1. INTRODUCTION & SCOPE

DailyLens.app ("DailyLens," "we," "our," or "us") is an AI-powered journaling and personal wellbeing platform operated as a Software-as-a-Service (SaaS) product. This Privacy Policy ("Policy") describes in full detail how we collect, use, process, store, share, and protect personal data when you access or use our web application, Progressive Web App (PWA), application programming interfaces, and all related features, content, and services (collectively, the "Service").

By creating an account, accessing, or using the Service in any manner, you acknowledge that you have read and understood this Policy. If you do not wish to have your data processed as described herein, please discontinue use of the Service.

This Policy applies to all users of the Service globally. Where applicable, additional rights and disclosures are provided for residents of the European Economic Area (EEA), United Kingdom, California (USA), and Canada.

This Policy does not apply to third-party websites, services, or applications that may be linked to or integrated with our Service. We are not responsible for the privacy practices of any such third parties.

2. DEFINITIONS

"Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), as defined under GDPR Article 4(1).

"Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means.

"Controller" means DailyLens.app, acting as the entity that determines the purposes and means of processing your Personal Data.

"Processor" means a third-party entity that processes Personal Data on behalf of the Controller under a Data Processing Agreement (DPA).

"Special Category Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, data concerning sex life or sexual orientation, or other categories defined under GDPR Article 9. Our Service may process certain data relating to mental health and emotional wellbeing; users are advised to exercise discretion in what they choose to record.

"AI-Generated Content" means outputs, reflections, insights, summaries, reports, or recommendations produced by artificial intelligence systems integrated within the Service.

"User Content" means all data, text, images, audio recordings, and other content that you create, upload, or submit through the Service, including journal entries, voice notes, and habit logs.

3. INFORMATION WE COLLECT

We collect information in three ways: data you provide directly, data generated automatically through your use of the Service, and data received from third-party services.

3.1 Account & Identity Data When you register for an account or manage your profile, we collect:

Email address and authentication credentials (hashed; never stored in plain text)
Display name and optional nickname or username
Profile settings, language preference, and timezone
Subscription plan and billing information (processed via third-party payment processors; we do not store full payment card data)
Authentication provider identifiers (unique identifiers assigned by our authentication provider)

3.2 Journal & Wellbeing Content Data The core function of the Service involves the creation and storage of personal wellbeing records. This category encompasses all content and structured data you voluntarily create within the Service, including but not limited to:

Written journal entries and notes in any format or language
Emotional and mood-related data you choose to record
Habit, practice, and routine tracking data, including supplement and wellness protocol records, schedules, completion logs, and progress measurements
Personal goals, preferences, and contextual information you provide to personalize your experience
AI personalization settings such as mentor style preferences and custom instructions

The specific types of data within this category may evolve as new features are added to the Service. Any material expansion of data collection will be reflected in an updated version of this Policy. The processing purposes and legal bases described in this Policy apply to all data within this category, regardless of feature-level changes.

Important Notice Regarding Special Category Data: Journal entries and wellbeing records may contain information about your mental health, emotional state, health and supplement practices, relationships, religious views, political opinions, or other sensitive matters. You voluntarily choose what to record. We process this data solely to deliver the Service's core functionality. You are encouraged to be mindful of the sensitivity of what you choose to record and store.

3.3 Voice & Media Data

Audio recordings: voice notes and audio journal entries recorded through the Service
Transcribed text: text generated from your audio recordings via AI transcription services
Images: photographs or images you upload as part of journal entries
Processed media variants: resized, compressed, or AI-described versions of uploaded images created by the Service for performance optimization
Media metadata: file size, duration, dimensions, MIME type, and upload timestamps

3.4 AI Interaction Data

Prompts, queries, and conversational inputs you send to AI-powered features
AI-generated reflections, insights, summaries, and reports
AI usage metadata: model identifiers, token consumption, provider information, and internal trace identifiers used for AI quality monitoring and debugging
Contextual data automatically included with AI requests (e.g., recent journal entries, mood history, habit data) to generate personalized responses

