Privacy Policy

1. INTRODUCTION

Thank you for choosing Endeavorise AB's habit tracking application ("App"). At Endeavorise AB ("we," "us," or "our"), we are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

This Privacy Policy is designed to comply with relevant data protection regulations, including the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. WHO WE ARE

Endeavorise AB is a company registered in Sweden. We are the data controller responsible for your personal data.

Contact information:

• Email: info@endeavorise.com

3. INFORMATION WE COLLECT

We collect the following types of information:

3.1 Personal Information You Provide

• Account Information: First and last name, email address, and phone number (for registration and authentication purposes)
• Profile Information: Profile images (optional)
• Habit Data: Information related to your habits, including responses to reassurance questions and habit completion records
• Accountability Information: Phone numbers of accountability partners, accountability contract images

3.2 Information Automatically Collected

• Usage Data: Information about how you use the App, including timestamps, app interactions, and feature usage
• Device Information: Device type, operating system, unique device identifiers, and IP address
• Log Data: Error reports, crash logs, and performance data

3.3 Affiliate Program Information

If you apply to or participate in our affiliate program, we collect additional personal data needed to evaluate your application, calculate commissions, and comply with global tax rules.

• Payout & Verification Data: Legal name, street address, city, postal code, country, phone number, and government-issued tax identifiers (for example VAT/Tax ID, SSN, or TIN equivalents depending on your jurisdiction)
• Payment Details: PayPal email or other payout credentials you provide so we can send commissions
• Marketing & Performance Data: Links to channels you submit, content metrics (clicks, conversions, promo code usage), and fraud-screening flags tied to your account
• Compliance Records: Copies of forms or attestations required under DAC7, KU81, IRS, or similar regulations, plus communications about verification requests

3.4 Google Sign-In

If you choose Google Sign-In, we receive your Google account identifier, name, email address, and profile picture, when available, through Google and Firebase to authenticate you and create your Endeavorise account and profile. We store account and profile information in Firebase.

We use and share this information as described in Sections 4 and 6, including sharing a hashed version of your account email with AppsFlyer for advertising attribution.

This sign-in does not request access to your Gmail, Google Drive, or Google Calendar data.

4. HOW WE USE YOUR INFORMATION

We use your information for the following purposes:

• To Provide Our Services: Enabling you to track habits, set goals, and connect with accountability partners
• To Personalize Your Experience: Customizing content and recommendations based on your habits and preferences
• To Improve Our Services: Analyzing usage patterns to enhance functionality and user experience
• To Communicate With You: Sending notifications, updates, and responding to your inquiries
• To Ensure Security: Preventing fraud, unauthorized access, and maintaining the integrity of our App
• To Provide AI-Powered Features: We may use your habit data and interactions to provide personalized AI coaching and insights to help you improve your habits and achieve your goals

5. LEGAL BASIS FOR PROCESSING (GDPR)

Under GDPR, we process your personal data based on the following legal grounds:

• Contractual Necessity: Processing necessary to provide our services as requested
• Consent: Where you have given explicit consent for specific purposes
• Legitimate Interests: Where processing is in our legitimate interests and not overridden by your rights and freedoms
• Legal Obligation: Where processing is necessary to comply with a legal obligation

6. DATA SHARING AND DISCLOSURE

We may share your information with:

• Service Providers: Third-party vendors who assist us in providing our services, including Firebase (data storage, authentication), AppsFlyer (attribution tracking), RevenueCat (subscription management), TikTok (advertising attribution), and Meta/Facebook (advertising attribution)
• Payment & Payout Partners: PayPal Payouts, banks, and compliance/KYC vendors who help us send affiliate commissions, detect fraud, and satisfy reporting requirements

6.1 Advertising Attribution Partners

We use AppsFlyer for mobile attribution to measure advertising campaign performance. AppsFlyer receives:

• A unique app-scoped user identifier (your Firebase UID, not your name or email address)
• A cryptographically hashed (SHA-256) version of your email address for privacy-safe matching across platforms
• Device information including device model, operating system, IP address, and device identifiers (IDFV on iOS, GAID on Android)
• In-app purchase events and revenue amounts to measure campaign return on investment

This data helps us understand which marketing campaigns are effective, allowing us to improve our advertising and reduce wasted marketing spend. AppsFlyer's data practices are governed by their Privacy Policy at https://www.appsflyer.com/legal/privacy-policy/

The email hashing process is one-way and cannot be reversed to reveal your actual email address, but it enables us to measure campaign effectiveness while protecting your privacy.

