Privacy Policy

SEC 01Data Collection — Specific Granularity & Purpose

We strictly follow the "minimum necessary" principle and collect the following information only through compliant technical means, used exclusively to maintain the operation of our IAA (in-app advertising) and IAP (in-app purchase) systems, optimize user experience, prevent fraud, and comply with global regional privacy regulations. We do not collect any personal information unrelated to the service:

SEC 02In-Depth Third-Party Sharing Architecture (Data Mapping)

To achieve legitimate monetization, service optimization, and anti-fraud purposes, we share necessary data only with the following compliant third-party ecosystem. The sharing process strictly follows the "minimum necessary, encrypted transmission, fully controllable" principle and does not share any sensitive personal information. You may review the privacy policies of each platform on their official websites to understand the details of data processing:

SEC 03Global Region-Specific Legal Notices

We strictly adapt to privacy regulations of countries and regions around the world. Combined with the latest policy changes in 2026, we have developed differentiated compliance terms for key regions to ensure full compliance throughout the service:

SEC 04Auto-Renewing Subscription Disclosure (Subscription Transparency)

If our apps include auto-renewing subscription services, we strictly follow Apple and Google app store rules and global regional compliance requirements, and make the following clear statements to protect users' right to know and right to choose:

SEC 05AI-Generated Content Disclosure (If Applicable)

If our apps include AI-generated content (including but not limited to text, audio, images, and interactive scenes), we strictly comply with global AI compliance requirements and make the following clear statements to protect users' right to know and legitimate rights:

SEC 06Cookies & Tracking Technologies

Our website and apps use cookies and similar tracking technologies to ensure service functionality, analyze traffic, and remember user preferences. You can control cookie behavior through your browser settings or in-app preferences. We categorize cookies into strictly necessary (always active), functional (preferences), analytics (opt-in), and advertising (opt-in, region-dependent).

• Strictly necessary cookies: session, security, load-balancing — cannot be disabled
• Functional cookies: language preference, theme — opt-out available
• Analytics cookies: aggregated, anonymized — opt-in required in EU/UK
• Advertising cookies: only set after explicit consent — fully revocable

SEC 07Children's Privacy (COPPA, GDPR-K, China PIPL minors)

Our apps are not directed to children under 13 (or under 16 in the EU/UK under GDPR-K, or under 14 in China). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact privacy@webgridsoftprime.com and we will delete it within 7 business days. Age-gating is implemented where required by regional law.

SEC 08DMCA Notice & Takedown

If you believe content hosted or distributed through our services infringes your copyright, please send a DMCA notice to dmca@webgridsoftprime.com including: (1) identification of the copyrighted work, (2) identification of the infringing material, (3) your contact information, (4) a good-faith statement, (5) a statement under penalty of perjury, and (6) your physical or electronic signature. We respond to valid notices within 5 business days.

SEC 09Contact & Data Protection Officer

For any questions, feedback, complaints, or data protection requests (access, correction, deletion, withdrawal of consent), please contact us:

• Privacy inbox: privacy@webgridsoftprime.com
• General inbox: contact@webgridsoftprime.com
• Support inbox: support@webgridsoftprime.com
• Postal address: Data Protection Officer, University of Texas Innovation Center, USA
• Response SLA: We respond to all privacy requests within 30 days (15 days for EU/UK under GDPR Art. 12).

SEC 10Data Retention & Deletion Policies

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Our retention framework is documented below:

At the end of the retention period, data is either irreversibly deleted, anonymized (such that it can no longer be associated with an individual), or archived in a form that prevents re-identification, in accordance with GDPR Art. 5(1)(e) storage limitation principle.

SEC 11Automated Decision-Making & Profiling

We use automated systems for content personalization, ad targeting, and feature recommendations. These systems may qualify as "profiling" under GDPR Art. 4(4) or "automated decision-making" under GDPR Art. 22.

• Logic involved: machine-learning models that infer user preferences from contextual signals, on-device behavior patterns, and aggregated cohort data.
• Significance and consequences: automated decisions affect (a) which ads are shown, (b) which content is featured, and (c) which subscription tier is offered. We do NOT use automated decision-making for purposes that produce legal or similarly significant effects on users (e.g., credit eligibility, employment).
• Right to human review: EU/UK users have the right to obtain human intervention in any decision based solely on automated processing that materially affects them. Contact privacy@webgridsoftprime.com to invoke this right.
• Right to contest: you may express your point of view and contest the decision at any time.
• Safeguards: we maintain model cards, regular bias audits, and human-in-the-loop review for all production ML systems.

