{
  "schemaVersion": 1,
  "documentId": "privacy-policy",
  "title": "Privacy Policy",
  "version": "1.2.0",
  "effectiveDate": "2026-05-16",
  "locale": "en-US",
  "blocks": [
    { "type": "heading", "level": 1, "text": "Project AG Privacy Policy" },
    {
      "type": "paragraph",
      "text": "Effective Date: May 16, 2026. Version 1.0.0."
    },
    {
      "type": "paragraph",
      "text": "This Privacy Policy describes how **S8 Investment Holdings, LLC** (\"Project AG\", \"we\", \"us\", or \"our\") collects, uses, shares, and protects personal information when you use the Project AG mobile application and any related websites, APIs, communications, and services (collectively, the \"Service\"). It also describes the rights you have over your personal information and how to exercise them."
    },
    {
      "type": "paragraph",
      "text": "Project AG is a travel-companion social application that connects adult travelers visiting the same destinations. Because we operate in this category, we process information that is sometimes sensitive — including precise travel plans, photographs, and identity-verification data. This Policy is designed to be clear about exactly what we do with it, and to comply with the General Data Protection Regulation (EU 2016/679, \"GDPR\"), the UK General Data Protection Regulation (\"UK GDPR\"), the California Consumer Privacy Act as amended by the California Privacy Rights Act (\"CCPA/CPRA\"), Brazil's Lei Geral de Proteção de Dados (\"LGPD\"), Canada's Personal Information Protection and Electronic Documents Act (\"PIPEDA\") and Quebec's Law 25, Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (\"LFPDPPP\"), Japan's Act on the Protection of Personal Information (\"APPI\"), South Korea's Personal Information Protection Act (\"PIPA\"), Australia's Privacy Act 1988 (Cth), South Africa's Protection of Personal Information Act (\"POPIA\"), Switzerland's revised Federal Act on Data Protection (\"FADP\"), and the Kingdom of Saudi Arabia's Personal Data Protection Law (\"PDPL\"), among others. Region-specific terms appear in dedicated annexes at the end of this Policy."
    },
    {
      "type": "paragraph",
      "text": "**You must be 18 or older to use the Service.** We do not knowingly collect personal information from anyone under 18. See Section 9."
    },

    { "type": "divider" },

    {
      "type": "heading",
      "level": 2,
      "text": "1. Who is the controller of your personal information?"
    },
    {
      "type": "paragraph",
      "text": "The data controller (or, where applicable, the \"business\" under CCPA/CPRA, \"controller\" under GDPR/UK GDPR, \"responsável\" under LGPD, \"operator\" under POPIA, etc.) responsible for your personal information is:"
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Legal entity:** S8 Investment Holdings, LLC",
        "**Registered office:** [REGISTERED ADDRESS — operator to confirm prior to launch]",
        "**General privacy contact:** privacy@projectag.app",
        "**Data Protection Officer (DPO):** dpo@projectag.app",
        "**EU representative (GDPR Article 27):** [EU REP NAME & ADDRESS — operator to confirm prior to EU launch]",
        "**UK representative (UK GDPR Article 27):** [UK REP NAME & ADDRESS — operator to confirm prior to UK launch]",
        "**Brazil DPO / Encarregado (LGPD Article 41):** [DPO BR NAME — operator to confirm prior to BR launch]",
        "**Quebec Person in Charge of the Protection of Personal Information (Law 25 §3.1):** [QC PIC NAME — operator to confirm prior to Canada launch]",
        "**South Korea Chief Privacy Officer (PIPA Article 31):** [KR CPO NAME — operator to confirm prior to KR launch]",
        "**South Africa Information Officer (POPIA §55):** [ZA INFORMATION OFFICER NAME — must be registered with the Information Regulator prior to ZA launch]",
        "**Saudi Arabia Local Representative (PDPL Article 5):** [KSA LOCAL REP NAME — must be registered with SDAIA prior to KSA launch]",
        "**EU Digital Services Act point of contact for authorities (Art. 11):** dsa-authorities@projectag.app",
        "**EU Digital Services Act point of contact for recipients of service (Art. 12):** dsa-users@projectag.app"
      ]
    },
    {
      "type": "paragraph",
      "text": "If you live in a region with a designated representative or DPO, you are entitled to contact them directly. We will respond in the language of this Policy unless local law requires otherwise."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "2. The personal information we collect"
    },
    {
      "type": "paragraph",
      "text": "We collect personal information in three ways: (a) information you provide directly, (b) information generated by your use of the Service, and (c) information from limited third parties (for example, your phone carrier when you receive an SMS one-time passcode, or Apple/Google when you sign in)."
    },

    { "type": "heading", "level": 3, "text": "2.1 Information you provide" },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Account identifiers** — phone number, email address, and (if you choose Sign in with Apple or Google) the identifier those providers return to us. We use this to create and authenticate your account.",
        "**Profile information** — first name, date of birth, gender identity, sexual orientation (if you choose to share it), a short bio, interests, home city, languages spoken, and other optional fields you choose to fill in.",
        "**Photographs** — the photos you upload for your profile. Photos are scanned automatically for safety and quality (see Section 4).",
        "**Travel plans** — the destinations and date ranges you choose to share for the purpose of meeting other travelers.",
        "**Identity-verification data** — when you complete identity verification, our partner Persona Identities, Inc. (\"Persona\") collects a photograph of a government-issued identity document and a short selfie video. Persona derives a biometric template from these images to confirm that the document is genuine and that the selfie matches the document. We receive the result (pass / fail / under review) and a redacted record; we do **not** receive or store the raw biometric template. See Section 3.4 below.",
        "**Communications** — the messages, reactions, and reports you send through the Service.",
        "**Support and feedback** — when you contact support@projectag.app or submit a bug report, we receive your message, your contact details, and any device diagnostics you choose to attach.",
        "**Payment-related metadata** — Project AG subscriptions are billed by Apple through your Apple ID. We do **not** receive your payment card number, security code, or Apple ID password. We receive only the subscription state (active / lapsed / refunded), tier, renewal date, and a pseudonymous customer identifier from Apple via our partner RevenueCat."
      ]
    },