• Accountability Partners: Limited information shared with partners you designate through the accountability feature
• Legal Requirements: When required by applicable law, legal process, or government requests
• Business Transfers: In connection with a merger, acquisition, or sale of assets

6.2 AI & Automation Vendors

We use artificial intelligence services (currently xAI’s Grok API and similar EU-compliant providers) to power habit coaching, summarise support tickets, and detect spam. When you interact with these features we may transmit the text you enter, relevant habit context (for example tag names or streak counts), and anonymised identifiers so the vendor can return a response. These vendors process your data under strict contractual safeguards, do not receive your plaintext password, and are only allowed to use the data to provide the requested service. AI data sharing is off by default, and you must opt in from the AI Coach settings to allow us to send prompts with the personal context described above. If you turn sharing off, we still send generic coach queries to the Grok API but strip out your name, email, habit notes, and any other personal data so only anonymized system text is processed.

We do not sell your personal data to third parties.

7. DATA RETENTION

We retain your personal data for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. Affiliate payout and tax records are retained for at least seven (7) years to comply with Swedish bookkeeping rules, DAC7/KU81 obligations, and other tax regimes. When determining retention periods, we consider:

• The amount, nature, and sensitivity of the personal data
• The potential risk of harm from unauthorized use or disclosure
• The purposes for which we process the data
• Whether we can achieve those purposes through other means
• Legal and regulatory requirements

8. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of personal data
• Secure Firebase Firestore rules and authentication
• Regular security assessments
• Access controls and authentication procedures

Despite our efforts, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. YOUR RIGHTS

Depending on your location, you may have certain rights regarding your personal data:

9.1 GDPR Rights (EU/EEA Residents)

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw previously given consent

9.2 CCPA Rights (California Residents)

• Right to Know: Request information about personal information collected, disclosed, or sold
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt-out of the sale of personal information
• Right to Non-Discrimination: Receive equal service and pricing even if you exercise your privacy rights

10. HOW TO EXERCISE YOUR RIGHTS

To exercise your data protection rights:

• Email us at info@endeavorise.com
• Email us at info@endeavorise.com

We will respond to your request within 30 days. We may need to verify your identity before fulfilling your request.

11. INTERNATIONAL DATA TRANSFERS

As a Swedish company, your data is primarily stored and processed in the European Union. However, we may transfer data to service providers in other countries. When transferring data outside the EU/EEA, we ensure appropriate safeguards are in place through:

• EU Standard Contractual Clauses
• Adequacy decisions by the European Commission
• Binding Corporate Rules
• Other legally approved mechanisms

12. CHILDREN'S PRIVACY

Our App is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will delete such information.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last Updated" date. We encourage you to review this Privacy Policy periodically.

If we make material changes, we will notify you through the App or by email prior to the changes becoming effective.

14. COOKIES AND TRACKING TECHNOLOGIES

Our App may use cookies or similar tracking technologies to enhance user experience and collect information about how the App is used. These technologies may collect information such as your device type, browser type, time spent on the App, pages visited, and other anonymized tracking information.

15. THIRD-PARTY LINKS AND SERVICES

Our App may contain links to third-party websites or services that are not owned or controlled by Endeavorise AB. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services. We encourage you to review the privacy policies of any third-party services you access.

16. CONTACT US

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

• Email: info@endeavorise.com

17. COMPLAINTS

If you are concerned about how we handle your personal data, please contact us first. If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish Data Protection Authority (Datainspektionen) at https://www.datainspektionen.se, as we are a Swedish company subject to Swedish data protection laws.