1. Introduction & Scope

This Privacy Policy ("Policy") describes how TNSE Trading LLC, the company behind Family Odyssey, collects, uses, discloses, transfers, retains, and protects personal information when you use our mobile apps (iOS and Android), our website, our AI Assistant, our AI Insights features, and any other services we provide (collectively, the "Service"). It applies to consumers worldwide and is supplemented by the jurisdictional Appendices below where local laws give you additional rights.

Family Odyssey is a family activity planning service. We help parents and guardians plan, coordinate, and remember family activities through shared calendars, todo lists, photos, place discovery, and AI-powered suggestions. We are designed for families that include children, and we have specific protections for child data — described in Section 6.

This Policy is written together with our Terms of Use. Where the Terms describe what the Service does, this Policy describes what we do with the information we collect to provide it. If anything is unclear, please email [email protected].

1.1 Incorporation of Terms of Use protections

The protections, limitations, and procedures in our Terms of Use apply with equal force to claims arising from or relating to this Policy, except where local law prohibits. In particular, the limitation of liability (Terms § 13), the disclaimer of warranties (Terms § 12), the dispute-resolution and binding-arbitration provisions (Terms § 15), the class-action waiver (Terms § 15.3), the coordinated-filing protocol (Terms § 15.9), the limitation period (Terms § 15.8), the governing-law choice (Terms § 15.6), the local-law carve-outs (Terms § 16 and the Appendices), the survival clause (Terms § 19.8), the force-majeure clause (Terms § 19.4), and the Apple App Store and Google Play additional terms (Terms § 20 and § 21) are incorporated into this Policy by reference. If a court holds any incorporated provision inapplicable to a privacy claim under your local law, the rest of the Terms remain in effect.

1.2 Statements about our practices reflect a point in time

Statements in this Policy describe our practices as of the Effective Date. We update them as the Service evolves and as we add or change Subprocessors, features, and operational controls. Section 16 describes how we communicate changes.

2. Definitions

Capitalized terms used in this Policy have the meanings set out in our Terms of Use (Section 1) unless defined below. Key terms:

"Personal Information" or "personal data"

Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. The term has the meanings given to it in the GDPR (Art. 4(1)), the UK GDPR, the CCPA/CPRA, the Quebec Civil Code, the LGPD, and equivalent laws.

"Sensitive Personal Information"

The subset of Personal Information given heightened protection under applicable laws — including precise geolocation, government identifiers, race or ethnic origin, religion, health information, sexual orientation, biometric identifiers, children's data, and similar categories. Where we receive such data we apply additional safeguards (see Section 3).

"Process" / "processing"

Any operation performed on Personal Information — including collection, recording, storage, retrieval, use, disclosure, transmission, alignment, restriction, erasure, and destruction.

"Subprocessor"

A third-party service provider engaged by Family Odyssey to process Personal Information on our behalf — for example, a cloud hosting provider or an AI model provider — under written data-processing terms.

"Anonymized Data" / "De-identified Data"

Data from which we have removed or hashed direct and indirect personal identifiers (such as names, emails, exact coordinates, device identifiers, and account IDs) so the data cannot reasonably be re-associated with you or your household.

"AI Provider" / "AI Subprocessor"

A third-party large-language-model or AI service used to power the AI Assistant or AI Insights — currently Google (Gemini) and OpenAI, with Anthropic and xAI as alternatives or specialized providers (see Section 8).

"Child Profile"

A sub-account created and managed by a Parent for a user under 18, governed by Section 6.

3. What Personal Information We Collect

The Service operates only with the information you, or someone in your Family Circle, choose to share. The categories below describe what we collect, the typical sources, and whether each category is "Sensitive" under one or more applicable laws.

3.1 What we do not collect

We deliberately do not collect or process the following:

• Government identifiers (Social Security number, passport, driver's license);
• Biometric identifiers (fingerprints, facial recognition templates, voiceprints, retinal scans) — we do not run facial recognition against your photos;
• Health records covered by HIPAA (we are not a HIPAA-regulated service; do not enter Protected Health Information into the AI Assistant);
• Educational records covered by FERPA;
• Financial account credentials (we do not store payment-card numbers; Apple or Google handles billing);
• Tracking identifiers for cross-app advertising — we do not perform "tracking" as defined under Apple's App Tracking Transparency framework.

3.2 Sources of Personal Information

We collect Personal Information from these sources:

• Directly from you — when you create an Account, sign in, complete profile fields, write content, attach photos, search for places, or interact with the AI Assistant.
• From other Family Circle members — when they invite you, share Content with you, mention you in events or todos, or upload photos containing you.
• From third-party sign-in providers — when you choose Sign in with Apple or Sign in with Google, we receive the basic profile fields you authorize the provider to share.
• From integrations you connect — Google Calendar (OAuth), iOS Calendar / Reminders (device permission); we read only the data scopes you authorize.
• From your device — device technical data and (with your permission) coarse or precise location.
• From third-party data providers — limited operational data, such as place metadata (Google Places, Geoapify, Mapbox), weather (Open-Meteo), or stock images (Pexels), to enrich features. These providers do not receive your personal identifiers.
• From mailing-list signups and inquiry forms — when you provide your email outside the in-app flow (e.g., to subscribe to our newsletter or contact us about the product).

4. Why We Process Your Information & Legal Bases

We process Personal Information for the purposes below. Where the General Data Protection Regulation, the UK GDPR, the Quebec Civil Code, the LGPD, or similar laws apply, we identify the legal basis for each purpose. Where multiple bases could apply, we list the primary one.

4.1 Children's data — special legal basis

Where we process Personal Information about a child, the legal basis is the verifiable parental consent obtained from the Parent under Section 6, supplemented by the legitimate interest of providing a safe family-planning environment and our legal obligations under COPPA, GDPR Art. 8, the UK Children's Code, Quebec Law 25, the LGPD's child-data rules, the India DPDPA 2023, and equivalent laws.

4.2 Sensitive data — additional protections

Where you provide sensitive information (precise geolocation if you opt in to it, allergy or medical-adjacent details, inferences that could be considered consumer health data under the Washington My Health My Data Act), we process it only for the feature you invoked, do not use it for advertising, do not share it with third parties for their own purposes, and apply additional access controls. See Appendix H for Washington-specific rules.

