PREPARED AUGUST 31, 2026

Privacy Policy

Last Updated: [[LAST_UPDATED_DATE]]
Effective Date: [[EFFECTIVE_DATE]]

This policy records the intended treatment of information in the Service. It is a review draft, not a statement of live production practices.

1. Scope and privacy controller

This policy applies to the GummiVio mobile application, its public website, and related support channels (the “Service”). The data controller is [[OPERATOR_LEGAL_NAME]], registered at [[REGISTERED_ADDRESS]].

2. Information under review

The Service may process profile data, source images, prompt text, output files, purchase status, device signals, crash records, and customer-service communications. Production verification is required before this list becomes authoritative.

3. Why information is processed

The intended uses are service delivery, output processing, account and purchase administration, abuse prevention, troubleshooting, user support, and compliance. The final wording must identify whether measurement or ad technology is present.

4. AI content handling

AI features require the Service to transmit selected photos and instructions to [[AI_MODEL_PROVIDERS]] and related hosting services. The published version must state where processing occurs, when inputs and outputs are removed, and whether model improvement is prohibited.

Do not upload content you lack the right or authority to use. Content is not treated as biometric identification data unless the final product deliberately performs that function; confirm the shipping behavior.

5. Providers and disclosures

Information may be disclosed to contracted vendors that support hosting, AI processing, authentication, analytics, crash reporting, payments, and customer care. Record the final vendors in [[PRODUCTION_VENDOR_LIST]]. Disclosure may also occur to protect users, comply with binding legal process, or complete a corporate transaction with appropriate safeguards.

6. Retention

Account, content, output, diagnostic, purchase, and support records must follow the confirmed schedule in [[RETENTION_SCHEDULE]]. Data may be kept longer only when necessary for security, disputes, legal duties, or documented backup cycles.

7. Security and international transfer

Reasonable organizational and technical measures should protect information in transit, at rest, and during vendor processing. No system is perfectly secure. If information moves across borders, the operator must use a lawful transfer mechanism suited to the launch markets.

8. Your choices and rights

Subject to applicable law, users may request access, correction, deletion, restriction, portability, or an objection to certain processing. Requests must be sent through [[PRIVACY_REQUEST_CHANNEL]]. Identity verification and legally permitted retention may apply.

9. Account and data deletion

The verified deletion route is [[ACCOUNT_DELETION_URL_OR_EMAIL]]. The final page must explain which account and content records are erased, what is retained, and the expected handling time. Uninstalling the app does not itself submit a deletion request or cancel a store-managed subscription.

10. Children and age requirement

The minimum permitted age is [[MINIMUM_AGE]]. The released wording must match the store rating, sign-up flow, safety controls, and target markets. If information from an ineligible child is identified, the operator should take appropriate steps to remove it.

11. Regional disclosures

Before publication, add the notices and rights required for [[TARGET_MARKETS]], including any lawful-basis, sale/share, targeted-advertising, appeal, or authorized-agent disclosures that actually apply.

12. Policy changes

Material changes should be described with an updated date and any notice or consent required by law. Earlier versions should be retained according to the operator’s recordkeeping policy.

13. Contact

Privacy requests: [[PRIVACY_EMAIL]]
Support: [[SUPPORT_EMAIL]]
Operator: [[OPERATOR_LEGAL_NAME]]
Address: [[REGISTERED_ADDRESS]]