All legal documents

PRIVACY POLICY

Global Data Protection and Privacy Notice

Effective Date: 17 October 2026

Service operated by: DigitalFreedom — a brand of DigitalFreedom Global LLC

Data Controller (legal entity):
DigitalFreedom Global LLC (trading as DigitalFreedom)
30 N Gould St, Ste N
Sheridan, WY 82801
United States

Contact (general): hello@digitalfreedom.co.za
Contact (data protection): data-protection@digitalfreedom.co.za
Data protection request form: https://data-protection.digitalfreedom.co.za
Website: https://digitalfreedom.co.za

0. WHAT THIS POLICY MEANS FOR MACBUSINESSSUITE — APP-SPECIFIC NOTICE

This Privacy Policy is the shared policy of every DigitalFreedom service and describes every processing operation that occurs somewhere in that portfolio. This section states which of them actually occur in MacBusinessSuite, so that the general sections below are read correctly for this app. Where a general section describes something that does not happen in MacBusinessSuite, this section says so; the general text is not thereby weakened for any other service.

What MacBusinessSuite is. A native macOS application for invoicing and business administration (customers, documents, tax, e-invoicing, PDF/A archiving, payments, time tracking). It is sold exclusively through the Mac App Store as an annual subscription. There is no Google Play version.

Local records, no app account. There is no registration or app login. Company profiles, customers, documents, payments, time entries and settings are stored on your Mac, protected by macOS and, for bank data, field-level encryption. DigitalFreedom Global LLC provides no cloud storage or synchronisation of these records. The external services and support submissions below are separate processing operations. Backups are created where you choose. Removing the app does not reliably erase its container, exports or backups; delete those separately when intended.

Your business records. You control local processing and remain responsible for your customer data where applicable law makes you its controller. Records are not automatically sent to DigitalFreedom Global LLC. Information you include in support submissions is received and processed for support.

Network services. The app uses the following services. Synchronisation by configured system accounts is described under device access below.

Optional Apple on-device suggestions. The system language model processes activity descriptions, recognised receipt text for field suggestions, document mail texts and ticket drafts locally. No text leaves the Mac for these functions, and no API key is needed. They require Apple mode, macOS 26 or later, compatible hardware, enabled Apple Intelligence and an available model. The initial mode is Off; unavailable or failed local processing never falls back to a cloud service. Receipt, mail and ticket suggestions do not use OpenAI. OpenAI is separately available only for activity descriptions with your own key and explicit consent; any information you put into that description is transmitted. See the transparency notice.

On-device recognition. Reading text out of scanned or photographed documents in the inbox uses Apple’s text-recognition framework on your Mac (Vision). It is machine learning that runs entirely on your device; no image and no text leaves your Mac for it, and no external provider is involved. The camera is used only when you scan a barcode, and the frames are not stored or transmitted.

Device access and system integrations (§§ 3.4, 3.5 and 8b).

• Local notifications: optional reminders and actions to complete or postpone tickets, record or reschedule a follow-up, or open an invoice. There is no remote push token. The system Focus filter can mute reminders or restrict them to one company; its state is local.
• Calendar and Reminders: optional full EventKit access to mirror and update due dates in dedicated calendars and lists, and read appointments, titles and attendees for time suggestions. Calendar and reminder entries may synchronise through the providers of your configured system accounts.
• Contacts: import selected contacts or explicitly save a customer as a contact. The configured Contacts account may synchronise those changes.
• App lock and keychain: optional Touch ID or system-password authentication returns only a result, never biometric templates. Mail passwords, the optional OpenAI key and encryption keys are stored in the macOS keychain.
• Widgets: the app group group.za.co.digitalfreedom.MacBusinessSuite shares widget-snapshot.json containing the active company’s overview, due items and running timer, not the database, documents or credentials. App lock suppresses figures and details unless numbers-only mode is selected; that mode permits figures and timer state without names, titles or item rows, including when app lock is enabled.
• Spotlight: business records are automatically indexed locally with links back into the app; there is no upload to a developer server.
• Automation: incoming script commands use the same validation and persistence commands as the interface. The app does not send automation commands to other apps.

Data categories and scope. There is no tracking, advertising, analytics SDK, crash-reporting SDK or install attribution. The privacy manifest declares OtherUserContent and CustomerSupport, linked to the user for app functionality: activity text sent through your identifiable OpenAI account, and information you submit for support. These can include personal or business information you supply. Optional processing is not a blanket exemption from disclosure. Local records, system integrations and your own mail provider are not developer collection. The app has no developer cloud synchronisation; configured system accounts can synchronise as described above. § 12 concerns website cookies and tracking, not a native-app tracking function.

