Privacy Policy (Apps)
App-VenTur ("we", "our", or "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share information when you use our applications and services — including our mobile apps and any associated web interfaces — in compliance with the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (nFADP).
By using our services, you acknowledge that you have read and understood this Privacy Policy.
1. Data Controller
Company: App-VenTur
Address: Am Börtli 10, 8049 Zurich, Switzerland
Phone: +41 78 212 69 69
General enquiries: le.gal@app-ventur.ch
Data Protection Officer: le.gal@app-ventur.ch
2. Scope of This Policy
This policy applies to all App-VenTur products and platforms, including:
- Mobile applications (iOS and Android) — including the EFT tapping app
- Web applications and interfaces — including any browser-based access to our services
- Associated backend services — including authentication, usage tracking, and AI content generation
3. Data We Collect
3.1 Account & Identity Data
- Email address and account ID
- Authentication credentials (passwords are hashed and never stored in plaintext)
- Account creation date and subscription tier
3.2 Sensitive / Health-Related Data (Special Category — Art. 9 GDPR)
Important: The following data is considered health-related and is processed only with your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7) nFADP).
When you create a session in our EFT (Emotional Freedom Techniques) tapping app ai-tapp, you enter:
- Session topic — the personal issue or topic you choose to focus on
- Emotions — the emotions you select to describe your current state (e.g., anxiety, sadness, anger)
- Distress intensity (SUDS) — your self-reported Subjective Units of Distress score (0–10 scale)
- Desired outcome — what you would like to achieve with the session
- Optional background ("about me") and gender, if you provide them
- Check-in feedback — how you feel during and after the session
The tapping scripts generated from these inputs contain the same information. This data is used solely to generate and deliver your personalised tapping session. It is not used for advertising or profiling, and it is shared only with the AI providers described in Section 6.
Your session content is not stored on our servers. Your session history, saved scripts and audio stay on your device.
3.3 Usage Records
- Session ID, duration and minutes used
- Voice and AI provider used for the session
- Voice preferences and voice test usage count
Usage records contain no session content. We use them to enforce plan limits and for billing.
3.4 Consent Records
- Whether you granted or withdrew consent to AI processing, the policy version, the platform and the time
3.5 Device & Technical Data
- Operating system version, device type and app version
- Crash reports (account ID, device and app version, stack trace — no email address and no session content)
3.6 Local Device Storage (Mobile)
- Session history and saved scripts — stored on your device
- Generated audio files — cached on your device as
.mp3files for replay without re-generating content - App state — preferences and authentication tokens are persisted in local device storage (AsyncStorage)
- These files remain on your device and are not uploaded to our servers
3.7 Web-Specific Data
- Browser type and version
- IP address (used for security and fraud prevention, not for tracking)
- Session cookies and local storage (see Section 9)
3.8 Payment Data
- Payments are processed directly by our payment provider (Stripe). We never see your card details.
- We retain transaction records (amount, date, subscription tier) for legal and accounting purposes
4. Purposes and Legal Basis
| Data | Purpose | Legal Basis | Stored Where |
|---|---|---|---|
| Email, password (hashed), account ID | Create and secure your account | Contract (Art. 6(1)(b) GDPR) | Supabase |
| Session inputs and generated scripts | Generate your tapping session and voice narration | Explicit consent (Art. 9(2)(a) GDPR) | Sent to the AI providers in Section 6 to create the session. Session history, saved scripts and audio stay on your device, not on our servers. |
| Usage records (no session content) | Enforce plan limits, billing | Contract (Art. 6(1)(b) GDPR) | Supabase |
| Consent records | Prove your consent | Legal obligation (Art. 6(1)(c) and Art. 7(1) GDPR) | Supabase |
| Subscription and payment data | Process payments | Contract (Art. 6(1)(b) GDPR); bookkeeping duty (Art. 6(1)(c) GDPR) | Stripe |
| Crash reports | Fix errors | Legitimate interest (Art. 6(1)(f) GDPR) | Sentry, EU data region |
| Email address of a deleted account | Prevent repeated free-tier sign-ups | Legitimate interest (Art. 6(1)(f) GDPR) | Supabase |
| Marketing communications (if you opt in) | Product news | Consent (Art. 6(1)(a) GDPR) | — |
5. AI Processing
When you create a session, the app sends your inputs over an encrypted connection to our server. The server forwards only the prompt and script text to the AI provider. It does not add your name, email address, account ID or IP address. Anything identifying that you type into a text field yourself is still sent with it.
