PRIVACY POLICY

Last Updated: March 11, 2024

These Terms and Conditions (the “Terms”) govern your use of the mobile applications (the “App”), provided by APPCAPITAL AG, a company registered at Baarerstrasse 78, 6300, Zug, Switzerland, together with companies in the same corporate group (hereinafter “AppCapital Group”) (“we”, “us”, “our”).
Our contact details:
Address: Baarerstrasse 78, 6300, Zug, Switzerland
E-mail: kb@appcapital.vc

Please read this Privacy Policy carefully as it contains important information about the following:
· How do we collect your Personal and Face Data?
· How do we process your Personal and Face Data?
· When can we share your Personal Data?
· How long do we retain your Personal and Face Data?
· Do we use automated decision-making or refer to the automated profiling?
· What rights do you have?

We may update this Privacy Policy from time-to-time to keep it in conformity with the relevant legislation, including the Regulation of the European Parliament and of the Council (EU) 2016/679 (the “GDPR”) and California Consumer Privacy Act 2018 (the “CCPA”). We will keep you informed about the changes to our Privacy Policy. If we make any major changes to our Privacy Policy and will need your explicit consent for further processing of your Personal Data, we will request your consent or your renewed consent (in case it was obtained previously).

HOW DO WE COLLECT YOUR FACE DATA?
Our Apps do not directly collect or store face data. It functions by requesting access to the user's camera, enabling the processing of facial photos to technically be able to use our Apps. With the user's explicit consent, Apps then transfer the processed data for storage in a designated section separate from the Apps, typically the user's photo gallery on its device. This approach ensures that the App’s role is strictly limited to processing face data and that we do not collect it to any of our storage or server.

HOW DO WE PROCESS AND USE YOUR FACE DATA?
We affirm that we do not utilize the collected face data for any purposes. Since the data remains securely stored on the user's device, we do not have access to it and, consequently, do not have any intentions to use this data in any form. We prioritize user privacy and, therefore, do not share any face data with third parties or external services. The data processed by our Apps is exclusively stored on the user's device. This ensures that the user retains full control and ownership of their personal information at all times.

HOW LONG DO WE RETAIN YOUR FACE DATA?
The duration for which face data is retained is entirely controlled by the user. Given that the data is stored locally on the user's device, they have the authority to manage and delete the data as per their preference. We do not impose any restrictions or guidelines on the retention period of the face data.

HOW DO WE COLLECT YOUR PERSONAL DATA?
We collect Personal Data if you provide it to us or automatically by electronic means.


HOW DO WE PROCESS YOUR PERSONAL DATA?
We respect your privacy and aim to limit the Personal Data that we collect from you to the amount which is strictly necessary to fulfil the purposes of processing.

Categories of Personal Data that we process are specified below:
WHEN CAN WE SHARE YOUR PERSONAL DATA?
We can share your Personal Data with third parties only in the cases listed below:

When we are required by law: We may disclose your Personal Data to the extent that we are required to do so by law (which may include to government bodies and law enforcement agencies), in connection with any legal proceedings or prospective legal proceedings and in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention).
With our partners who help us support the App: We may have partners that help us to make the App better, including analytics and advertising partners which may process your Technical Data and some User Data for analytical and advertising purposes respectively.
The list of our analytics and advertising partners:
· Google Analytics. Google Analytics is a web analytics service provided by Google, Inc. Address: Google, Google Data Protection Office, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA, Privacy Help Center. Privacy Policy of Google Inc.;
· Facebook Ads. Facebook Ads Manager is a Facebook tool that allows to create and manage ads provided by Meta Platforms, Inc. Address: 1601 Willow Road, Menlo Park, CA 94025, USA. Privacy Policy of Meta;
· Google Ads. Google Ads is a contextual advertising service from Google, Inc. Address: Google, Google Data Protection Office, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA, Privacy Help Center. Privacy Policy of Google Inc.
Please note that some of these companies may be located outside the EU (international data transfers) including in the countries which do not ensure an adequate level of protection of your Personal Data. Where this is the case, we meet the strict conditions of Personal Data transfers from the member states of European Union to other countries by using the Standard Contractual Clauses (SCC) adopted by the European Commission to ensure that Personal Data are properly protected or relying on other derogations compliant with GDPR. In case you want to check the relevant SCC, the links to them are provided below:
· Google Analytics. Transfer to the USA and Singapore is based on Google Ads Controller-Controller Data Protection Terms and Google Ads Data Processing Terms;
· Facebook Ads. Transfer to the countries specified here based on the Data Processing Terms and Facebook European Data Transfer Addendum;
· Google Ads. Transfer to the USA and Singapore based on Google Ads Controller-Controller Data Protection Terms and Google Ads Data Processing Terms.