For this app, § 3 does not mean that app account, usage, analytics or diagnostic logs are collected. Communication and support data you submit, external text processing and Apple’s purchase processing remain applicable. Providers in § 6.1.1 for mail, helpdesk hosting and server backups, including Storj, can process submitted support data; the transfer disclosures and any outstanding safeguards in § 7 still apply. They do not receive the local database automatically. OpenAI requests use your own account rather than the provider’s account described in the general policy; RevenueCat is not used. § 8 support retention applies; no app-account retention or deletion arises under § 13.5. Email breach notices (§ 9.1) require that we have your address, for example through a support request. § 13.2 covers the local suggestions and separately consented external activity-text processing described above; your OpenAI account’s retention terms apply.

Adult audience and choices. MacBusinessSuite is intended for adults aged 18 and over under its Terms. The app does not ask for an age band or date of birth and does not verify age. Necessary local processing is explained during onboarding, separately from express acceptance of the Terms. Apple on-device assistance is an optional local feature choice. Only external OpenAI processing asks for the separate, versioned OpenAI consent, which can be withdrawn at any time under Settings → Legal & Privacy. Refusing or withdrawing it leaves local functions, including separately selected Apple assistance, available.

California residents: the notice at collection (§ 17.4) is also available as its own page under Settings → Legal & Privacy.

Version. The version of this Policy and the app-specific notice you are reading is shown under Settings → Legal & Privacy, together with the versions of every other legal text in the app. Wise Business / Mercury. Optional bank access is sent directly to Wise or Mercury under your bank account: the access token, business and account identifiers, requested dates and network metadata. The app receives account details and the selected accounts’ transactions, including amounts, dates, counterparties and references. No bank connection goes through a DigitalFreedom server. Your token stays in the macOS Keychain. The app contacts your bank directly and stores imported transactions locally. Updates run only while this app is open and unlocked. You can turn them off at any time. Only business profiles are shown. Private balances and statements are not retrieved. Disconnecting removes the local token and stops updates. Imported transactions remain. Revoke the token separately in your bank’s settings if needed.

1. INTRODUCTION

This Privacy Policy explains how DigitalFreedom (a brand of DigitalFreedom Global LLC, collectively “we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use our applications, software, websites, and related services (“the Services”).

1.1 Global scope

Our applications are distributed via the Apple App Store and the Google Play Store and are therefore made available in every country and territory those platforms serve. This Privacy Policy applies globally to all users of the Services, regardless of the country in which the Service is downloaded, accessed or used.

1.2 GDPR as the global baseline

We adopt the European Union General Data Protection Regulation (GDPR) and related EU data-protection law as the baseline and apply it as a global floor — every user, in every country, benefits from at least the GDPR-level protections set out in this Policy. We additionally respect and comply with any applicable local data-protection law of the user’s jurisdiction, and where that local law is more protective for the user, the more protective standard applies.

We are committed to protecting your privacy and complying with applicable data-protection laws, including but not limited to:

• EU General Data Protection Regulation (GDPR) — applied as the global baseline
• German Federal Data Protection Act (BDSG)
• UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018
• Swiss Federal Act on Data Protection (FADP)
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) and other US state privacy laws
• Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)
• Australian Privacy Act 1988
• Brazilian General Data Protection Law (LGPD)
• Japanese Act on the Protection of Personal Information (APPI)
• South Korean Personal Information Protection Act (PIPA)
• Indian Digital Personal Data Protection Act (DPDP Act) and IT Act
• South African Protection of Personal Information Act (POPIA)
• All other applicable national data-protection regimes in jurisdictions in which the Services are made available via the Apple App Store or Google Play Store

2. DATA CONTROLLER

The Services are offered under the DigitalFreedom brand. The legal entity responsible for processing your personal data (the “data controller” under Art. 4(7) GDPR) is:

DigitalFreedom Global LLC (trading as DigitalFreedom)
30 N Gould St, Ste N
Sheridan, WY 82801
United States

For data protection inquiries (GDPR Art. 13/14, access, rectification, erasure, portability, objection requests): Request form: https://data-protection.digitalfreedom.co.za Email: data-protection@digitalfreedom.co.za

You may use either route, and you are free to reach us by any other channel — we act on your request however it arrives.