| Provider | What It Does | Where It Processes | Training | Retention by the Provider |
|---|---|---|---|---|
| Google Cloud (Vertex AI: Gemini) | Writes scripts (Committed plan); Gemini voices | EU region | Not used for training | May be cached for up to 24 hours, then deleted |
| Google Cloud Text-to-Speech | Voice narration | EU endpoint | Not used for training | As set out in Google Cloud's data processing terms |
| OpenAI (GPT-4.1, EU data residency) | Writes scripts (Free and Explorer plans; backup for Committed) | EU | Not used for training | Up to 30 days for abuse monitoring, then deleted |
| Murf AI (Falcon 2) | Voice narration | EU endpoint | Not used for training | As set out in Murf AI's data processing terms |
The scripts are AI-generated. They are not medical advice, and they do not lead to any decision about you with legal or similarly significant effects.
Withdrawing consent: Settings → AI Data Processing Consent. After you withdraw, the app and our server block all further AI requests for your account. Withdrawal does not affect processing that happened before it. Without consent you cannot create new AI sessions, but you can still replay sessions saved on your device. You can also withdraw any other consent by contacting le.gal@app-ventur.ch.
6. Processors
We share data with the following processors where necessary to deliver our services. All processors act only on our instructions under a data processing agreement. For where they are located and how transfers are safeguarded, see Section 12.
| Processor | Purpose | Data Shared |
|---|---|---|
| Google Cloud (Vertex AI, Text-to-Speech) | AI script generation and voice narration | Session inputs and script text (no account identifiers) |
| OpenAI | AI script generation | Session inputs and script text (no account identifiers) |
| Murf AI | Voice narration | Script text (no account identifiers) |
| Supabase | Backend infrastructure — authentication, database, usage tracking | Account data, usage records, consent records (no session content) |
| Sentry (Functional Software, Inc.) | Error tracking and crash reporting | Account ID, device and app version, stack trace |
| Stripe | Subscription billing and payment processing | Payment details, transaction records, subscription tier |
We never sell your personal data to third parties.
7. Data Retention
| Data Type | Retention |
|---|---|
| Session content (inputs, scripts, audio) on our servers | Not stored |
| Session history, saved scripts and audio on your device | Until you delete them, delete your account or uninstall the app |
| Account data and usage records | While your account exists; after account deletion, until deleted or anonymised as described in Section 7.1 |
| Email address of a deleted account | Kept to prevent repeated free-tier sign-ups |
| Consent records | As long as needed to prove your consent within the applicable limitation periods |
| Billing and payment records | 10 years (Swiss bookkeeping duty, Art. 958f CO) |
| Crash reports | Up to 90 days |
| Server logs (operation name and status code only) | Short-term, per our hosting provider's standard log retention |
7.1 Deleting Your Account
Settings → Delete Account immediately deletes everything stored on your device (session history, saved scripts, audio, preferences) and signs you out. On our servers the account is marked as deleted and can no longer be used. If you want the remaining server records erased as well, write to le.gal@app-ventur.ch. We will delete or anonymise them within 30 days, except the records we must keep by law (billing records) and the email address we keep to prevent repeated free-tier sign-ups.
8. Your Rights (GDPR & nFADP)
| Right | Description |
|---|---|
| Right of Access | Request a copy of the personal data we hold about you |
| Right to Rectification | Request correction of inaccurate or incomplete data |
| Right to Erasure | Request deletion of your personal data ("right to be forgotten") |
| Right to Restriction | Request that we limit processing of your data |
| Right to Portability | Receive your data in a structured, machine-readable format (JSON or CSV) |
| Right to Object | Object to processing based on legitimate interests or for direct marketing |
| Right to Withdraw Consent | Withdraw consent for sensitive data processing at any time |
| Right to Human Review | Request human review of any automated decision that significantly affects you |
To exercise any of these rights, contact our DPO at le.gal@app-ventur.ch or use the Data Rights Request page in your account settings.