    {
      "type": "heading",
      "level": 3,
      "text": "2.2 Information generated by your use of the Service"
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Activity data** — which profiles you view, which you like or pass on, who you match with, the timestamps of these events, and the messages you exchange. This data is used to operate the matching algorithm, prevent abuse, and enforce subscription limits.",
        "**Approximate and precise location** — when you grant location permission, we collect your approximate location (city-level) to power discovery. If you opt in to precise location for trip planning, we collect your device's precise location at the time you create or update a trip. You can revoke location access at any time in iOS Settings. See Section 4 for the legal basis.",
        "**Device and diagnostic data** — your device model, operating-system version, app version, language and locale, IP address, time-zone, mobile-network carrier, advertising identifier (only if you grant ATT consent — see Section 8), crash logs, and performance metrics.",
        "**Push-notification tokens** — your Apple Push Notification service (APNs) token, used to deliver in-app notifications (matches, messages, subscription receipts).",
        "**Cookies and similar technologies** — our website uses a small number of strictly necessary cookies (session, CSRF). We do not use advertising or cross-site tracking cookies."
      ]
    },

    {
      "type": "heading",
      "level": 3,
      "text": "2.3 Information we receive from third parties"
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Apple / Google** — when you sign in with Apple or Google, we receive a stable account identifier and (if you authorize it) your name and email. We do not receive your Apple ID or Google password.",
        "**Twilio** — your phone carrier and the result of SMS one-time-passcode delivery (delivered, failed, etc.). We do not receive the contents of any other messages.",
        "**Persona** — the verification result, the date of verification, and a redacted reference identifier, as described in Section 2.1.",
        "**RevenueCat / Apple** — your subscription state, tier, renewal date, and a pseudonymous customer identifier.",
        "**Sentry** — error and crash reports that originate on your device. Sentry strips most personal data automatically before transmission; we additionally configure Sentry to scrub email addresses, phone numbers, and free-text content."
      ]
    },

    {
      "type": "heading",
      "level": 3,
      "text": "2.4 Special categories of personal information"
    },
    {
      "type": "paragraph",
      "text": "Some of the information you choose to share is treated as a \"special category\" of personal data under GDPR Article 9 (and analogous laws elsewhere): (i) the biometric data processed by Persona for identity verification, (ii) photographs and self-identified data that can reveal racial or ethnic origin or religious belief, (iii) information you may volunteer in your bio or messages about your health or sexual orientation. **We process these categories only with your explicit consent**, given through specific in-app prompts at the point of collection. You can withdraw consent at any time as described in Section 11. Withdrawing consent for identity verification means we cannot continue to provide the Service to you and your account will be deactivated."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "3. The purposes for which we process your personal information, and the legal bases"
    },
    {
      "type": "paragraph",
      "text": "Under GDPR, UK GDPR, LGPD, FADP, and similar laws, we are required to identify a lawful basis for each purpose for which we process your personal information. The table below sets out our purposes, the categories of data involved, and the lawful basis (GDPR Article 6 and, where applicable, Article 9)."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "3.1 Operating your account and authenticating you"
    },
    {
      "type": "paragraph",
      "text": "Categories: account identifiers, profile, device data. Legal basis: **performance of a contract** (GDPR Art. 6(1)(b)) — without this data we cannot deliver the Service you have requested."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "3.2 Matching you with other travelers"
    },
    {
      "type": "paragraph",
      "text": "Categories: profile, travel plans, location, activity. Legal basis: **performance of a contract** (Art. 6(1)(b)). Where this involves a special category of data (for example, sexual-orientation filters), the additional Article 9 basis is **explicit consent** (Art. 9(2)(a))."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "3.3 Sending you transactional and service notifications"
    },
    {
      "type": "paragraph",
      "text": "Categories: account identifiers, activity. Legal basis: **performance of a contract** (Art. 6(1)(b)) for service-essential notifications (e.g., new matches, message receipts, subscription renewals). Marketing or promotional push notifications are sent only on the basis of your **consent** (Art. 6(1)(a)), which you can withdraw at any time in **Settings → Notifications**."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "3.4 Identity verification and fraud prevention"
    },
    {
      "type": "paragraph",
      "text": "Categories: identity-verification data (including biometric data processed by Persona), device data, IP address. Legal bases: **explicit consent** for the processing of biometric data (Art. 9(2)(a)); **legitimate interests** under Art. 6(1)(f) for fraud prevention, where our interest in protecting the community from impersonation, romance fraud, and account-takeover attacks materially outweighs the limited and necessary use of your data; and **compliance with a legal obligation** (Art. 6(1)(c)) where local law requires age- or identity-verification (for example, certain online-safety statutes)."
    },
    {
      "type": "paragraph",
      "text": "Persona processes the biometric template under a Data Processing Addendum signed with us. We instruct Persona to delete the biometric template and the source ID images on a fixed retention schedule (see Section 7). We do not use Persona's output to make automated decisions that produce legal or similarly significant effects on you (see Section 12 on automated decision-making)."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "3.5 Safety, moderation, and enforcement"
    },
    {
      "type": "paragraph",
      "text": "Categories: photos, messages, reports, activity, device data. Legal bases: **legitimate interests** (Art. 6(1)(f)) in keeping the community safe, supported by our published Community Guidelines; **compliance with a legal obligation** (Art. 6(1)(c)) where applicable (for example, mandatory reporting of certain content); and **explicit consent** (Art. 9(2)(a)) for any processing of special-category data such as photographic content depicting race, ethnicity, or religious affiliation."
    },
    {
      "type": "paragraph",
      "text": "Photo moderation is performed by Amazon Web Services, Inc. (\"AWS\") via the Amazon Rekognition service. Rekognition returns a category-by-category confidence score (for example, \"Explicit Nudity\", \"Violence\"). A human moderator on our trust-and-safety team reviews any photo flagged by Rekognition before it is removed from circulation, except in the case of CSAM (child sexual abuse material), where we follow the mandatory reporting procedures in the jurisdictions where we operate."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "3.6 Billing and subscription administration"
    },
    {
      "type": "paragraph",
      "text": "Categories: account identifiers, subscription metadata. Legal basis: **performance of a contract** (Art. 6(1)(b)) and **compliance with a legal obligation** (Art. 6(1)(c)) for tax and accounting records."
    },