3.5 Device, Technical & Usage Data

Device type, operating system version, browser type and version
IP address (used for security, fraud prevention, and approximate geolocation for legal compliance purposes; not used for behavioral advertising)
App usage patterns, feature interactions, session duration, and navigation paths
Crash reports, error logs, and performance diagnostics
Push notification subscription tokens and device identifiers required for notification delivery
Notification preference settings and delivery logs
Offline sync metadata, including sync timestamps and device identifiers used for conflict resolution in our offline-first architecture
Local data stored on your device for offline functionality (this data remains on your device and is synced to our servers when you are online)

3.6 Analytics & Behavioral Data

Page views, events, and interaction data collected via our analytics tooling (see Section 6 for full details)
User session recordings and heatmap data collected via behavioral analytics tools (requires your consent where applicable)
Aggregate, anonymized usage statistics used for product improvement

3.7 Communications Data

Content of support tickets, emails, and other communications you send to us
Email interaction data (opens, clicks) for transactional and marketing communications sent via our email service provider

3.8 Health Data Imported from Connected Apps

If you choose to connect a phone, the DailyLens Android app imports a limited set of health and fitness records from Android Health Connect. The import is optional and off by default. It starts only after you turn on “Allow health data import” in Settings → Health and pair a phone with a one-time code.

What we import

Sleep sessions: start and end times, sleep stages and stage totals (light, deep, REM, awake), the number of awakenings, and the session title
Workouts: activity type, title, start and end times, distance, active energy, average and maximum heart rate during the workout, and the steps counted during the workout
Steps: one daily total per source app, calculated on your phone
Record details: the app that wrote each record (for example, your watch’s companion app), the device manufacturer, model and type, how the record was made (automatically, during an activity, or entered manually), time zone offsets, and the record identifiers and versions used by Health Connect
Connection details: the name you give the connection, your phone’s model, its Android version, the DailyLens app version, your time zone, the times of pairing and synchronization, and a sync log with counts, time ranges and error codes (it contains no health values)

The DailyLens app asks only for the Health Connect permissions needed for the data listed above, and it never writes to Health Connect.

How the import works

The app reads Health Connect only with the permissions you grant there. When you first connect, it reads up to the last 30 days; it reads that period again after you pair the phone anew or when it has not synchronized for a long time. Otherwise it reads new and changed records: about every 30 minutes when Android allows it, if you allow background reading, and otherwise when you open the app or tap sync. Records are sent to our servers over encrypted HTTPS using a device key that is issued once and stored on your phone encrypted with the Android Keystore. Our servers store only a one-way hash of the key and a short preview used to recognize it. The one-time pairing code is valid for 10 minutes.

On your phone, records waiting to be sent are kept in the app’s private storage, which is excluded from device backups. Sent records are removed after each synchronization, and records that could not be sent within 30 days are deleted.

Legal basis

Imported health data is Special Category Data. We process it on the basis of your explicit consent (GDPR Art. 9(2)(a) and Art. 6(1)(a)), which you give separately by turning on “Allow health data import”, in addition to the consent you give at registration (Section 4). You can turn it off at any time; this does not affect the lawfulness of processing before withdrawal.

How we use it

To show your sleep, workouts and steps in DailyLens
To record workouts as practice entries according to the rules you set, and to measure goals that you choose to base on imported data
In AI features, but only while the import is on: the assistant can use a short summary of your last 7 days, together with practice entries created from imported workouts and goal progress based on imported data, in chat, in daily and weekly reports, and in entry inspirations. In chat it can also look up imported records for dates relevant to your conversation, up to 30 days at a time
This information is sent to the AI service providers described in Section 7.2. For daily and weekly reports we use only endpoints that do not store requests (zero data retention). Chat requests are not limited this way and are handled as described in Section 7.2
When you turn the import off, imported records are no longer sent to AI features. Reports, conversation summaries and chat messages already written may still mention imported figures, and they stay in your history
If you connect an external AI client through our MCP integration, practice entries created from imported workouts and goal progress based on imported data can be returned to that client while the import is on, as can reports and chat messages the assistant wrote. Processing by that client is governed by its provider’s terms

We do not sell imported health data, use it for advertising, or use it to train AI models.