SEC 12International Data Transfer Mechanisms

Our infrastructure spans multiple regions. To lawfully transfer personal data across borders, we rely on the following mechanisms:

• EU Standard Contractual Clauses (SCCs): the 2021 EU SCCs (Module 1, 2, and 3) are executed with all non-adequate-jurisdiction subprocessors. The UK International Data Transfer Addendum applies to UK data exports.
• EU-U.S. Data Privacy Framework (DPF): for transfers to U.S.-based subprocessors certified under the DPF, we rely on the framework's adequacy decision.
• Adequacy decisions: for transfers from the EU/UK to countries with adequacy decisions in force (e.g., UK, Switzerland, Canada, Japan, South Korea, Israel, New Zealand), we rely on the corresponding adequacy regulations.
• Transfer Impact Assessments (TIAs): we conduct and document TIAs for every cross-border transfer flow, evaluating local surveillance laws, government access risks, and supplementary technical measures.
• Supplementary safeguards: end-to-end encryption, pseudonymization, strict access controls, and data minimization ensure transferred data is unreadable to unauthorized third parties.
• China PIPL outbound transfers: for data of mainland China users, we cooperate with the CAC security assessment, standard contract filing, or certification path as applicable.
• India DPDP cross-border transfers: we obtain approval from the central government where required by the Data Protection Board for restricted cross-border flows.

SEC 13Biometric Data Processing

Where our apps use biometric authentication (Face ID, Touch ID, Android BiometricPrompt), the following principles apply:

• Biometric data is processed exclusively on-device via Secure Enclave / TEE. Raw biometric templates NEVER leave the user's device.
• We do NOT store, transmit, or share biometric identifiers with any third party.
• Biometric data is not used for advertising, marketing, or any commercial purpose beyond authentication.
• Users may opt out of biometric authentication and use a strong passcode or hardware security key instead, without loss of core functionality.
• Illinois BIPA, Texas CUBI, Washington biometric statutes, and equivalent regional laws are complied with; users in those jurisdictions are not required to provide biometric data as a condition of service.

SEC 14Health, Wellness & Sensitive Data

For apps in our matrix that process health-related data (e.g., Calorie Quantified Tracker):

• All health data is stored locally on the user's device using encrypted CoreData / Room databases.
• We do NOT transmit health data to our servers or any third party.
• If cloud sync is offered, it is opt-in, end-to-end encrypted with user-controlled keys, and the user may delete it at any time.
• We do NOT use health data for advertising targeting, insurance underwriting, employment decisions, or any prohibited purpose under HIPAA, GDPR Art. 9, or PIPL sensitive data classifications.
• HealthKit / Google Fit integrations are governed by Apple's and Google's respective health data policies; we only access data with explicit user permission via the HealthKit / Fit APIs.

SEC 15Financial Data & Payment Security

For our financial-tracking apps (Budget Analysis Engine):

• All financial data is stored locally on the user's device. We do NOT maintain server-side records of transactions.
• If optional cloud backup is enabled, data is encrypted client-side with keys derived from the user's password before transmission.
• We do NOT access, aggregate, or sell financial transaction data for any purpose.
• Bank account linking (where offered) uses OAuth 2.0 with read-only scopes through aggregators (Plaid, Finicity) — we never store bank credentials.
• GLBA (Gramm-Leach-Bliley Act) safeguards apply to U.S. financial data subjects.

SEC 16Behavioral Advertising Opt-Out & Limit Ad Tracking

In compliance with Apple App Tracking Transparency (ATT), Google Play Data Safety, and global privacy regulations, we provide the following controls:

• iOS: the ATT prompt is displayed once on first relevant request. Users may change their preference at any time via iOS Settings → Privacy & Security → Tracking.
• Android: users may opt out of ad personalization via Google Settings → Ads → Opt out of Ads Personalization.
• App-level: in-app "Settings → Privacy → Reset Advertising ID" deletes the IDFA/GAID and any associated profiles.
• Web: Global Privacy Control (GPC) signals and DNT headers are honored at the browser level.
• Opting out does NOT disable ads entirely — only the personalization component. Users still see contextual ads based on the current screen content.

SEC 17Third-Party Login & Social Features

• Where apps offer "Sign in with Apple," "Sign in with Google," or other OAuth-based authentication, the respective provider's privacy policy applies to data they collect.
• We receive only the minimum fields necessary (typically: stable opaque identifier, display name, verified email). We do NOT receive your contacts, friends list, or social graph.
• "Sign in with Apple" users on iOS may request Apple's private relay email to hide their real email address from us.
• Disconnecting a third-party login in our in-app settings deletes the linkage from our systems. The third-party provider's own account and data remain subject to their policies.
• Social sharing features (e.g., share buttons that post to Twitter/X, Facebook, LinkedIn) only transmit data to those services if the user explicitly initiates the share action.

SEC 18Cookies, Local Storage & Similar Technologies

Our website and apps use various storage technologies. Each category serves a specific purpose:

SEC 19Session Replay, A/B Testing & Analytics Technologies

• Session replay: NOT used in our apps. We do not record user sessions for playback.
• A/B testing: used internally for product experimentation. Test variants are assigned randomly with explicit consent for analytics.
• Heatmaps & click tracking: used only on opt-in product surfaces, never on legal documents or sensitive data entry fields.
• Crash reporting: anonymized stack traces are sent to our self-hosted Sentry-compatible instance. No PII is attached to crash events.
• Performance monitoring: aggregated frame-rate, app-launch time, and network latency metrics. No user-identifying correlation.