4.3 We do not engage in automated decisions with legal effect

Family Odyssey does not make decisions about you that produce legal or similarly significant effects within the meaning of GDPR Article 22 / UK GDPR Article 22 / Quebec Law 25 § 12.1. AI Assistant and AI Insights outputs are advisory; you decide whether to act on them. If you would nonetheless like a human at Family Odyssey to review an AI output that affected you, email [email protected] with the subject line "AI Human Review." We will acknowledge receipt within 5 business days and respond with one of three outcomes — correction, deletion, or no-action with an explanation — generally within 30 days.

5. AI Processing

Family Odyssey uses artificial intelligence to power the AI Assistant chat and the AI Insights features (Story of Us, Time Capsule, Invisible Traditions, Childhood Architect, Unrepeatable Window, Kids-Eye View, Bonding Forecast, Family Quest, For You Parent). This section explains in detail what happens to your data when you use those features. It is the privacy-side counterpart to Section 5 of our Terms of Use.

5.1 What we send to AI providers

When you use an AI feature, we send the following to a third-party AI Provider for processing:

• The text of your prompt and recent conversation history;
• An aliased view of your family profile (e.g., "Parent1", "Child1") with last names stripped;
• Your approximate location, rounded to neighborhood-level precision (~1 km), where the feature needs location;
• Photos you attach to a chat, with GPS EXIF metadata stripped before transmission;
• Voice input you submit, transcribed on-device where the platform supports it; otherwise transcribed via a server-side transcription provider, then handled like a typed prompt;
• Tool-call context the AI requires to answer your prompt (current date, the names of your todo lists, your circle membership at runtime).

5.2 What we do not send

We do not transmit to AI Providers:

• Your account email or password;
• Payment information;
• Government identifiers, biometric identifiers, or precise street-level location;
• Real first or last names of family members (these are aliased before transmission);
• Authentication tokens, push tokens, or device fingerprints.

5.2.1 Quick reference — Sent vs. Not sent

5.3 No retention or training by AI Providers

We instruct AI Providers — contractually and through API flags such as the provider's no-store flag — not to retain your prompts or responses beyond what is needed to return the response, and not to use your conversations to train their models. Where required by law (for example, when processing EU- or UK-origin data), we put in place Data Processing Addenda and Standard Contractual Clauses with the AI Provider. Note: Section 5.5 describes a narrow exception under which we may retain content on our own systems when our automated safety filters flag a conversation; that retention is by us, not the AI Provider, and is described separately.

5.4 Use of De-identified Data to improve our own AI features

Family Odyssey may use De-identified Data — derived from interactions with the Service after we have removed direct and indirect identifiers — to (i) train, evaluate, and improve our own AI features, ranking, safety classifiers, and product quality; (ii) generate aggregate analytics; (iii) measure and enhance Service safety and reliability; and (iv) publish aggregate, non-identifying statistics about how the Service is used. We do not attempt to re-identify De-identified Data, and we contractually require subprocessors not to do so.

Child Profile data is excluded. We do not use Child Profile data, nor data about identifiable minors, to train AI models — even in de-identified form — except where strictly necessary for safety classifiers protecting minors.

Opt-out: You may opt out of having your De-identified Data used to improve AI features by going to in-app Settings > Privacy > AI Improvement (where available) or by emailing [email protected].

5.5 Conversation review for safety

We do not routinely read your AI Assistant chats. To keep the Service safe for kids and families, our automated safety filters may flag a conversation; only flagged content is briefly reviewed (by software systems and, when needed, by authorized personnel under confidentiality obligations) to detect and prevent abuse, fraud, and harm to minors; investigate safety concerns; comply with legal obligations; and improve the safety and quality of the Service. Reviewed content may be shared with our AI Providers (for the safety case at hand), with law enforcement (where legally required, including suspected child sexual abuse material reported to NCMEC under 18 U.S.C. § 2258A), and with trusted safety partners. We retain flagged content only as long as needed for the safety review and applicable legal obligations.

5.6 Photo handling for AI

If you attach a photo to an AI chat, we strip GPS coordinates and similar location-revealing EXIF metadata before transmission to the AI Provider. We do not run facial-recognition templates against your photos. We may use industry-standard image-safety tools (including hash matching against known child-sexual-abuse material) and we comply with our reporting obligations under US 18 U.S.C. § 2258A, the EU Digital Services Act, the UK Online Safety Act 2023, and equivalent laws; confirmed CSAM is reported to NCMEC and to the equivalent national bodies in your jurisdiction.

5.7 Voice and microphone

Voice input is captured only when you grant microphone permission and only when you actively use a voice feature. Audio is transcribed on-device where the platform supports on-device speech recognition; otherwise via a server-side transcription provider listed in Section 8. Audio is not retained beyond what is necessary to produce the transcription, except where retention is required for safety review under Section 5.5.

5.8 AI Insights — inferred attributes about your family

AI Insights generate narrative observations and forecasts about your family from data you and your Family Circle have created within the Service. Insights are inferences, not statements of fact, and may be inaccurate. You can delete any Insight at any time; Insights about a Child Profile are deleted when the Child Profile is deleted (see Section 10). Where your jurisdiction recognizes a right to object to profiling, you may object to AI Insights generation by disabling the feature in Settings or by emailing [email protected].

5.9 AI memory (vector embeddings)

To give the AI Assistant useful continuity, we store small mathematical representations of your conversation history ("vector embeddings") in our primary database. Embeddings are linked to your Account, are not shared with third parties for their own purposes, and are deleted when you delete the underlying conversation, when you delete a Child Profile, or when your Account is hard-deleted (see Section 10).

5.10 AI-generated content is labeled

AI Assistant responses and AI Insights outputs are visually labeled as AI-generated within the app, satisfying the human-readable and machine-readable transparency obligations of EU AI Act Article 50 and equivalent laws.

5.11 AI rights you can exercise

In addition to the general rights in Section 11, you can:

• Opt out of having your De-identified Data used to improve our AI features (Section 5.4);
• Delete AI conversation history; we will scrub or pseudonymize references to deleted content in any residual safety logs we hold (Section 5.5);
• Delete AI Insights generated about you;
• Object to profiling — that is, the inference-generation that powers AI Insights — by disabling the feature;
• Disable voice input by revoking microphone permission;
• Disable photo attachments to AI chats;
• Request human review of an AI output that affected you (Section 4.3);
• Report harmful AI output by emailing [email protected] with subject "AI Incident."

5.12 Use of the Service without AI

The AI Assistant and AI Insights are optional. You can use Family Odyssey's calendar, todos, Family Circles, place search, photos, and other non-AI features without invoking any AI feature. We do not condition access to non-AI features on your use of AI features.

