Privacy Policy for the Use of the ailloy App and Website

Last updated: 6 October 2026

Note: This is an English translation of our German Privacy Policy (“Datenschutzerklärung”) provided for informational purposes. The German version is the legally binding one. In the event of any discrepancy between the two language versions, the German text shall prevail.

1. General

This Privacy Policy informs you about the processing of your personal data in connection with:

• the use of the mobile application (hereinafter the “ailloy App”), and
• the use of the website ailloy.io (hereinafter the “ailloy Website”, and together the “ailloy Service”).

The ailloy Service is an AI-supported offering for reflecting on and supporting relationship topics for individuals and couples.

Important notes on use:

• ailloy does not constitute a medical, psychotherapeutic or diagnostic service and does not replace professional advice, therapy or emergency care.
• Use is intended exclusively for persons aged 18 and over.
• In the course of use, personal data may be processed that contains sensitive content (e.g. emotional, psychological or relationship-related information).

2. Controller

The controller responsible for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

ailloy labs GmbH
Feuerbachstraße 3
65195 Wiesbaden
Germany

Email: info@ailloy.io

The controller for data processing is ailloy labs GmbH. You can reach us with data protection questions at dev@ailloy.io

3. Categories of Personal Data

In connection with the use of the ailloy Service, we process personal data that is required for the provision and use of the Service or is otherwise provided by you, as well as data that arises in the course of using the Service. Below we inform you about the categories of personal data processed in this context. Mandatory information means data without whose processing we may not be able to provide the ailloy Services, or only to a limited extent.

3.1 Master and Contract Data

This data is required in order to provide you with a user account and to manage the usage relationship.

Mandatory information

• Master data / account data, such as email address (for registration, login and communication with you; pursuant to Art. 6(1)(b) GDPR)
• Age (to confirm that you are of legal age; pursuant to Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR)

Voluntary information

• First and last name (optional; you may also use a pseudonym / a username that does not allow any conclusions to be drawn about your identity; pursuant to Art. 6(1)(b) GDPR and Art. 6(1)(a) GDPR – consent)
• Gender (optional, pursuant to Art. 6(1)(a) GDPR – consent)

3.2 Relationship Master Data

If you use the ailloy Service in the context of a relationship or together with another person, we additionally process certain relationship data.

Voluntary information

• Relationship status (e.g. single / in a partnership, to adapt content, recommendations or features; pursuant to Art. 6(1)(a) GDPR – consent and Art. 6(1)(b) GDPR)
• Name or designation of your partner (e.g. first name, nickname, to allocate the relationship context; pursuant to Art. 6(1)(a) GDPR – consent)
• Linking with a partner via a Connection Code within the ailloy Service (Art. 6(1)(b) GDPR, insofar as the linking function is actively used, and Art. 6(1)(a) GDPR)

This information is not strictly necessary for using the ailloy Service. It serves to enable you to use the Service in a way that is tailored to your relationship situation.

3.3 Content and Communication Data (Sessions)

When using the ailloy Service, you can enter or generate various content, in particular in the context of AI-supported Sessions and reflection formats.

This includes in particular:

• Chat messages between you and the AI deployed in the ailloy Service (text; where applicable also audio)
• Audio recordings of voice messages and their transcripts
• Your answers to questions, questionnaires and daily reflection prompts
• Content from other activities within the ailloy Service (e.g. exercises, journal entries, notes)
• Descriptions of situations and accounts of your personal experiences and relationship situations

Special categories of personal data (Art. 9 GDPR):

In many cases, this content may contain highly sensitive information, such as:

• information about your mental health, emotional state or distress,
• information about your relationship, your sex life or your sexual orientation,
• information about your physical health or other particularly protected areas of life.

Insofar as you enter such content, this constitutes special categories of personal data within the meaning of Art. 9 GDPR. The processing of this data takes place exclusively on the basis of your explicit consent and only for the purposes described in this Privacy Policy.