SEC 20Voice, Audio & Biometric Capture

• Voice recordings (where captured, e.g., voice memos) are stored locally on the device. We do NOT transmit voice data to any server.
• Voice assistant integrations (Siri Shortcuts, Google Assistant) are governed by Apple's and Google's respective privacy policies.
• Speech-to-text processing happens entirely on-device using CoreML / TensorFlow Lite. No audio is sent to cloud speech APIs.
• Microphone access is requested with explicit, purpose-disclosed permission, and may be revoked at any time via device settings.

SEC 21Geolocation Data

• Precise GPS / GPS-equivalent location data is requested only with explicit, granular user consent (foreground permission on Android, "While Using" on iOS).
• Background location is NEVER requested without a separate, prominent disclosure and explicit opt-in.
• Location data is used solely for the user-facing feature that requested it (e.g., finding nearby stores) and is processed in-memory where possible.
• We do NOT sell location data or share it with advertising networks for real-time bidding.
• Coarse / city-level location (derived from IP) is used only for region-specific compliance and content localization.
• Geofencing (where used) is computed on-device. Server-side geofence triggers are never persistent.

SEC 22AR / VR & Camera Data

• Camera and ARKit / ARCore access is requested with explicit purpose disclosure.
• Camera frames are processed in real time on-device. We do NOT record, store, or transmit photos or video from our apps unless the user explicitly initiates a save or share action.
• AR world maps and spatial anchors are stored locally on the device.
• Face mesh data from ARKit is processed entirely on-device and never transmitted.
• Body tracking data (where used) follows the same on-device-only principle.

SEC 23IoT, Connected Devices & Companion Apps

• Companion apps for IoT devices operate on a local-first principle. Communication with devices happens via BLE / Local Network where possible.
• If cloud relay is required, end-to-end encryption with user-controlled keys is used.
• Device telemetry is anonymized at the source before any cloud transmission.
• Account binding between app and device uses secure pairing flows (QR code, NFC tap, or out-of-band key exchange).

SEC 24Marketing Communications

• Marketing emails and push notifications are sent only with explicit opt-in consent (double opt-in for EU/UK).
• Every marketing email includes a clear, working unsubscribe link per CAN-SPAM Act and GDPR requirements.
• Transactional emails (purchase receipts, security alerts, policy changes) are sent regardless of marketing preferences.
• Push notification permissions are requested separately from any data collection and may be revoked at any time via device settings.
• Email engagement metrics (opens, clicks) are tracked using transparent pixels with the option to disable image loading to opt out.

SEC 25Data Protection Officer & EU/UK Representative

• Data Protection Officer (DPO): dpo@webgridsoftprime.com
• EU Statutory Representative (per GDPR Art. 27): EU-REP@webgridsoftprime.com — [EU representative name and registered address reserved per Article 27 obligation; will be appointed within 30 days of first EU market launch]
• UK Statutory Representative (per UK-GDPR Art. 27): UK-REP@webgridsoftprime.com — [UK representative details reserved; will be appointed per ICO guidance]
• Response SLA: 7 business days for EU/UK GDPR requests; 30 days for global privacy requests.
• Postal correspondence: Data Protection Officer, WebGridSoftPrime.com, University of Texas Innovation Center, USA.

SEC 26U.S. State-Specific Privacy Rights (Detailed)

In addition to the federal-level disclosures above, the following state-specific rights apply:

We honor Global Privacy Control (GPC) and other Universal Opt-Out Mechanisms (UOMs) as valid signals under applicable state laws.

SEC 27Data Breach Notification Procedures

• In the event of a personal data breach affecting our users, we will notify the relevant supervisory authority within 72 hours of becoming aware, per GDPR Art. 33.
• Affected users will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms, per GDPR Art. 34.
• U.S. state-specific notification timelines are followed: CA (most expedient), NY (30 days for computerized data), TX (60 days for 250+ affected), etc.
• Notification includes: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed.
• Notification channels: in-app message, registered email (if available), and where required by state law, direct mail or telephone.
• Where the breach is unlikely to result in risk to user rights, we maintain a documented internal incident record per GDPR Art. 33(5).

SEC 28Changes to This Privacy Policy

• We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations.
• Material changes will be communicated at least 30 days in advance via in-app notification, registered email (where consent exists), and a prominent banner on our website.
• Non-material changes (e.g., typo corrections, clarifications, contact info updates) will be posted with an updated "Last Revised" date.
• Continued use of our apps after the effective date of changes constitutes acceptance. If you do not agree, you may stop using the apps and request account deletion per our data subject rights procedure.
• Previous versions of this policy are archived and available upon request to privacy@webgridsoftprime.com.

SEC 29Miscellaneous Provisions

• Severability: if any provision of this policy is held unenforceable, the remaining provisions remain in full force.
• Assignment: we may transfer this policy in connection with a merger, acquisition, or sale of assets; users will be notified per Section 28.
• No waiver: our failure to enforce any right under this policy does not constitute a waiver of that right.
• Entire agreement: this policy, together with our Terms of Service and any product-specific addenda, constitutes the entire agreement regarding privacy.
• Language: the English version of this policy is the authoritative version. Translated versions are provided for convenience only.
• Headings: section headings are for navigation only and do not affect interpretation.