6. Children's Privacy & Family Use

Family Odyssey is a service for families. We expect children of any age to participate in family-planning life, and we have built specific protections for child data. This section is the privacy-side counterpart to Section 6 of our Terms of Use.

6.1 How children use the Service

Only adults (18 or older) may create a Family Odyssey Account. Children may use the Service only through a Child Profile created and supervised by their Parent or legal guardian. Children under 13 may not have a stand-alone Account; they may only use the Service through a Parent-managed Child Profile.

6.2 Verifiable Parental Consent

Before we collect any personal information from a child under 13 in the United States (or below the digital-consent age in other jurisdictions — typically 13 to 16 in the EU; 14 in Quebec; 12 in Brazil; 18 in India), we obtain verifiable parental consent from the Parent. We use one of the following consent methods, each accepted under the FTC's COPPA Rule (16 CFR § 312.5(b)) and equivalent laws:

• Payment method on file: the Parent has a credit card, debit card, or active in-app purchase associated with the Account; or
• Email-plus: the Parent confirms consent via a verified email address combined with an in-app confirmation step; we send a follow-up confirmation to the same email a reasonable time later.

We retain a record of the consent method, timestamp, and Parent identifier as evidence of consent. The Parent may revoke consent at any time by deleting the Child Profile or by emailing [email protected] from the Parent's verified email; revocation triggers deletion under Section 10.

6.3 Categories of child data we collect

From or about a Child Profile, we collect only what is reasonably necessary for the family-planning features the Parent enables:

• Child's first name and age or birthdate;
• Optional: child's interests, hobbies, allergies/special needs the Parent chooses to enter;
• Optional: child's profile photo (uploaded by the Parent);
• Calendar events, todos, and photos that reference the child (created by Parents and other Family Circle adults);
• Approximate location only if the Parent affirmatively turns it on for the Child Profile (default: OFF);
• References to the child within Parent-submitted AI Assistant prompts (treated as data about the child — see Section 5.1).

6.4 What we do not do with child data

• We do not show targeted advertising to children;
• We do not profile children for marketing purposes;
• We do not disclose Child Profile data to any third party for that third party's own advertising or marketing — therefore the FTC's 2025 COPPA amendment requirement of separate verifiable parental consent for third-party advertising disclosures does not apply to our practices, because we do not engage in those disclosures at all;
• We do not use Child Profile data to train AI models — including third-party AI providers — except for safety classifiers that protect minors;
• We do not collect biometric identifiers from children without separate, explicit parental consent (and we have no current biometric features);
• We do not send push notifications to Child Profiles; notifications about a child go only to the Parent;
• We do not share child data with third parties for their own purposes;
• We do not condition the Service on the disclosure of more child information than is reasonably necessary for the feature being used.

6.5 Direct notice to Parents (COPPA § 312.4(c))

Before a Parent provides verifiable parental consent for a Child Profile, we display a direct in-app notice that summarizes: the categories of personal information we will collect from the child; how we will use it; that we will not disclose it to third parties for those parties' own purposes; the Parent's right to review, delete, and refuse further collection (Section 6.6); and our contact for child-data inquiries ([email protected]). This Policy together with that direct notice constitutes our online privacy notice and direct notice under COPPA.

6.6 Parental rights

Parents may at any time:

• Review the personal information we have collected for a Child Profile;
• Correct inaccurate child data;
• Delete a Child Profile and the data associated with it (subject to the retention rules in Section 10);
• Revoke consent and refuse further collection;
• Export the child's data in a portable format.

To exercise these rights, log in as the Parent and use Settings > Family > Manage Child Profile, or email [email protected] from the Parent's verified email with the subject line "Child Profile Request." Review delivers an in-app summary of what we hold for the child plus, on request, an emailed JSON export with attached media within 30 days. We confirm deletion in writing within the same period.

6.7 Children's data retention

We retain Child Profile data only as long as reasonably necessary to provide the Service to the family. When you delete a Child Profile, we delete the child's personal data within 90 days, except (a) backups and audit logs, which are purged within 12 months; (b) records of parental consent and revocation, which are retained as long as needed to demonstrate compliance; and (c) data legally required to be retained (for example, content reported under Section 14 for a safety investigation). Inactive Child Profiles are flagged after 3 years of no activity; if the Parent does not respond, the profile is archived and proceeds to deletion within an additional 12 months.

6.8 Age transitions (13, 16, 18)

As a child grows up, our handling of their data adjusts to match the legal regime that applies. At each transition we send the Parent an in-app prompt and an email at least 30 days before the transition takes effect.

• Reaching 13 (US COPPA threshold). COPPA's verifiable-parental-consent requirements no longer apply once the child turns 13. By default, the Child Profile remains under the Parent's Account; existing calendar events, todos, photos, AI conversation history, and Insights stay where they are. The Parent may elect to convert the profile into a stand-alone Account, in which case (a) the user accepts these terms and creates credentials; (b) the user's prior contributions transfer with them to the new Account; (c) shared family content remains in the Circle; (d) the Parent retains read access only to data the user explicitly leaves shared with the Circle.
• Reaching 16 (CCPA opt-in for sale/sharing; GDPR digital-consent age in many EU member states). Where local law makes the user an adult for personal-data purposes at 16, we prompt the user for fresh consent and convert to an adult Account where appropriate. Pre-existing data migrates with the user; consent records show both the original parental consent and the user's confirmation at 16.
• Reaching 18. The user is offered conversion to a full adult Account. Prior contributions remain in the Family Circle as the user's Content; the user assumes ownership and may exercise full data-rights requests directly. The Parent's prior administrative role over the (now-adult) profile ends; the Parent retains visibility only into Circle-shared content.

We do not assume that consent obtained for a child under 13 continues to validate processing once the child is 13+ in jurisdictions that require fresh consent at that age. We refresh consent prompts where required.

6.9 Information about a child you reference in AI prompts

If you reference a child in an AI Assistant prompt (for example, "find a peanut-free birthday venue for my 8-year-old in Pataskala"), the information about the child is treated as data about the child and is governed by this Section 6 — even when the prompt comes from a Parent's Account rather than a Child Profile session. Alias substitution (Section 5.1) reduces but does not eliminate re-identification risk; please avoid entering uniquely identifying details about a child.

6.10 No targeted advertising or profiling-based ads to known minors

Consistent with EU Digital Services Act Article 28, the UK Children's Code, the California Age-Appropriate Design Code, the Texas SCOPE Act, the Maryland Kids Code, the Florida HB 3, and equivalent frameworks, we do not present targeted advertising or profiling-based advertising to known or likely minors. Default settings for known minors favor privacy (location off, sharing limited, push notifications routed only to Parents). See Appendix F (Texas) and Appendix I (Maryland) for jurisdiction-specific protections.

