PRIVACY POLICY – MINDLIGHT

Effective Date: April 29, 2026

Welcome to MindLight,

At MINDLIGHT PROJECT – FZCO («Company», «we», «us», or «our»), we are committed to protecting your privacy and safeguarding your personal information. This Privacy Policy («Policy») explains how we collect, use, process, store, share, and protect your personal information when you use the MindLight service, including our iOS application (available via the Apple App Store), our Android application (available via Google Play), our website at https://www.mindlight.ae/

(«Website»), and all related services, features, and content (collectively, the «Service» or «Services»).

MindLight is a digital wellbeing, self-development, and personal growth platform that provides users with tools for mood tracking, journaling, productivity management, personalized guidance through an AI-powered chat assistant, and optional esoteric features (numerology).

We operate in compliance with the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data («UAE Data Protection Law»), and where applicable, with other

international data protection regulations including the EU General Data Protection Regulation

(GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), and other applicable privacy laws.

By accessing, downloading, installing, or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

Important Note About AI-Powered Wellbeing Services:

When you use MindLight to track your mood, maintain a personal diary, or engage with our AI chat assistant:

• You may provide sensitive personal information about your emotional state, mental wellbeing, personal struggles, relationships, and life circumstances;
• Our AI chat assistant processes your queries using third-party artificial intelligence providers (such as large language models);
• We do NOT provide medical, psychiatric, or professional psychological advice – the Service is for informational, self-exploration, and entertainment purposes only;
• Your AI chat messages may be transmitted to third-party AI providers located outside your country (typically in the USA) for processing;
• We do NOT use your diary entries, mood data, or AI chat messages to train our general AI models;
• Your diary and AI chat data are encrypted and protected with the highest security standards;
• You may mention third parties (names, details) in your diary or AI chat – you are responsible for obtaining necessary consents;
• If you experience a mental health crisis, DO NOT USE THIS SERVICE – immediately contact emergency services or a crisis hotline.

If you have any questions about this Privacy Policy or our data practices, please contact us at

hello@mindlight-app.com.

1. SCOPE AND APPLICATION

1.1. Applicability

This Privacy Policy applies to:

(a) All users of the MindLight Service, including users of our iOS app, Android app, and web

platform;

(b) All visitors to our Website;

(c) All individuals whose personal information we collect in connection with the Service;

(d) All processing of personal data by the Company in connection with the Service.

1.2. Exclusions

This Privacy Policy does not apply to:

(a) Information collected by third-party websites, applications, or services that you may access through links on our Service;

(b) Third-party payment processors’ collection and processing of payment card information (subject to their own privacy policies);

(c) Information processed by third-party AI providers solely on our behalf as data processors, except as described in this Policy.

1.3. Acceptance

By using the Service, you:

(a) Acknowledge that you have read and understood this Privacy Policy;

(b) Consent to the collection, use, and processing of your personal information as described herein;

(c) Agree to be bound by the terms of this Privacy Policy and our Terms of Service.

1.4. Separate Consent

Where required by applicable law (including UAE Data Protection Law), we will obtain your separate, explicit consent for specific processing activities, including:

(a) Processing of Mood Data, Diary Entries, and AI Chat Messages (sensitive personal data concerning mental and emotional state);

(b) Processing of Optional Numerology Data (name, date of birth, gender – if you opt in to esoteric features);

(c) Transmission of AI Chat Messages to Third-Party AI Providers;

(d) Marketing communications;

(e) Use of non-essential cookies;

(f) Cross-border data transfers.

Your silence or inaction does not constitute consent.

2. DATA CONTROLLER INFORMATION

2.1. Identity of Data Controller.

The data controller responsible for your personal information is:

MINDLIGHT PROJECT – FZCO

Registration Number: 64926

Registered Address: Dubai Silicon Oasis DSO-IFZA, IFZA Properties, Dubai, PO Box 34, United Arab Emirates

Email: hello@mindlight-app.com

Website: mindlight.ae

Support: hello@mindlight-app.com

2.2. Representative for Data Protection Matters.

For questions, requests, or complaints regarding data protection, you may contact our Data Protection Officer at:

Email: hello@mindlight-app.com

Address: Dubai Silicon Oasis DSO-IFZA, IFZA Properties, Dubai, PO Box 34, United Arab Emirates

2.3. Payment Processing (Where Applicable).

All payments for the app are made and processed exclusively through the app stores from which the app is distributed (Apple App Store and Google Play). Such processors act as independent data

controllers for payment card data and transaction processing, subject to their own privacy policies and applicable payment card industry standards (PCI DSS).

3. DEFINITIONS

For the purposes of this Privacy Policy, the following terms have the meanings assigned below: «Mood Data» or «Wellbeing Data» means your self-reported evaluations of your emotional state, mood, or wellbeing, including historical tracking data and trends.

«Diary Data» or «Journal Data» means text-based personal notes, reflections, thoughts, and journal entries you create and store in the Service, including post-practice reflections.

«AI Chat Data» means your conversational messages, queries, prompts, and dialogue history with the AI-powered chat assistant, including the context and content of your discussions on personal topics, self-development, emotional state, relationships, and life circumstances.

«Life Sphere Diagnostics» means the evaluation and analysis of various areas of your life (such as career, relationships, health, finances, personal growth) based on your self-assessments, resulting in derived insights, scores, and reports.

«Personal Data» or «Personal Information» means any information relating to an identified or identifiable natural person («Data Subject»), including but not limited to name, email address, date of birth, mood ratings, diary entries, AI chat messages, IP address, device identifiers, and any other data that can directly or indirectly identify you, as defined under UAE Data Protection Law.

«Sensitive Personal Data» means personal data revealing emotional state, mental health,

psychological wellbeing, or other categories of special personal data as defined under UAE Federal Decree-Law No. 45 of 2021, GDPR Article 9, and other applicable data protection laws. In the context of MindLight, this includes Mood Data, Diary Data, AI Chat Data, and Life Sphere Diagnostics.

«Processing» means any operation or set of operations performed on personal data, whether

automated or not, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.

«User Content» means any content, including mood ratings, diary entries, AI chat messages, task descriptions, habit names, goal statements, life sphere assessments, queries, prompts, or other

materials, that you input, submit, or otherwise provide to the Service.

«Generated Content» or «AI Responses» means text-based responses, insights, guidance, reflections, life sphere diagnostic reports, or other outputs created by the Service’s AI assistant in response to your inputs.

«Third-Party Data» means personal information (such as names, dates, details, or characteristics) of individuals other than the User, which the User may mention or input into the Service (e.g., in diary entries, AI chat conversations, or compatibility analyses).

«AI Provider» or «Third-Party AI Provider» means external providers of artificial intelligence technology, models, or APIs (including large language models) used by the Company to power the AI Chat Assistant and analytical features.

«Practices» means audio or text-based wellbeing sessions (such as meditations, affirmations,

breathing exercises, or guided reflections) provided through the Service.

«Cookies» means small text files or similar technologies stored on your device when you access the Service, used for authentication, preferences, analytics, and security.

«Cross-Border Data Transfer» means the transfer of personal data from one country or jurisdiction to another, including transfers outside the UAE.

«Data Breach» means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.

«Profiling» means any form of automated processing of personal data to evaluate certain personal aspects relating to a natural person, including analyzing or predicting aspects concerning performance, emotional state, behavior, personal preferences, interests, or life sphere assessments.

4. INFORMATION WE COLLECT

We collect only the personal information necessary to provide and improve the Service, ensure

security, and fulfill our legal obligations. We collect information directly from you, automatically when you use the Service, and from third parties in limited circumstances.

In accordance with UAE Data Protection Law, we follow the principles of data minimization and purpose limitation – we collect only the data necessary for specific, legitimate purposes.

4.1. Account and Registration Data

When you create an account or use the Service, we collect:

• Email address (required for account creation and communication);
• Password (stored in encrypted form);
• User ID (internal identifier assigned by our system);
• Account status (active, suspended, deleted);
• Registration date and time;
• Third-party account information (if you register via Google, Apple ID, or social media):
  • Username or display name;
  • Profile picture (if you choose to import it);
  • Email address;
  • Unique third-party account identifier.

4.2. Subscription and Payment Data

When you purchase a subscription or make a payment, we collect:

• Transaction ID and payment reference numbers;
• Subscription type and billing period;
• Subscription status (active, canceled, expired);
• Purchase date and time;
• Amount, currency, and payment method type (e.g., credit card, Apple Pay);
• Billing email address (for receipts and notifications);
• Transaction history and refund records.

Important: We do not collect, store, or have access to your full payment card details (card number, CVV, expiration date). Payment processing is handled by third-party payment processors (Apple App Store and Google Play) who are PCI DSS compliant and act as independent data controllers for payment data.

4.3. Wellbeing and Mood Tracking Data

When you use the mood tracking feature, we collect:

• Mood ratings (your self-assessment of emotional state);
• Historical mood data (dates, times, and trends of your mood evaluations);
• Contextual notes (if you add notes to mood entries).

Critical Privacy Notice:

Mood Data may reveal information about your mental and emotional state and is considered Sensitive Personal Data under applicable laws. We process this data solely to provide you with tracking,

insights, and historical trends for self-reflection purposes. We do NOT use Mood Data for medical diagnoses, psychiatric assessments, or clinical evaluations. See Section 8 for detailed information.

4.4. Diary and Journal Data

When you use the personal diary/journal feature, we collect:

• Text entries (your personal notes, thoughts, reflections, daily logs);
• Post-practice reflections (notes you write after completing mindfulness practices);
• Diary metadata (creation date, last modified date).

Critical Privacy Notice:

Diary Data is unstructured text input and may contain highly Sensitive Personal Data, including:

• Information about your mental health, emotional struggles, personal relationships, health conditions, spiritual or philosophical beliefs, or other intimate details;
• Names or details of third parties you mention.