3.4 Derived Analysis Data and Recommendations (Profiling)

On the basis of your content and communication data, the AI deployed in the ailloy Services may recognise certain patterns and carry out evaluations in order to provide you with personalised feedback and suggestions.

This may include in particular:

• behavioural patterns recognised by the AI (e.g. “avoidance behaviour in conflicts”)
• allocations to thematic focus areas (e.g. conflict resolution, trust, closeness and distance)
• suggestions derived from the above analyses, such as “psychological homework” or reflection tasks

These evaluations serve solely to support you and your self-reflection and produce no legal effect and no comparably significant impact.

Insofar as these analyses relate to information concerning special categories of personal data (e.g. health, sex life, sexual orientation), we also process this analysis data on the basis of your explicit consent.

3.5 Technical Usage and Log Data

When using the ailloy Service, certain data automatically arises for technical reasons, which we process for the provision, security and further development of the ailloy Service.

This includes in particular:

• User ID
• Information about your subscription status (e.g. active subscription, plan)
• Usage data (e.g. session histories, features used, times of use)
• Device and connection data (e.g. device type, operating system, app version, IP address, timestamps)
• Server log data (e.g. technical logs of accesses, error messages)
• Processing logs of AI calls (e.g. time, AI system involved, technical status information)

Insofar as, in exceptional cases, these logs contain content from your Sessions, we limit the scope of such logging to the technically necessary minimum and process this log data – where possible – in pseudonymised or anonymised form.

3.6 Payment and Billing Data

If you take out a paid subscription, we additionally process payment and billing data, in particular:

• information about your chosen subscription (e.g. term, price)
• technical transaction identifiers and payment references
• payment method (e.g. credit card, payment service provider)
• information on processing the payment via the payment service provider used
• billing-relevant data (e.g. invoice amount, time of payment) within the scope of statutory retention obligations

The actual payment data (e.g. credit card number) is regularly processed directly by the payment service provider. Details can be found in the section “Recipients of Your Data”.

4. Individual and Couple Use

The ailloy Service can be used both individually and jointly with a partner.

When used as a couple, separate data contexts arise:

• individual context of User A
• individual context of User B
• shared relationship context (where a connection exists within the ailloy Service)

4.1 Visibility of Content

Individual content (content allocated to the individual relationship context, such as content from individual Sessions, Journeys and answers to personal reflections) is generally visible only to the respective person. Shared content (content allocated to the shared relationship context, such as content from shared Sessions, content from shared Journeys and answers from the “Question of the Day” for couples) is visible to both partners.

We employ appropriate technical and organisational measures – in particular the strict separation of data contexts, role-based access restrictions and technical control mechanisms – in order to protect the confidentiality of individual and shared content and to prevent an unintended mixing of these data contexts.

However, as with all complex IT systems, it cannot be entirely ruled out that, in rare individual cases, technical malfunctions or unintended processing may occur, in particular in connection with automated processing by AI systems. In such a case, we will promptly take appropriate measures to investigate and remedy the incident and – insofar as legally required – to inform the data subjects concerned and the competent supervisory authority.

4.2 Decoupling of Partners

If the connection between two users is dissolved:

• the shared relationship context is deleted,
• individual data remains, provided that no account is deleted.

5. Purposes of Processing

We process your personal data for the following purposes:

• Provision and operation of the ailloy Service, in particular for registration, sign-in, authentication, provision and management of your user account, user management, communication regarding account-related matters, and the provision of the features you use. For this purpose we process in particular master data, account data, login data, age information, voluntary profile information and technical usage data. Processing takes place pursuant to Art. 6(1)(b) GDPR insofar as it is necessary for the provision and use of the ailloy Service. Insofar as certain information is provided voluntarily and is not necessary for use, processing takes place pursuant to Art. 6(1)(a) GDPR.