    { "type": "heading", "level": 3, "text": "3.7 Customer support" },
    {
      "type": "paragraph",
      "text": "Categories: communications, account identifiers, device data. Legal basis: **performance of a contract** (Art. 6(1)(b)) and our **legitimate interest** (Art. 6(1)(f)) in providing efficient support."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "3.8 Analytics and product improvement"
    },
    {
      "type": "paragraph",
      "text": "Categories: device data, activity, performance metrics. We use this data on an aggregated, pseudonymized basis to understand which features work and where the Service has bugs. Legal basis: **legitimate interests** (Art. 6(1)(f)). You may object to this processing at any time as described in Section 11. We do not use this data to build advertising profiles of you, and we do not sell or rent it to third parties."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "3.9 Legal and regulatory compliance"
    },
    {
      "type": "paragraph",
      "text": "Categories: any data necessary to comply with applicable law. Legal basis: **compliance with a legal obligation** (Art. 6(1)(c)) and, where appropriate, the **establishment, exercise, or defense of legal claims** (Art. 9(2)(f) for special-category data)."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "4. The third parties with whom we share personal information"
    },
    {
      "type": "paragraph",
      "text": "We share personal information only with the categories of recipient listed below, and only to the extent strictly necessary for the purpose stated. We do **not** sell or rent your personal information to data brokers, advertising networks, or any other third party for monetary or non-monetary consideration. We do **not** \"share\" your personal information for cross-context behavioral advertising as that term is defined under CCPA/CPRA."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "4.1 Service providers (processors)"
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Apple Inc.** — Sign in with Apple, push notifications (APNs), in-app purchase processing. United States. Apple acts as an independent controller for the parts of the transaction it directly administers (for example, App Store billing) and as a processor for the parts it performs on our behalf (for example, APNs delivery). See [Apple's privacy policy](https://www.apple.com/legal/privacy/).",
        "**Google LLC** — Sign in with Google. United States. See [Google's privacy policy](https://policies.google.com/privacy).",
        "**Twilio, Inc.** — SMS one-time passcode delivery. United States, with EU/UK sub-processors. See [Twilio's privacy notice](https://www.twilio.com/legal/privacy).",
        "**Persona Identities, Inc.** — identity-verification platform. United States. See [Persona's privacy policy](https://withpersona.com/legal/privacy-policy).",
        "**Amazon Web Services, Inc.** — cloud hosting, storage (Amazon S3), email delivery (Amazon SES), and content moderation (Amazon Rekognition). United States and, for European users, Frankfurt/Dublin AWS regions where commercially available. See [AWS's privacy notice](https://aws.amazon.com/privacy/).",
        "**RevenueCat, Inc.** — subscription state synchronization. United States. See [RevenueCat's privacy policy](https://www.revenuecat.com/privacy/).",
        "**Functional Software, Inc. d/b/a Sentry** — crash and error diagnostics. United States. See [Sentry's privacy policy](https://sentry.io/privacy/)."
      ]
    },
    {
      "type": "paragraph",
      "text": "Each of these providers is bound by a written data-processing agreement that imposes confidentiality, security, sub-processor, and (where applicable) cross-border-transfer safeguards consistent with GDPR Articles 28 and 46. An up-to-date sub-processor list is available on request from privacy@projectag.app."
    },

    { "type": "heading", "level": 3, "text": "4.2 Other Project AG users" },
    {
      "type": "paragraph",
      "text": "Profile information you mark as visible — your photos, first name, age, bio, interests, and current trip — is shown to other adult users of the Service for matching purposes. **Your phone number, email address, exact home address, and identity-verification status are never disclosed to other users.** Your verification badge (a generic indicator that you have passed identity verification) is shown if you have completed the optional verification flow."
    },

    {
      "type": "heading",
      "level": 3,
      "text": "4.3 Law enforcement and legal process"
    },
    {
      "type": "paragraph",
      "text": "We will disclose personal information to law-enforcement, courts, regulators, or other public authorities when we are compelled to do so by valid legal process (such as a subpoena, warrant, or court order issued by a court of competent jurisdiction), or where we believe in good faith that disclosure is necessary to (a) protect the safety of any person, (b) investigate or prevent fraud or security incidents, or (c) comply with applicable law. Where the law permits us to notify the affected user before disclosing, we will do so."
    },