Your controls

You can turn off the import in Settings → Health. This disconnects every phone, stops further imports and AI use of imported records, and lets you choose whether the data already imported is kept or deleted
You can disconnect a single phone in Settings → Health and choose whether its data is kept or deleted, or disconnect it in the DailyLens app. You can also withdraw any permission in Health Connect at any time
You can use “Delete imported data” to delete all imported records and sync logs from our active systems (backups follow Section 10.2(c)). It also removes the practice entries the import created and you have not edited; entries you edited stay as your own. It does not remove reports, conversation summaries or chat messages the assistant has already written; these remain in your account history until your account is deleted or you ask us to delete them (Section 9). It also does not remove copies held by an external AI client you connected
You can hide individual records in the app. Hiding cannot yet be undone in the app
Your account data export includes imported data

Retention

Imported records are kept until you delete them, turn off the import and choose deletion, or delete your account. Records you hide, records deleted in Health Connect, and records replaced by a newer version are kept until then, marked so that they are not shown or used. Detailed sleep stage intervals are removed 90 days after the night; the stage totals are kept. For each phone we keep the 200 most recent sync logs. A disconnected phone with no imported data left is removed after 30 days, and expired pairing codes are removed. When you delete your account, imported health data is deleted with it as described in Section 10.2.

4. LEGAL BASIS FOR PROCESSING (GDPR)

For users in the EEA and United Kingdom, we process your Personal Data on the following legal bases under GDPR Article 6:

(a) Performance of a Contract (Art. 6(1)(b)): Processing necessary to provide the Service you have subscribed to, including account management, data storage, AI insights, sync functionality, and subscription billing.

(b) Legitimate Interests (Art. 6(1)(f)): Processing for our legitimate business interests, including fraud prevention, network and information security, product improvement through anonymized analytics, and protection of our legal rights - provided such interests are not overridden by your fundamental rights.

(c) Consent (Art. 6(1)(a)): For non-essential tracking technologies (e.g., behavioral analytics tools, certain cookies), direct marketing communications, and any processing of Special Category Data you voluntarily submit. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

(d) Legal Obligation (Art. 6(1)(c)): Where processing is required to comply with applicable law, court orders, or regulatory requirements.

For Special Category Data (e.g., mental health information, emotional wellbeing data, or health-related records within journal entries), our processing is based on your explicit consent under GDPR Article 9(2)(a). This explicit consent is obtained separately during the account registration process, via a dedicated, unchecked-by-default consent checkbox - distinct from acceptance of our Terms of Service - where you are asked to expressly agree to the processing of your health and wellbeing data for the purpose of delivering the Service. You may withdraw this consent at any time; withdrawal will not affect the lawfulness of prior processing but may impair our ability to deliver AI-powered features that rely on such data.

5. HOW WE USE YOUR INFORMATION

5.1 Service Delivery

Creating, maintaining, and managing your account
Storing and synchronizing your journal entries, mood data, habits, and media across devices
Delivering AI-powered reflections, insights, pattern analysis, and personalized coaching reports
Transcribing voice notes and generating AI descriptions of uploaded images
Processing and delivering scheduled push notifications and reminders
Enabling offline functionality through local device storage with server synchronization

5.2 AI Personalization

Generating personalized AI-powered reports and summaries based on your journaling patterns, mood trends, and habit data, delivered at intervals determined by the Service and your preferences
Adapting AI mentor style, tone, and advice to your stated preferences
Detecting patterns in your wellbeing data to surface relevant insights over time Your personal data submitted to AI systems is processed as described in Section 7.2 and subject to the disclaimers in Section 11.

5.3 Service Improvement & Analytics

Conducting aggregated, anonymized analysis of usage patterns to improve Service features and performance
Monitoring application performance, diagnosing errors, and resolving technical issues
Training and improving our proprietary AI prompts and insight algorithms using anonymized, aggregated data only - your individually identifiable data is never used to train third-party foundational AI models without your explicit consent

5.4 Communication & Support

Sending transactional emails (account confirmation, password reset, billing receipts)
Delivering in-app notifications and scheduled wellbeing reminders
Responding to support requests and inquiries
Sending product updates, feature announcements, and (where you have consented) marketing communications