• Conducting AI-supported Sessions and reflection formats, in particular for processing your inputs, generating AI-supported responses, reflection prompts, exercises and context-related content, and for continuing Sessions already started. For this purpose we process in particular content and communication data, chat messages, answers to questions, reflections and, where applicable, audio recordings and transcripts. Processing takes place pursuant to Art. 6(1)(b) GDPR insofar as it is necessary to carry out the Session or reflection function you use. Insofar as your inputs contain special categories of personal data, processing additionally takes place pursuant to Art. 9(2)(a) GDPR on the basis of your explicit consent.

• Personalisation and improvement of the user experience, in particular for adapting content, reflection prompts, recommendations, features and displays to your information, settings, use and relationship situation, and for providing context-related content. For this purpose we process in particular profile information, relationship data, usage and preference data, Session histories and voluntary information within the Service. Processing takes place pursuant to Art. 6(1)(b) GDPR insofar as the personalisation is part of the feature you use or is necessary for its provision. Insofar as the personalisation is based on voluntary information or optional settings, it takes place pursuant to Art. 6(1)(a) GDPR. Insofar as we improve the user experience on the basis of general usage data, processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in a user-friendly design of the Service.

• Ensuring the technical stability and security of the systems, in particular for the technical provision of the Service, maintaining system stability, error detection and correction, preventing unauthorised access, abuse and fraud prevention, and ensuring IT security. For this purpose we process in particular technical data, device and browser information, IP addresses, server log data, times of access, session IDs, error messages and security-relevant events. Processing takes place pursuant to Art. 6(1)(b) GDPR insofar as it is necessary for the provision of the Service, and otherwise pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure, stable and functional operation of the ailloy Service.

• Processing of payments and management of subscriptions, in particular for payment processing, invoicing, management of paid features, allocation of payments to your user account, management of terms, renewals and cancellations, and fulfilment of tax and accounting obligations. For this purpose we process in particular payment data, invoice data, contract and subscription data, transaction data, payment status, the chosen plan and term information. Processing takes place pursuant to Art. 6(1)(b) GDPR insofar as it is necessary for the performance of the contractual relationship and the provision of paid features. Insofar as we fulfil statutory retention, tax or accounting obligations, processing takes place pursuant to Art. 6(1)(c) GDPR.

• Product analysis, further development and improvement of the ailloy Service, in particular for analysing usage, error analysis, quality assurance, improving existing features, developing new features and optimising technical performance. For this purpose we process in particular usage data, technical event data, error reports, support and feedback data and, where possible, pseudonymised or anonymised evaluations. Processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the further development, quality assurance and improvement of the ailloy Service. Insofar as non-essential cookies, comparable technologies or consent-requiring analytics tools are used for this purpose, processing takes place pursuant to Art. 6(1)(a) GDPR.

• Marketing attribution – measuring the effectiveness of our advertising measures, in particular for measuring the success of app install campaigns, analysing the effectiveness of our marketing measures, and detecting and preventing fraudulent installs. For this purpose we process in particular pseudonymised device identifiers, technical device information, and attribution and event data. Processing takes place on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw a consent you have given at any time with effect for the future.

6. Legal Bases for Processing

6.1 Performance of a Contract (Art. 6(1)(b) GDPR)

The processing of the following data takes place insofar as this is necessary for the provision of the ailloy Service and the performance of the usage relationship:

• Master and contract data (mandatory information), in particular email address, user ID, login data and account status, for registration, sign-in, authentication, provision of the user account, communication regarding account-related matters and management of the usage relationship.
• Age information, in particular confirmation of legal age, to verify eligibility to use the Service and to provide an age-appropriate service.
• Essential relationship master data, insofar as this is necessary for certain features actively used by you, to adapt the respective feature to your relationship situation, e.g. for couple-related reflection formats or an optional partner linking.
• Technical usage and log data, in particular session histories, device and connection data, IP address, login times, session IDs and technical event data, insofar as this is necessary for the technical provision, sign-in, session management, security and functionality of the ailloy Service.
• Payment, billing and subscription data, in particular payment status, invoice data, chosen plan, term, transaction data and subscription status, for processing paid subscriptions, providing paid features and managing the contractual relationship.