For general inquiries:
Email: hello@digitalfreedom.co.za

Website: https://digitalfreedom.co.za

3. DATA WE COLLECT

3.1 Data You Provide

• Account information (name, email address, username)
• Communication data (support requests, feedback)
• Payment information (processed via third-party payment providers)
• User-generated content

3.2 Data Collected Automatically

• Device information (device type, operating system, version)
• Usage data (features used, interaction patterns)
• Log data (IP address, access times, error logs)
• Analytics data (aggregated usage statistics)

3.3 Data from Third Parties

• Authentication data from social login providers (if applicable)
• Platform-specific data from app stores (Apple, Google)

3.4 Sensor, Device and Biometric Data

Where the app uses sensors or biometrics on your device:

• Biometric authentication (Face ID / Touch ID / Android BiometricPrompt): the biometric template never leaves your device. The app only receives a yes/no result from the operating system.
• Camera, microphone, location, photos, contacts, calendar, motion, health: accessed only when you actively use the feature that needs them. Each access is prompted by the OS with our usage-description text explaining why.
• Health & Fitness data (HealthKit / Health Connect): processed only for the specific feature you use; not shared with third parties for advertising; not used to train AI models.
• App Tracking Transparency (iOS) / AAID controls (Android): by default, DigitalFreedom apps do not track you across other companies’ apps and websites. We do not present the ATT prompt unless a specific feature requires it; if a future feature does, you can decline without losing access to the rest of the app.

3.5 Data NOT Collected

Unless explicitly disclosed for a specific feature in the per-app addendum, we do not collect:

• precise location in the background
• contacts / address book
• SMS / email contents from your device
• browsing history outside the app
• behavioural-advertising identifiers
• payment-card data (payment is collected by Apple or Google; we never receive card details)

4. LEGAL BASIS FOR PROCESSING (GDPR)

We process your personal data based on the following legal grounds:

5. HOW WE USE YOUR DATA

We use your personal data to:

• Provide, operate, and maintain the Services
• Process transactions and manage subscriptions
• Communicate with you (support, updates, notices)
• Improve and personalize the Services
• Ensure security and prevent fraud
• Comply with legal obligations
• Conduct analytics (where permitted or consented)

6. DATA SHARING AND DISCLOSURE

We may share your data with:

6.1 Service Providers

Third-party providers who assist in operating the Services, including:

• Cloud hosting providers
• Payment processors
• Analytics providers
• Customer support tools

6.1.1 Named Sub-processors

The following sub-processors are currently engaged for processing your personal data:

Workloads on Civo are distributed across the fra1 and lon1 regions for redundancy and migration purposes. The list of sub-processors may change; the current list is maintained in our internal sub-processor register and is available on request via the data protection contact below.

6.1.2 Platform and Distribution Channels

The following parties act as independent controllers for processing carried out in connection with platform distribution, payment, and platform-level services — not as our processors under Art. 28 GDPR. They are disclosed here for transparency:

For data processed by Apple under its own controllership (Apple ID, payment details, App Store analytics), Apple’s own Privacy Policy applies: https://www.apple.com/legal/privacy/. For data Google processes under its own controllership (Google account, Play billing, Play analytics), Google’s Privacy Policy applies: https://policies.google.com/privacy.

6.2 Legal Requirements

We may disclose data when required by law, legal process, or government request.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred.

6.4 No Sale of Personal Data

We do not sell your personal data to third parties.

7. INTERNATIONAL DATA TRANSFERS

Your data may be transferred to and processed in countries outside your country of residence.

Specifically with regard to our named sub-processors:

• Civo fra1 (Frankfurt am Main, Germany) — within the EU, no transfer outside the EEA.

• Civo lon1 (London, United Kingdom) — covered by the EU Commission adequacy decision for the UK pursuant to Art. 45 GDPR.

• Migadu-Mail GmbH — mail is stored on servers in France (EU), so storage involves no transfer outside the EEA. Migadu is established in Switzerland; access by the Swiss company is covered by the EU Commission adequacy decision for Switzerland pursuant to Art. 45 GDPR.

• Google Cloud / Workspace — primary processing in EEA data-centre regions. Onward transfers to Google entities outside the EEA (including the United States) are governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum issued by the ICO, and supplementary technical measures (encryption in transit and at rest, key management). The contractual basis is Google’s Cloud Data Processing Addendum (Customers).

• OpenAI Ireland Ltd. (Ireland) and OpenAI OpCo, LLC (United States) — Customer Data submitted to the OpenAI API is processed by OpenAI Ireland Ltd. in the EEA. Onward transfers to OpenAI OpCo, LLC in the United States are governed by the EU Standard Contractual Clauses (Module Three — Processor to Sub-Processor), the UK International Data Transfer Addendum, and intra-group safeguards. API Customer Data is retained for a maximum of 30 days and then deleted, unless retention is required by law. The contractual basis is the OpenAI Data Processing Addendum.