5.5 Security, Fraud Prevention & Legal Compliance

Verifying identity and preventing unauthorized access
Detecting and preventing fraud, abuse, or violation of our Terms of Service
Complying with legal obligations and responding to lawful requests from public authorities
Protecting our legal rights and those of our users

5.6 Subscription Management

Processing subscription upgrades, downgrades, and cancellations
Managing billing cycles, payment failures, and refund requests in cooperation with our payment processor

6. COOKIES, ANALYTICS & TRACKING TECHNOLOGIES

6.1 Essential Technologies We use certain technologies that are strictly necessary to provide the Service and cannot be disabled without breaking core functionality. These include:

Authentication session cookies and tokens managed by our authentication provider
Local device storage for offline-first PWA functionality
Service worker cache for offline access

6.2 Analytics & Performance (Consent Required Where Applicable)

Analytics (Page Views & Events): We use a web analytics service to collect aggregated data about how users interact with our Service (page views, feature usage, session patterns). To enhance privacy, analytics requests are routed through a first-party proxy endpoint on our own domain, which prevents direct data transmission from your browser to the analytics provider. The provider processes this data as our processor under a Data Processing Agreement and applicable Standard Contractual Clauses. You may opt out of analytics tracking via our cookie consent interface or by using browser-level opt-out mechanisms provided by the analytics vendor.

Behavioral Analytics: We use a behavioral analytics service for session analysis, heatmaps, and interaction recording to improve usability of our interface. This service is activated only with your prior consent where required by applicable law. You may withdraw your consent at any time via our cookie consent settings.

Bot & Abuse Protection: We use an automated bot-detection service on certain forms and interactions to protect the Service against spam, credential stuffing, and automated abuse. This service collects device and behavioral signals and processes them to determine whether an interaction is human or automated. Its use of data is governed by its own privacy policy, available on request.

6.3 Managing Cookie Preferences You may manage your cookie and tracking preferences through our in-app consent management interface. Note that withdrawing consent for non-essential technologies will not affect your ability to use the core Service.

7. INFORMATION SHARING & THIRD-PARTY SERVICES

We do not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes. We share your data only as described below, and only with service providers who are contractually bound to protect it under Data Processing Agreements (DPAs).

7.1 Authentication We use an industry-standard, enterprise-grade identity and authentication provider to manage secure user login and session handling. This provider processes your email address and authentication state solely for the purpose of verifying your identity and maintaining a secure session. All data exchanges with this provider are governed by a Data Processing Agreement and GDPR-compliant transfer mechanisms.

7.2 AI Service Providers We integrate with one or more leading AI service providers to deliver the Service's core intelligent features, including natural language analysis, generation of personalized reflections and coaching-style insights, image analysis, and voice transcription.

To generate personalized outputs, relevant context from your journal entries, mood data, and habit records may be transmitted to these providers' APIs. The specific providers we work with are disclosed in our Data Processing Register, available upon request.

Critical Data Protection Notice: We have contractually configured our relationships with AI providers under terms that explicitly opt out of using submitted API data for training their foundational models. Your personally identifiable journal content is not used to train any third-party base AI model. All data transmitted to AI providers is processed under Data Processing Agreements and applicable Standard Contractual Clauses for international transfers.

We also employ AI quality monitoring and observability tooling to debug and improve the quality of AI-generated outputs. This system processes AI prompt metadata (trace identifiers, token counts, model version references) and is used solely for internal quality assurance purposes.

7.3 Infrastructure & Storage We utilize secure, enterprise-grade cloud infrastructure providers for database hosting, structured data storage, media file storage, and performance caching. These providers are selected based on their compliance certifications (including ISO 27001 and SOC 2), their ability to enter into Data Processing Agreements, and their support for GDPR-compliant data transfer mechanisms.

Media files you upload (voice notes, images) are stored in encrypted object storage and are accessible exclusively via time-limited, cryptographically signed URLs generated per authenticated request. No media file is directly publicly accessible by URL.

7.4 Payment Processing We use a leading, PCI DSS-compliant payment processing provider to handle subscription billing. When you purchase a subscription, your payment information is submitted directly and exclusively to that provider's secure infrastructure. We do not receive, process, or store your full payment card details or sensitive financial credentials. The payment processor may act as an independent controller for payment fraud prevention purposes and operates under its own privacy policy and applicable financial regulations.