    { "type": "heading", "level": 3, "text": "4.4 Corporate transactions" },
    {
      "type": "paragraph",
      "text": "If Project AG or substantially all of its assets are acquired by, merged with, or transferred to another entity, personal information may be transferred to the acquirer subject to the same protections set out in this Policy. We will notify you of any change in controller and, where required, provide an opportunity to object."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "5. International transfers of personal information"
    },
    {
      "type": "paragraph",
      "text": "Project AG is operated from the United States. The personal information we collect is processed primarily in the United States, with regional storage in the European Union (Frankfurt and Dublin) for users located in the EEA, the United Kingdom, and Switzerland, to the extent commercially practicable."
    },
    {
      "type": "paragraph",
      "text": "When we transfer personal information from a jurisdiction with comprehensive data-protection law to a jurisdiction that does not benefit from an adequacy decision, we rely on appropriate safeguards under Chapter V of the GDPR (and analogous provisions of UK GDPR, LGPD, FADP, and others). Specifically:"
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Standard Contractual Clauses (SCCs)** — for transfers from the EEA, we use the European Commission's 2021 SCCs (Decision (EU) 2021/914), supplemented by the technical and organizational measures described in Section 6.",
        "**UK International Data Transfer Addendum** — for transfers from the United Kingdom, we use the UK Addendum to the EU SCCs, or the UK International Data Transfer Agreement, as appropriate.",
        "**Swiss FADP transfers** — we apply the SCCs adapted for Switzerland and recognize the Swiss Federal Data Protection and Information Commissioner as the relevant supervisory authority.",
        "**Other jurisdictions** — for transfers from Brazil (LGPD Articles 33–36), South Africa (POPIA Section 72), Japan (APPI Article 24), and South Korea (PIPA Article 17), we apply equivalent contractual safeguards or rely on your specific informed consent.",
        "**Transfer impact assessments** — we conduct and maintain documented transfer impact assessments for each recipient country in line with EDPB Recommendations 01/2020 (\"Schrems II\")."
      ]
    },
    {
      "type": "paragraph",
      "text": "You may request a copy of the safeguards in place for a specific transfer (with confidential commercial terms redacted) by writing to privacy@projectag.app."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "6. How we protect your personal information"
    },
    {
      "type": "paragraph",
      "text": "We implement and maintain technical and organizational measures designed to protect personal information against unauthorized or unlawful access, disclosure, alteration, loss, or destruction. These include:"
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "Encryption in transit using industry-standard TLS 1.2 or higher between your device, our APIs, and our processors.",
        "Encryption at rest of databases, object storage (Amazon S3), and backup volumes using AES-256.",
        "Strict access controls — production data is accessible only to a small number of named engineers, authenticated via single-sign-on with hardware-security-key second factor.",
        "Network segmentation, web-application firewalls, and intrusion detection on production infrastructure.",
        "Centralized logging and audit trails of administrative actions, retained for a minimum of one year.",
        "Periodic security assessments and an internal vulnerability-management program.",
        "An incident-response plan that includes notification to supervisory authorities and affected individuals where required by law (see Section 13)."
      ]
    },
    {
      "type": "paragraph",
      "text": "No security measure is perfect. If you become aware of a security issue affecting Project AG, please report it to security@projectag.app."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "7. How long we keep your personal information"
    },
    {
      "type": "paragraph",
      "text": "We retain personal information only for as long as necessary for the purposes for which it was collected, in line with the storage-limitation principle (GDPR Article 5(1)(e) and equivalent provisions of UK GDPR, LGPD, FADP, POPIA, PIPA, APPI, CCPA/CPRA, and others)."
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Account information** — for the lifetime of your account. When you delete your account, we delete or irreversibly anonymize the underlying data within **30 days**, except for the categories below.",
        "**Identity-verification data held by Persona** — retained by Persona for the period set in our agreement with Persona and Persona's published retention policy (currently a maximum of 12 months for a successful verification, or as required by applicable anti-fraud law). The biometric template is deleted within the timeframe Persona discloses in its policy.",
        "**Trust-and-safety records** — when an account is removed for a violation, a minimal record (account identifier, reason for removal, timestamp) is retained for up to **5 years** to prevent the banned user from re-registering and to defend against legal claims.",
        "**Transaction and billing records** — retained for **7 years** to comply with tax, accounting, and consumer-protection record-keeping obligations.",
        "**Backups** — encrypted backups of our production database are retained for **35 days** and then overwritten. Personal information that you have deleted from production may persist briefly in backups during that window.",
        "**Server and security logs** — retained for **13 months**, then deleted automatically.",
        "**Aggregate, de-identified analytics** — may be retained indefinitely; this data does not identify you."
      ]
    },
    {
      "type": "paragraph",
      "text": "You can delete your account at any time from **Settings → Account → Delete account** in the app. Deletion is irreversible."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "8. Tracking, advertising identifiers, and cross-context behavioral advertising"
    },
    {
      "type": "paragraph",
      "text": "Project AG does **not** display behavioral advertising inside the app and does **not** \"sell\" or \"share\" personal information for cross-context behavioral advertising under CCPA/CPRA. We do not participate in the IAB Transparency and Consent Framework."
    },
    {
      "type": "paragraph",
      "text": "Apple's App Tracking Transparency (ATT) prompt is shown only if we ever introduce a feature that would require it; today, we do not access the Identifier for Advertisers (IDFA) and we have not enabled any such feature. If this changes, we will update this Policy and obtain your explicit ATT consent before processing the IDFA."
    },
    {
      "type": "paragraph",
      "text": "Our marketing website (project-ag.com, when launched) uses only strictly-necessary first-party cookies. We do not deploy advertising cookies or third-party trackers on our website."
    },