6.2 Consent (Art. 6(1)(a) GDPR)

On the basis of your consent, we process in particular:

• voluntary information in your profile and about yourself (e.g. name, gender, detailed relationship information)
• additional information within the ailloy Service that is not necessary for the core function (e.g. certain questionnaires, optional content)

You can withdraw a consent you have given at any time with effect for the future (see the section “Your Rights”).

6.3 Special Categories of Personal Data (Art. 9(2)(a) GDPR)

In the course of using the ailloy Service, content may be processed that contains special categories of personal data, e.g. information about your mental or physical health, your sex life or your sexual orientation.

The processing of this data takes place exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR).

Before using the AI-supported Sessions for the first time, you will be expressly asked for your consent to the processing of such sensitive content. You can withdraw this consent at any time with effect for the future.

6.4 Legitimate Interest (Art. 6(1)(f) GDPR)

On the basis of our legitimate interests, we process in particular:

• technical usage and log data to ensure the stability, security and error-freeness of our systems (e.g. server logs, AI processing logs)
• pseudonymised or anonymised usage data for the further development and improvement of the ailloy Service (e.g. analysis of usage frequencies, error analyses)

Our legitimate interests lie in the secure, functional and economically viable provision of the ailloy Services and their further development. Insofar as we process your data on the basis of legitimate interests, you can lodge an objection to this processing (see the section “Your Rights”).

7. Recipients of Data and Transfers to Third Countries

7.1 Recipients of Your Data

To provide and further develop the ailloy Service, we use selected external service providers that process personal data on our behalf (processors pursuant to Art. 28 GDPR).

These include in particular:

• Hosting and database services that operate our server and storage systems in the European Union
  e.g. Supabase, with server locations in the European Union; storage of user data and technical logs.

• Providers of the AI systems we use
  e.g. OpenAI or Google; processing of text inputs, audio transcripts and, where applicable, further content data to generate responses within the ailloy Service.

• Audio transcription services
  e.g. AssemblyAI; processing of audio recordings to create transcripts.

• Payment service providers
  Management of subscriptions, trials and entitlements by RevenueCat Inc.; native purchases via the Apple App Store or Google Play; processing of Web payments, taxes, invoices and subscription management by Stripe/Link as merchant of record.

• Technical provision of conversion flows
  Management of app and Web subscriptions, trials and paywalls, and the provision of conversion flows and – where used – hosted quiz and marketing funnels via RevenueCat Inc.

• Mobile attribution and campaign performance measurement
  Measuring the success of our app install campaigns and analysing the effectiveness of our marketing measures using Adjust, provided by adjust GmbH.

Where providers act as processors, they process personal data on the basis of our instructions and corresponding contractual agreements pursuant to Art. 28 GDPR. Payment providers such as Stripe/Link, Apple and Google may at the same time or exclusively act as independent controllers for their own payment, tax, fraud-prevention, compliance and billing purposes. In particular, the AI providers we use do not process the transmitted data for their own purposes (such as training generally available AI models), but exclusively to provide the contractually agreed services.

7.2 Transfers to Third Countries

Our primary data processing (in particular storage) takes place within the European Union.

To carry out the AI-supported functions, we transmit content (e.g. text inputs or voice messages) to external service providers. The transmission takes place exclusively for the specified purpose and to the extent necessary for the respective function.

In this context, it cannot be ruled out that personal data is transferred to countries outside the European Economic Area (EEA), in particular to the USA, where we engage providers based there (e.g. OpenAI, Google, AssemblyAI, RevenueCat, Sentry) as processors.

In such cases, we ensure that appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place, in particular through:

• the conclusion of EU Standard Contractual Clauses,
• a certification under the EU-U.S. Data Privacy Framework
• additional technical and organisational protective measures.