We will respond within 30 days (extendable to 90 days for complex requests, with notice).
9. Cookies and Local Storage
Mobile Applications
Our mobile apps do not use browser cookies. We use device-local storage (AsyncStorage on iOS and Android) to persist:
- Authentication session tokens
- User preferences (voice, TTS provider, session settings)
- Cached session history and script data
- Generated audio files
You can clear this data by logging out of the app or uninstalling it.
Web Applications
Our web interfaces use the following:
| Type | Purpose | Retention |
|---|---|---|
| Strictly necessary cookies | Session authentication, security | Session or up to 30 days |
| Functional cookies | Remembering preferences | Up to 12 months |
| Analytics cookies | Aggregated usage analytics | Up to 12 months |
You can manage cookie preferences via the consent banner displayed on first visit, or in your browser settings. Blocking strictly necessary cookies may affect core functionality.
10. Automated Decision-Making
Our AI-powered features use automated processing to generate personalised content. Specifically:
- EFT tapping script generation: Your session inputs are sent to an AI provider (Google Gemini or OpenAI, see Section 5) to generate a personalised tapping script. The output is generated automatically without human review.
- Usage quota management: Subscription limits are enforced automatically based on your tier and recorded usage minutes.
The scripts are AI-generated and are not medical advice. No decision with legal or similarly significant effects is made about you on the basis of automated processing.
If you believe a session output was inappropriate or harmful, you can ask us to review it. Contact us at le.gal@app-ventur.ch.
11. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption of data in transit (TLS 1.2+)
- Encryption of sensitive data at rest
- Role-based access controls for backend systems
- Row-level security policies on our database
- Authentication requirements for all API access
- Regular security assessments
Despite these measures, no system is completely secure. If you believe your account has been compromised, contact us immediately.
12. International Transfers
We process session content in the EU wherever possible. Several of our processors, or their parent companies, are based outside Switzerland and the EU/EEA. Even where data is processed in the EU, a parent company abroad may be legally compelled to give access to it.
| Processor | Company Location | Data Location |
|---|---|---|
| Google Cloud | USA (Google Cloud EMEA, Ireland, for EU customers) | EU |
| OpenAI | USA (OpenAI Ireland for EU customers) | EU |
| Murf AI | USA / India | EU |
| Supabase | USA | EU / USA |
| Sentry | USA | EU (Germany) |
| Stripe | USA (Stripe Payments Europe, Ireland) | EU / USA |
For any transfer to or access from a country without an adequate level of data protection, we rely on the EU–US and Swiss–US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses (SCCs) of the European Commission with the Swiss addendum, as recognised under nFADP.
13. Children's Privacy
Our services are not directed to children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child under 16, please contact us immediately at le.gal@app-ventur.ch and we will delete it promptly.
14. Policy Updates
We may update this Privacy Policy from time to time. We will notify you of significant changes via:
- Email notification to your registered address
- In-app notification on next launch
- Updated "Last Updated" date at the top of this document
Continued use of our services after the effective date of changes constitutes acceptance of the updated policy. For material changes affecting how we process sensitive data, we will request renewed explicit consent where required by law. When we add an AI provider or change how your session inputs are processed, the app asks you for consent again before your next session.
15. Google API Services User Data Policy & AI Limited Use
App-VenTur's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- No AI Training on Google User Data: App-VenTur does not use, transfer, or sell Google Workspace user data (including raw, aggregated, or derived data from Google Calendar, Gmail, or Google Tasks) to create, train, fine-tune, or improve foundational or generalized machine learning and artificial intelligence models.
- Data Isolation: Any AI features across App-VenTur applications (such as voice-to-text task parsing) process only direct user voice input prompts and do not ingest or process user data retrieved from Google APIs.
16. Contact & Complaints
For privacy-related questions or to exercise your rights:
DPO Email: le.gal@app-ventur.ch
Phone: +41 78 212 69 69
Address: Am Börtli 10, 8049 Zurich, Switzerland
To lodge a complaint:
- Switzerland: Swiss Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch
- EU residents: Your local data protection supervisory authority
This policy applies to all App-VenTur applications and services. For questions specific to a particular product, please reference the product name in your enquiry.