• RevenueCat, Inc. (United States) — subscription / in-app-purchase data is transferred to the United States. Transfers are covered by the EU Standard Contractual Clauses referenced in RevenueCat’s publicly published DPA framework and supplementary technical measures (encryption in transit and at rest, pseudonymous App User IDs, no payment-card data — card data is processed by Apple or Google, never by us).

• Storj (United States company; storage in the EU) — a nightly copy of our server backups is uploaded through Storj’s hosted gateway, which encrypts it on Storj’s side with keys handed to Storj, so Storj can access the data in readable form there; the location of that gateway is not verified. The encrypted pieces are stored on storage nodes in the EU, because our bucket is placed in Storj’s EU region. As Storj is a US company with access to the data, this is a transfer to a third country. No data processing agreement and no Standard Contractual Clauses with Storj are in place at the date of this Policy, and we do not rely on an adequacy decision for it. A request to Storj for a data processing agreement, the EU Standard Contractual Clauses (Module Two) and the UK Addendum was prepared on 14 October 2026.

• Apple (Apple Distribution International Ltd., Ireland; intra-group processing by Apple Inc., United States) — Apple acts as independent controller. Intra-group transfers to Apple Inc. in the United States are governed by Apple’s internal Binding Corporate Rules / SCCs as disclosed in the Apple Privacy Policy.

The Controller is established outside the EEA. Where personal data of users in the EEA is processed by the Controller itself, that processing takes place outside the EEA; the Controller applies the GDPR standard to it as a global baseline, as set out in section 1.2. For onward transfers to the sub-processors named above that are not covered by an adequacy decision, other than Storj (see above):

• We rely on EU Standard Contractual Clauses (SCCs)
• We ensure adequate safeguards under GDPR Chapter V
• We assess the data protection laws of the recipient country (Transfer Impact Assessment)

For transfers from other jurisdictions, we comply with applicable cross-border transfer requirements.

8. DATA RETENTION

We retain personal data only as long as necessary for the purposes described in this Policy.

Criteria for retention periods:

• Duration of your account or use of the Services
• Legal obligations — the retention periods of the law that actually binds the Controller and the transaction, not the longest period found anywhere: for billing records that means up to 10 years of statutory tax and accounting retention; where an EU-law retention duty attaches to a specific record, that duty; never a foreign period applied to a user it does not cover
• Legitimate interests (e.g., dispute resolution)

Concrete periods per category: account data — while the account is active plus 30 days after deletion; billing records — up to 10 years; support tickets — 3 years from closure; logs — 30 days hot, 90 days cold; marketing subscriber data — until unsubscribe, with a suppression-list entry retained. Upon expiration, data is securely deleted or anonymized. Jurisdiction-specific retention statements are in § 17.

8a. SPECIAL CATEGORIES — HEALTH AND FITNESS DATA

Where an app offers a health or fitness feature, it processes data about your body or condition. That is a special category under Art. 9(1) GDPR and is treated separately from everything else in this Policy.

• We ask for your explicit consent before the first read or write, on a screen that carries no other subject. Art. 9(2)(a).
• The screen names the concrete data types the app reads and writes — not “health data” as a category.
• The data is stored on your device, or on our servers in Frankfurt and London. It leaves neither for analytics, nor for crash reporting, nor for the AI feature, nor to any advertising recipient.
• It is never used for a secondary purpose: no personalisation, no model training, no profiling.
• Refusing costs you only the health feature. Everything else works.
• Withdrawing your consent stops the processing for the future and is done in the app’s settings.
• On account deletion it goes with the account, immediately.

Where health data would reach an AI feature, that requires its own separate consent. The health consent does not cover it.

8b. ACCESS TO INFORMATION ON YOUR DEVICE (APPS)

Independently of data protection law, § 25(1) TDDDG and Art. 5(3) of Directive 2002/58/EC require your consent for storing information on your device or reading information already stored there — regardless of whether that information is personal data.

No advertising identifier is read. The apps display no advertising, and attribution uses the platform tokens above rather than IDFA or the Android advertising ID.

Every one of these is a separate switch, all off by default, and each can be changed at any time in the app’s settings.

9. DATA SECURITY

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256 or equivalent)
• Access controls (RBAC, MFA for administrative access, principle of least privilege)
• Regular security assessments and sub-processor audits
• Audit logging restricted to authorised personnel
• Daily backups with off-site replicas
• Documented incident response per our internal Breach Response Plan (Art. 33/34 GDPR)

No system is completely secure. We cannot guarantee absolute data security.