You input diary content entirely at your own discretion and risk. We strongly advise against including:

• Highly confidential medical information;
• Financial passwords or account numbers;
• Sensitive personal data of third parties without their consent.

We do NOT read, review, or moderate your diary entries. Diary Data is encrypted and accessible only to you. We do NOT use Diary Data to train our AI models. See Section 8 for detailed information.

4.5. AI Chat Assistant Data

When you use the AI-powered chat assistant, we collect:

• Chat messages (your questions, queries, prompts, and conversational inputs);
• AI responses (messages generated by the AI assistant in response to your inputs);
• Chat history (conversation threads and context);
• Session metadata (timestamps, session duration).

CRITICAL Privacy Notice – AI Chat Processing:

Sensitive Personal Data: AI Chat Data may contain Sensitive Personal Data about your emotional state, mental health, personal struggles, relationships, and life circumstances.

Third-Party Processing: Your AI chat messages are transmitted to third-party AI Providers located outside your country (typically in the United States) for processing via secure APIs.

What We Share with AI Providers:

• Text content of your chat messages (queries and prompts);
• Session identifiers (to maintain conversation context).

NOT shared: Your email address, name, User ID, payment information, or unrelated User Content. AI Provider Commitments:

• We use enterprise API endpoints with «Zero Data Retention» policies enabled;
• Your chat messages are NOT used by AI Providers to train their general models;
• Data is deleted by AI Providers immediately after generating responses (per our contractual agreements);
• Encryption in transit.

Retention: We retain your AI Chat history for up to 90 days (to provide conversational context). You may delete chat history at any time via app settings.

NOT Medical Advice: The AI chat assistant does NOT provide medical, psychiatric, or professional psychological advice. It is for informational, self-exploration, and entertainment purposes only. See Section 8 for comprehensive details about AI Chat processing.

4.6. Productivity and Goal Management Data

When you use productivity features, we collect:

• Tasks (To-Do Lists):
  • Task descriptions (text);
  • Task status (completed, pending, overdue);
  • Deadlines and due dates;
  • Task history and completion records.
• Habits:
  • Habit names and descriptions;
  • Target frequency (daily, weekly, custom);
  • Tracking history (completion dates and streaks);
  • Habit categories or tags (if applicable).
• Goals:
  • Goal statements (short-term and long-term goals);
  • Goal categories (personal, professional, health, etc.);
  • Progress indicators;
  • Target completion dates.

4.7. Life Sphere Diagnostics Data

When you use the life sphere diagnostics feature, we collect:

• Life sphere categories (e.g., career, relationships, health, finances, personal growth, family, spirituality);
• Your self-assessments (ratings or evaluations for each life sphere);
• Diagnostic reports (derived insights, scores, and analyses based on your assessments);
• Historical diagnostics (changes over time).

Important – Profiling:

Life Sphere Diagnostics involves Profiling – the automated analysis of your inputs to generate insights about your life circumstances, priorities, and areas for improvement. This processing:

• Does NOT constitute automated decision-making that produces legal effects or similarly significantly affects you (prohibited under Article 18 of UAE Data Protection Law and GDPR Article 22);
• Is conducted solely to provide the self-reflection features you requested;
• You have the right to object to this processing at any time.

See Section 8 for detailed information.

4.8. Practices Data

When you use mindfulness practices (meditations, affirmations, breathing exercises), we collect:

• Practice usage events (which practices you access);
• Session duration (how long you engage with each practice);
• Completion status (whether you completed or exited early);
• Frequency of use (daily, weekly trends);
• Practice preferences (favorites, recently used).

4.9. Optional Numerology Data (If You Opt In)

If you explicitly opt in to numerology features, we additionally collect:

• Full name (first name, last name, middle name/patronymic);
• Date of birth (day, month, year);
• Gender (male, female, other);
• Place of birth (city, country) – if required for specific calculations.

IMPORTANT – Separate Consent Required:

Numerology features are OPTIONAL and require separate, explicit consent.

By providing this data, you:

• Consent to processing of this identifiable personal data for numerology calculations;
• Understand that name + date of birth + gender = precise identification;
• Acknowledge this is a separate purpose of processing beyond the core wellbeing features.

You may withdraw this consent at any time by disabling numerology features or deleting your

numerology data via app settings.

Numerology data is processed in accordance with Section 8 (sensitive and identifiable data

protections).

4.10. Device and Technical Data

When you access the Service, we automatically collect:

• IP address (for security, fraud prevention, and approximate geolocation);
• Device ID or unique device identifier;
• Device type (smartphone, tablet, desktop);
• Operating system and version;
• Browser type and version (for web access);
• Language preference;
• Time zone;
• Screen resolution (to optimize display);
• App version (to ensure compatibility and provide updates).

4.11. Usage and Analytics Data

To improve the Service and understand user behavior, we collect:

• Session data (login time, session duration, logout time);
• Feature usage (which features you use, how often, and for how long);
• User interactions (clicks, taps, navigation patterns, screens viewed);
• Performance data (loading times, errors, crashes);
• Usage history (number of mood entries, diary entries created, AI chat sessions, tasks

completed, habits tracked, goals set, practices completed);

• Retention metrics (daily and weekly active usage);
• Crash logs and error reports (for troubleshooting).

This data is collected automatically through cookies, analytics tools (see Section 13), and our own logging systems.

4.12. Communications and Support Data

When you contact us for support or send us messages, we collect:

• Email address and name;
• Subject and content of your message;
• Support ticket ID and correspondence history;
• Device and account information you provide for troubleshooting;
• Attachments (screenshots, logs, or files you send us).

4.13. Marketing and Preferences Data (Optional)

If you consent to receive marketing communications, we may collect:

• Email address;
• Marketing preferences (topics of interest, frequency);
• Communication history (emails opened, links clicked);
• Opt-in and opt-out records.

You can withdraw consent at any time by clicking «Unsubscribe» in marketing emails or updating your preferences in account settings.

4.14. Information WE DO NOT Collect

In accordance with UAE Data Protection Law and data minimization principles, we do NOT

intentionally collect:

• Sensitive Personal Data (except as explicitly disclosed above):
  • Racial or ethnic origin;
  • Political opinions;
  • Trade union membership;
  • Genetic data;
  • Health data or medical diagnoses (unless you voluntarily include such information in diary or AI chat – see warnings above);
  • Data concerning sex life or sexual orientation (unless you voluntarily include such information).
• Other Data WE DO NOT Collect:
  • Financial account details (full credit card numbers, bank account numbers);
  • Government-issued ID numbers (passport, driver’s license, national ID, social security number);
  • Precise geolocation data (GPS coordinates – we collect only approximate location from IP address);
  • Children’s personal data (we do not knowingly collect data from individuals under 18).

Important: If you voluntarily provide Sensitive Personal Data in your diary, AI chat messages, or other inputs (e.g., discussing health conditions, therapy, medications, spiritual beliefs), you

acknowledge that such data may be processed solely for generating your requested outputs and

providing the Service. We recommend minimizing such disclosures.

5. HOW WE COLLECT YOUR INFORMATION

We collect personal information through the following methods:

5.1. Information You Provide Directly

You provide information directly when you:

(a) Register for an account or log in;

(b) Rate your mood or emotional state;

(c) Create diary or journal entries;

(d) Send messages to the AI chat assistant;

(e) Create tasks, set goals, or track habits;

(f) Complete life sphere diagnostic assessments;

(g) Access and use mindfulness practices;

(h) Opt in to numerology features and provide name or date of birth;

(i) Purchase a subscription or make a payment;

(j) Contact customer support or send us inquiries;

(k) Update your profile or account settings;

(l) Participate in surveys, contests, or promotions (if offered);

(m) Consent to receive marketing communications.

5.2. Information Collected Automatically

We collect information automatically when you use the Service through:

(a) Cookies and similar technologies (see Section 13);

(b) Server logs (recording IP addresses, timestamps, requests);

(c) Analytics tools (Amplitude);

(d) Mobile SDKs (software development kits embedded in our apps);

(e) Error and crash reporting tools (to diagnose technical issues).

5.3. Information from Third Parties

We may receive information about you from:

(a) Third-party authentication providers: none. Accounts are created with an email address and a password; the app does not use third-party or social sign-in services.

(b) Payment processors (Apple App Store, Google Play):

• Transaction status;
• Purchase confirmation;
• Refund information.

(c) Third-party AI Providers (if they return metadata or processing status related to AI chat

responses).

(d) Analytics and advertising partners (aggregated or de-identified usage data).

We require all third parties to process your information lawfully and in accordance with applicable data protection laws.

6. LEGAL BASIS FOR PROCESSING

Under UAE Federal Decree-Law No. 45 of 2021 and other applicable data protection laws, we process your personal information based on the following legal grounds:

6.1. Performance of Contract (Article 4(9) of UAE Data Protection Law)

We process your personal information to:

(a) Provide the Service you have requested;

(b) Create and manage your account;

(c) Process payments and subscriptions;

(d) Track your mood and provide historical insights;

(e) Store and secure your diary entries;

(f) Process your AI chat queries and provide AI-generated responses;

(g) Manage your tasks, habits, and goals;

(h) Generate life sphere diagnostic reports based on your assessments;

(i) Deliver mindfulness practices and track your usage;

(j) Process optional numerology data (if you opt in);

(k) Provide customer support;

(l) Fulfill our obligations under the Terms of Service.

Data categories: Account data, payment data, Mood Data, Diary Data, AI Chat Data, productivity data (tasks, habits, goals), Life Sphere Diagnostics, Practices data, optional numerology data,

Generated Content, device data, usage data.