7.3 Disclosure to Authorities

In individual cases, personal data may also be transmitted to competent authorities (e.g. law enforcement authorities) where we are legally obliged to do so or where this is necessary for the establishment, exercise or defence of legal claims.

8. Storage and Deletion

We store your personal data only for as long as this is necessary for the respective purposes or we are legally obliged to retain it.

In detail, the following applies:

• User account and content data (Sessions)
  Your personal data is generally stored for the duration of your user account. Upon deletion of the account, all personal data is deleted within 30 days, insofar as no statutory retention obligations preclude this.

• Shared relationship context
  Upon decoupling of partners, the shared relationship context is deleted; individual data remains, provided the account is not deleted.

• Server log data and technical logs
  Server log data and comparable technical logs are stored only for as long as this is necessary to ensure technical stability, security and error analysis, and are subsequently deleted or anonymised (as a rule after 30 days).

• Payment and billing data
  Payment and billing data is retained in accordance with statutory retention obligations, in particular commercial and tax law requirements. The statutory retention period is 10 years.

• Data for the further development of the ailloy Service
  Data that we use for the further development and improvement of the ailloy Service is processed, where possible, in pseudonymised or anonymised form. Personally identifiable data is deleted or anonymised as soon as it is no longer necessary for this purpose.

9. Data Security

We employ appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access and unauthorised disclosure.

These include in particular:

• encrypted data transmission, in particular via HTTPS/TLS,
• authentication and session-based access control,
• role-based access restricted according to the need-to-know principle,
• technical separation of publicly accessible, productive, administrative and internal data areas,
• row-level security, backend access controls and service-role-restricted data access for data requiring particular protection,
• rate limits, size restrictions for requests and further protective measures against abuse,
• private storage of audio files with controlled access granting,
• logging of security-relevant technical events while avoiding or masking sensitive content,
• backup and recovery measures for database content within the framework of the infrastructure used,
• documented reviews of the service providers deployed and the conclusion of appropriate data processing agreements, where required.

Productive systems, logs and error reports are configured such that sensitive content – such as message content, audio content, transcripts, authentication data or payment data – is not captured unnecessarily. Insofar as we use service providers, we contractually oblige them to comply with appropriate data protection and security measures.

10. Your Rights

As a data subject, you have the following rights within the scope of the statutory requirements:

• Right of access
  You can request information about the personal data we process about you (Art. 15 GDPR).

• Right to rectification
  You can request the rectification of inaccurate data and the completion of incomplete data (Art. 16 GDPR).

• Right to erasure
  You can request the erasure of your personal data under the conditions of Art. 17 GDPR, in particular where the data is no longer necessary for the purposes for which it was collected or where you have withdrawn consent.

• Right to restriction of processing
  You can request the restriction of processing under the conditions of Art. 18 GDPR.

• Right to data portability
  You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, or to have it transmitted to another controller (Art. 20 GDPR).

• Right to withdraw consent
  Insofar as we process your data on the basis of consent, you can withdraw this consent at any time with effect for the future, without affecting the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.

Furthermore, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation, insofar as we process it on the basis of Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR); this also applies to any profiling based on these provisions.

To exercise your rights, you can contact us at any time, e.g. by email at info@ailloy.io or via the contact details set out in Section 2.

10.1 Right to Lodge a Complaint with a Supervisory Authority

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by us (Art. 77 GDPR).

The competent data protection supervisory authority for Wiesbaden is:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)

Gustav-Stresemann-Ring 1
65189 Wiesbaden

Postal address: Postfach 31 63
65021 Wiesbaden

Telephone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
Website: datenschutz.hessen.de

11. No Automated Decision-Making in Individual Cases

In the course of using the ailloy Service, AI-supported systems are used to analyse content and provide personalised feedback. However, no automated decision-making within the meaning of Art. 22 GDPR takes place that produces legal effects or similarly significantly affects you.

The content provided serves solely for support, reflection and orientation and does not constitute binding decisions.