9.1 Breach Notification to You

In the event of a personal data breach likely to result in a high risk to your rights and freedoms (Art. 34 GDPR), we will notify you without undue delay using the email address associated with your account, including:

• nature of the breach
• categories and approximate number of records concerned
• likely consequences
• measures taken or proposed to address the breach and mitigate adverse effects
• contact details for further information

If individual notification would involve disproportionate effort, we make a public communication on https://digitalfreedom.co.za/.

10. YOUR RIGHTS

10.1 The GDPR catalogue, as the global floor

Wherever you live, you can exercise at least:

• Access to your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16)
• Erasure (“right to be forgotten”) (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing (Art. 21)
• Withdrawal of consent at any time, as easily as it was given (Art. 7(3))
• A complaint to a supervisory authority

10.2 What your jurisdiction adds

Several jurisdictions grant rights beyond this floor or attach different deadlines and procedures — appeal routes, shorter response periods, named officers. § 17 is the single place where those are stated, per jurisdiction. Nothing in § 17 reduces the floor above.

10.3 How to exercise any of them

Email data-protection@digitalfreedom.co.za or use the request form at https://data-protection.digitalfreedom.co.za. We respond within one month (Art. 12(3) GDPR) — or within the shorter period your jurisdiction prescribes, as stated in § 17.

11. CHILDREN’S PRIVACY

Our Services are not directed to children under the age of 16 (or the applicable age of consent in your jurisdiction).

We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

12. COOKIES AND TRACKING

Our use of cookies and similar technologies is described in our separate Cookie Policy.

13. AUTOMATED DECISION-MAKING AND AI

13.1 Automated decisions with legal or similarly significant effect

We do not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, unless:

• You have given explicit consent
• It is necessary for contract performance
• It is authorized by applicable law

Where any such processing occurs, you have the right under Art. 22(3) GDPR to obtain human intervention, to express your point of view, and to contest the decision.

13.2 AI-assisted features

Where the Services include AI-assisted features (for example, content generation, summarisation, classification powered by third-party AI APIs such as OpenAI), the AI Transparency Notice describes:

• which features use AI
• which AI provider is engaged
• what data is sent to the AI
• retention at the AI provider (30 days for OpenAI API by default)
• that the feature runs only after your consent, given before the first use, and that you can withdraw it at any time in the app’s settings without losing anything else
• AI-generated content labelling (Art. 50 EU AI Act, in force 2026-08-02)

13.3 Fair Use enforcement

The Fair Use Policy describes how operational telemetry is used to detect abuse and to apply throttling, rate-limiting, restriction or suspension where appropriate. Automated detection informs human review; no automated decision under the Fair Use Policy produces legal effects on you without human involvement, except where strictly necessary to mitigate an immediate threat.

13.4 Marketing communications

Marketing emails are sent only with your explicit, separate opt-in, which you can withdraw at any time without affecting the rest of the Services. There are no marketing push notifications: the apps schedule notifications locally on your device and nothing is sent to them from a server. For recipients in Australia, the Spam Act 2003 standard applies to every commercial electronic message: prior consent, accurate sender identification, and a functional unsubscribe.

13.5 Account deletion

You can delete your account and request erasure of your data at any time. See the Account Deletion Notice for the in-app, email and postal paths.

14. THIRD-PARTY LINKS AND SERVICES

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of third parties.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time.

• Material changes will be communicated via the Services or by email
• Where a change to the processing requires your consent under applicable law, we will obtain that consent before the change applies to you; we do not rely on continued use alone as consent
• The “Effective Date” at the top reflects the latest revision

16. CONTACT

For privacy-related inquiries or to exercise your rights:

DigitalFreedom
A brand of DigitalFreedom Global LLC
30 N Gould St, Ste N
Sheridan, WY 82801
United States

Data protection: data-protection@digitalfreedom.co.za
Data protection request form: https://data-protection.digitalfreedom.co.za
General inquiries: hello@digitalfreedom.co.za
Website: https://digitalfreedom.co.za

For EU residents, you may also contact the competent supervisory authority in your member state.

17. REGIONAL PROVISIONS

What each jurisdiction adds to the global baseline of this Policy. § 10.1 states the floor that applies everywhere; nothing below reduces it. Requests for any of the rights in this section: data-protection@digitalfreedom.co.za or https://data-protection.digitalfreedom.co.za.