HOW LONG DO WE RETAIN YOUR PERSONAL DATA?
We retain your Personal Data for no longer than it is necessary to fulfill the purposes specified in the section “How do we process your Personal Data”. Except for any legal obligation that sets a longer data retention period, at the end of these periods, the Personal Data processed will be deleted or anonymized.

DO WE USE AUTOMATED DECISION-MAKING OR REFER TO THE AUTOMATED PROFILING?
We neither use automated decision-making nor refer to the automated profiling.

WHAT RIGHTS DO YOU HAVE?
Rights of EU residents:
(1) The right of access to your Personal Data meaning that you can receive a copy of the Personal Data that we hold about you, as well as other supplementary information.

(2) The right to rectification of your Personal Data which is incomplete or inaccurate.

(3) The right to erasure of your Personal Data meaning that you can ask us to delete or remove your Personal Data in certain circumstances. Note, that we can retain your Personal Data as necessary to comply with our legal obligations or resolve disputes. If we have no grounds to continue processing your Personal Data, we will delete or remove it and notify you about such deletion or removal.

(4) The right to restrict processing of your Personal Data if (a) the accuracy of the Personal Data is contested by you, (b) the processing is unlawful and you oppose the erasure of the Personal Data, (c) we no longer need the Personal Data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, and (d) you have objected to processing pending the verification whether the legitimate grounds override this.

(5) The right to data portability. The right to portability of your Personal Data, which applies only to information we have processed based on your consent or Terms and Conditions.

(6) The right to object to the processing of your Personal Data where we are relying on a legitimate interest and there is something about your particular situation that makes you want to object to the processing on this ground. We will no longer process the Personal Data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

(7) Right to withdraw consent at any time where we are relying on the consent to process your Personal Data. If we have no other grounds for processing your Personal Data, after you send us a request to withdraw consent, we will stop processing your Personal Data that we were processing under your consent.
We will address your request as early as possible and no longer that within 1 month. Please note that this period may be extended by 2 further months where necessary, taking into account the complexity and number of the requests. In this case, we will inform you of the extension within 1 month of receipt of your request and will explain you the reasons for the delay.

Rights of California residents:
(1) The right to opt out. Under the CCPA each California resident can request business stops selling Personal Data to third parties.
Do we actually “sell” Personal Data? We do not, and will not, provide your Personal Data in direct exchange for money. Therefore, in the literal sense, we do not sell your Personal Data.

(2) Other rights. You also have a right to be informed about what categories of Personal Data we are collecting: you can request us to disclose what Personal Data we have collected in the past 12 months and right to get a free copy of your Personal Data disclosed in a readily usable and readable format. You can also request us to delete the Personal Data we have collected in the past 12 months. We will not discriminate against you for exercising any of your rights granted under CCPA.
Mandatory Verification: As required by CCPA we will need to verify your identity before processing your request. In order to verify your identity, you will be asked to log in to your account or (if you do not have an account) we will try to match the information you provided with the information we handle about you. In certain circumstances, we may decline the request, mainly where we are unable to verify your identity, for example, if you have requested us to delete your Personal Data.

As required by CCPA we endeavor to respond to a verifiable request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will deliver our written response by e-mail.
How to exercise any of your rights? You may exercise your rights by sending a relevant request to the e-mail indicated in the contact details.

If you have any comments about how we process your Personal Data, please let us know and we will consider your claim. If you are not satisfied with our response to the complaint, you have the right to file a complaint with the competent authority.