12. Website: Hosting

This website is hosted externally. The personal data collected on this website is processed on the servers of the host. This may include in particular IP addresses, website accesses, server log data, meta and communication data, and other data generated via the website.

The external hosting takes place for the purpose of the secure, fast and efficient provision of our website. Processing takes place, insofar as it is necessary for the provision of our online offering, on the basis of Art. 6(1)(b) GDPR and otherwise on the basis of our legitimate interest in the secure, stable and efficient provision of our online offering by a professional provider pursuant to Art. 6(1)(f) GDPR. Insofar as corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

We use the following host:

Railway Corp
Ballindamm 39
20095 Hamburg, Germany
Privacy Policy: railway.com/legal/privacy/

Domain registration and DNS management are handled by:

IONOS Group SE
Elgendorfer Straße 57
56410 Montabaur, Germany
Privacy Policy: ionos-group.com/privacy-policy.html

13. Website: Cookies and Embedded Services

13.1 Website (Browser)

When you visit our website, we use cookies and comparable technologies. Some of these technologies are technically necessary to provide basic functions of the website. We use cookies and comparable technologies in particular to provide technically necessary functions, e.g. the language selection or protection against repeated waiting-list submissions. This processing takes place on the basis of Art. 6(1)(f) GDPR and, insofar as the storage of or access to information on your device is technically necessary, on the basis of Section 25(2) TDDDG.

13.2 Server Log Files

The provider of the website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are in particular:

• browser type and browser version
• operating system used
• referrer URL
• hostname of the accessing computer
• time of the server request
• IP address

This data is not merged with other data sources. The collection of this data takes place for the technical provision of the website, to ensure stability and security, and for error analysis, on the basis of Art. 6(1)(f) GDPR.

Our legitimate interest lies in the secure, stable and error-free provision of our website.

13.3 Waiting List

If you sign up for the waiting list, we process the first name and email address you provide for the purpose of sending you information about ailloy Services and early access. Processing takes place on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future.

The form is processed via the Loops service provided by Astrodon Corporation. To protect the form against automated abuse, we use Google reCAPTCHA Enterprise provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

In this context, in particular the IP address, browser and device information, usage data and a reCAPTCHA verification token may be transmitted to Google and processed there for abuse detection. This processing takes place on the basis of our legitimate interest in the security and integrity of the waiting-list form pursuant to Art. 6(1)(f) GDPR.

Further information can be found in the privacy policies of Loops and Google.

13.4 Plugins and Tools

YouTube in extended data protection mode

A video is embedded on this website via YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video is embedded in extended data protection mode via youtube-nocookie.com and is only loaded when you actively click the video button.

Therefore, merely accessing the page does not establish a connection to YouTube. If you actively load or play the video, data may be transmitted to YouTube or Google. This may include in particular your IP address, device and browser information and usage data.

According to YouTube, in extended data protection mode cookies are only set once you actively interact with the embedded player. The embedding takes place on the basis of our legitimate interest in an appealing presentation of our online offering pursuant to Art. 6(1)(f) GDPR. Through the extended data protection mode and loading the player only after active user interaction, we minimise the data transmission to YouTube or Google.

Further information can be found in Google’s privacy policy.

Google Fonts — local hosting

This website uses so-called Google Fonts for the uniform display of fonts. The Google Fonts are embedded locally on our server. No connection to Google’s servers is established when the fonts are loaded. As the fonts are hosted locally, no personal data is transmitted to Google in this respect.

Insofar as we use cookies or comparable technologies, we inform you about this separately and obtain – where legally required – your consent. You can withdraw your consent at any time via the corresponding settings of your browser.

14. App (Mobile): Services Used

In our mobile app, we use services for crash reporting, campaign performance measurement and subscription management in order to ensure the technical stability, security and performance of the app, to measure the effectiveness of our marketing measures and to provide paid features. In this context, in particular technical data, device information, event data, error reports, crash reports as well as subscription and purchase information may be processed.

