Privacy Policy for Inessio AB

1. Data controller

Inessio is the data controller for the processing of your personal data and is therefore responsible for ensuring that your data is handled correctly and securely in accordance with applicable legislation. If you have any questions, please contact us using the contact details in the "Contact" section below.

2. What personal data do we process?

Personal data means any information that directly or indirectly relates to a natural, living person. Accordingly, personal data is information about you and your person, e.g. your name, your contact information, pictures of you and your IP address.

Processing means any operation which is performed on personal data, such as collection, storage, use, adaption or disclosure.

We collect and process the following personal data about you when you create an account, use Inessio’s app and services, contact us, or otherwise interact with the service.

• Account details: email address, username and password (encrypted) upon registration.
• Profile information: selected plan, credits, referral code.
• Content: stories you create, save and share, including descriptions, text, audio files and cover images that you provide to the service.
• Usage data: number of stories generated, listening minutes, streaks, genre and voice preferences.
• Technical data: IP address, browser type, other data from cookies or similar mechanisms (device information).
• Communication: information you send via the DM function, share via social media or other communication channels, and feedback you provide to us.
• Payment and purchase history.

3. Purpose

We process your personal data for the purpose of operating and providing the service to you, as well as for the following purposes:

1. To create your account and manage subscriptions.
2. To verify your identity and check your age in order to create an account.
3. To manage payments for your purchase of subscription services.
4. To answer questions and investigate complaints, claims and support issues relating to the app, your account and the subscription services.
5. To improve the app and your user experience.
6. To ensure the operation of our website and application, and to carry out troubleshooting.
7. To enable marketing and communication regarding the services.
8. To moderate content and enforce our terms and conditions.
9. To prevent fraud and misuse.
10. To send you email notifications.

4. Legal basis

With regard to points 1–4 under the section "Purpose" above, the legal basis for the processing of your personal data is that we need to be able to fulfil the contract you enter into with us in connection with your use of our services. If you do not provide us with the relevant personal data, we are unfortunately unable to offer the service and our application.

With regard to points 5–9 under the section "Purpose" above, the legal basis for the processing of your personal data is that the processing is necessary for purposes relating to our legitimate interests. This means that we consider our interests in processing your personal data for the purposes listed above to outweigh the infringement of your privacy resulting from the processing. This assessment has been made in particular in light of the fact that we consider the processing to be beneficial to you.

With regard to point 10 under the section "Purpose" above, the legal basis for the processing of your personal data is that the processing is necessary for purposes relating to our legitimate interests, provided that the email mailing does not relate to direct marketing, in which case the legal basis for the processing of your personal data is your consent. You may withdraw your consent at any time by contacting us at support@inessio.com.

5. How long do we retain your personal data?

We retain your data for as long as you have an active account and for 30 days after your account is deleted, in case of any restoration. We log your IP address upon registration in the application for security purposes and delete it after 30 days. Stories you create, save and share, including descriptions, text, audio files and cover images that you provide via the service, are retained for as long as they are either published in the app or remain in your account, and are deleted as soon as you delete the story. We store information that you provide to us via communication channels for as long as is necessary to respond to you and your enquiry, and it is normally deleted within 30 days of the matter being resolved. If the matter concerns a complaint or claim, we retain the data for as long as necessary to handle the complaint or claim, and for up to 24 months thereafter to be able to defend against any legal claims.

Certain personal data will, for the purpose of complying with relevant accounting legislation, be retained for seven years from the end of the calendar year in which the financial year to which the information relates ended.

For further information on how long we store specific personal data, please contact us. Contact details are provided in the "Contact" section below.

6. Sharing with third parties

We do not disclose personal data to third parties, except in situations where this is required to fulfil a legal obligation or to fulfil our commitments to you. Your personal data will not be sold to third parties for advertising purposes.

In certain situations described below, we may disclose your personal data to third parties. Where the third party acts as a data processor on our behalf, we have entered into data processing agreements with them.

• Service providers: including for hosting, database management and AI processing.
• Payment providers: to manage subscriptions and payments.
• Public authorities: where required to comply with legal obligations.
• Disposal: in the event that we intend to transfer all or part of the company’s business, personal data may be disclosed to a potential buyer.

7. Your rights under the GDPR

As a data subject, you have the following rights:

• Right of access: you have the right to access your personal data and to receive a copy of the personal data concerning you that we process.
• Right to rectification: if the personal data we process about you is inaccurate, incomplete or out of date, you have the right to ask us to rectify it.
• Right to erasure: you have the right to request that we erase your personal data. If we do not have a legal basis for continuing to process the personal data, it must be erased.
• Right to object: in certain circumstances, you have the right to object to our processing of your personal data.
• Right to restriction: in certain cases, you have the right to request that we restrict the processing of your personal data. This means that we may only process the personal data in ways other than storing it under certain conditions.
• Right to data portability: where personal data is processed with your consent or on the basis of a contract with you, you have the right to receive your personal data in a machine-readable format and to transfer that data to another data controller.
• Right to withdraw consent: where personal data is processed with your consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Please contact us using the contact details provided in the "Contact" section below to exercise your rights. We will respond within 30 days.

8. Storage and security

Your data is stored within the EU/EEA. You should always feel secure when providing your personal data to us. We have therefore implemented the necessary security measures to protect your personal data against unauthorised access, alteration and deletion, such as encryption, access controls and backups. We will not disclose your data to anyone else, other than as expressly set out in this Privacy Policy.

We may transfer your personal data to countries outside the EU/EEA. If your personal data is transferred to a country outside the EU/EEA, we will take the necessary measures to ensure that the transfer of personal data is lawful and that your personal data is processed securely and with a level of protection equivalent to that within the EU/EEA, for example by entering into the European Commission’s standard contractual clauses with the recipient. If you would like a copy of the standard contractual clauses, please contact us. Our contact details are provided in the "Contact" section below.

9. Cookies and local storage

We use necessary cookies and localStorage for login and application settings. The information is stored in the form of a file containing encrypted login data. We do not use tracking cookies, third-party cookies or ad tracking.

10. Children and minors

Inessio is not intended for children under the age of 16. Users aged between 16 and 18 require parental consent. If we discover that a child under the age of 16 has registered, we will delete the account immediately.

11. Changes to the policy

We reserve the right to amend this policy at any time. In the event of changes to this policy, we will publish the amended policy on our website www.inessio.com with information on when the changes come into effect. We may also notify customers via email.

12. Supervisory authority

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Swedish Data Protection Authority (IMY), Box 8114, 104 20 Stockholm.

13. Contact

Questions about your privacy? Contact us at support@inessio.com.