6.2. Your Consent (Articles 4 and 6 of UAE Data Protection Law)

We obtain your explicit, informed, and freely given consent to process:

(a) Sensitive Personal Data (Mood Data, Diary Data, AI Chat Data, Life Sphere Diagnostics) –

obtained when you:

• Create your account and agree to this Privacy Policy;
• First use mood tracking, diary, AI chat, or diagnostic features;
• Are presented with in-app consent prompts (where applicable).

(b) AI Chat transmission to Third-Party AI Providers – obtained when you:

• Send your first AI chat message;
• Agree to this Privacy Policy (which explicitly discloses third-party processing);
• Are presented with a consent prompt before using AI chat (where required).

(c) Optional Numerology Data (name, date of birth, gender) – obtained when you:

• Explicitly opt in to numerology features;
• Provide this data via dedicated input forms;
• Confirm consent via checkboxes or prompts.

(d) Marketing communications (email);

(e) Non-essential cookies (analytics, marketing cookies);

(f) Cross-border data transfers (where required by law).

You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

6.3. Compliance with Legal Obligations (Article 4(10) of UAE Data Protection Law)

We process your information to comply with:

(a) UAE laws and regulations (tax, accounting, anti-money laundering);

(b) Court orders, subpoenas, or lawful requests from authorities;

(c) Data protection laws (reporting data breaches, responding to data subject requests);

(d) Intellectual property laws (responding to copyright infringement notices).

Data categories: Account data, transaction data, communications, usage logs.

6.4. Legitimate Interests (Article 4(7) of UAE Data Protection Law)

We process your information based on our legitimate interests, provided such interests do not override your fundamental rights and freedoms:

(a) Security and fraud prevention:

• Detecting and preventing unauthorized access;
• Identifying fraudulent transactions;
• Monitoring for abuse of the Service.

(b) Service improvement and development:

• Analyzing usage patterns to improve features;
• Testing new features and functionality;
• Conducting research and development.

(c) Business operations:

• Internal record-keeping;
• Financial reporting and auditing;
• Business planning and analytics.

(d) Legal claims:

• Establishing, exercising, or defending legal rights;
• Resolving disputes.

Data categories: Usage data, device data, transaction data, communications.

We conduct balancing tests to ensure our legitimate interests do not override your privacy rights. You have the right to object to processing based on legitimate interests (see Section 12).

6.5. Protection of Vital Interests

In exceptional cases, we may process your information to protect:

(a) Your life or physical safety;

(b) The life or physical safety of others.

This legal basis is rarely used and only in emergency situations.

7. HOW WE USE YOUR INFORMATION

We use your personal information for the following purposes, corresponding to the legal bases

described in Section 6:

7.1. Providing and Delivering the Service

• Creating and managing your account;
• Authenticating your identity when you log in;
• Recording and tracking your mood ratings and displaying historical trends;
• Storing your diary and journal entries securely and making them accessible to you;
• Processing your AI chat messages (transmitting to AI Providers, receiving and delivering AI responses, maintaining chat context);
• Managing your tasks, habits, and goals (tracking completion, sending reminders);
• Generating life sphere diagnostic reports based on your assessments;
• Delivering mindfulness practices and tracking your practice history;
• Processing optional numerology data (if you opt in) to generate numerology insights;
• Processing payments and managing subscriptions;
• Providing customer support and responding to inquiries;
• Sending transactional emails (account confirmations, password resets, payment receipts, feature notifications);
• Enabling features you have requested.

7.2. Improving and Developing the Service

• Analyzing usage patterns and user behavior to improve features and user experience;
• Conducting research and development for new wellbeing tools, AI capabilities, and content;
• Testing new features, updates, and bug fixes;
• Generating anonymized and aggregated statistics for internal analysis (e.g., «average mood rating trends», «most popular practices», «feature adoption rates»);
• Improving our AI models and algorithms (using only anonymized or aggregated data derived from usage patterns, NEVER your identifiable Mood Data, Diary entries, AI Chat messages, or personal User Content).

7.3. Security, Fraud Prevention, and Compliance

• Detecting and preventing fraud, abuse, and unauthorized access;
• Monitoring for violations of our Terms of Service;
• Investigating security incidents and data breaches;
• Complying with legal obligations (tax, accounting, regulatory requirements);
• Responding to lawful requests from authorities;
• Establishing, exercising, or defending legal claims.

7.4. Marketing and Communications (With Your Consent)

• Sending promotional emails about new features, special offers, or updates (only if you have consented);
• Personalizing marketing messages based on your preferences and usage history;
• Conducting surveys to gather feedback;
• Informing you about events, webinars, or promotions.

You can opt out of marketing communications at any time by:

• Clicking «Unsubscribe» in marketing emails;
• Updating your preferences in account settings;
• Contacting us at hello@mindlight-app.com.

7.5. Analytics and Performance Monitoring

• Measuring Service performance, uptime, and reliability;
• Tracking feature adoption and usage trends;
• Identifying and fixing technical errors and bugs;
• Optimizing loading times and user interface;
• Monitoring server capacity and scaling infrastructure.

8. SENSITIVE PERSONAL DATA AND AI PROCESSING

This section is critically important. Please read it carefully.

8.1. What is Sensitive Personal Data in MindLight?

Under UAE Federal Decree-Law No. 45 of 2021, GDPR Article 9, and other applicable data protection laws, Sensitive Personal Data includes data revealing:

• Mental health or psychological state;
• Emotional wellbeing;
• Health data;
• Other special categories of personal data.

In the context of MindLight, the following data categories may constitute Sensitive Personal Data:

(a) Mood Data / Wellbeing Data:

Your self-reported mood ratings and historical tracking may reveal information about your mental and emotional state.

(b) Diary / Journal Data:

Your diary entries are unstructured text input and may contain:

• Information about your mental health, emotional struggles, therapy, medications;
• Personal relationships, intimate life details;
• Spiritual or philosophical beliefs;
• Health conditions or medical information;
• Other highly personal or sensitive information.

(c) AI Chat Data:

Your conversations with the AI chat assistant may contain:

• Discussions about your emotional state, mental health, personal problems, life challenges;
• Information about your relationships, career struggles, family issues;
• Spiritual, philosophical, or existential questions;
• Other sensitive personal topics.

(d) Life Sphere Diagnostics:

Your self-assessments of life spheres (career satisfaction, relationship quality, health, etc.) and the resulting derived insights (profiling) may reveal sensitive information about your life circumstances, priorities, and psychological state.

8.2. How We Process Sensitive Personal Data

Legal Basis:

We process Sensitive Personal Data based on:

• Your explicit consent, obtained when you:
• Create your account and agree to this Privacy Policy (which explicitly discloses sensitive data processing);
• First use mood tracking, diary, AI chat, or diagnostic features;
• Are presented with in-app consent prompts (where required by law).

Performance of contract – processing is necessary to provide the wellbeing, journaling, AI chat, and diagnostic services you have requested under our Terms of Service.

Processing Activities:

(a) Mood Data:

Storage: Securely encrypted and stored on our servers;

Retention: Until you delete it, or up to 30 days after account deletion (see Section 11);

Access: Accessible only to you (and our technical staff with strict access controls for support or troubleshooting);

Use: Displayed to you in charts, trends, and historical views. NOT used for profiling, automated decision-making, or training AI models.

(b) Diary Data:

Storage: Securely encrypted and stored on our servers;

Retention: Until you delete it, or up to 30 days after account deletion;

Access: Accessible only to you (we do NOT read, review, or moderate your diary entries);

Use: Displayed to you for personal reflection. NOT shared with third parties. NOT used to train AI models. NOT analyzed for marketing or profiling.

(c) AI Chat Data:

Processing Flow:

• You send a chat message;
• Your message is transmitted via encrypted connection to a third-party AI Provider (see Section 8.5 below);
• The AI Provider processes your message and generates a response;
• The response is returned to us and displayed to you;
• The AI Provider deletes your message immediately after processing (per our contractual agreements);
• We store your chat history (messages and responses) for up to 90 days (configurable; you may delete earlier).

Storage: Encrypted and stored on our servers;

Retention: Up to 90 days (you may delete at any time via app settings);

Access: Accessible only to you (and technical staff for troubleshooting, with strict access controls); Use: Displayed to you to maintain conversational context. NOT used to train our general AI models.

(d) Life Sphere Diagnostics:

Processing: Your self-assessments are analyzed using algorithms to generate insights, scores, and recommendations;

Profiling: This processing constitutes Profiling (automated evaluation of personal aspects);

Storage: Encrypted and stored;

Retention: Until you delete it, or up to 30 days after account deletion;

Use: NOT used for automated decision-making that produces legal effects or similarly significantly affects you (prohibited under Article 18 of UAE Data Protection Law and GDPR Article 22);

Your Right: You may object to profiling at any time (see Section 12.6).

8.3. What WE DO NOT DO with Sensitive Personal Data

We do NOT and will NEVER:

(a) Sell, rent, or trade your Mood Data, Diary Data, AI Chat Data, or Life Sphere Diagnostics to third parties for monetary consideration;

(b) Use your Sensitive Personal Data for marketing or advertising (e.g., targeting ads based on your mood or diary content);

(c) Share your Diary Data with any third party (except as required by law – see Section 9.3);

(d) Use your Mood Data, Diary Data, or AI Chat Data to train our general AI models or for purposes unrelated to providing the Service to you;

(e) Provide medical, psychiatric, or professional psychological advice based on your data (see Section 8.4);

(f) Make automated decisions with legal effects based on profiling (e.g., credit decisions, employment decisions, insurance underwriting);

(g) Discriminate against you based on your Sensitive Personal Data;

(h) Disclose your Sensitive Personal Data to employers, insurers, law enforcement, or other third parties (except as strictly required by law – see Section 9.3 and 9.4).