Insofar as consent is required for the use of certain analytics or tracking technologies, we obtain this separately in advance. You can withdraw a consent you have given at any time with effect for the future in the corresponding settings of the app.

14.1 Sentry — Crash Reporting and Error Analysis

We use Sentry in the app, a service for error analysis, crash reporting and application monitoring. The provider is Sentry, Inc.

Sentry supports us in detecting, analysing and remedying technical errors, crashes, performance issues and security-relevant events in the app. This enables us to improve the stability, security and functionality of the app.

In this context, the following data in particular may be processed:

• crash reports and error messages,
• stack traces and technical diagnostic data,
• app version, operating system, device type and technical device characteristics,
• time of the error, affected app function and technical event data,
• IP address and connection data, insofar as these arise technically,
• pseudonymised user or device identifiers, insofar as necessary to allocate errors and detect recurring problems.

Processing takes place for the detection, analysis and correction of technical errors, to ensure app stability, to improve performance and to ensure the security of the ailloy Service.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and error-free provision of the app and in the rapid detection and correction of technical problems.

14.2 Adjust – Mobile Attribution and Campaign Performance Measurement

We use Adjust in our app, a service provided by adjust GmbH, Saarbrücker Straße 37a, 10405 Berlin, Germany, to measure the success of our app install campaigns and to analyse the effectiveness of our marketing measures.

Adjust supports us in understanding through which marketing campaigns users become aware of our app, which campaigns lead to app installs, and how we can optimise our marketing measures. In addition, Adjust serves to detect and prevent fraudulent installs and advertising interactions.

In this context, the following data in particular may be processed:

• pseudonymised device identifiers and technical device information,
• operating system, app version and further technical device characteristics,
• IP address, insofar as this is technically necessary,
• times of app installs, app opens and certain events within the app,
• information on the allocation of an app install or an app event to a marketing campaign (attribution).

Processing takes place exclusively on the basis of your prior consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future in the settings of the app.

Further information on data processing by Adjust can be found at:
https://www.adjust.com/terms/privacy-policy/

14.3 RevenueCat – Subscriptions and Conversion Features

We use RevenueCat in the ailloy Service, a service provided by RevenueCat Inc., to manage subscriptions and paid features.

RevenueCat supports us in managing app and Web subscriptions, trials, entitlements, in-app and Web purchases and the technical provision of paid features. Insofar as we use corresponding features, RevenueCat may also be used to provide paywalls, conversion flows or hosted quiz and marketing funnels.

In this context, the following data in particular may be processed:

• pseudonymised user or device identifiers,
• information about app subscriptions, trials and entitlements,
• technical transaction and purchase information,
• information on the use of paywalls or conversion flows,
• the status of purchase assignment or redemption,
• when using hosted quiz or marketing funnels, additionally the data entered there (e.g. answers to questions or email address), insofar as this is provided by you.

For a purchase through a hosted RevenueCat Funnel, the purchase is initially assigned to a pseudonymous RevenueCat customer identifier. RevenueCat may send a Redemption Link to the email address provided. When you open this link in the ailloy App and sign in or register, the purchase is assigned to your ailloy user account.

Processing takes place for the provision and management of paid features, the performance of the usage relationship, the management of trials and subscriptions and – where used – the provision and optimisation of conversion features and marketing funnels.

Processing takes place on the basis of Art. 6(1)(b) GDPR insofar as it is necessary for the performance of the usage relationship. Insofar as RevenueCat is used for optional marketing or conversion features and consent is required for this, processing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. Insofar as, in the context of hosted quiz or marketing funnels, information is processed that contains special categories of personal data (e.g. relating to your relationship or your well-being), this takes place exclusively on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR.

Further information on data processing by RevenueCat can be found at:
https://www.revenuecat.com/privacy

15. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time in order to adapt it to changed legal, technical or organisational conditions. The current version is available in the app and on our website. In the event of material changes, we will inform you in an appropriate manner.