflections, written inputs, ratings, reviews, step answers, feedback, micro-commitments, evidence uploads (such as photos or documents you choose to attach), and progress history.
• Voice data: audio recordings you submit for voice journaling, plus transcripts generated from those recordings.
• Location data: city, region, country, formatted address, place identifier, and approximate coordinates when you select a location through Google Places during onboarding or profile setup. We do not continuously track your real-time GPS location in the background.
• Social and community data: friend requests, friendships, direct messages, group memberships, discussion posts, replies, likes, blocks, and public display name/username.
• Ambassador and referral data: referral codes, referral relationships, conversion records, and commission status if you participate in the ambassador program.
• Support communications: messages, attachments, and information you send when contacting us.

3.2 Information collected automatically

• Device and app data: device type, operating system, app version, language, time zone, and technical identifiers needed to operate the service.
• Usage and product analytics: features used, paths explored, rounds completed, subscription tier, notification interactions, session activity, and error/diagnostic events.
• Subscription metadata: product purchased, billing interval, currency, country, subscription status, renewal dates, and store transaction identifiers received from RevenueCat and app stores. We do not receive or store full payment card numbers.
• Presence data: last-seen timestamps used for optional online presence features.
• Diagnostic and crash data: logs, stack traces, performance data, and, where enabled, session replay or feedback data collected through Sentry for reliability and debugging.

3.3 Information from third parties

• Authentication providers: if you sign in with Google or other supported providers through Clerk, we receive basic profile and authentication information permitted by your provider settings.
• App stores and billing: Google Play and Apple App Store, via RevenueCat, provide subscription status, product identifiers, purchase dates, and related billing metadata.
• Google Places: location suggestions and place details you select.

4. How We Use Your Information

We use personal information to:

1. Provide the service — create and manage your account, deliver paths, steps, rounds, VITE intelligence reports, translations, audio cases, reminders, and social features.
2. Personalize your experience — tailor content, recommendations, difficulty, and language to your profile and activity.
3. Process subscriptions and referrals — manage Plus/Premium access, ambassador commissions, fraud prevention, and billing support.
4. Operate AI features — send prompts and content to AI providers to generate mentorship guidance, translations, speech-to-text, and text-to-speech output.
5. Communicate with you — send service messages, reminders, referral notices, support replies, and important legal or security updates.
6. Maintain safety and integrity — detect abuse, enforce our Terms, prevent fraud, and protect users and our systems.
7. Improve the product — analyze aggregated or de-identified usage to improve features, reliability, and content quality.
8. Comply with law — respond to lawful requests and meet accounting, tax, and regulatory obligations.

5. Legal Bases for Processing (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data on the following bases:

6. AI Processing and Automated Personalization

Arboris AI uses third-party artificial intelligence services, including Google Gemini and DeepSeek, to generate paths, steps, feedback, translations, reports, and audio content. Voice journaling uses Deepgram for speech-to-text. Audio playback may use Google Gemini TTS.

• We send the minimum content necessary to provide the requested feature.
• We do not permit third-party AI providers to use your personal data to train their public models for Arboris AI features, to the extent we can contractually restrict such use.
• AI outputs may be inaccurate or inappropriate; you should not rely on them as professional advice. See our Terms of Service.
• Personalization based on your onboarding answers, activity, and inputs may constitute profiling under some laws. You may contact us to object where applicable.

7. How We Share Information

We do not sell your personal information. We may share information with:

Service providers process data only on our instructions and subject to appropriate confidentiality and security obligations.

8. International Data Transfers

We and our service providers may process personal information in the United States and other countries where they operate. If you are outside those countries, your data may be transferred internationally.

Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and comparable mechanisms. You may contact us for more information about transfer safeguards.

9. Data Retention

We retain personal information only as long as necessary for the purposes described in this policy, including:

• Active accounts: while your account remains active and as needed to provide the service.
• Deleted accounts: most personal data is deleted or anonymized within 30 days after confirmed deletion, unless a longer period is required by law or needed to resolve disputes, enforce terms, or prevent fraud.
• Backups: residual copies may persist in encrypted backups for a limited period before being overwritten.
• Billing and tax records: retained as required by applicable law.
• Aggregated or de-identified data: may be retained longer for analytics and product improvement.

10. Security

We use administrative, technical, and organizational measures designed to protect personal information, including:

• Encryption in transit (TLS)
• Access controls and authenticated APIs
• Secure authentication through Clerk
• Monitoring, logging, and incident response procedures

No method of transmission or storage is completely secure. Please use a strong password, protect your device, and notify us promptly if you suspect unauthorized access.

11. Your Privacy Rights

Depending on your location, you may have some or all of the following rights:

• Access a copy of your personal information
• Correct inaccurate or incomplete information
• Delete your personal information
• Export or receive your data in a portable format
• Restrict or object to certain processing
• Withdraw consent where processing is based on consent
• Opt out of certain analytics or marketing, where applicable
• Lodge a complaint with a supervisory authority

To exercise your rights, email privacy@arboris.app. We may need to verify your identity before responding. We aim to respond within the time required by applicable law.

11.1 European Economic Area, United Kingdom, and Switzerland

You have GDPR-style rights as described above. You may contact your local data protection authority if you believe we have not handled your request appropriately.

11.2 Brazil (LGPD)

If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados, including confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, revocation of consent, and review of automated decisions where applicable. Our data protection contact is privacy@arboris.app. You may also contact the Autoridade Nacional de Proteção de Dados (ANPD).

11.3 United States

Residents of certain U.S. states, including California, may have additional rights such as knowing what personal information we collect, requesting deletion, correcting inaccurate information, and opting out of the “sale” or “sharing” of personal information. We do not sell personal information. To submit a request, contact privacy@arboris.app.

11.4 Canada

Canadian users may request access to and correction of personal information subject to PIPEDA and applicable provincial laws.

11.5 Australia and New Zealand

Users in Australia and New Zealand may request access to and correction of personal information in accordance with the Privacy Act 1988 (Australia) and the Privacy Act 2020 (New Zealand).

11.6 Japan, South Korea, India, and other regions

Where local law grants additional rights, including under Japan’s APPI, South Korea’s PIPA, or India’s Digital Personal Data Protection Act, we will honor valid requests to the extent required by applicable law.

12. Account Deletion

You may request account deletion through the app settings or by emailing privacy@arboris.app. Deletion is permanent and will remove access to your journey history, social connections, and subscriptions tied to the account, subject to legal retention requirements. Cancel active subscriptions through Google Play or the Apple App Store before or after deletion as needed.

13. Children’s Privacy

Arboris AI is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe a minor has provided us personal information, contact privacy@arboris.app and we will take steps to delete it.

14. Sensitive Information

You may choose to share information about health, relationships, finances, or other sensitive topics while using the app. Please share only what you are comfortable processing for personalization. Arboris AI is not a medical, mental health, financial, or legal service. Do not submit information you are not willing to have processed by our systems and AI providers as described in this policy.

15. Permissions and Device Features

• Microphone: used only when you record voice journal entries.
• Photos / files: used only when you choose to upload evidence or a profile image.
• Location: used only when you search for or select a city/location.
• Notifications: used for reminders, social activity, and service messages if you enable them.

You can change many permissions in your device settings. Some features may not work without them.

16. Third-Party Links and Stores

The app may contain links to third-party websites or resources. Their privacy practices are governed by their own policies. Purchases made through Google Play or the Apple App Store are also subject to the applicable store terms and privacy policies.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the app, by email, or by updating the “Last updated” date above. Continued use of the service after the effective date constitutes acceptance of the updated policy, except where applicable law requires otherwise.