    { "type": "heading", "level": 2, "text": "9. Children" },
    {
      "type": "paragraph",
      "text": "Project AG is intended for adults aged **18 and over**. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact privacy@projectag.app and we will delete the information promptly. In the United States, we comply with the Children's Online Privacy Protection Act (COPPA); in the UK we comply with the ICO's Age-Appropriate Design Code; in the EU, with GDPR Article 8 and applicable Member-State age-of-consent rules; and elsewhere with equivalent local provisions."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "10. Cookies and similar technologies"
    },
    {
      "type": "paragraph",
      "text": "The Project AG mobile application does not use HTTP cookies. The app does use local on-device storage (UserDefaults, Keychain, and an encrypted Core Data store) to maintain your session, cache your profile, and store your preferences. This data is local to your device and is removed when you uninstall the app."
    },
    {
      "type": "paragraph",
      "text": "When we operate a marketing website, it will use only the strictly-necessary cookies required to deliver the page (e.g., session and CSRF tokens). A separate cookie notice will be published at that time."
    },

    { "type": "heading", "level": 2, "text": "11. Your privacy rights" },
    {
      "type": "paragraph",
      "text": "Subject to your jurisdiction, you have some or all of the following rights with respect to your personal information. To exercise any of these rights, contact us at privacy@projectag.app or use the in-app tools described below. We will respond within the timeframes required by applicable law (in the EEA/UK, no later than one month, extendable by two further months for complex requests; in California, 45 days, extendable by 45 days; in Brazil, 15 days). We will not discriminate against you for exercising any of these rights."
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Right of access** — to obtain confirmation of whether we process your data and a copy of that data (GDPR Art. 15; UK GDPR; LGPD Art. 18 I/II; CCPA §1798.110/130; PIPEDA Principle 9; Quebec Law 25 §27; LFPDPPP Art. 23; APPI Art. 33; PIPA Art. 35; POPIA §23; PDPL Art. 4).",
        "**Right of rectification / correction** — to have inaccurate or incomplete data corrected (GDPR Art. 16; CCPA §1798.106; LGPD Art. 18 III; and equivalents).",
        "**Right of erasure / deletion** — to have your data deleted, subject to the exceptions in Section 7 above (GDPR Art. 17; CCPA §1798.105; LGPD Art. 18 VI; and equivalents).",
        "**Right to restrict processing** — to have processing paused in certain circumstances (GDPR Art. 18; UK GDPR; LGPD Art. 18 IX).",
        "**Right to data portability** — to receive your data in a structured, commonly used, machine-readable format (JSON), and to have it transmitted to another controller where technically feasible (GDPR Art. 20; LGPD Art. 18 V; Quebec Law 25 §27 paragraph 3, effective Sept. 2024).",
        "**Right to object** — to object to processing based on legitimate interests (Section 3.8 above) (GDPR Art. 21).",
        "**Right not to be subject to automated decision-making** with legal or similarly significant effects (GDPR Art. 22; LGPD Art. 20). See Section 12.",
        "**Right to withdraw consent** at any time, without affecting the lawfulness of processing carried out before withdrawal (GDPR Art. 7(3); LGPD Art. 8 §5; and equivalents).",
        "**Right to lodge a complaint** with a supervisory authority (see Section 14)."
      ]
    },
    {
      "type": "paragraph",
      "text": "Many of these rights can be exercised directly in the app:"
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Access / portability** — email privacy@projectag.app from the address on your account. We will provide a copy of your data in a structured, machine-readable format (JSON) within the statutory timeframe applicable in your jurisdiction (one month under GDPR/UK GDPR, 45 days under CCPA, 15 days under LGPD, and equivalent timelines elsewhere).",
        "**Correction** — most fields are editable in **Settings → Edit Profile**.",
        "**Deletion** — **Settings → Account → Delete account**.",
        "**Restrict / object / withdraw consent** — toggles in **Settings → Privacy** (e.g., pause discovery, read receipts, online status, incognito mode) and **Settings → Notifications** (matches, messages, likes, trip reminders, product updates, marketing) cover the processing purposes those controls govern. For any right we have not yet exposed as an in-app control, email privacy@projectag.app and we will action your request within the statutory timeframe applicable in your jurisdiction."
      ]
    },
    {
      "type": "paragraph",
      "text": "We may need to verify your identity before fulfilling a rights request, particularly for access, portability, and deletion. We will use the minimum data necessary to do so — typically a confirmation code sent to the phone number or email on file."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "12. Automated decision-making and profiling"
    },
    { "type": "paragraph", "text": "We use automated systems in two places:" },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**Matching algorithm** — recommends candidate profiles based on the preferences you set, your declared trip, and aggregate signals such as mutual interests. This does not produce a legal or similarly significant effect on you (GDPR Art. 22(1)). You can influence outputs by adjusting your filters and preferences.",
        "**Content moderation (Amazon Rekognition)** — flags potentially policy-violating photos for human review. The final decision to remove a photo or restrict an account is made by a human moderator, except in the case of confirmed CSAM, which is handled under mandatory legal procedures.",
        "**Anti-fraud signals** — we use rule-based and statistical signals to detect account-takeover attempts, mass-registration abuse, and payment fraud. A confirmed positive triggers a request for re-authentication or human review, not an automatic adverse decision."
      ]
    },
    {
      "type": "paragraph",
      "text": "If you would like to contest the outcome of any automated decision, or request human review, contact privacy@projectag.app."
    },

    { "type": "heading", "level": 2, "text": "13. Data-breach notification" },
    {
      "type": "paragraph",
      "text": "In the unlikely event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33; UK GDPR; equivalent timelines under LGPD, PIPA, FADP, POPIA, PDPL). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (GDPR Art. 34; CCPA §1798.82; PIPEDA; LGPD Art. 48; APPI Art. 26; PIPA Art. 34)."
    },

