Privacy Policy

Data Controller

CACAO MOBILE SPOLKA Z OGRANICZONA ODPOWIEDZIALNOSCIA is the data controller responsible for your personal data. For privacy-related inquiries, contact us at support@airshow.dev.

Data We Collect

We may collect the following categories of personal data:

• Account data: name, email address, username, and password (hashed).
• Payment data: billing address and transaction records. Full card details are processed by our payment provider (Stripe) and not stored by us.
• Usage data: pages visited, features used, session duration, device type, browser, and IP address.
• Health data: heart rate, HRV, stress, and rhythm stability measurements, measurement history, and data you choose to sync from Apple Health or Apple Watch.
• Communications: messages you send to our support team.

Third-Party AI Processing

To provide certain features, we share the following data with third-party AI service providers acting as our data processors:

• OpenAI — receives your chat messages and health profile data (gender, age, height, weight, goal type, and desired pace of achieving your goal) and your heart rate, HRV, and stress measurements to generate personalized wellness recommendations. Per OpenAI’s API data usage policy, this data is not used to train OpenAI’s models by default and is retained short-term (up to 30 days) for abuse-monitoring purposes.

These providers are contractually restricted from using your data for any purpose other than delivering the requested output to us.

How We Use Your Data

We use your personal data to:

• Provide, operate, and improve the Service.
• Process payments and manage subscriptions.
• Verify eligibility and enforce our Terms of Service.
• Communicate with you about your account, updates, and support requests.
• Detect and prevent fraud, abuse, and violations of our Terms of Service.
• Comply with applicable legal obligations.

Legal Bases for Processing (GDPR)

If you are located in the EU/EEA, we process your data on the following legal bases:

• Contract performance: processing necessary to provide the Service.
• Legitimate interests: fraud prevention, security, and service improvement.
• Legal obligation: compliance with applicable laws.
• Consent: where you have given explicit consent (e.g., marketing emails).

Where we process health-related data (e.g., heart rate, HRV, stress measurements, weight, height, age, gender, and wellness goals) to generate AI-powered wellness recommendations, we rely on your explicit consent (Art. 9(2)(a) GDPR), which you provide when you enter this information into the Service. You may withdraw this consent at any time by deleting this data from your profile or by contacting us at support@airshow.dev.

Sharing of Data

We do not sell your personal data. We may share it with:

• Service providers: payment processors (Stripe), hosting providers, analytics, and customer support tools, under strict data processing agreements.
• Law enforcement: when required by law or to protect our legal rights.
• Business transfers: in the event of a merger, acquisition, or asset sale, subject to continued privacy protections.

Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. After account deletion, we may retain certain data for up to 90 days for backup and legal compliance purposes, after which it is permanently deleted.

Data shared with third-party AI providers (OpenAI) is retained according to their respective data retention policies, which are generally shorter-term and used only for abuse-monitoring or service-delivery purposes. Refer to the Third-Party AI Processing section above for details.

Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Object to or restrict certain processing activities.
• Request data portability.
• Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, contact us at support@airshow.dev. We will respond within 10 days.

Automated Decision-Making

The Service uses automated processing, including AI, to generate personalized wellness recommendations based on the data you provide. This processing does not produce legal or similarly significant effects concerning you, and you are free to disregard, modify, or ignore any AI-generated recommendation. You may request human review of how your data is used to generate recommendations by contacting support@airshow.dev.

Cookies

We use cookies and similar tracking technologies to operate and improve the Service, remember your preferences, and analyze usage. You can control cookies through your browser settings.

Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), hashed password storage, and access controls. No method of transmission is 100% secure; we cannot guarantee absolute security.

International Transfers

Your data may be processed outside your country of residence. Where we transfer data internationally, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses for EU data).

Children’s Privacy

The Service is not directed to individuals under 18 years of age, and we do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.

California Privacy Rights

If you are a California resident, you may have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and limit the use of your Sensitive Personal Information (which may include health-related data you provide). To exercise these rights, contact support@airshow.dev. We do not sell or share personal information as defined by the CCPA.

Changes to This Notice

We may update this Privacy Notice periodically. We will notify you of material changes by email or via a prominent notice on the Service. Continued use after changes constitutes acceptance.

Contact

For privacy questions or complaints, contact us at: support@airshow.dev