6.11 Reporting harmful content involving a minor

If you encounter content within Family Odyssey that you believe harms a minor — including child sexual abuse material, grooming, exploitation, bullying, or threats — report it immediately by emailing [email protected] with the subject line "Minor Safety Report", or by using the in-app "Report" function. We aim to acknowledge such reports within two business days, take appropriate remedial action (which may include content removal, account suspension, and law-enforcement referral), and report confirmed CSAM to NCMEC and equivalent national bodies. For emergencies involving an immediate threat to a child, contact local law enforcement first.

6.12 Children's information security program

Consistent with COPPA § 312.8 and the FTC's 2025 amendments, we maintain a security program for children's data. The program incorporates risk assessments, encryption in transit and at rest, hashed credential storage, and role-based access controls, and is reviewed when the Service materially changes and on a periodic basis. The program is overseen by our Privacy Officer (Section 17.1). We will provide a high-level summary on parental request to [email protected].

6.13 No Safe Harbor program participation (current state)

Family Odyssey is not currently a member of an FTC-approved COPPA Safe Harbor program. If we join one in the future (kidSAFE, iKeepSafe, ESRB, etc.), we will update this Policy and the in-app direct notice with the program details.

7. Family Circles & Sharing

Family Odyssey is a multi-user product. When you join or create a Family Circle, certain information about you becomes visible to other adult members of that Circle. This section explains who sees what.

7.1 Roles within a Family Circle

Members of a Family Circle hold one of the Roles defined in Terms of Use § 7.2 — Owner, Co-Parent, Caregiver, Extended Family, or legacy Member. The Owner controls Role assignment. Roles determine the default access scopes below; the Owner may further restrict any individual's access in Settings.

7.2 Invitations

The Owner (or a Co-Parent, where the Owner has enabled co-administration) may invite adults by email or shareable link. Email addresses you provide for invitations are used solely to deliver the invitation and link; we do not use them to market to invitees who do not accept. Invitations remain valid for 30 days; expired links can be resent.

7.3 Leaving and removal

If you leave a Family Circle, content you created remains in the Circle unless you delete it; content others created stays with them; and your access to the Circle's shared calendar, todos, and photos is removed. If you were the Subscriber of Record for circle-shared Premium, the wind-down rules in Terms § 4.8 apply (including a 14-day continuation grace).

7.4 Owner role transfer and succession

An Owner may transfer the Owner role to a Co-Parent at any time. If an Owner closes their Account or becomes long-term unreachable, Owner role may be transferred to a nominated Successor Co-Parent (see Terms § 7.8) with identity verification. We will work with the estate or a verified family representative on receipt of appropriate documentation in cases of death or incapacity.

7.5 Public Shared Content (Shared Memories & Shared Stories)

Family Odyssey lets you publish certain content via a public, link-accessible URL — for example, Shared Memory pages (URLs of the form /m/[token]) and Shared Story pages (URLs of the form /story/[token]) so grandparents and friends can view a memory or AI-generated family story without creating an Account. Public means public: anyone with the link can view the page; recipients may forward, screenshot, or save the content; search engines may discover and index public pages unless we mark them no-index. You can revoke a share link at any time from in-app Settings > Sharing.

What revocation does and does not do. When you revoke a link, we remove the page from our public hosting immediately and mark it as no-index. Search engines (such as Google) typically remove the page from their index within 7 to 14 days after we update the no-index marker; you can also use Google's removal tools to speed this up. Cached copies on third-party services like the Internet Archive, screenshots saved by recipients, and forwarded copies are outside our control.

7.6 Place reviews on the public web

Place reviews you submit may be displayed on public-facing place-detail pages within the Service (which may be indexable by search engines), in marketing summaries (e.g., aggregate ratings), and in derivative formats (e.g., AI-generated summaries of multiple reviews). We will not display your real name, email, or precise location alongside a review unless you explicitly elect to. You can withdraw a review at any time; withdrawal removes it from public display within a reasonable period (typically 7 days), though cached copies on third-party search engines may persist longer.

8. Recipients & Subprocessors

We share Personal Information only with the categories of recipients listed below, and only as necessary for the purposes in Section 4. We do not sell or rent your Personal Information. We do not "share" Personal Information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

8.1 Categories of recipients

• Other Family Circle members who you have invited or accepted into your Circle, subject to the Role-based access controls in Section 7;
• Subprocessors we engage to operate the Service (the table in Section 8.2);
• Public viewers when you affirmatively choose to publish Public Shared Content (Section 7.5) or place reviews (Section 7.6);
• Government authorities, regulators, and law enforcement where legally required, including mandatory child-safety reporting to NCMEC and equivalent national bodies under 18 U.S.C. § 2258A and similar laws;
• Professional advisors (lawyers, accountants, auditors) under confidentiality, as needed;
• Acquirers in a corporate transaction — in the event of a merger, acquisition, asset sale, financing, restructuring, bankruptcy, or similar transaction, your Personal Information may be transferred as part of the assets, subject to confidentiality and to your continued rights under this Policy.

8.2 Subprocessor table

Family Odyssey relies on the following Subprocessors to operate the Service. Each Subprocessor processes Personal Information only on our instructions, under written data-processing terms (a Data Processing Addendum or equivalent), and only to the extent necessary for the stated purpose.

We may add or change Subprocessors as the Service evolves. Material changes to Subprocessors that handle Personal Information will be reflected in this Section 8 with the effective date updated; where required by law (for example GDPR Art. 28(2)), we will provide affected users with reasonable advance notice and, where applicable, the right to object.

8.3 Google Gemini and OpenAI specifically

AI Assistant, AI memory and AI Insights requests go first to Google's Gemini API, on its paid tier. Under Google's Gemini API terms for paid services, Google does not use your prompts or the responses to improve its products or train its models; it keeps them for a limited period only to detect abuse and comply with law. When the AI Assistant needs current information from the web (for example local events or opening hours), the search terms it builds are sent to Google Search through the Gemini API's grounding feature. The same minimizations described in Section 5 apply, and Google user data from a connected Google Calendar is handled under Section 8.4.

AI requests are sent to OpenAI when Gemini is unavailable, and for recipe reading and place descriptions, under (a) OpenAI's Enterprise / API data-processing terms with the store: false flag set, meaning OpenAI does not retain prompts or completions beyond what is needed to return the response and does not use them to train its models; (b) Standard Contractual Clauses for EU-origin transfers; and (c) the privacy minimizations described in Section 5.