    {
      "type": "heading",
      "level": 2,
      "text": "14. How to contact us, and how to complain"
    },
    {
      "type": "paragraph",
      "text": "If you have a question about this Policy or wish to exercise a right, please contact us first at privacy@projectag.app. We are committed to resolving complaints directly."
    },
    {
      "type": "paragraph",
      "text": "If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority. Some examples:"
    },
    {
      "type": "list",
      "style": "unordered",
      "items": [
        "**European Economic Area** — the data-protection authority of the EU Member State where you live, work, or where the alleged infringement took place. A list is at [edpb.europa.eu](https://edpb.europa.eu/about-edpb/about-edpb/members_en).",
        "**United Kingdom** — Information Commissioner's Office (ICO), [ico.org.uk](https://ico.org.uk/make-a-complaint/).",
        "**Switzerland** — Federal Data Protection and Information Commissioner (FDPIC), [edoeb.admin.ch](https://www.edoeb.admin.ch/).",
        "**Brazil** — Autoridade Nacional de Proteção de Dados (ANPD), [gov.br/anpd](https://www.gov.br/anpd/).",
        "**Canada** — Office of the Privacy Commissioner (OPC), [priv.gc.ca](https://www.priv.gc.ca/); residents of Quebec: Commission d'accès à l'information du Québec (CAI).",
        "**California, USA** — California Privacy Protection Agency (CPPA), [cppa.ca.gov](https://cppa.ca.gov/); or the California Attorney General.",
        "**Mexico** — Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), [home.inai.org.mx](https://home.inai.org.mx/).",
        "**Japan** — Personal Information Protection Commission (PPC), [ppc.go.jp](https://www.ppc.go.jp/en/).",
        "**South Korea** — Personal Information Protection Commission (PIPC), [pipc.go.kr](https://www.pipc.go.kr/eng/).",
        "**Australia** — Office of the Australian Information Commissioner (OAIC), [oaic.gov.au](https://www.oaic.gov.au/).",
        "**South Africa** — Information Regulator, [inforegulator.org.za](https://inforegulator.org.za/).",
        "**Saudi Arabia** — Saudi Data and Artificial Intelligence Authority (SDAIA), [sdaia.gov.sa](https://sdaia.gov.sa/)."
      ]
    },

    { "type": "heading", "level": 2, "text": "15. Changes to this Policy" },
    {
      "type": "paragraph",
      "text": "We may update this Privacy Policy from time to time. The \"Effective Date\" and \"Version\" at the top of the document indicate when this Policy was last revised. If we make material changes, we will notify you in the app at least 14 days before the change takes effect, and (where required by law) ask you to acknowledge the new Policy. Older versions are available on request from privacy@projectag.app."
    },

    { "type": "divider" },

    {
      "type": "heading",
      "level": 1,
      "text": "Annex A — European Economic Area and Switzerland (GDPR / FADP)"
    },
    {
      "type": "paragraph",
      "text": "This Annex applies to you if you are in the European Economic Area, Switzerland, or — by virtue of the extraterritorial scope of GDPR Article 3(2) — if our processing of your personal information relates to the offering of goods or services to you in the EEA, or to the monitoring of your behavior within the EEA."
    },
    {
      "type": "paragraph",
      "text": "**Controller and EU representative.** S8 Investment Holdings, LLC is the controller. Our EU Article 27 representative is [EU REP NAME], at [EU REP ADDRESS], reachable at eu-rep@projectag.app."
    },
    {
      "type": "paragraph",
      "text": "**Legal bases.** As described in Section 3. Where we rely on legitimate interests, we have conducted a documented Legitimate Interests Assessment and the conclusion is available on request."
    },
    {
      "type": "paragraph",
      "text": "**International transfers.** As described in Section 5. For transfers to the United States, we rely on the EU–US Data Privacy Framework where the recipient is self-certified, and on the 2021 SCCs (Module 2) otherwise, supplemented by the measures described in Section 6."
    },
    {
      "type": "paragraph",
      "text": "**Supervisory authority.** The competent lead supervisory authority for our EU operations will be determined by reference to the location of our main establishment in the EU. Until such time, you may complain to the authority in your Member State of residence."
    },
    {
      "type": "paragraph",
      "text": "**Digital Services Act (Regulation (EU) 2022/2065).** Project AG is an intermediary service within the meaning of the DSA. Our single point of contact for **Member State authorities, the European Commission, and the European Board for Digital Services** under Article 11 is dsa-authorities@projectag.app (working language: English). Our single point of contact for **recipients of the service** under Article 12 is dsa-users@projectag.app. Statements of reasons for content-moderation decisions are or will be published in the **DSA Transparency Database** where and when required by Article 24(5), in the form prescribed by the European Commission. The notice-and-action procedure under Article 16, the internal complaint-handling system under Article 20, and your right to refer disputes to a certified out-of-court dispute-settlement body under Article 21 are described in our Terms and Conditions and Community Guidelines."
    },

    {
      "type": "heading",
      "level": 1,
      "text": "Annex B — United Kingdom (UK GDPR)"
    },
    {
      "type": "paragraph",
      "text": "This Annex applies to you if you are in the United Kingdom or our processing is otherwise subject to the UK GDPR."
    },
    {
      "type": "paragraph",
      "text": "**Controller and UK representative.** S8 Investment Holdings, LLC is the controller. Our UK Article 27 representative is [UK REP NAME], at [UK REP ADDRESS], reachable at uk-rep@projectag.app."
    },
    {
      "type": "paragraph",
      "text": "**International transfers.** Transfers from the UK are made under the UK Addendum to the EU SCCs or under the UK International Data Transfer Agreement issued by the Information Commissioner."
    },
    {
      "type": "paragraph",
      "text": "**Supervisory authority.** Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — [ico.org.uk](https://ico.org.uk)."
    },
    {
      "type": "paragraph",
      "text": "**Online Safety Act 2023.** Project AG is a \"user-to-user service\" within the meaning of the Online Safety Act 2023. We have designated a senior person accountable for compliance with our duties under the Act (section 103); the designation is held internally and can be confirmed to Ofcom on request at uk-safety@projectag.app. Our risk assessments, illegal-content policies, and age-assurance approach for adult-content controls are reviewed at least annually and updated when product changes warrant."
    },