7.5 Email Communications We use a GDPR-compliant email delivery provider for transactional communications (account-related notifications, billing alerts) and, where you have consented, marketing communications. This provider processes your email address and communication metadata (delivery status, interaction signals) under a Data Processing Agreement.

7.6 Monitoring & Observability We employ application performance monitoring and error-detection tooling to ensure the reliability and security of the Service. These systems process operational metadata (request traces, latency metrics, error rates, system logs) and do not contain your journal entries, User Content, or personally identifiable data beyond technical identifiers necessary for debugging.

7.7 Notifications If you opt in to push notifications, your browser's native push delivery infrastructure is used to transmit notification payloads to your device. We store the minimal technical identifiers required to deliver scheduled notifications to your device. You may revoke push notification permission at any time via your browser or device settings.

7.8 Content & Documentation We use a third-party content management platform to publish and manage our public blog and documentation. No Personal Data about Service users is shared with this provider.

7.9 Legal Disclosures We may disclose Personal Data without prior notice only: (i) as required by applicable law, regulation, or binding court order; (ii) to respond to lawful requests from public authorities (including law enforcement), provided we are legally permitted to notify you; (iii) to protect the safety, rights, or property of DailyLens.app, our users, or the public; (iv) in connection with a merger, acquisition, asset sale, or corporate restructuring - in which case we will provide notice prior to your data being transferred and becoming subject to a different privacy policy; (v) with your explicit prior consent.

8. DATA STORAGE, SECURITY & PROTECTION

8.1 Security Measures We implement technical and organizational security measures appropriate to the sensitivity of your data, including:

Encryption in Transit: All communications between your device and our servers are encrypted using TLS 1.3 or higher. API endpoints are accessible exclusively over HTTPS.
Encryption at Rest: All data stored in our database and object storage is encrypted at rest using AES-256 encryption.
Access Controls: Access to production systems and Personal Data is restricted on a strict need-to-know basis, with role-based access controls and mandatory multi-factor authentication for all personnel with system access.
Infrastructure Security: Our infrastructure is deployed on hardened cloud environments with network-level isolation, regular security patching, and intrusion detection monitoring.
Media Access Security: Uploaded media files are never publicly accessible by direct URL. Access requires time-limited, pre-signed URLs generated per authenticated request.
Offline Data: Data cached locally on your device for offline functionality is subject to your device's own security mechanisms (OS-level encryption, screen lock, etc.).

8.2 Data Breach Notification In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will: (a) notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible; (b) notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms; (c) document all breaches, including those not requiring notification, in accordance with GDPR Article 33(5).

8.3 Security Disclaimer NOTWITHSTANDING THE SECURITY MEASURES DESCRIBED ABOVE, NO METHOD OF TRANSMISSION OVER THE INTERNET AND NO METHOD OF ELECTRONIC STORAGE IS 100% SECURE. WHILE WE ENDEAVOR TO USE COMMERCIALLY REASONABLE MEANS TO PROTECT YOUR PERSONAL DATA, WE CANNOT GUARANTEE ITS ABSOLUTE SECURITY. YOU ACKNOWLEDGE AND ACCEPT THIS INHERENT RISK AS A CONDITION OF USING THE SERVICE. WE SHALL NOT BE LIABLE FOR ANY UNAUTHORIZED ACCESS, DISCLOSURE, OR THEFT OF YOUR PERSONAL DATA THAT OCCURS DESPITE OUR REASONABLE SECURITY MEASURES, EXCEPT TO THE EXTENT SUCH LIABILITY CANNOT BE EXCLUDED UNDER APPLICABLE LAW.