8.4. NOT Medical, Psychiatric, or Professional Psychological Service

CRITICAL DISCLAIMER:

MindLight, including all mood tracking, diary, AI chat, and life sphere diagnostic features, DOES NOT provide, and is NOT intended to provide:

• Medical, psychiatric, or professional psychological advice, diagnosis, or treatment;
• Mental health diagnoses or clinical assessments;
• Therapy, counseling, or psychotherapy;
• Crisis intervention or suicide prevention services;
• Licensed mental health professional services.

All features, insights, and AI responses are for informational, self-exploration, and entertainment purposes only. They are NOT a substitute for face-to-face professional consultations with licensed healthcare providers, therapists, psychiatrists, or counselors.

If you are experiencing:

• A medical or mental health emergency;
• Severe psychological distress, anxiety, or depression;
• Thoughts of self-harm or suicide;
• Harm to others;
• Any life-threatening situation;

DO NOT USE THE SERVICE

Immediately:

• Call your local emergency services;
• Contact a crisis hotline in your country;
• Go to the nearest emergency room;
• Contact a licensed mental health professional.

The Company is NOT liable for any consequences arising from your use of or reliance on the Service in lieu of professional medical or psychological care.

8.5. AI Chat and Third-Party Processing

IMPORTANT – Cross-Border Data Transfer:

When you use the AI chat assistant, your chat messages are transmitted to third-party AI Providers located outside your country for processing.

AI Provider Details:

(a) AI Provider Identity:

We use large language model (LLM) providers.

AI Providers are located primarily in the United States and may process data on servers in the USA, EU, or other jurisdictions.

(b) Data Shared with AI Providers:

What IS shared:

• Text content of your chat messages (queries, prompts, conversational inputs);
• Session identifiers (to maintain conversation context across multiple messages);
• Processing parameters (e.g., model version, temperature settings).

What is NOT shared:

• Your email address;
• Your name or User ID;
• Your payment information;
• Your Diary Data, Mood Data, or other User Content (unless you explicitly reference them in your chat messages);
• Your device information or IP address.

(c) AI Provider Data Handling Commitments:

We select AI Providers based on their privacy and security practices and require them (contractually) to:

• Process data only for generating AI responses (not for their own purposes);
• NOT use your chat messages to train their general AI models:
  • We utilize enterprise API endpoints with «Zero Data Retention» and «Opt-Out from Training» policies enabled;
  • Your chat data is excluded from AI Provider training datasets per our Data Processing Agreements.
• Delete your chat messages immediately after processing (typically within seconds or minutes);
• Implement robust security measures:
  • Encryption in transit;
  • Encryption at rest;
  • Access controls and authentication;
  • Regular security audits.
• Comply with applicable data protection laws (GDPR, CCPA, UAE Data Protection Law).

(d) Cross-Border Transfer Safeguards:

Transfers of AI Chat Data to AI Providers in the USA or other third countries are protected by:

• Standard Contractual Clauses (SCCs) (EU Commission-approved);
• EU-U.S. Data Privacy Framework (DPF) adequacy decision (for certified providers);
• Encryption (data encrypted in transit and at rest);
• Contractual safeguards (Data Processing Agreements);
• Your explicit consent (obtained via this Privacy Policy and in-app prompts).
• See Section 10 for comprehensive details on international data transfers.

(e) AI Provider Privacy Policies:

For more information, you may review AI Provider privacy policies.

However, we cannot guarantee AI Providers’ compliance. If you have specific concerns about

third-party processing, contact us at hello@mindlight-app.com or refrain from using the AI chat feature.

AI Chat is not a crisis oriented service. If AI Chat filters detect keywords related to self-harm, suicide, severe distress – AI Chat will automatically display the crisis message and will not process the query with the AI Provider. No records of such messages is retained.

8.6. Your Rights Regarding Sensitive Personal Data

You have the right to:

(a) Withdraw consent at any time by:

• Deleting your Mood Data, Diary entries, or AI Chat history via app settings;
• Disabling specific features (mood tracking, diary, AI chat, life diagnostics);
• Deleting your account entirely;
• Contacting us at hello@mindlight-app.com to request deletion.

Withdrawal of consent does not affect the lawfulness of processing based on consent before

withdrawal.

(b) Access your Sensitive Personal Data (see Section 12.1);

(c) Rectify inaccurate Sensitive Personal Data (see Section 12.2);

(d) Erase or Delete your Sensitive Personal Data (see Section 12.3);

(e) Restrict processing of your Sensitive Personal Data (see Section 12.4);

(f) Data portability – receive your Sensitive Personal Data in a structured, machine-readable format (see Section 12.5);

(g) Object to processing based on legitimate interests or profiling (see Section 12.6);

(h) Lodge a complaint with the UAE Data Office or your local supervisory authority (see Section 12.8).

8.7. Third-Party Data in Diary and AI Chat

If you mention or include personal information of other individuals (names, details, characteristics) in your diary entries or AI chat messages, you represent and warrant that:

(a) You are providing this data for purely personal or household activities (e.g., personal journaling, self-reflection);

(b) You have obtained necessary consents from those individuals (where required by applicable law) or have another lawful basis for processing their data;

(c) You comply with applicable data protection laws governing third-party data.

Company’s Role:

• The Company acts as Data Controller for Third-Party Data you input;
• We process Third-Party Data based on our legitimate interest (to provide the requested Service to you);

We implement strict data minimization:

• We do NOT use Third-Party Data to train AI models;
• We do NOT contact third parties mentioned in your diary or chat;
• We delete Third-Party Data when you delete diary entries, chat messages, or your account.

Your Responsibility:

You are solely responsible for:

• Ensuring you have a lawful basis to input third-party data;
• Obtaining necessary consents (where required);
• Complying with applicable laws (GDPR, CCPA, etc.);
• Any claims or complaints from third parties whose data you provided without authorization.

You agree to indemnify and hold the Company harmless from any claims arising from your

unauthorized processing of third-party data (see Terms of Service, Section 16).

8.8. Automated Decision-Making and Profiling

Profiling Disclosure:

In accordance with UAE Data Protection Law, Article 18, and GDPR Article 22, we disclose the following:

(a) Profiling Occurs:

The Life Sphere Diagnostics feature involves Profiling – automated analysis of your self-assessments to generate insights about your life circumstances, priorities, and areas for improvement.

(b) No Legal Effects or Similarly Significant Effects:

This profiling DOES NOT constitute automated decision-making that produces legal effects

concerning you or similarly significantly affects you within the meaning of Article 18 of UAE Data Protection Law or GDPR Article 22.

Specifically, we do NOT use profiling to:

• Make credit, loan, or financial decisions;
• Make employment, hiring, or promotion decisions;
• Determine insurance eligibility or pricing;
• Make legal, governmental, or law enforcement decisions;
• Deny you services, benefits, or opportunities;
• Subject you to discrimination or adverse treatment.

(c) Purpose of Profiling:

Profiling is conducted solely to:

• Provide the self-reflection and life assessment features you requested;
• Generate personalized insights for your personal use and entertainment;
• Help you identify areas of your life you may wish to focus on (for informational purposes only).

(d) Your Rights:

You have the right to:

• Object to profiling (see Section 12.6) – we will stop processing your Life Sphere Diagnostics;
• Request human review of any insights or recommendations (contact us at

hello@mindlight-app.com);

• Delete your Life Sphere Diagnostics data at any time.

9. SHARING AND DISCLOSURE OF INFORMATION

We do not sell, rent, or trade your personal information to third parties. We share your information only in the limited circumstances described below, and only to the extent necessary to provide the Service, comply with law, or protect our rights.

9.1. Service Providers and Processors

We engage third-party service providers to perform functions on our behalf, acting as data

processors under our instruction:

(a) Cloud Infrastructure and Hosting:

• Amazon Web Services (AWS), Google Cloud Platform (GCP), or similar providers
• Purpose: Hosting the Service, storing data, computing resources
• Data shared: All categories (account, User Content including Mood Data, Diary Data, AI Chat Data, productivity data, Generated Content, device data)
• Location: Primarily USA and EU regions, see Section 10 for cross-border transfers
• Safeguards: Standard Contractual Clauses, encryption, access controls

(b) Payment Processing:

• Apple App Store, Google Play
• Purpose: Processing payments, managing subscriptions, issuing refunds
• Data shared: Transaction data, email address (we do not share or store payment card details)
• Note: Payment processors act as independent data controllers for payment card data and are PCI DSS compliant

(с) AI and Machine Learning Providers:

• Third-party AI model providers (e.g., providers of generative AI APIs)
• Purpose: Processing AI Chat messages to generate conversational responses
• Data shared: Text content of your AI chat messages (queries, prompts), Session identifiers (for context), NOT shared: Email address, name, User ID, payment information, Diary Data, Mood Data, or unrelated User Content.
• Safeguards:
  • Data transmitted via encrypted connections (TLS 1.3+);
  • Contractual obligations prohibiting use of data for training their general models; Immediate deletion of data after response generation (per our Data Processing Agreements);
  • Enterprise API endpoints with «Zero Data Retention» policies enabled;
  • Standard Contractual Clauses (SCCs) for EU and UK data transfers;
  • EU-U.S. Data Privacy Framework (DPF) adequacy (for certified providers).