17.1 European Union and EEA

• Processing complies with the GDPR, which also applies in Norway, Iceland and Liechtenstein through the EEA Agreement.
• No lead supervisory authority applies: the Controller is not established in the Union, so the one-stop-shop under Art. 56 GDPR does not apply.
• You may lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR) — in the EEA states that is Datatilsynet (Norway), Persónuvernd (Iceland) or the Datenschutzstelle (Liechtenstein).
• Data Protection Impact Assessments are conducted where required.
• For the age of digital consent, which Member States set between 13 and 16, see the Children’s Privacy Notice — this Policy states no single number because none exists.

17.2 United Kingdom

• Processing complies with the UK GDPR and the Data Protection Act 2018.
• The supervisory authority is the Information Commissioner’s Office (ICO).

17.3 Switzerland

• The revised Federal Act on Data Protection (revFADP) applies to circumstances that have an effect in Switzerland regardless of where the Controller sits. The GDPR baseline of this Policy covers its substance.
• Right to information (Art. 25 revFADP): substantially the access right of Art. 15 GDPR; we respond within 30 days.
• Breach notification (Art. 24 revFADP): owed to the FDPIC “as soon as possible”. Our internal plan runs on the shorter of the applicable periods, so the GDPR’s 72-hour clock governs in practice.
• Switzerland is recognised as adequate by the EU and recognises the EEA; transfers between them need no additional safeguard.
• The competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

17.4 United States

The state-law common core. The comprehensive state statutes (Virginia, Colorado, Connecticut, Texas, Oregon and the wider family) grant substantially the rights in § 10.1, and add two things:

• Appeal. If we deny your request, you may appeal to us; our appeal response tells you how to complain to your State Attorney General. Exception: Utah (Utah Code § 13-61-203 provides no appeal process).
• Deadlines. We respond within 45 days, extendable once by a further 45 with notice. Exception: Iowa, where the statute allows 90 days plus a 45-day extension (Iowa Code § 715D.3(3)) — in practice we apply the shorter period.

Biometrics (Illinois BIPA). No biometric identifier is collected. Face ID and Touch ID are handled by the operating system on your device; the app receives only a yes/no. If a feature ever collects a biometric identifier, BIPA’s written-release, retention-schedule and destruction duties apply before the first collection.

Consumer health data (Washington, Nevada). Where an app touches health data, the separate Consumer Health Data Policy applies — it is its own document because Washington’s My Health My Data Act requires one, linked separately and prominently.

“Do Not Sell or Share” link. Not required here: no personal information is sold or shared for cross-context behavioural advertising — no advertising runs in the apps, and install attribution uses platform tokens rather than an advertising identifier. If that changes, the link becomes mandatory.

California — Notice at Collection (CCPA/CPRA)

Provided to California residents at or before the point of collection, as required by Cal. Civ. Code §§ 1798.100(a) and 1798.130(a)(5)(A). The full Privacy Policy this notice belongs to: the Privacy Policy in this app (Settings → Legal & Privacy → Privacy Policy) and at https://digitalfreedom.co.za/.

Categories collected in the past 12 months:

We have not sold or shared personal information of California residents in the past 12 months and do not intend to. The opt-out of sale or sharing therefore has no operative effect — but is available on request.

Retention per category: account data — while active + 30 days after deletion; billing records — up to 10 years (statutory tax and accounting retention); support tickets — 3 years from closure; logs — 30 days hot, 90 days cold; marketing subscriber data — until unsubscribe, plus the suppression-list entry.

Sensitive personal information — limit of use (§ 1798.121). We use sensitive personal information only for the purposes permitted under CPRA Regs § 7027(m) — performing the services, security, fraud prevention, service quality. Not for inferring characteristics, not for targeted advertising. The opt-out therefore has no operative effect — but is available on request.

Your CCPA/CPRA rights:

We verify requests proportionate to sensitivity and risk (CCPA Regs §§ 7060–7063) and respond within 45 days, extendable once by 45 with notice.

Shine the Light (§ 1798.83): we disclose no personal information to third parties for their direct-marketing purposes; the annual response is “none disclosed”.

Global Privacy Control: honoured as a valid opt-out signal (CPRA Regs § 7025). Because we neither sell nor share, it does not change our processing, but it is acknowledged.

Complaints: California Privacy Protection Agency, 2101 Arena Boulevard, Sacramento, CA 95834 — https://cppa.ca.gov/webapplications/complaint — or the California Attorney General.