9. YOUR PRIVACY RIGHTS

9.1 Universal Rights (All Users) Regardless of your location, you may at any time:

Access your data by exporting it from your account settings
Correct inaccurate account information via your profile settings
Delete your account and associated data (see Section 10)
Opt out of marketing communications via the unsubscribe link in any email or via account settings
Revoke push notification permissions via your browser settings
Manage cookie and tracking preferences via our consent interface

9.2 EEA & UK Users (GDPR / UK GDPR) You have the following rights under GDPR and UK GDPR, exercisable by contacting us at the details in Section 16:

Right of Access (Art. 15): Obtain confirmation of whether we process your Personal Data and receive a copy thereof.
Right to Rectification (Art. 16): Request correction of inaccurate or incomplete Personal Data.
Right to Erasure / "Right to Be Forgotten" (Art. 17): Request deletion of your Personal Data, subject to legal retention obligations.
Right to Restriction of Processing (Art. 18): Request that we restrict processing in certain circumstances.
Right to Data Portability (Art. 20): Receive your Personal Data in a structured, commonly used, machine-readable format (JSON or CSV) and transmit it to another controller.
Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.
Right to Lodge a Complaint: Lodge a complaint with your national supervisory authority. For Poland, this is the Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (www.uodo.gov.pl).

We will respond to verified rights requests within 30 days. Complex requests may require up to 90 days, with prior notice of extension.

9.3 California Residents (CCPA / CPRA) Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, California residents have the right to:

Know what Personal Information is collected, used, disclosed, or sold
Delete Personal Information (subject to exceptions)
Correct inaccurate Personal Information
Opt out of the "sale" or "sharing" of Personal Information

WE DO NOT SELL OR SHARE YOUR PERSONAL INFORMATION AS DEFINED UNDER CCPA. We do not engage in cross-context behavioral advertising.

To exercise your California rights, contact us at [email protected] with the subject line "CCPA Rights Request." We will not discriminate against you for exercising your CCPA rights.

9.4 Canadian Residents (PIPEDA / Law 25) Canadian residents have rights under PIPEDA and, for Quebec residents, Law 25. These include the right to access and correct your Personal Information. Contact us as described in Section 16.

10. DATA RETENTION & DELETION

10.1 Active Accounts We retain your Personal Data and User Content for as long as your account is active and as necessary to provide the Service. Subscription and billing records are retained for the period required by applicable accounting and tax regulations (in Poland: 5 years from the end of the financial year in which the transaction occurred).

10.2 Account Deletion Upon your request to delete your account, we will: (a) immediately revoke access to your account and associated data; (b) permanently delete all Personal Data and User Content (journal entries, mood data, voice notes, images, habit logs, AI interaction history) from our active production systems within 30 days; (c) purge your data from backup systems within 90 days following the backup rotation cycle; (d) confirm deletion upon completion.

Deletion is irreversible. We strongly recommend exporting your data before initiating account deletion.

10.3 Retention Exceptions Notwithstanding the above, we may retain certain data beyond the periods described where:

retention is required by applicable law, regulation, or court order;
the data is necessary for the establishment, exercise, or defense of legal claims;
the data has been fully anonymized and aggregated such that re-identification is not reasonably possible.

10.4 Inactive Accounts Accounts with no login activity for 24 consecutive months may be subject to data archival or deletion after providing 60 days' prior notice to your registered email address.

11. AI SERVICES & MENTAL WELLBEING DISCLAIMER

11.1 Nature of the Service

⚠️ IMPORTANT DISCLAIMER - PLEASE READ CAREFULLY

DailyLens.app is a personal journaling, habit-tracking, and wellbeing tool that uses artificial intelligence to generate reflective insights, pattern summaries, and coaching-style content.

THE SERVICE DOES NOT PROVIDE, AND SHALL NOT BE CONSTRUED AS PROVIDING, MEDICAL ADVICE, PSYCHOLOGICAL DIAGNOSIS, PSYCHIATRIC TREATMENT, MENTAL HEALTH COUNSELING, THERAPEUTIC SERVICES, OR ANY OTHER FORM OF PROFESSIONAL HEALTHCARE.

11.2 AI Limitations AI-generated content within the Service (including reflections, insights, reports, and recommendations):

is produced by statistical language models and may contain errors, omissions, inaccuracies, or outdated information;
does not account for your full medical, psychological, or personal history;
may reflect biases present in the training data of underlying AI models;
is not reviewed by licensed mental health professionals before delivery;
may not be appropriate for individuals experiencing acute mental health crises, severe depression, suicidal ideation, or other serious conditions.