8.4 Google Calendar — Limited Use compliance

Where you connect Google Calendar, we use Google user data only to provide the integration's user-facing features (event sync, conflict detection, AI-aware scheduling). We comply with the Google API Services User Data Policy and its Limited Use requirements: we do not transfer Google user data to third parties except as needed to provide or improve user-facing features (with prominent disclosure); we do not use Google user data for serving advertisements; and we do not allow humans to read Google user data unless we have your affirmative agreement, the data is required for security or to comply with law, or the data has been aggregated and de-identified.

8.5 No "sale" or "sharing" for cross-context behavioral advertising

We do not sell Personal Information for monetary or other valuable consideration, and we do not share Personal Information with third parties for cross-context behavioral advertising. This commitment is reflected in our App Store Privacy Nutrition Label and Google Play Data Safety declarations (Section 15).

9. International Transfers

Family Odyssey is operated from the United States. When you use the Service, your Personal Information may be transferred to, stored in, or processed in the United States, the European Union, the United Kingdom, or other countries where our Subprocessors operate (see Section 8.2). Where Personal Information leaves your home country, we apply the safeguards required by your local law:

• EU / EEA → non-EEA transfers: European Commission Standard Contractual Clauses (Decision 2021/914/EU) supplemented by appropriate technical and organizational measures (encryption in transit and at rest, pseudonymization for AI-bound data, no-retention contractual flags with AI providers). The clauses are incorporated by reference in our Subprocessor DPAs.
• UK → non-UK transfers: the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs.
• Switzerland → non-Switzerland transfers: SCCs adapted for Swiss law as recommended by the Swiss FDPIC.
• Quebec / Canada → non-Canada transfers: we conduct privacy impact assessments where required by Quebec Law 25 § 17 and contract for equivalent protection.
• Brazil → non-Brazil transfers: the international-transfer mechanisms permitted by the LGPD (Articles 33–35).
• Other jurisdictions: the legal mechanism prescribed by your local data-protection authority.

You may request a copy of the relevant safeguards by emailing [email protected] with the subject line "Transfer Safeguards Request."

10. Retention & Deletion

We keep Personal Information only as long as we have a legitimate purpose for it. Specific retention periods:

10.1 What "deletion" means

Deletion means we remove the data from active production systems and replace it with anonymized or null values. Backups are not immediately rewritten — they are purged on the next backup-retention cycle (no longer than 12 months). De-identified data derived from your activity may persist in aggregate analytics and AI safety-classifier training sets even after your Account is deleted, consistent with Section 5.4.

10.2 Legal-hold exception

Where data is the subject of an active legal claim, regulatory investigation, ongoing safety case, or legally mandated retention period (for example tax records under IRC § 6001), we retain that data for the duration of the legal hold and delete it as soon as the hold ends.

10.3 Coming back to Family Odyssey

If you reopen your Account during the 30-day soft-delete restore window, your data is restored as it was at closure (subject to any deletions that occurred at your request before closure). If you sign up again with the same email after hard deletion (after day 30), you are creating a fresh Account with no prior data — your previous family memories, calendar history, and AI conversation history are not recoverable. We may offer promotional or win-back pricing to returning users at our discretion.

11. Your Privacy Rights

Wherever you live, you have rights over the Personal Information we hold about you. The list below is the universal set; your jurisdiction may add to it (see the Appendices).

11.1 Universal rights

• Right to be informed — this Policy is our primary way of telling you what we do.
• Right of access — request a copy of the Personal Information we hold about you.
• Right to rectification — request correction of inaccurate or incomplete Personal Information.
• Right to erasure ("right to be forgotten") — request deletion of Personal Information when no longer needed for the purpose collected, or when you withdraw consent.
• Right to restrict processing — request that we limit how we use your Personal Information while we resolve a question about it.
• Right to data portability — receive your Personal Information in a structured, commonly used, machine-readable format (typically JSON with attached media).
• Right to object — object to processing based on legitimate interests (including direct marketing and AI Insights profiling).
• Right to withdraw consent — for any processing based on your consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to solely automated decision-making producing legal or similarly significant effects (we do not engage in such decision-making — see Section 4.3).
• Right to lodge a complaint with your local data-protection authority (see Section 17).
• Right to opt out of "sale" or "sharing" of Personal Information for cross-context behavioral advertising (we do not sell or share — see Section 8.5).
• Right to limit use of Sensitive Personal Information to specified purposes.
• Right to non-discrimination — we will not discriminate against you for exercising any privacy right.

11.2 How to exercise your rights

You can exercise most rights from the in-app Privacy Center: Settings > Privacy. Specifically:

• Access & export: Settings > Privacy > Export My Data — receive a structured export within 30 days of a verified request.
• Correction: in-line edits in your Profile and Family member screens.
• Deletion: Settings > Privacy > Close Account — starts the soft-delete window described in Section 10.
• Opt out of AI improvement: Settings > Privacy > AI Improvement (where available).
• Opt out of marketing email: any unsubscribe link, or Settings > Notifications > Marketing Emails.
• Object to AI Insights: Settings > AI Insights > Disable.

Alternatively, email [email protected] from your verified Account email with the subject line "Privacy Request" and a description of what you want. Parents acting on behalf of a Child Profile should use the subject line "Child Profile Request" and include the child's profile name.

11.3 Authorized agents

You may use an authorized agent to submit requests on your behalf where allowed by law (for example CCPA/CPRA). We may verify the agent's authority and your identity before responding. Submit agent designations via [email protected] with documentation.

11.4 Verification

To prevent fraudulent requests, we will verify the requester's identity in proportion to the sensitivity of the request and the risk of harm from unauthorized disclosure. For most requests, replying from your verified Account email is sufficient. For higher-sensitivity requests (full export, full deletion, child-data requests), we may ask for additional verification (for example, confirming a recent in-app action, a payment method on file, or a one-time code).

11.5 Response time and cost

We will respond to your request without undue delay and generally within 30 calendar days of a verified request, as required by applicable law. We may extend this period by up to 60 additional days for complex or voluminous requests and will let you know if we do. Response timelines may be extended due to events beyond our reasonable control (natural disaster, infrastructure outage, etc.) consistent with applicable law's allowances. Your first request in any 12-month period is free; we reserve the right to charge a reasonable administrative fee — typically not more than US$25 per additional request — for manifestly unfounded, excessive, or repetitive requests where the law allows.