17.5 Canada

• Consent (PIPEDA Principle 3): express consent where information is sensitive or the purpose not obvious; implied consent where it is obvious and not sensitive. Withdrawal at any time, subject to legal or contractual restrictions and reasonable notice.
• Your PIPEDA rights: access and a copy, accuracy challenge and correction, withdrawal of consent, and complaint to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca). Response generally within 30 days (PIPEDA § 8(4)).
• Quebec (Law 25):
  • Person responsible for the protection of personal information: Marcel R. G. Berger, data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States.
  • Before personal information of Quebec residents is transferred outside Quebec, a privacy impact assessment (EFVP) is conducted (Law 25 § 17). Destinations: EEA, UK and Switzerland (adequate), and the US under EU SCCs, the UK Addendum and, where applicable, the EU-US DPF.
  • You may request your data in a structured, commonly used technological format (§ 27), request cessation of dissemination or de-indexing where dissemination seriously injures your reputation or privacy, and are informed of any decision based exclusively on automated processing with the right to human review — no such decisions are currently made.
  • Confidentiality incidents presenting a risk of serious injury are notified to the Commission d’accès à l’information and to you without delay.
  • A French version of any document is available on request; for Quebec residents the French version governs where Quebec law so requires.
• CASL: commercial electronic messages only with express opt-in, sender identification and a working unsubscribe processed within 10 business days.
• Provincial laws (BC PIPA, Alberta PIPA) apply where more protective. Complaints also to the OIPC BC and OIPC Alberta.

17.6 Australia and New Zealand

• Australia: the Privacy Act 1988 and the Australian Privacy Principles apply to an overseas entity carrying on business in Australia. APP 12 sets a 30-day response period for access. APP 8 makes us accountable for an overseas recipient’s handling of your data — stricter than a transfer analysis, and part of why recipients are named in § 6. Complaints: Office of the Australian Information Commissioner (OAIC).
• New Zealand: the Privacy Act 2020 applies to an overseas agency carrying on business in New Zealand. IPP 12 restricts disclosure outside New Zealand; access requests are answered within 20 working days. Complaints: Office of the Privacy Commissioner (NZ).

17.7 Brazil (LGPD)

• Encarregado (Art. 41 LGPD): Marcel R. G. Berger, data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. ANPD Resolution CD/ANPD No. 18/2024 permits the role to be performed for a foreign controller through the channels above; this Policy is the public publication of the Encarregado’s contact details it requires.
• Legal bases (Art. 7 and 11): consent (I) for marketing; contract performance (V) for account, billing, AI features and service delivery; legal obligation (II) for the retention duties that bind the Controller under the law applicable to it; legitimate interest (IX) for security and fraud prevention. Sensitive data only on explicit consent or another Art. 11 ground.
• Your Art. 18 rights: confirmation, access, correction, anonymisation/blocking/deletion of unnecessary or non-compliant data, portability, deletion of consent-based data, information about sharing and about the consequences of refusing consent, and revocation of consent. Response within 15 days (Art. 19 § 3).
• Transfers (Chapter V, Art. 33): adequacy (EEA, UK, Switzerland), contractual safeguards for the US legs, or your consent given with prior information about the international character — the AI feature names its US recipient before you enable it.
• Children (Art. 14): processing of a child’s data (under 12) requires specific and prominent parental consent; no such mechanism is operated — consent-based processing is withheld instead. See the Children’s Privacy Notice.
• Incidents (Art. 48): the ANPD and affected data subjects are notified; our target is 72 hours, aligned with Art. 33 GDPR.
• Complaints: Autoridade Nacional de Proteção de Dados — https://www.gov.br/anpd. A Portuguese version of this section is available on request.

17.8 India (DPDP Act, 2023)

• DigitalFreedom Global LLC is the Data Fiduciary; it is not designated a Significant Data Fiduciary.
• Consent (§ 6): free, specific, informed, unconditional and unambiguous, by clear affirmative action, limited to what the purpose needs, withdrawable as easily as given. Service is not conditioned on consent the purpose does not need.
• Your rights (§§ 11–14): access to what is processed and with whom it is shared; correction, completion and erasure; grievance redressal; and nomination of another person to exercise your rights in case of death or incapacity.
• Grievance Officer (§ 8(10), IT Rules 2021): Marcel R. G. Berger, data-protection@digitalfreedom.co.za. Acknowledgement within 24 hours; resolution within 15 days, extended to 30 for complex grievances with explanation. Escalation: the Data Protection Board of India, once constituted.
• Children (§ 9): data of a person under 18 is processed only with verifiable parental or guardian consent; no tracking, behavioural monitoring or targeted advertising directed at children.
• Transfers (§ 16): permitted save to destinations notified as restricted; none of the destinations used (EEA, UK, Switzerland, US) is currently restricted.
• Notices are available in English; a Hindi or other Eighth-Schedule-language version can be requested at hello@digitalfreedom.co.za.