    {
      "type": "heading",
      "level": 1,
      "text": "Annex C — California, United States (CCPA / CPRA)"
    },
    {
      "type": "paragraph",
      "text": "This Annex supplements the Policy if you are a California resident. Capitalized terms have the meaning given in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the \"CCPA\")."
    },
    {
      "type": "paragraph",
      "text": "**Categories of personal information collected, sources, purposes, and disclosures.** In the preceding 12 months we have collected the categories listed in Cal. Civ. Code §1798.140(v): identifiers; customer-records information; commercial information (subscription transactions); internet or network activity information; geolocation; sensory information (photographs and, transiently, biometric identifiers via Persona); inferences (matching signals); and sensitive personal information (precise geolocation, account log-in credentials in transit, contents of communications). Sources, purposes, and disclosures are as described in Sections 2–4 of this Policy."
    },
    {
      "type": "paragraph",
      "text": "**Sale and \"sharing\" of personal information.** We do **not** sell personal information and we do **not** share personal information for cross-context behavioral advertising, as those terms are defined in the CCPA. We have not done so in the preceding 12 months."
    },
    {
      "type": "paragraph",
      "text": "**Sensitive personal information.** We use sensitive personal information (notably, photographs, precise geolocation, biometric identifiers transiently processed for verification, and the contents of your communications) only for the limited purposes permitted by Cal. Civ. Code §1798.121 and the implementing regulations, namely: to provide the services you have requested; to detect security incidents; to verify or maintain the quality of the service; and to comply with law. You have the right to limit our use of sensitive personal information; write to privacy@projectag.app to exercise it. We will action a verified request within 45 days (extendable by 45 days for complex requests)."
    },
    {
      "type": "paragraph",
      "text": "**Rights of California consumers.** You have the right to know, the right to delete, the right to correct, the right to limit use of sensitive personal information, the right to opt out of sale/sharing (we do neither), the right to portability, and the right not to receive discriminatory treatment for exercising any of the foregoing. To submit a request, email privacy@projectag.app or call our toll-free intake line at [TOLL-FREE NUMBER — operator to confirm]. Authorized agents may submit requests on your behalf with proof of authorization."
    },
    {
      "type": "paragraph",
      "text": "**Retention.** As described in Section 7 of this Policy."
    },
    {
      "type": "paragraph",
      "text": "**\"Shine the Light\" (Cal. Civ. Code §1798.83).** We do not disclose personal information to third parties for their direct-marketing purposes."
    },

    {
      "type": "heading",
      "level": 1,
      "text": "Annex D — Other U.S. State Privacy Laws"
    },
    {
      "type": "paragraph",
      "text": "If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MTCDPA), Iowa (ICDPA), Delaware (DPDPA), New Hampshire (NHDPA), New Jersey (NJDPA), Tennessee (TIPA), Minnesota (MCDPA), or Maryland (MODPA), you have rights of access, correction, deletion, portability, and to opt out of \"targeted advertising\", \"sale\", and certain forms of \"profiling\" in furtherance of decisions producing legal or similarly significant effects. We do not engage in any of these practices. To exercise an applicable right, email privacy@projectag.app."
    },

    { "type": "heading", "level": 1, "text": "Annex E — Brazil (LGPD)" },
    {
      "type": "paragraph",
      "text": "Aplica-se a você se estiver no Brasil ou se o tratamento de seus dados pessoais ocorrer no território nacional. Os princípios da LGPD (Art. 6º) — finalidade, adequação, necessidade, livre acesso, qualidade, transparência, segurança, prevenção, não discriminação e responsabilização — orientam todo o nosso tratamento."
    },
    {
      "type": "paragraph",
      "text": "**Encarregado (DPO).** [DPO BR NAME], dpo-br@projectag.app. **Autoridade competente.** Autoridade Nacional de Proteção de Dados (ANPD)."
    },
    {
      "type": "paragraph",
      "text": "**Bases legais.** Conforme a Seção 3 desta Política, em correspondência aos Arts. 7º e 11 da LGPD. **Direitos do titular.** Conforme o Art. 18 da LGPD — confirmação, acesso, correção, anonimização/bloqueio/eliminação, portabilidade, eliminação dos dados tratados com consentimento, informação sobre compartilhamento, informação sobre a possibilidade de não fornecer consentimento, e revogação do consentimento."
    },

    {
      "type": "heading",
      "level": 1,
      "text": "Annex F — Canada (PIPEDA) and Quebec (Law 25)"
    },
    {
      "type": "paragraph",
      "text": "We comply with the ten fair-information principles set out in Schedule 1 of PIPEDA, and with the additional requirements of Quebec's Law 25 (An Act to modernize legislative provisions as regards the protection of personal information)."
    },
    {
      "type": "paragraph",
      "text": "**Person in charge of the protection of personal information.** For residents of Quebec under Law 25 §3.1: [QC PIC NAME], quebec-privacy@projectag.app. **Transfer impact assessments** under Law 25 §17 are conducted prior to any transfer of personal information outside Quebec, and a summary is available on request. **Right to portability** in a structured, commonly-used technological format took effect September 22, 2024 and is supported via the in-app data export."
    },

    { "type": "heading", "level": 1, "text": "Annex G — Mexico (LFPDPPP)" },
    {
      "type": "paragraph",
      "text": "El presente Aviso de Privacidad se emite en cumplimiento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) y su Reglamento. El responsable es S8 Investment Holdings, LLC. **Finalidades primarias:** operación del servicio, comunicación con usted, prevención de fraude, cumplimiento legal. **Finalidades secundarias** (mercadotecnia, encuestas) — usted puede oponerse en privacy@projectag.app. **Derechos ARCO** (Acceso, Rectificación, Cancelación, Oposición) — solicitudes a privacy@projectag.app, conforme a los artículos 28–32 de la Ley."
    },