11.6 Appeals

If we decline a request you believe is valid, we will explain our reasons. You may appeal by replying to our response with the words "I appeal" — appeals are reviewed by a different team member and answered within 60 days. If the appeal is also declined, you may submit a complaint to your local data-protection authority or attorney general (see Section 17) — we will provide their contact details on request.

11.7 Universal Opt-Out / Global Privacy Control (GPC)

We honor browser-based Universal Opt-Out signals (including the Global Privacy Control / "Sec-GPC" header) on our website where applicable, treating them as an opt-out of "sale" and "sharing" under California, Colorado, Connecticut, and other applicable laws.

12. Marketing Communications

12.1 What we send

We send two kinds of email:

• Transactional / Service email — account verification, password reset, family invitations, billing receipts, security alerts, important Service updates, and other emails necessary to operate the Service. You cannot opt out of these while you are using the Service, but you can close your Account.
• Marketing email — newsletters, product updates, tips, and occasional promotional offers. Marketing email is opt-in where required by law (for example a double opt-in in the EU/UK and Canada), and always includes an unsubscribe link.

12.2 Pre-Account email

If you provide your email outside the in-app sign-up (for example to subscribe to our newsletter or contact us about the product), we will use that address only for the purpose you provided it for. Subscribing to the newsletter does not create an Account and does not subscribe you to other lists.

12.3 Compliance frameworks

Our marketing email practices comply with the US CAN-SPAM Act, Canada's Anti-Spam Legislation (CASL), the UK Privacy and Electronic Communications Regulations (PECR), the EU ePrivacy Directive, the Australian Spam Act 2003, and equivalent laws.

12.4 Push notifications

We send push notifications (where you grant permission) for transactional purposes — calendar reminders, family-activity updates, AI response readiness, family-circle invitations, payment-grace reminders, and security alerts. We do not send marketing push notifications. Push notifications about a Child Profile are routed only to the Parent's Account.

12.5 SMS and phone

We do not currently send marketing SMS. If we add SMS in the future, we will obtain explicit opt-in consent and comply with the US Telephone Consumer Protection Act (TCPA), CASL, and equivalent laws.

13. Cookies, Tracking & Analytics

13.1 On the Family Odyssey website

Our website uses the following cookie and client-side storage categories:

• Strictly necessary storage — required to provide the website (session cookies, authentication, CSRF tokens, and a small localStorage entry recording your cookie-consent choice so we don't ask again). No consent required, since this storage is needed to remember your consent decision and to deliver the service you requested.
• Functional cookies — remember your preferences (language, theme). Set with your consent where required by law.
• Analytics cookies — help us understand how the website is used. We use Microsoft Clarity for anonymous session replays and heatmaps (full details in Section 13.1.1 below). No cross-site advertising tracking. Set only after your explicit consent.
• Advertising cookies — we do not use advertising cookies or third-party advertising trackers.

We display a cookie banner to every visitor — not only those in the EU or UK — and load analytics cookies only if you affirmatively accept. You can change your mind at any time via the "Change your mind" link in the website footer, or through your browser's cookie controls. We honor browser-based "Do Not Track" and Global Privacy Control (GPC) signals as automatic opt-outs of non-essential cookies — if your browser sends GPC, our consent banner does not appear and Microsoft Clarity will not load.

13.1.1 Microsoft Clarity

We partner with Microsoft Clarity, a behavioral analytics service from Microsoft Corporation, to learn how visitors use our marketing website. Clarity is used only on the marketing website (familyodyssey.ai); we do not run Clarity inside the mobile apps.

What Clarity records (anonymously):

• Mouse movements, clicks, taps, scroll depth, and navigation between pages on our website;
• A session replay — a video-like reconstruction of how the visitor moved through the page, with sensitive form fields automatically masked at the source so passwords, names, addresses, and similar data are never captured;
• Browser type, operating system, screen size, and approximate city-level location derived from your IP address (not your device GPS).

What Clarity does not see:

• Anything you type into form fields (passwords, names, addresses, payment info — all masked before transmission);
• Activity on other websites — Clarity does not follow you across the web;
• Any direct identifier linking the recorded session to your real identity.

Clarity sets two cookies on our domain after you consent: _clck (12 months, anonymous Clarity user identifier) and _clsk (1 day, current-session continuation). Microsoft may also set MUID (up to ~13 months, Microsoft's cross-property identifier) on its own domain.

Your control:

• Clarity loads only after you click "Yes, that's fine" on our cookie banner;
• If you click "No thanks," Clarity is never loaded and no Clarity cookies are set;
• If you previously accepted and want to withdraw consent, click the "Change your mind" link in the website footer — we tear down Clarity (cancelling the active session and removing the script) and stop tracking immediately;
• If your browser sends a Global Privacy Control (GPC) signal, we treat it as an automatic decline and Clarity never loads.

Microsoft as an independent controller: Microsoft acts as an independent data controller for the data Clarity collects, not as a subprocessor of Family Odyssey. Microsoft uses the data to operate and improve Clarity in accordance with the Microsoft Privacy Statement. Data may be transferred to and processed in the United States and at Microsoft's European facilities (Microsoft Ireland Operations Ltd., Dublin).

13.2 In the mobile app

The mobile app does not use traditional web cookies but does use SDK identifiers for analytics and crash reporting (see Section 8.2). We do not use SDKs that perform "tracking" as defined under Apple's App Tracking Transparency framework, and we do not request the ATT permission prompt — that is, we do not show you the iOS "Allow this app to track your activity?" popup, because we do not track you across other apps or websites. We do not pass identifiers to advertising networks.

13.2.1 PostHog (mobile-app product analytics)

To learn how families actually use the mobile app — and to find places where the app is confusing or broken — we use PostHog, a product-analytics service from PostHog Inc. PostHog is used only inside the mobile app; it does not run on our marketing website (Microsoft Clarity covers the website, see Section 13.1.1).

What PostHog records:

• Anonymous user identifiers (your Family Odyssey user UUID — not your name or email);
• Screen views (which screens you visit, in what order);
• A small set of "activation events" we use to measure onboarding success: completing signup, sending a circle invitation, creating your first calendar event, sending your first AI chat message, and receiving your first AI Insight;
• Aggregate timing data (how long actions take, whether errors occurred);
• Device type and OS version (for compatibility debugging).