(d) Analytics and Performance Monitoring:

• Providers: Amplitude
• Purpose: Usage analytics, performance monitoring, crash reporting
• Data shared: usage data, device data and session data, linked to your internal user identifier (NOT Mood Data, Diary Data, or AI Chat Data)
• Location: Various (see provider’s privacy policy)
• Opt-out: You can opt out via device settings or browser settings (see Section 13)

(e) Customer Support:

• Zendesk, Intercom, or similar support platforms
• Purpose: Managing support tickets, live chat, email communications
• Data shared: Email, name, support messages, account information (only information you provide in support requests)
• Location: USA, EU

(f) Email and Communications:

• SendGrid, Mailchimp, or similar email service providers
• Purpose: Sending transactional and marketing emails
• Data shared: Email address, name, preferences
• Opt-out: Click «Unsubscribe» in emails

All service providers are contractually bound to:

• Process data only on our instructions;
• Implement appropriate security measures (encryption, access controls, audits);
• Delete or return data upon termination of services;
• NOT use data for their own purposes;
• Comply with applicable data protection laws (GDPR, CCPA, UAE Data Protection Law).

9.2. Business Transfers

If we are involved in a merger, acquisition, reorganization, sale of assets, bankruptcy, or similar business transaction, your personal information may be transferred to the successor entity, subject to:

(a) Notification to you via email and/or prominent notice on the Website;

(b) Same or equivalent privacy protections as provided in this Privacy Policy;

(c) Option to delete your account before the transfer (if you do not consent).

9.3. Legal Obligations and Law Enforcement

We may disclose your personal information if required to do so by law or in response to:

(a) Court orders, subpoenas, warrants, or legal processes;

(b) Lawful requests from government authorities, regulators, or law enforcement agencies;

(c) National security or public safety requirements;

(d) UAE Data Office requests (under Article 24 of UAE Data Protection Law).

We will:

• Verify the legal basis for any request;
• Disclose only the minimum information required;
• Notify you (unless legally prohibited);
• Challenge overly broad or unlawful requests where possible.

9.4. Protection of Rights and Safety

We may disclose your information to:

(a) Enforce our Terms of Service and other agreements;

(b) Detect, prevent, or investigate fraud, security breaches, or illegal activity;

(c) Protect life or physical safety (yours, ours, or that of others) – for example, If you disclose

imminent risk of self-harm or harm to others in AI chat or diary, and we determine immediate action is necessary, we may disclose relevant information to emergency services or authorities;

(d) Establish, exercise, or defend legal claims in litigation or arbitration.

Note: We do NOT proactively monitor or review your Diary Data or AI Chat messages. Disclosure under this Section would occur only in exceptional circumstances where we become aware of

imminent risk.

9.5. With Your Consent

We may share your information with third parties for purposes not described in this Privacy Policy if we obtain your explicit consent.

9.6. Anonymized and Aggregated Data

We may share anonymized and aggregated data that cannot identify you individually with:

(a) Business partners for analytics or research;

(b) Advertisers or marketing partners (aggregate usage statistics);

(c) Academic researchers (for publications or studies);

(d) The public (in reports, presentations, or blog posts).

This data is not considered personal information under data protection laws.

10. INTERNATIONAL DATA TRANSFERS

10.1. Cross-Border Transfers

The Company is located in the United Arab Emirates. When you use the Service, your personal information may be transferred to, stored in, and processed in:

(a) The United Arab Emirates (where the Company is based);

(b) The United States (where cloud infrastructure providers are located);

(c) The European Union (where some service providers are located);

(d) Other countries where our service providers operate.

Some of these countries may not provide the same level of data protection as your country of

residence.

10.2. Legal Safeguards for Transfers

In accordance with UAE Federal Decree-Law No. 45 of 2021, Articles 22 and 23, we ensure that cross-border data transfers are protected by appropriate safeguards:

(a) Adequacy Decisions (Article 45 GDPR):

Where applicable, we rely on adequacy decisions issued by the European Commission, such as the EU-U.S. Data Privacy Framework (DPF), when transferring personal data to certified service

providers located in the United States.

(b) Standard Contractual Clauses (Article 46 GDPR):

For transfers to countries without an adequacy decision (including transfers from the EU to the UAE), we implement appropriate safeguards, primarily relying on the standard data protection clauses (SCCs) adopted by the European Commission, coupled with supplementary technical and organizational measures (such as robust encryption).

(c) Additional Safeguards:

We implement supplementary measures, including:

• Encryption of data in transit and at rest;
• Pseudonymization and anonymization where feasible;
• Access controls limiting who can access data in each jurisdiction;
• Regular audits of service provider security practices;
• Data transfer impact assessments evaluating risks.

(d) Your Consent:

For certain transfers (e.g., to AI providers in third countries), we obtain your explicit consent by:

• Disclosing the transfer in this Privacy Policy (Section 8.5);
• Requiring you to agree to this Privacy Policy before using AI chat features;
• Presenting in-app consent prompts (where required);
• Providing clear information about the destination, purpose, and risks.

10.3. Your Rights Regarding Cross-Border Transfers

You have the right to:

(a) Object to transfers to specific countries or providers;

(b) Request information about the safeguards protecting your data;

(c) Obtain a copy of the Standard Contractual Clauses or other transfer mechanisms.

If you object to cross-border transfers, we may be unable to provide certain features of the Service.

10.4. Specific Transfer Scenarios

(a) AI Processing via Third-Party APIs:

When you use the AI chat assistant, your chat messages may be transmitted to third-party AI Providers located in the United States.

This transfer is:

• Necessary to perform the contract (Terms of Service);
• Based on your consent (inputting data and clicking «Generate Report»);
• Protected by encryption and contractual safeguards;
• Temporary (data is deleted by AI Providers immediately after response generation).

(b) Cloud Storage:

Your account data, User Content, and Generated Content are stored on servers operated by cloud providers located primarily in:

• USA;
• EU if you are in the EU.

We select data center locations to optimize performance and comply with data localization

requirements where applicable.

11. DATA RETENTION

11.1. Retention Principles

We retain your personal information only for as long as necessary to:

(a) Provide the Service and fulfill the purposes described in this Privacy Policy;

(b) Comply with legal, tax, accounting, or regulatory obligations;

(c) Resolve disputes and enforce our agreements;

(d) Protect our legal rights and defend against claims.

After the retention period expires, we delete or anonymize your personal information in accordance with UAE Data Protection Law, Article 5(7).

11.2. Specific Retention Periods

11.3. Deletion Process

When retention periods expire or you request deletion, we:

(a) Permanently delete your data from active systems;

(b) Delete backup copies within 90 days (backups are retained temporarily for disaster recovery);

(c) Anonymize data used in aggregated analytics (so it can no longer identify you);

(d) Securely destroy physical copies (if any).

Deletion is irreversible and you will not be able to recover data after it is deleted.

11.4. Legal Holds and Exceptions

We may retain data longer than the standard retention period if:

(a) Required by law (e.g., litigation hold, regulatory investigation);

(b) Necessary for legal claims (until the claim is resolved);

(c) You have requested (e.g., to preserve evidence for a dispute);

(d) Anonymized (anonymized data is no longer personal data and may be retained indefinitely).

12. YOUR PRIVACY RIGHTS

Under UAE Federal Decree-Law No. 45 of 2021 and other applicable data protection laws, you have the following rights regarding your personal information:

12.1. Right to Access (Article 13 of UAE Data Protection Law)

You have the right to obtain:

(a) Confirmation of whether we are processing your personal information;

(b) Access to your personal information;

(c) Information about the processing, including:

• Purposes of processing;
• Categories of data processed;
• Recipients or categories of recipients;
• Retention periods;
• Sources of data (if not collected from you);
• Existence of automated decision-making (if any).

How to exercise: Email us at hello@mindlight-app.com or access your account settings. We will respond within 15 working days (or as required by applicable law).

12.2. Right to Rectification (Article 15 of UAE Data Protection Law)

You have the right to:

(a) Correct inaccurate personal information;

(b) Complete incomplete personal information.

How to exercise: Update your information in account settings or contact us at

hello@mindlight-app.com.

12.3. Right to Erasure / Deletion (Article 15 of UAE Data Protection Law)

You have the right to request deletion of your personal information if:

(a) The data is no longer necessary for the purposes for which it was collected;

(b) You withdraw consent (where processing is based on consent);

(c) You object to processing (see Section 12.6);

(d) The data has been unlawfully processed;

(e) Deletion is required by law.

Exceptions: We may refuse deletion if retention is necessary for:

• Legal obligations (tax, accounting);
• Establishing, exercising, or defending legal claims;
• Public health or safety;
• Archiving in the public interest, scientific/historical research (with safeguards).

How to exercise: Delete your account in app settings or contact us at hello@mindlight-app.com. We will delete your data within 30 days (except as noted in Section 11).

12.4. Right to Restrict Processing (Article 16 of UAE Data Protection Law)

You have the right to request that we restrict processing (i.e., stop using but continue storing) your data if:

(a) You contest the accuracy of the data (restriction applies while we verify);

(b) Processing is unlawful but you prefer restriction over deletion;

(c) We no longer need the data, but you need it for legal claims;

(d) You object to processing (restriction applies while we verify our legitimate grounds).

How to exercise: Contact us at hello@mindlight-app.com.

12.5. Right to Data Portability (Article 14 of UAE Data Protection Law)

You have the right to:

(a) Receive your personal information in a structured, commonly used, machine-readable format;

(b) Transmit the data to another service provider (where technically feasible).

This right applies only to data:

• Processed based on consent or contract;
• Processed by automated means.

How to exercise: Request a data export by emailing hello@mindlight-app.com. We will provide your data within 30 days.

Data included in export:

• Account data (email, User ID, registration date);
• Mood Data (all mood ratings and history);
• Diary Data (all journal entries);
• AI Chat history (all messages and responses);
• Tasks, Habits, Goals;
• Life Sphere Diagnostics;
• Practices usage history;
• Optional Numerology data (if applicable);
• Generated Content.

12.6. Right to Object (Articles 17 and 18 of UAE Data Protection Law)

You have the right to object to processing based on:

(a) Legitimate interests (Section 6.4) – we will stop unless we demonstrate compelling legitimate grounds that override your rights;

(b) Direct marketing – we will stop immediately (opt-out links are provided in all marketing emails);

(c) Profiling or automated decision-making – we will stop or provide human review.