17.9 Japan (APPI)

• The APPI applies to a foreign operator that acquires personal information in connection with supplying goods or services to persons in Japan; this Service is therefore covered.
• Purpose specification: the purpose of use is specified as narrowly as possible and notified or published at acquisition. A change of purpose is limited to what remains relevantly connected to the original purpose; a larger change requires fresh consent.
• Third-party provision, and provision to third parties in a foreign country: provision to a third party requires your consent as a rule. For a third party in a foreign country, consent is obtained only after providing you with (1) the name of the country, (2) information on that country’s personal-information protection system, and (3) the measures the recipient takes to protect personal information. This applies to OpenAI Ireland Ltd. (Ireland) and the onward transfer to OpenAI OpCo, LLC (United States); the AI feature’s consent screen carries exactly this information.
• Publicly available matters (Art. 32): the operator’s name and address and its representative’s name, the purposes of use, the procedures for disclosure requests and the complaint contact are kept in your reach — through this Policy and the Impressum. Representative: Marcel R. G. Berger.
• Breach reporting: for the reportable categories, a preliminary report to the Personal Information Protection Commission within roughly 3–5 days and a final report within 30 days (60 for breaches caused by wrongful access); you are notified. Our internal plan runs on the shortest applicable deadline.
• No advertising email is sent (特定電子メール法 — opt-in, sender identification, unsubscribe — would otherwise apply).

17.10 Korea (PIPA)

• PIPA applies to a foreign operator processing personal information in the course of offering goods or services to data subjects in Korea; this Service is therefore covered.
• Itemised, separated consent: consent is obtained separately per item, with required and optional items distinguished; refusing an optional item never blocks the service; each request states the items collected, the purpose, the retention period, your right to refuse and the consequence of refusal. The per-purpose toggles in the apps implement exactly this.
• Cross-border transfer: transferring personal information abroad requires notice of the recipient, the destination country, the date and method of transfer, the items transferred, the recipient’s purpose and retention period, and your separate consent. This applies to OpenAI Ireland Ltd. and the onward US transfer; the AI consent screen carries these items.
• Under 14: processing a child’s data requires the legal representative’s consent, with only the minimum information collected to verify it. No app is directed at children; the age gate handles the case.
• Response period: access, correction/deletion and suspension requests are acted on within 10 days, or you are told the reason and schedule. That is shorter than the GDPR month, and the shorter period governs.
• Breach: you are notified without delay; above the statutory scale, the Personal Information Protection Commission or the designated agency is notified within 72 hours.

17.11 Türkiye (KVKK)

• The KVKK (Law No. 6698) resembles the GDPR in concept but leans harder on explicit consent as the general basis; each processing activity is assessed against Turkish law separately rather than assumed to carry over from an Art. 6(1)(f) analysis.
• Transfers abroad: for the US transfer the AI feature relies on, the basis is your explicit consent, given after the transfer is disclosed to you.
• Response period: requests are answered within 30 days. You may complain to the Kişisel Verileri Koruma Kurumu after applying to us first — within 30 days of our response or 60 days of your application.
• The Turkish version of the published documents governs for consumers resident in Türkiye.

17.12 South Africa (POPIA)

POPIA § 3(1) applies to a responsible party domiciled in the Republic, or processing by means located there. Neither is the case — the Controller is domiciled in Wyoming and processes on servers in Frankfurt and London, with an off-provider backup copy on Storj storage nodes in the EU (§ 7), and a .co.za domain name is a name, not a processing means. The Act therefore does not apply on the present facts. Every POPIA-style enquiry is nonetheless answered through the same channels and on the same clock as everywhere else — a service commitment, not an admission that the Act applies. Two points where POPIA would differ from the GDPR floor, stated rather than papered over: POPIA treats everyone under 18 as a child, and § 22(1) requires breach notification without the GDPR’s high-risk threshold — the breach plan operates on the GDPR standard. The Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — https://inforegulator.org.za.

17.13 All other countries

Everywhere the stores distribute and no section above applies: the GDPR baseline of this Policy is your floor (§ 1.2), any more protective mandatory local law prevails over it, and every request goes through data-protection@digitalfreedom.co.za or https://data-protection.digitalfreedom.co.za.

(c) 2025-2026 DigitalFreedom Global LLC. All rights reserved.