What PostHog does not record:

• The contents of your form fields, calendar event details, photos, todo-list items, or AI chat messages;
• Child Profile data;
• Your precise GPS location;
• Any cross-app or cross-website identifiers;
• Your name, email address, or other directly-identifying personal information.

Your control:

• Default: ON for US and most other regions; OFF for users in the EU, UK, and EEA (detected via your device's timezone setting at first launch).
• Settings toggle: Open the app → Settings → "Your privacy" → "Help improve Family Odyssey". Toggle ON or OFF anytime; your choice persists across launches.
• If you turn it off, PostHog stops collecting data immediately. No app functionality is affected.

PostHog acts as a processor on our behalf under a Data Processing Addendum. Data is stored in PostHog's US Cloud (Oregon, USA). For details, see the PostHog Privacy Policy.

13.3 Pixels in marketing email

Our marketing emails may include a tracking pixel that records whether the email was opened and which links were clicked. We use this only to measure aggregate engagement and to suppress sending more email to addresses that consistently bounce or flag as spam. You can disable image loading in your email client to block the pixel.

14. Security & Breach Notification

14.1 Our security program

We maintain a written information-security program and apply industry-standard administrative, technical, and physical safeguards to protect Personal Information. Specifically:

• Encryption in transit — TLS 1.2+ for all client connections;
• Encryption at rest — AES-256 (or stronger) on database storage and on object storage of photos and media;
• Hashed credentials — passwords stored using bcrypt (and PBKDF2 for child-specific paths) with per-user salts;
• Access controls — role-based access for personnel, with least-privilege defaults and multi-factor authentication on administrative consoles;
• Network controls — Cloudflare-protected edge, restricted ingress to backend services, internal admin behind Cloudflare Access;
• Logging and monitoring — security and access logs retained per Section 10;
• Vendor diligence — Subprocessors (Section 8.2) sign DPAs and complete security questionnaires before onboarding;
• Annual review — the program is reviewed at least annually by a designated security lead;
• Children's-data security program — supplemental controls per COPPA § 312.8 (see Section 6.12);
• Responsible disclosure — we welcome good-faith security research; see Terms § 9.1 for our safe-harbor policy.

No internet-connected service can be made completely secure, and we cannot guarantee absolute security. We recommend you choose a strong, unique password, enable two-factor authentication where available, and notify us promptly at [email protected] if you suspect unauthorized access to your Account.

14.2 Breach notification

If we become aware of a personal-data breach affecting your Personal Information, we will:

• Notify the appropriate supervisory authorities without undue delay and within the time required by law (for GDPR, within 72 hours where feasible; for state and federal US breach laws, within their statutory windows);
• Notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms, including a description of the nature of the breach, contact details, likely consequences, and the measures we are taking;
• Notify the FTC, state attorneys general, NCMEC, and other authorities where required by US 18 U.S.C. § 2258A, the CCPA, COPPA, the Gramm-Leach-Bliley Act (where applicable), or specific state breach-notification statutes;
• Notify the EU/UK supervisory authority (or all relevant authorities for cross-border breaches) per GDPR Articles 33–34, the LGPD per Article 48, Quebec Law 25 § 3.5, India DPDPA, and equivalent laws.

15. Apple App Store & Google Play Disclosures

15.1 Apple App Store Privacy Nutrition Labels

The data Family Odyssey collects, as represented to Apple in the App Store Privacy Nutrition Label, aligns with this Policy. Specifically:

• We collect, in linked form, the categories described in Section 3 (Contact Info, Location, User Content, Identifiers, Purchases, Usage Data, Diagnostics, and limited Sensitive Info such as family-relationship data and child age);
• We do not collect, in any form: Health & Fitness data, Financial Info beyond purchase status, Browsing History outside the Service, Search History outside the Service, or contact lists from your device;
• We do not perform "tracking" as defined by Apple's App Tracking Transparency framework, and we do not pass identifiers to advertising networks. We declare "Data Not Used to Track You" across all data types.

15.2 Sign in with Apple

If you sign in with Apple, we receive a stable user identifier and (depending on your election) your name and an Apple-provided email address (which may be a private relay address). We do not contact Apple's relay address for marketing without your separate opt-in.

15.3 Apple Designed for Families / Kids Category

Family Odyssey is rated 9+ on the App Store and is designed for use within a family context. If we enroll in Apple's Designed for Families program or the Kids Category in the future, additional restrictions on third-party SDKs and analytics will apply, and we will update this Policy accordingly.

15.4 Google Play Data Safety

The data Family Odyssey collects, as represented to Google in the Play Console Data Safety form, aligns with this Policy. Specifically:

• Data collected: identifiers, contacts (only family invitee email addresses you provide), location (approximate, plus precise only with affirmative permission for opted-in features), photos (uploaded by you), audio (microphone, only with affirmative permission), files and documents (uploaded by you), calendar (with OAuth/permission), app activity, app info and performance, device or other identifiers;
• Data shared: with Subprocessors only as described in Section 8 — never for advertising;
• Security practices: encryption in transit and at rest; user can request deletion in-app or by email; data deleted within 90 days of closure;
• COPPA / Families Policy: we comply with COPPA and the Google Play Families Policy where applicable; Family Odyssey supports parent-managed Child Profiles only.

15.5 Google Play Families Policy & Designed for Families

Where we participate in the Google Play Designed for Families program, additional restrictions on advertising SDKs and analytics apply, and we comply with Google Play's Families Policy.

16. Changes to This Policy

We may update this Policy as the Service evolves, as laws change, or as our practices change. The "Effective Date" at the top of the document reflects the date of the most recent material update.

For material changes, we will provide reasonable advance notice — generally 30 days where feasible — before the change takes effect, via in-app banner, push notification, and email to your Account email address. For non-material changes (clarifications, formatting, contact updates), we will update the document and refresh the version number without separate notice. If a feature requires faster rollout for safety, security, or legal compliance, we may modify this Policy on shorter notice with prompt notification.

If you do not agree with a material change, you may close your Account before the change takes effect (Section 10). Continued use of the Service after the effective date constitutes acceptance of the updated Policy. We will keep prior versions of this Policy available on request to [email protected].

17. Contact, Complaints & Privacy Center

17.1 Privacy contact and Privacy Officer

• Provider / Data Controller: TNSE Trading LLC, a single-member Ohio limited liability company
• Mail: 620 Keltonhurst Dr, Pataskala, OH 43062, USA
• Email: [email protected] (subject lines: "Privacy", "Privacy Request", "Child Profile Request", "AI Incident", "Minor Safety Report", "Service Credit", "Transfer Safeguards Request" as appropriate)
• Privacy Officer: Teng Zhang, the principal of TNSE Trading LLC, serves as our Privacy Officer and as the designated contact for privacy and data-protection inquiries (including for Quebec Law 25, Brazil LGPD Encarregado, and India DPDPA Grievance-Officer requirements where applicable). Reach the Privacy Officer at the email above.