11.3 Crisis Resources If you are experiencing a mental health crisis, suicidal thoughts, or emotional distress that requires immediate attention, please contact:

Emergency services: 112 (EU) / 911 (USA)
Poland: Telefon Zaufania dla Dorosłych: 116 123
International: findahelpline.com

11.4 Professional Consultation We strongly encourage you to work with qualified mental health professionals, therapists, counselors, or physicians in conjunction with your use of this Service. Nothing in the Service should be used to replace, delay, or override professional psychological or medical advice.

Note: Provisions concerning limitation of liability, warranties, and remedies for AI-generated content are set out in our Terms of Service, available at https://dailylens.app/terms-of-service.

12. CHILDREN'S PRIVACY

We do not knowingly collect, solicit, or process Personal Data from individuals under the age of 18. The Service is not directed at minors, and we have no intention of processing their personal data.

If we become aware that Personal Data has been submitted by or on behalf of a person under 18, we will promptly delete all such data from our systems and close the relevant account.

If you have reason to believe that a person under 18 has registered for or is using the Service, please notify us immediately at [email protected].

Note: The minimum age requirement for creating an account, along with the consequences of providing false age declarations, is set out in our Terms of Service, available at https://dailylens.app/terms-of-service.

13. INTERNATIONAL DATA TRANSFERS

DailyLens.app is operated from Poland and may process or transfer your Personal Data to countries outside the EEA, including the United States, in connection with the third-party service providers described in Section 7.

For all transfers of Personal Data from the EEA to third countries, we ensure an adequate level of protection is in place through one or more of the following mechanisms:

Standard Contractual Clauses (SCCs) approved by the European Commission;
Adequacy decisions by the European Commission (where applicable);
Other approved transfer mechanisms under Chapter V of the GDPR.

14. GOVERNING LAW & DISPUTE RESOLUTION

14.1 Governing Law This Policy and all matters relating to your use of the Service are governed by the laws of the Republic of Poland, including the Act of May 10, 2018 on the Protection of Personal Data (implementing GDPR into Polish law), without regard to its conflict of law principles. For EEA users, nothing in this clause limits your rights under GDPR or applicable national consumer protection law.

14.2 Jurisdiction Subject to Section 14.3, any legal action, proceeding, or dispute arising out of or relating to this Policy or the Service shall be subject to the exclusive jurisdiction of the competent courts located in Poland.

14.3 Alternative Dispute Resolution Before initiating formal legal proceedings, we encourage attempting to resolve disputes in good faith through direct negotiation. You may also utilize the EU Online Dispute Resolution platform available at https://ec.europa.eu/consumers/odr for disputes related to online services. Your statutory rights, including the right to lodge a complaint with the UODO (see Section 9.2), are not affected.

Note: Provisions concerning limitation periods for claims, arbitration, class action waivers, and other contractual dispute resolution mechanisms are set out in our Terms of Service, available at https://dailylens.app/terms-of-service.

15. POLICY UPDATES

We reserve the right to update or modify this Policy at any time to reflect changes in our practices, legal requirements, or Service functionality. The "Last updated" date at the top of this document will be revised accordingly.

For material changes that significantly affect your rights or how we use your data, we will:

(a) notify you via email to the address registered with your account at least 30 days before the changes take effect;

(b) display a prominent in-app notice;

Your continued use of the Service after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must discontinue use of the Service and may request account deletion as described in Section 10.

16. CONTACT & DATA PROTECTION

For all privacy-related matters, including requests to exercise your rights, questions about this Policy, data deletion requests, or to report a data breach, please contact us:

Email: [email protected] Subject: [Privacy] - [brief description of your request]

Website: https://dailylens.app

We aim to acknowledge all inquiries within 5 business days and resolve them within 30 days. For complex requests under GDPR, the response period may be extended to 90 days with prior notice.

For requests involving the exercise of GDPR rights, we may require verification of your identity to protect against unauthorized access to your data. We will not charge a fee for reasonable requests; however, we reserve the right to charge a reasonable administrative fee for requests that are manifestly unfounded, excessive, or repetitive.

DailyLens.app Email: [email protected]

This document constitutes the Privacy Policy of DailyLens.app and supersedes all prior versions.

Created: February 21, 2026

Last updated: February 21, 2026

Effective date: February 21, 2026

Version: 1.0

Privacy Policy