How to exercise: Click «Unsubscribe» in marketing emails, adjust account settings, or contact us at hello@mindlight-app.com.

12.7. Right to Withdraw Consent (Article 6(2) of UAE Data Protection Law)

Where processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. In accordance with Article 7(3) of the GDPR, we ensure that it is as easy to withdraw your consent as it is to give it. How to exercise:

• Marketing emails: Click «Unsubscribe»;
• Cookies: Adjust browser settings or use our cookie preferences tool (see Section 13);
• Mood tracking, Diary, AI Chat: Delete data via app settings or disable features;
• Optional Numerology: Disable numerology features or delete numerology data;
• General consent: Email us at hello@mindlight-app.com.

12.8. Right to Lodge a Complaint (Article 24 of UAE Data Protection Law)

You have the right to lodge a complaint with the UAE Data Office if you believe we have violated your privacy rights:

UAE Data Office

Website: https://u.ae/en/about-the-uae/digital-uae/data

Phone: +97126118229

You may also lodge a complaint with the supervisory authority in your country of residence (if

different from the UAE), such as:

• GDPR (EU/UK): Your national data protection authority;
• CCPA (California): California Attorney General;
• See Section 19 for regional contacts.

12.9. Exercising Your Rights

To exercise any of the above rights:

(a) Contact us at:

• Email: hello@mindlight-app.com
• Support: hello@mindlight-app.com
• Address: Dubai Silicon Oasis DSO-IFZA, IFZA Properties, Dubai, PO Box 34, United Arab Emirates

(b) Include in your request:

• Your name and email address (associated with your account);
• Description of the right you wish to exercise;
• Any supporting information or documentation.

(c) Verification:

We may request additional information to verify your identity (to prevent unauthorized access). We will not use information provided in a request for any other purpose.

(d) Response time:

• UAE Data Protection Law: 10 working days (extendable by 5 days with notice);
• GDPR: 1 month (extendable by 2 months for complex requests);
• CCPA: 45 days (extendable by 45 days);
• We aim to respond as quickly as possible under all applicable laws.

(e) Fees:

We do not charge a fee for exercising your rights, unless your request is manifestly unfounded or excessive (e.g., repetitive requests). In such cases, we may charge a reasonable administrative fee or refuse the request.

12.10. Limitations on Rights

Your rights are not absolute. We may deny or limit requests if:

(a) Legal obligation: Processing is required by law;

(b) Public interest: Processing is necessary for public health, safety, or vital interests;

(c) Legal claims: Data is needed to establish, exercise, or defend legal rights;

(d) Trade secrets: Disclosure would reveal confidential business information;

(e) Rights of others: Your request would adversely affect others’ rights.

We will inform you of any denial and the reasons, and you may challenge our decision with the UAE Data Office or applicable supervisory authority.

13. COOKIES AND TRACKING TECHNOLOGIES

13.1. What Are Cookies?

Cookies are small text files placed on your device (computer, phone, tablet) when you visit a website or use an app. Cookies allow the service to recognize your device, remember your preferences, and provide personalized experiences.

We also use similar technologies such as:

• Pixels (invisible images embedded in emails or web pages);
• Local storage (HTML5 local storage, session storage);
• Mobile SDKs (software development kits in our apps);
• Device fingerprinting (collecting device characteristics).

13.2. Types of Cookies We Use

(a) Strictly Necessary Cookies (Essential)

Purpose: Enable basic functionality of the Service, the Service cannot function without them.

Examples:

• Session management (keeping you logged in);
• Security (CSRF tokens, fraud prevention);
• Load balancing (routing requests to servers);
• Account authentication.

Legal basis: Legitimate interest (necessary to provide the Service).

Retention: Session (deleted when you close browser) or up to 30 days.

Consent required: No (essential for Service operation).

(b) Functional Cookies

Purpose: Remember your preferences and choices to enhance your experience.

Examples:

• Language preference;
• Theme (ligh or dark mode).

Legal basis: Legitimate interest or consent (depending on jurisdiction).

Retention: Up to 1 year.

Consent required: In some jurisdictions (e.g., EU, UK).

(c) Analytics and Performance Cookies

Purpose: Understand how users interact with the Service, measure performance, identify errors. Examples:

• Amplitude (feature adoption, retention metrics);
• Crash reporting tools (error logs, stack traces).

Data collected: user behavior, device type, OS, pages visited, clicks and session duration, linked to your internal user identifier (NOT Mood Data, Diary Data, or AI Chat Data).

Legal basis: Consent (required in EU, UK, California).

Retention: as configured with the analytics provider.

Opt-out:

• Browser settings (block third-party cookies);
• App settings (disable analytics).

(d) Marketing and Advertising Cookies

Purpose: Deliver targeted advertising, measure ad effectiveness, build user profiles for marketing. Examples:

• Retargeting pixels (Facebook Pixel, Google Ads);
• Ad networks (serving personalized ads);
• Conversion tracking (attributing sign-ups or purchases to ads).

Legal basis: Explicit consent required (EU, UK, California).

Retention: Up to 2 years.

Opt-out:

• Cookie consent banner (reject marketing cookies);
• Browser settings (block third-party cookies);
• Industry opt-out tools:
  • Digital Advertising Alliance (DAA): http://optout.aboutads.info/
  • Network Advertising Initiative (NAI): http://optout.networkadvertising.org/
  • European Interactive Digital Advertising Alliance (EDAA): http://www.youronlinechoices.eu/

Note: We currently do not use marketing/advertising cookies, but may do so in the future with your consent.

13.3. Cookie Consent and Management

(a) Consent Banner:

When you first visit our Website or use the Service, we display a cookie consent banner allowing you to:

• Accept all cookies;
• Reject non-essential cookies;
• Customize your preferences (select specific cookie categories).

Your choice is saved for 12 months.

(b) Changing Your Preferences:

You can change your cookie preferences at any time by:

• Accessing the Cookie Settings link in the footer of our Website;
• Adjusting your browser settings (see below);
• Adjusting app settings (if available).

(c) Browser Controls:

Most browsers allow you to:

• Block cookies (all or third-party only);
• Delete cookies (clear browsing data);
• Receive alerts when cookies are set.

Browser instructions:

• Chrome: Settings > Privacy and security > Cookies and other site data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Cookies and website data
• Edge: Settings > Cookies and site permissions

Note: Blocking essential cookies may prevent you from using certain features of the Service.

(d) Mobile App Tracking:

On mobile devices, you can:

• iOS: Settings > Privacy > Tracking > [App Name] > Toggle off «Allow Apps to Request to Track»
• Android: Settings > Google > Ads > Opt out of Ads Personalization

13.4. Do Not Track

Some browsers offer a «Do Not Track» (DNT) signal. We currently do not respond to DNT signals because there is no industry standard for how to interpret them. We will update this Policy if we adopt a DNT protocol in the future.

13.5. Cookie List

For a detailed list of cookies used on our Website and in our apps, including cookie names, providers, purposes, and expiration periods, please visit our Cookie Policy or contact us at

hello@mindlight-app.com.

14. DATA SECURITY

14.1. Our Commitment to Security

We take the security of your personal information seriously. We implement appropriate technical and organizational measures to protect your data against:

(a) Unauthorized or unlawful access;

(b) Accidental loss, destruction, or damage;

(c) Alteration or disclosure;

(d) Cyberattacks (hacking, malware, ransomware);

(e) Data breaches.

Our security measures are designed to comply with UAE Federal Decree-Law No. 45 of 2021, Articles 7 and 20, as well as international best practices.

14.2. Technical Security Measures

(a) Encryption:

• In Transit: All data transmitted between your device and our servers is encrypted using TLS 1.3 (Transport Layer Security) or higher.
• At Rest: Sensitive data (passwords, Mood Data, Diary Data, AI Chat Data, User Content) is encrypted at rest using AES-256 encryption or equivalent.

(b) Access Controls:

• Role-based access control (RBAC): Employees and contractors have access only to data necessary for their job functions.
• Multi-factor authentication (MFA): Required for all administrative access to production systems.
• Least privilege principle: Access is granted on a need-to-know basis.
• Access logs: All access to Sensitive Personal Data (Diary, AI Chat, Mood) is logged and audited.

(c) Network Security:

• Firewalls protecting our servers from unauthorized access.
• Intrusion detection and prevention systems (IDS/IPS) monitoring for malicious activity.
• Virtual Private Clouds (VPCs) isolating production environments.
• DDoS protection mitigating denial-of-service attacks.

(d) Application Security:

• Secure coding practices (OWASP Top 10 guidelines).
• Regular security testing (penetration testing, vulnerability scanning).
• Input validation to prevent SQL injection, XSS, and other attacks.
• Rate limiting to prevent abuse.

(e) Data Minimization and Pseudonymization:

• We collect only the data necessary for specified purposes (see Section 4).
• Where feasible, we pseudonymize or anonymize data (especially in analytics).
• Diary and AI Chat data are stored separately from account identifiers where technically

feasible, with encryption keys managed separately.

14.3. Organizational Security Measures

(a) Policies and Procedures:

• Information Security Policy governing data handling, access, and incident response.
• Data Protection Policy implementing UAE Data Protection Law requirements.
• Employee Confidentiality Agreements binding all staff to confidentiality obligations.

(b) Training:

• All employees receive data protection and security training upon hiring and annually thereafter.
• Developers receive specialized training on secure coding and privacy-by-design.
• Support staff are trained NOT to access Diary or AI Chat data except when absolutely

necessary for troubleshooting (with user consent).