Family Odyssey is operated by a small team. If a more formal Data Protection Officer is required by law as the Service grows, we will appoint one and update this Policy.

17.2 EU representative (Article 27)

Where required by GDPR Article 27, we will appoint and publish a representative in the European Union; until that designation is finalized, EU users may contact us at the email above and may also lodge a complaint with their national supervisory authority (see Section 17.5).

17.3 UK representative (UK GDPR Article 27)

Where required, we will appoint and publish a UK representative; until then, UK users may contact us at the email above and may lodge a complaint with the UK Information Commissioner's Office.

17.4 Quebec privacy officer (Law 25)

Quebec users may contact our privacy officer at the email above (subject "Quebec — Law 25") and may lodge a complaint with the Commission d'accès à l'information du Québec.

17.5 Right to lodge a complaint with a supervisory authority

You may always lodge a complaint with your local data-protection authority. Examples:

• EU: the supervisory authority of your member state of residence — see edpb.europa.eu/about-edpb/about-edpb/members
• UK: Information Commissioner's Office — ico.org.uk/make-a-complaint
• California (CCPA/CPRA): California Privacy Protection Agency / Attorney General — oag.ca.gov/privacy
• Quebec: Commission d'accès à l'information du Québec — cai.gouv.qc.ca
• Canada (federal): Office of the Privacy Commissioner of Canada — priv.gc.ca
• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• Brazil: Autoridade Nacional de Proteção de Dados — gov.br/anpd
• India: Data Protection Board of India
• Texas: Office of the Texas Attorney General — texasattorneygeneral.gov/consumer-protection

17.6 Privacy Center

Our in-app Privacy Center (Settings > Privacy) provides one-tap access to:

• Your Personal Information (review and edit);
• Data export;
• Account closure / soft-delete restoration;
• AI Improvement opt-out;
• AI Insights enable/disable;
• Marketing communication preferences;
• Cookie preferences (web);
• Universal Opt-Out / Global Privacy Control honoring;
• Child Profile management (for Parents);
• Subprocessor list (linked to this Policy);
• Privacy contact form.

18. Privacy Impact Assessments & Governance

18.1 Data Protection Impact Assessments

Where required by GDPR Art. 35, the UK GDPR, the UK Children's Code, the California Age-Appropriate Design Code, the Maryland Kids Code, the Colorado Privacy Act, or equivalent laws, we conduct Data Protection Impact Assessments (DPIAs). The processing activities most likely to require a DPIA include: (a) systematic processing of children's data through Child Profiles; (b) AI-driven inferences about families through AI Insights; (c) any new feature involving precise geolocation, voice, or photo analysis. DPIAs are overseen by our Privacy Officer and updated as features evolve.

18.2 Records of processing

Where required by GDPR Art. 30 or equivalent laws, we maintain records of our processing activities — covering each purpose, the categories of data, recipients, transfers, retention, and safeguards — and we will make them available to supervisory authorities on lawful request, consistent with the timelines set by applicable law.

18.3 Privacy by design and by default

We apply privacy-by-design and privacy-by-default principles (GDPR Art. 25): default settings favor privacy (location off for Child Profiles, no behavioral advertising, no facial recognition); we collect only what we need for the feature you invoked; we apply pseudonymization and aliasing where feasible (Section 5.1); and we run feature reviews to flag privacy implications before launch.

18.4 Vendor management

Each Subprocessor (Section 8.2) is subject to written data-processing terms, security and privacy due diligence, and ongoing review. We do not engage Subprocessors that cannot demonstrate appropriate technical and organizational measures.

18.5 Training and accountability

Personnel with access to Personal Information are subject to confidentiality obligations and receive privacy and security training appropriate to their role. Our Privacy Officer is accountable for this Policy and for our compliance with applicable privacy laws.

18.6 Privacy Policy operative provisions

The following operative provisions apply to this Policy in addition to those incorporated from the Terms of Use under Section 1.1:

• Severability. If any provision of this Policy or any Appendix is held invalid or unenforceable by a court of competent jurisdiction, the remaining provisions remain in full force and effect, and the invalid provision will be construed as narrowly as necessary to preserve the rest of the Policy.
• Force majeure (privacy operations). The response timelines in this Policy (including Section 11.5 and the Appendices) may be extended due to events beyond our reasonable control — including outages of infrastructure providers, cyber-incidents, government action, or natural disasters — consistent with the allowances permitted by applicable law.
• Governing law for the Policy itself. Subject to the local-law carve-outs (Section 16 of the Terms and the Appendices), this Policy is governed by the laws of the State of Ohio, United States, without regard to conflict-of-law principles. Where local law requires the application of its own privacy framework, that local law applies to your relationship with us.
• No waiver. Our delay or failure to enforce any right under this Policy is not a waiver of that right or of any other right.
• No third-party beneficiaries. Except where mandatory privacy law gives a person rights as a data subject, this Policy creates no third-party beneficiary rights, and no person other than the parties to the Terms of Use may enforce any provision.
• Headings. Section and sub-section headings are for convenience only and do not affect the interpretation of this Policy.
• Assignment and successors in interest. If we assign or transfer this Policy in connection with a merger, acquisition, asset sale, financing, restructuring, bankruptcy, or similar transaction (Section 8.1), the successor entity will assume the rights and obligations of this Policy on the same terms; your continued use of the Service after notice of the transition constitutes acknowledgment, subject to your rights to object or close your Account under applicable law.
• Subprocessor changes — your remedy. Where required by GDPR Art. 28(2) or equivalent law, we provide reasonable advance notice of material changes to Subprocessors that handle Personal Information. Where you object to a change, your remedy is to close your Account under Section 10; we are not obligated to halt the Subprocessor change for a single objector.
• Subprocessor SCCs and DPAs. Where required by law, we put in place Standard Contractual Clauses or equivalent transfer mechanisms and execute Data Processing Addenda with Subprocessors that handle Personal Information. We update Subprocessor relationships as needed; the current list is in Section 8.2.
• Language. The English-language version of this Policy is the controlling version. Where we provide translations, the translation is for convenience; in case of conflict between the English and a translated version, the English version governs (subject to mandatory consumer-language laws in your jurisdiction).