Privacy Policy

1. Introduction

This Privacy Policy describes how Aureli Labs LLC ("Aureli," "we," "us," or "our"), a Wyoming limited liability company, collects, uses, discloses, and protects your personal information when you use the Aureli mobile application (the "App"), our website, and any related services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this policy, please do not use our Services.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you create an account (via Google or Firebase Authentication), we collect your name, email address, date of birth or age, and profile information.
• Health & Fitness Data: Information you provide about your face yoga progress, skincare routines, self-care goals, skin type, and any related health or wellness data you choose to share.
• Face Photos & Biometric Data: If you use our face scanning features, we collect facial photographs that you upload or capture. These photos may be processed to generate biometric data such as facial measurements and skin analysis. See Section 5 for specific protections.
• Payment Information: When you purchase a subscription or make a one-time purchase, payment is processed by Apple (App Store), Google (Play Store), or Paddle (website purchases). We do not directly collect or store your credit card numbers or bank account details. We receive transaction confirmation data including purchase dates, amounts, and subscription status.
• Communications: When you contact our support team or provide feedback, we collect the content of those communications.
• User Content: Photos, notes, feedback, or other content you voluntarily upload or submit through the Services.

2.2 Information Collected Automatically

• Usage Data: How you interact with the App, including features used, content viewed, exercises completed, session duration, and in-app actions.
• Device Information: Device type, operating system and version, unique device identifiers (e.g., IDFA, IDFV, Android Advertising ID), device model, language settings, and time zone.
• Log Data: IP address, browser type (for web access), access times, referring URLs, and error logs.
• Cookies & Tracking Technologies: We use cookies, pixels, SDKs, and similar technologies to collect usage data and support advertising. See Section 8 for details.

2.3 Information from Third Parties

• Health Platforms: If you connect Apple HealthKit or Android Health Connect, we may read activity data, step counts, and other health metrics you authorize. We only access data categories you explicitly grant permission for. See Section 5.
• Advertising Partners: We may receive information from ad networks about how you interacted with our advertisements on other platforms.
• Analytics Providers: We receive aggregated and individual usage analytics from our third-party analytics providers.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide & Improve Services: To deliver personalized face yoga programs, skincare routines, progress tracking, and app functionality; to develop new features and improve existing ones.
• AI-Powered Features: To power AI-generated recommendations, skin analysis, and other intelligent features within the App. See Section 4.
• Personalization: To tailor content, exercises, and routines to your profile, goals, and progress.
• Analytics: To understand how users interact with the Services, measure feature performance, and inform product decisions.
• Advertising: To deliver, measure, and improve advertisements for Aureli on third-party platforms. We do not use health or biometric data for advertising purposes.
• Communications: To send you service-related messages, respond to support requests, and with your consent, promotional communications.
• Legal & Safety: To comply with legal obligations, enforce our Terms of Use, protect against fraud, and ensure the security of our Services.

4. AI Features & Data Processing

Aureli uses artificial intelligence powered by Google AI models to provide personalized recommendations, skin analysis, and other intelligent features. When you use AI-powered features:

• Your relevant data (such as profile information, preferences, and uploaded content) may be processed by our AI systems to generate personalized outputs.
• Your personal data is not used to train third-party AI models. Any data sent to AI service providers is processed solely to deliver functionality to you.
• AI outputs are generated algorithmically and may contain inaccuracies. They are provided for informational purposes only and should not be considered medical, dermatological, or professional advice.
• We may use de-identified and aggregated data from AI interactions to improve the quality and accuracy of our features.

5. Health, Biometric & Face Photo Data Protections

We treat your health, biometric, and face photo data with the highest level of care:

• Never Used for Advertising: Health data, biometric data, face photos, and data from Apple HealthKit or Android Health Connect are never used for advertising, marketing, or sold to third parties.
• Face Photo Handling: Facial photographs uploaded for skin analysis are automatically deleted from our servers after processing is complete, unless you provide explicit consent for us to retain them for a limited period to improve our analysis algorithms. You may withdraw this consent at any time.
• Health Platform Data:Data imported from Apple HealthKit or Android Health Connect is used solely to enhance your in-app experience (e.g., correlating activity data with your wellness goals). You control which data categories are shared and can revoke access at any time through your device's health app settings.
• Biometric Data: Where applicable law treats facial geometry or skin analysis data as biometric data, we process such data only with your informed consent and in accordance with applicable biometric privacy laws.