(c) Vendor Management:

• Third-party service providers (see Section 9.1) are vetted for security and privacy practices.
• Data Processing Agreements (DPAs) require vendors to implement equivalent security

measures.

• We conduct periodic audits and reviews of vendors.

(d) Incident Response:

• Incident Response Plan defining procedures for detecting, responding to, and recovering from data breaches.
• 24/7 monitoring of critical systems.
• Data Breach Response Team responsible for coordinating response efforts.

14.4. Data Breach Notification

In accordance with UAE Data Protection Law, Article 9, if a data breach occurs that is likely to result in a risk to your rights and freedoms, we will:

(a) Notify the relevant supervisory authorities (including the UAE Data Office and/or competent EU authorities) without undue delay, and where subject to the GDPR, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to your rights;

(b) Notify affected users via email and/or in-app notification, including:

• Nature of the breach;
• Likely consequences;
• Measures taken to address the breach;
• Contact information for further inquiries;
• Recommendations for users (e.g., change password).

(c) Document the breach and remedial actions taken.

We will also comply with breach notification requirements under GDPR, CCPA, and other applicable laws.

14.5. Your Responsibility for Security

While we implement robust security measures, the security of your information also depends on you:

(a) Protect your password:

• Choose a strong, unique password;
• Do not share your password with others;
• Change your password if you suspect unauthorized access.

(b) Secure your device:

• Use device lock (PIN, password, biometric);
• Install security updates for your OS and apps;
• Use antivirus software.

(c) Beware of phishing:

• We will never ask for your password via email;
• Verify the sender of any suspicious emails claiming to be from MindLight;
• Do not click on suspicious links or download attachments from unknown sources.

(d) Log out:

• Log out when using shared or public devices.

(e) Report suspicious activity:

• If you notice unauthorized access to your account, contact us immediately at

hello@mindlight-app.com.

14.6. Limitations

No security system is impenetrable. While we strive to protect your information using

industry-standard measures, we cannot guarantee absolute security. You acknowledge and accept the inherent risks of transmitting data over the internet.

In the event of a data breach despite our safeguards, our liability is limited as set forth in our Terms of Service, Section 16.

15. THIRD-PARTY SERVICES AND AI PROVIDERS

15.1. Third-Party Links and Services

The Service may contain links to third-party websites, applications, or services (e.g., social media platforms, payment processors, external resources, wellbeing content providers). This Privacy Policy does NOT apply to third-party services. We are NOT responsible for the privacy practices or content of third parties. We encourage you to review the privacy policies of any third-party services you access.

15.2. Third-Party AI Providers

We use third-party AI models and APIs to power our AI chat assistant feature. When you send chat messages, your data may be transmitted to Third-Party AI Providers, including but not limited to:

(a) Large language model providers;

(b) Specialized AI content generation services.

See Section 8.5 for comprehensive details about AI Provider data handling.

15.3. Data Shared with AI Providers

When using AI chat, the following data may be sent to AI Providers:

What IS shared:

• Text content of your chat messages (queries, prompts, conversational inputs);
• Session identifiers (to maintain conversation context);
• Processing parameters (e.g., model version, temperature settings).

What is NOT shared:

• Your email address;
• Your name or User ID;
• Your payment information;
• Your Diary Data, Mood Data, or other User Content (unless you explicitly reference them in your chat messages);
• Your device information or IP address.

15.4. AI Provider Data Handling Commitments

We select AI Providers based on their privacy and security practices and require them (contractually) to:

(a) Process data only for generating AI responses (not for their own purposes);

(b) NOT use your chat messages to train their general AI models:

We utilize enterprise API endpoints with «Zero Data Retention» and «Opt-Out from Training» policies enabled;

Your chat data is excluded from AI Provider training datasets per our Data Processing Agreements.

(c) Delete your chat messages immediately after processing (typically within seconds or minutes);

(d) Implement robust security measures:

• Encryption in transit;
• Encryption at rest;
• Access controls and authentication;
• Regular security audits;

(e) Comply with applicable data protection laws (GDPR, CCPA, UAE Data Protection Law).

However, we cannot guarantee AI Providers’ compliance. We recommend reviewing AI Providers’ privacy policies if you have specific concerns:

15.5. Your Consent to AI Processing

By using the AI chat assistant feature of the Service, you:

(a) Consent to the transmission of your chat messages to third-party AI Providers as described above;

(b) Acknowledge that AI processing may involve cross-border data transfers (see Section 10);

(c) Understand that AI-generated responses are inherently unpredictable and may contain errors, inaccuracies, or inappropriate content («hallucinations»);

(d) Accept that AI Providers may be located in jurisdictions outside your country of residence

(typically the United States).

If you do not consent to AI processing via third-party providers, you should not use the AI chat assistant feature.

15.6. Social Media and Third-Party Authentication

If you choose to:

(a) Share Generated Content (Reports) on social media:

• You are subject to the social media platform’s privacy policy and terms;
• We do not control what the platform does with your shared content.

15.7. Analytics and Advertising Platforms

We use third-party analytics platforms (see Section 13.2(c)) such as:

(a) Amplitude (privacy policy: https://amplitude.com/privacy).

These platforms may collect data about your device and usage for analytics purposes. You can opt out via browser settings or platform-specific opt-out mechanisms.

16. CHILDREN’S PRIVACY

16.1. Age Restriction

The Service is not intended for use by individuals under 18 years of age (or the age of majority in your jurisdiction, whichever is greater).

In accordance with our Terms of Service (Section 3), we do not knowingly:

(a) Collect personal information from children under 18;

(b) Allow children under 18 to create accounts or use the Service;

(c) Target marketing or advertising to children.

16.2. Parental Consent Not Obtained

We do not have mechanisms for obtaining parental consent for children’s use of the Service because the Service is age-restricted and children are prohibited from using it.

16.3. If We Discover Child Data

If we become aware that we have inadvertently collected personal information from a child under 18, we will:

(a) Delete the data as soon as reasonably practicable (within 30 days);

(b) Terminate the account (if any);

(c) Take steps to prevent future access by the child.

16.4. Parental Responsibility

If you are a parent or guardian and you discover that your child has provided personal information to us:

(a) Contact us immediately at hello@mindlight-app.com;

(b) We will delete the child’s data and account promptly.

16.5. Compliance with Children’s Privacy Laws

We comply with:

(a) UAE Data Protection Law (no special provisions for children, but general prohibition applies);

(b) GDPR (Article 8: minimum age for consent is 16, or lower as set by Member States);

(c) COPPA (USA) (Children’s Online Privacy Protection Act: applies to children under 13);

(d) UK GDPR and other applicable children’s privacy laws.

Our blanket prohibition on use by individuals under 18 exceeds the requirements of most children’s privacy laws.

17. CHANGES TO THIS PRIVACY POLICY

17.1. Right to Modify

We reserve the right to update, modify, or replace this Privacy Policy at any time to:

(a) Reflect changes in our data practices;

(b) Comply with new legal requirements;

(c) Introduce new features or services;

(d) Improve clarity or transparency.

17.2. Notice of Changes

When we make material changes to this Privacy Policy, we will notify you by:

(a) Posting the updated Privacy Policy on the Website and in the Service;

(b) Updating the «Effective Date» and «Last Updated» date at the top of this Policy;

(c) Sending an email to the email address associated with your account (for material changes);

(d) Displaying an in-app notification or banner (for material changes);

(e) Requiring re-acceptance (if required by law).

17.3. Material Changes

Material changes include (but are not limited to):

(a) Expansion of the purposes for which we process personal information;

(b) Addition of new categories of personal information collected (especially Sensitive Personal Data);

(c) Changes to the legal basis for processing;

(d) Introduction of new third-party recipients or cross-border transfers;

(e) Changes to your rights or how to exercise them;

(f) Changes to retention periods or security measures.

17.4. Your Acceptance

By continuing to use the Service after the updated Privacy Policy becomes effective, you accept the changes.

If you do not agree to the updated Privacy Policy:

(a) Stop using the Service;

(b) Delete your account before the effective date of the changes (to avoid being bound);

(c) Contact us at hello@mindlight-app.com if you have questions or concerns.

17.5. Review Requirement

We encourage you to review this Privacy Policy periodically (at least every 6-12 months) to stay informed about how we protect your information.

18. CONTACT INFORMATION

18.1. Data Controller

If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data practices, please contact us:

MINDLIGHT PROJECT – FZCO

Registration Number: 64926

Registered Address: [●]

Email: hello@mindlight-app.com

Support: hello@mindlight-app.com

Website: mindlight.ae

18.2. Data Protection Officer

For privacy-specific inquiries or to exercise your data subject rights, contact our Data Protection Officer:

Email: hello@mindlight-app.com

Address: Dubai Silicon Oasis DSO-IFZA, IFZA Properties, Dubai, PO Box 34, United Arab Emirates

18.3. Response Time

We will acknowledge your inquiry within 3 business days and provide a substantive response within:

(a) 10 working days (extendable by 5 days) under UAE Data Protection Law;

(b) 1 month (extendable by 2 months for complex requests) under GDPR;

(c) 45 days (extendable by 45 days) under CCPA;

(d) Such other period as required by applicable law.

18.4. Supervisory Authority

If you are not satisfied with our response or believe we have violated your privacy rights, you may lodge a complaint with:

UAE Data Office

Website: https://u.ae/en/about-the-uae/digital-uae/data

Phone: +97126118229

And/or the supervisory authority in your jurisdiction (see Section 19 for regional contacts).

19. REGIONAL PRIVACY NOTICES

This Section provides additional information for users in specific jurisdictions with enhanced privacy protections.

19.1. European Economic Area (EEA), United Kingdom (UK), and Switzerland

(a) Legal Basis for Processing

See Section 6 for our legal bases under GDPR/UK GDPR. We process your data based on:

• Contract performance (Article 6(1)(b) GDPR);
• Consent (Article 6(1)(a) GDPR);
• Legal obligation (Article 6(1)(c) GDPR);
• Legitimate interests (Article 6(1)(f) GDPR).