    { "type": "heading", "level": 1, "text": "Annex H — Japan (APPI)" },
    {
      "type": "paragraph",
      "text": "本附則は、日本の個人情報の保護に関する法律（APPI）に基づき、日本国内の利用者に適用されます。S8 Investment Holdings, LLC が個人情報取扱事業者です。利用目的、第三者提供、外国にある第三者への提供については、本ポリシーの第3〜5項のとおりです。日本の利用者は、APPI 第33条〜第35条に基づき、保有個人データの開示、訂正、利用停止、第三者提供の停止を請求できます。お問い合わせ：privacy-jp@projectag.app。"
    },

    { "type": "heading", "level": 1, "text": "Annex I — South Korea (PIPA)" },
    {
      "type": "paragraph",
      "text": "본 부속서는 대한민국 개인정보 보호법(PIPA)에 따라 한국 내 이용자에게 적용됩니다. 개인정보처리자는 S8 Investment Holdings, LLC 입니다. **개인정보 보호책임자(CPO)** (PIPA 제31조에 따라 지정): **[KR CPO 성명 — 한국 출시 전 운영자 확정]**, 연락처 privacy-kr@projectag.app. 국내대리인(PIPA 제31조의2)이 지정된 경우: [국내대리인 성명 및 주소 — 해당 시 확정]. **민감정보 및 고유식별정보**의 처리, **국외 이전**, 그리고 **자동화된 결정**에 대한 권리는 본 정책의 해당 절을 참조하십시오. 본인은 개인정보 보호위원회(PIPC)에 신고할 권리가 있으며, 개인정보 분쟁조정위원회(KISA) 또는 대검찰청 사이버수사과를 통한 구제 절차도 이용할 수 있습니다."
    },

    {
      "type": "heading",
      "level": 1,
      "text": "Annex J — Australia (Privacy Act 1988)"
    },
    {
      "type": "paragraph",
      "text": "We comply with the Australian Privacy Principles (APPs) set out in Schedule 1 of the Privacy Act 1988 (Cth). Our cross-border disclosures (APP 8) are governed by contractual safeguards with each overseas recipient and, where consent is required, are made only after we have obtained your consent. Complaints may be lodged with the Office of the Australian Information Commissioner (OAIC) at [oaic.gov.au](https://www.oaic.gov.au/)."
    },

    { "type": "heading", "level": 1, "text": "Annex K — South Africa (POPIA)" },
    {
      "type": "paragraph",
      "text": "We are the \"responsible party\" under the Protection of Personal Information Act, 2013 (POPIA). Our **Information Officer** (POPIA §55), registered with the Information Regulator under Regulation 4 of the POPIA Regulations: **[ZA INFORMATION OFFICER NAME — operator to confirm and register prior to ZA launch]**, reachable at popia@projectag.app. A **Deputy Information Officer** may be designated under §56 where the volume of requests warrants. South-African data subjects may exercise the rights conferred by POPIA Chapter 3 and may complain to the Information Regulator at [inforegulator.org.za](https://inforegulator.org.za/). Where we transfer personal information across borders, we do so in accordance with POPIA §72 (adequate level of protection, contractual safeguards, or your specific informed consent)."
    },

    {
      "type": "heading",
      "level": 1,
      "text": "Annex L — Kingdom of Saudi Arabia (PDPL)"
    },
    {
      "type": "paragraph",
      "text": "هذا الملحق ينطبق عليك إذا كنت في المملكة العربية السعودية أو إذا خضعت معالجة بياناتك الشخصية لنظام حماية البيانات الشخصية (PDPL). يقع مقر مراقب البيانات خارج المملكة، وقد عيّن المراقب **ممثلاً محلياً مسجلاً لدى الهيئة السعودية للبيانات والذكاء الاصطناعي (SDAIA)** وفقاً للمادة 5 من النظام: **[اسم وعنوان الممثل المحلي السعودي — يجب على المشغّل تأكيده وتسجيله لدى SDAIA قبل الإطلاق في المملكة]**، البريد الإلكتروني: ksa-rep@projectag.app. تُجرى التحويلات الدولية وفقاً لأحكام النظام واللائحة التنفيذية، بما في ذلك الإخطار المسبق لـ SDAIA حيثما يكون مطلوباً. للوصول إلى حقوقك (المادة 4 من النظام) — بما في ذلك الحق في الإعلام، والحق في الاطلاع، والحق في طلب الحصول على بياناتك، والحق في طلب تصحيح بياناتك أو إتلافها — يُرجى التواصل عبر privacy@projectag.app. للشكاوى يمكنك التواصل مع الهيئة السعودية للبيانات والذكاء الاصطناعي (SDAIA) عبر [sdaia.gov.sa](https://sdaia.gov.sa)."
    },

    { "type": "heading", "level": 1, "text": "Annex M — Rest of World" },
    {
      "type": "paragraph",
      "text": "If you are in a jurisdiction not specifically named above, the body of this Policy applies. To the extent local law grants you additional rights, we will honor those rights on request. To the extent local law imposes additional obligations on us, we will comply with those obligations and update this Policy or publish a supplemental notice as appropriate."
    },

    { "type": "divider" },
    {
      "type": "paragraph",
      "text": "_Document identifier: privacy-policy. Version 1.0.0. Effective 2026-05-16. Locale en-US. Authoritative version. Translations into other languages are provided for convenience; in the event of a conflict, the English (en-US) version controls except where local law requires otherwise._"
    }
  ]
}