6. How We Share Your Information

We do not sell your personal information for monetary consideration. We may share your information in the following circumstances:

• Service Providers: We share data with third-party vendors who help us operate, maintain, and improve the Services (see Section 7). These providers are contractually obligated to protect your data and use it only for the purposes we specify.
• Advertising Partners:We may share device identifiers and usage data (but never health or biometric data) with advertising platforms to measure and optimize our ad campaigns. This may constitute a "sale" or "share" under certain US state privacy laws. See Section 10 for opt-out rights.
• Legal Requirements: We may disclose information when required by law, subpoena, court order, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction.
• With Your Consent: We may share information for other purposes when you provide specific consent.

7. Third-Party Services

We use the following categories of third-party services to operate and improve Aureli:

Each of these providers operates under their own privacy policies. We encourage you to review their respective policies. We enter into data processing agreements with our service providers to ensure your data is handled appropriately.

8. Cookies & Tracking Technologies

We use cookies, web beacons, pixels, and mobile SDKs to collect information and support our Services:

• Essential Cookies: Required for authentication, security, and core functionality.
• Analytics Cookies & SDKs: Used by Google Analytics, Amplitude, and similar tools to measure usage patterns, feature performance, and user engagement.
• Advertising Cookies & Pixels: Used by Meta, Google Ads, Apple Search Ads, and AppsFlyer to measure ad conversions, attribute installs, and deliver relevant advertisements.

Your choices:You can manage cookie preferences through your browser settings. On mobile devices, you can limit ad tracking through your device's privacy settings (e.g., "Limit Ad Tracking" on iOS or "Opt out of Ads Personalization" on Android). You may also opt out of interest-based advertising through the Digital Advertising Alliance (DAA) at optout.aboutads.info or the Network Advertising Initiative (NAI) at optout.networkadvertising.org. To opt out of Google Analytics specifically, visit tools.google.com/dlpage/gaoptout.

9. Data Retention

• We retain your personal data for as long as your account is active or as necessary to provide you with our Services.
• If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required for legal compliance, dispute resolution, or enforcement of our agreements. Backup systems may retain copies for up to 90 days before automatic deletion.
• Face photos submitted for analysis are deleted immediately after processing unless you have opted in to temporary retention.
• De-identified and aggregated data may be retained indefinitely for research and service improvement purposes.

10. Your Rights

10.1 European Economic Area, United Kingdom & Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the General Data Protection Regulation:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure:Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit processing of your data.
• Portability: Receive your data in a structured, commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests, including profiling and direct marketing.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

We process your data under the following legal bases: performance of a contract (to provide the Services), legitimate interests (analytics, security, service improvement), consent (health data, marketing communications, face photo retention), and legal obligation. For transfers of data outside the EEA/UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. You have the right to lodge a complaint with your local data protection authority.

10.2 California (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: Request information about the categories and specific pieces of personal information we have collected, the sources, purposes, and third parties with whom we share it.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out:Opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. While we do not sell personal information for monetary consideration, sharing device identifiers with advertising partners may constitute a "sale" or "share" under the CCPA.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at contact@aureli-labs.com. We will respond within the timeframes required by applicable law.

10.3 Other US State Laws

Residents of other US states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, and others) may have similar rights. Please contact us at contact@aureli-labs.com to exercise your rights under applicable state law.

11. Children's Privacy

Our Services are not intended for, and are not directed at, individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at contact@aureli-labs.com and we will promptly delete such information.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. These countries may have data protection laws that differ from those in your jurisdiction. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses (SCCs) for transfers from the EEA/UK and reliance on adequacy decisions where applicable.

13. Data Security

We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit and at rest, access controls, regular security assessments, and secure development practices. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the App, on our website, and/or by sending you an email or in-app notification. The "Last updated" date at the top of this policy indicates when it was last revised. Your continued use of the Services after any changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, or if you wish to exercise any of your privacy rights, please contact us:

• Email: contact@aureli-labs.com
• Entity: Aureli Labs LLC, Wyoming, USA
• Address: 30 N Gould St, Ste N, Sheridan, WY 82801, USA

We will respond to your inquiry within a reasonable timeframe and in accordance with applicable law.