For Sensitive Personal Data (Mood Data, Diary Data, AI Chat Data, Life Sphere Diagnostics), we rely on:

• Explicit consent (Article 9(2)(a) GDPR);
• Necessary for reasons of substantial public interest (where applicable).

(b) Your Rights

See Section 12. You have enhanced rights under GDPR, including:

• Right to lodge a complaint with your national supervisory authority;
• Right to data portability (Article 20 GDPR);
• Right to restriction of processing (Article 18 GDPR);
• Right to object to profiling (Article 21 GDPR).

(c) Supervisory Authorities

EU Member States:

Each EU country has a data protection authority.

Find yours at: https://edpb.europa.eu/about-edpb/board/members_en

United Kingdom:

Information Commissioner’s Office (ICO)

Website: https://ico.org.uk

Phone: +44 303 123 1113

Switzerland:

Federal Data Protection and Information Commissioner (FDPIC)

Website: https://www.edoeb.admin.ch

Email: info@edoeb.admin.ch

(d) International Data Transfers

Transfers from the EEA, UK, Switzerland to the UAE or USA are protected by:

• Standard Contractual Clauses (SCCs) (EU Commission-approved);
• EU-U.S. Data Privacy Framework (DPF) adequacy (for certified providers);
• Additional safeguards (encryption, pseudonymization);
• Your explicit consent (for AI chat processing).

See Section 10 for details.

(e) GDPR Representative (EU/UK/CH)

As we are established outside the European Union and the United Kingdom, we have appointed a designated representative pursuant to Article 27 of the GDPR and the UK GDPR. Supervisory

authorities and data subjects in the EU and UK may address our Representative, in addition to or instead of the Company, on all issues related to processing to ensure compliance with the GDPR. Please direct all such inquiries to:

Email: hello@mindlight-app.com

Note: We act as our own point of contact for GDPR compliance pending formal designation of a third-party representative, if legally required based on processing scale.

19.2. California (USA) – CCPA/CPRA

(a) California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act).

(b) Personal Information Collected

In the past 12 months, we have collected the following categories of personal information:

Sensitive Personal Information (SPI) under CPRA:

We collect the following SPI:

• Personal information revealing mental or psychological trends or states (Mood Data, Diary Data, AI Chat Data) – processed solely to provide wellbeing features;
• Account login credentials (password – stored encrypted).

We do not collect:

• Social Security numbers, driver’s license numbers, passport numbers;
• Precise geolocation;
• Racial or ethnic origin, religious beliefs, union membership;
• Contents of mail, email, or text messages (unless you provide them in support requests or AI chat);
• Genetic data;
• Medical diagnoses or health information (unless you voluntarily include in diary or AI chat);
• Sexual orientation or sex life.

(c) Sources of Personal Information

See Section 5:

• Directly from you;
• Automatically (cookies, analytics);
• Third parties (authentication providers, payment processors).

(d) Purposes of Use

See Section 7. We use personal information for:

• Providing the Service;
• Security and fraud prevention;
• Analytics and improvement;
• Marketing (with consent).

(e) Disclosure to Third Parties

In the past 12 months, we have disclosed the following categories of personal information to third parties:

• Service providers (cloud hosting, analytics, AI providers): Identifiers, commercial info, internet activity, AI Chat Data (temporary transmission for processing).
• Payment processors: Identifiers, commercial info.
• Government authorities (upon lawful request): Any category, as required.

We do not sell your personal information for monetary consideration. However, we may «share» certain identifiers and internet activity information with our advertising partners for cross-context behavioral advertising purposes (e.g., through marketing cookies). You have the absolute right to opt-out of this sharing by clicking the link in our footer or broadcasting a GPC signal.

(f) Retention

See Section 11.

(g) Your California Rights

1. Right to Know:

You have the right to request:

• Categories of personal information collected;
• Categories of sources;
• Business purposes for collection;
• Categories of third parties to whom we disclose;
• Specific pieces of personal information we hold about you.

2. Right to Delete:

You have the right to request deletion of your personal information, subject to exceptions (legal obligations, fraud prevention, etc.).

3. Right to Correct:

You have the right to request correction of inaccurate personal information.

4. Right to Opt-Out of Sale and Sharing:

We do not sell personal information. We do not share personal information for cross-context

behavioral advertising. Therefore, no opt-out is required.

Our Website is configured to detect and honor Global Privacy Control (GPC) signals and similar opt-out preference signals sent by your browser. If we receive a GPC signal, we will automatically treat it as a valid request to opt-out of the «sale» and «sharing» of your personal information for cross-context behavioral advertising.

5. Right to Limit Use of Sensitive Personal Information:

You have the right to limit our use of Sensitive Personal Information (SPI) to:

• Performing services reasonably expected;
• Security and fraud prevention;
• Short-term, transient use.

We already limit use of SPI to these purposes. If you wish to object, contact us at

hello@mindlight-app.com.

6. Right to Non-Discrimination:

We will not discriminate against you for exercising your California privacy rights (e.g., we will not deny service, charge different prices, or provide different quality of service).

How to Exercise Your Rights:

• Email: hello@mindlight-app.com
• Website: mindlight.ae
• Phone: +97126118229

You may also authorize an agent to submit a request on your behalf. The agent must provide proof of authorization.

Verification:

To protect your privacy, we will verify your identity by:

• Matching the email address you provide with the email on file for your account;
• Sending a verification link to your email;
• Requesting additional information if needed.

Response Time:

We will respond within 45 days (extendable by 45 days for complex requests).

Right to Limit the Use of Sensitive Personal Information

We process your Sensitive Personal Information solely to perform the services reasonably expected by you and we do not use it to infer characteristics about you. Therefore, the statutory

right to limit such use is already satisfied by our strict processing and immediate deletion

policies.

(h) California «Shine the Light» Law

California Civil Code Section 1798.83 allows California residents to request information about

disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

(i) Contact for California Residents

Email: hello@mindlight-app.com

Address: Dubai Silicon Oasis DSO-IFZA, IFZA Properties, Dubai, PO Box 34, United Arab Emirates California Attorney General (for complaints):

Website: https://oag.ca.gov/privacy

Phone: (916) 210-6276

19.3. Canada – PIPEDA

(a) Applicability

If you are a Canadian resident, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA).

(b) Valid and Meaningful Consent:

In accordance with Section 6.1 of PIPEDA and Principle 3, we ensure that our request for your consent is clear and understandable. By using our AI generation features, you acknowledge that you

understand the nature, purpose, and consequences of the collection, use, and disclosure of your

personal information (including temporary processing of Biometric Data). You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice.

(c) Cross-Border Transfers

Your data may be stored on servers in the USA or UAE. By using the Service, you consent to such transfers. We implement safeguards (see Section 10).

(d) Your Rights

You have the right to:

• Access your personal information;
• Correct inaccurate information;
• Withdraw consent (subject to restrictions);
• Complain to the Privacy Commissioner of Canada.

How to exercise: Contact us at hello@mindlight-app.com.

(e) Accountability and Privacy Officer

In accordance with Principle 1 of PIPEDA (Accountability), we have designated a Privacy Officer who is accountable for our compliance with Canadian privacy principles. Our global Data Protection Officer serves in this capacity for Canadian users.

Email: hello@mindlight-app.com

Address: Dubai Silicon Oasis DSO-IFZA, IFZA Properties, Dubai, PO Box 34, United Arab Emirates

(f) Complaints

If you have a privacy complaint, contact our Privacy Officer (above). We will investigate and respond within 30 days.

If you are not satisfied, you may complain to:

Office of the Privacy Commissioner of Canada

Website: https://www.priv.gc.ca

Toll-free: 1-800-282-1376

Phone: 819-994-5444

TTY: 819-994-6591

Email: info@priv.gc.ca

(g) Breach of Security Safeguards (RROSH)

In compliance with Division 1.1 (Section 10.1) of PIPEDA, we will report to the Privacy

Commissioner of Canada and notify you of any breach of security safeguards involving your personal information if it is reasonable in the circumstances to believe that the breach creates a «real risk of significant harm» (RROSH) to you, such as identity theft, financial loss, or damage to reputation. We also maintain a record of all breaches in accordance with Section 10.3 of PIPEDA.

19.4. Other Jurisdictions

If you are located in a jurisdiction not specifically addressed above (e.g., Brazil, Japan, South Korea, India, etc.), we will comply with applicable local data protection laws to the extent they apply to our processing activities.

For jurisdiction-specific questions, contact us at hello@mindlight-app.com.

20. ADDITIONAL PROVISIONS

20.1. Language

This Privacy Policy is drafted in English. If we provide translations into other languages, the English version shall prevail in the event of any conflict or ambiguity.

20.2. Severability

If any provision of this Privacy Policy is found to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

20.3. No Waiver

Our failure to enforce any right or provision of this Privacy Policy shall not constitute a waiver of such right or provision.

20.4. Entire Agreement

This Privacy Policy, together with our Terms of Service and any other policies referenced herein, constitutes the entire agreement between you and the Company regarding the processing of your personal information.

20.5. Survival

Sections that by their nature should survive termination of your use of the Service (e.g., data retention, your rights, limitations of liability, dispute resolution) shall survive.

By using MindLight, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

MINDLIGHT PROJECT – FZCO

Registration Number: 64926

Registered Address: Dubai Silicon Oasis DSO-IFZA, IFZA Properties, Dubai, PO Box 34, United Arab Emirates

Email: hello@mindlight-app.com

Website: mindlight.ae

Support: hello@mindlight-app.com

Last Updated: April 29, 2026