PRIVACY POLICY

Identification of personal data controller: Amorza s.r.o., ID no. 21053189, registered in the Commercial

Register maintained by the Municipal Court in Prague, file no. C 396227, with its registered seat at Bělehradská

858/23, Vinohrady, 120 00 Prague 2 (“we” or “Amorza”).

Contact details: support@amorza.com

We are the creators of the Amorza mobile application (“App”). App is an AI-powered relationship guidance

tool. By this Privacy Policy, we would like to inform you about how we process your personal data when you

use our App. More information about the App is available at: https://amorza.com (“Website”).

We recommend that you read this information carefully. If you have any questions, you can contact us at any

time using the contact details above. As we are a company located in the European Union, the processing of

personal data is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27

April 2016 on the protection of natural persons with regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC (“GDPR”).

Important: The App is intended exclusively for individuals aged 18 and over. By downloading or installing the

App, you declare that you are at least 18 years old. We do not knowingly collect personal data from anyone

under the age of 18. If we become aware that we have collected personal data from a person under 18, we will

take steps to delete such data promptly.

Disclaimer: The App does not provide therapeutic, medical, or professional counseling services. It is an

AI-based decision-support tool for personal relationship situations.

A. PERSONAL DATA PROCESSED

We do not sell your personal data to third parties, but we may share it with our partners who help us provide

our services (see Part C of this Privacy Policy).

Personal data are stored within the period stipulated for each purpose in Part B of this Privacy Policy. Generally,

we will retain your personal data for the length of time needed to fulfill the purposes outlined in this Privacy

Policy unless a longer retention period is required or permitted by law. When the data retention period expires

for a given type of data, we will delete or anonymize it.

You may also request for your data to be deleted directly in the App (Profile → Delete Account) or by

contacting us at support@amorza.com.. We will process such requests in accordance with GDPR.

CATEGORIES OF PERSONAL DATA PROCESSED

● Identifiers, such as user account ID, device identifier, IP address.

● Contact info, such as e-mail address.

● Profile data, such as nickname, date of birth (used for age verification), gender, relationship status.

● Special category data, sexual orientation (provided during onboarding). The content of your

conversations with the AI may also indirectly contain sensitive personal information (e.g., regarding

health, intimate life, or family situations) that you voluntarily share. We process such data solely for

the purposes of providing our service to you and as described below.

● Personality and behavioral data (DNA Profile), such as answers to relationship-pattern questionnaires

(DNA questions), resulting personality archetypes, personality type.

● User content, such as AI conversations, screenshots and chat exports uploaded by you, audio

recordings (if you use voice input), feedback responses, profile photo (optional).

● Usage and activity data, such as Daily clarity score, progress of growth metrics, session length,

frequency of use, engagement patterns.

● Technical and diagnostic data, such as device type, operating system version, App version, crash logs,

performance data.

● Subscription data, such as subscription status, plan type, subscription period.

Note: Amorza does not have access to your payment card details or financial information. All payments are

processed exclusively through Apple App Store or Google Play.

Please note: If you upload screenshots, chat exports, or other content that contains personal data of third

parties (e.g., the other person in a conversation), that data is processed by the AI solely for the purpose of

analyzing your specific case and providing you with guidance. We do not use such third-party data for any

other purpose. You are also responsible for proper informing of data subjects that are part of the

screenshots/exports.

In most cases, data is gathered directly from you during your use of the App. We may also obtain limited data

from third-party platforms that enable us to provide the App, in particular app distribution platforms (Apple,

Google) and subscription management services (RevenueCat).

B. PURPOSES OF THE PROCESSING OF PERSONAL DATA

We process your personal data as a data controller for the processing purposes, legal bases, and periods set

out below.

B.1 Provision of App core functionalities

We primarily process personal data to provide you with our App as an AI relationship guidance tool, create

your account, authenticate your identity, enable the core features, and manage your subscription. Personal

data is processed to authenticate you as the user, enable AI-driven guidance, ensure your session continuity,

perform customer support, and ensure functionality of our App.

Categories of personal data processed:

• Identifiers, Contact info, Profile data, Special category data, Personality and behavioral data (DNA

Profile), User content, Usage and activity data, Technical and diagnostic data, Subscription data.

Legal basis: Performance of the contract between you and us and the need to take steps at your request before

entering the contract under Art. 6(1)(b) GDPR. For the processing of special category data (sexual orientation),

the legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you provide during onboarding.

Retention period: Data is processed for the duration of your account and for 30 days after deletion of the

account (to complete the deletion process, including removal from backups). Backups containing personal data

are overwritten within 7 days.

B.2 Personalization of AI responses and user experience

We process your profile data, DNA Profile, and conversation history to personalize the AI’s responses to your

specific personality type, communication style, and relationship context. This allows the App to provide

relevant, tailored guidance rather than generic advice.

Categories of personal data processed:

• Identifiers, Profile data, Special category data, Personality and behavioral data (DNA Profile), User

content, Usage and activity data.

Legal basis: Legitimate interest in improving and personalizing the service for effective guidance under Art.

6(1)(f) GDPR. For special category data used in personalization, the legal basis is your explicit consent Art.

9(2)(a) GDPR.

Retention period: Personalization data is retained while your account is active and for 30 days after account

deletion.

B.3 Safety, security, and abuse prevention

We process certain data to verify that you meet the minimum age requirement, to enforce rate limits, to detect

and prevent abuse, automated access, scraping, or other prohibited activities, and to ensure the overall

security of the App.

Categories of personal data processed:

• Identifiers, Profile data (date of birth), Technical and diagnostic data, Usage and activity data.

Legal basis: Legitimate interest in maintaining a safe and secure service and protecting our users under Art.

6(1)(f) GDPR.

Retention period: Security logs are retained for a maximum of 12 months from the date of collection. Age

verification data is retained for the duration of the account.

B.4 Service notifications (push notifications and in-app messages)

We use your identifiers and device information to send you service-related push notifications and in-app

messages that are integral to the functioning of the App. These include feedback requests 24 hours after

completing a case, reminders about unfinished cases after 48 hours, and weekly insights summaries. These are

service communications within the scope of providing the contracted service, not marketing messages.

Categories of personal data processed:

• Identifiers, Contact info, Usage and activity data.

Legal basis: Performance of the contract under Art. 6(1)(b) GDPR and legitimate interest in informing users and

ensuring proper operation of the App under Art. 6(1)(f) GDPR.

Retention period: Data is processed only as long as strictly necessary to deliver such notifications (while your

account is active). Push notification delivery requires your device-level permission, which you can manage in

your device’s Settings at any time.

B.5 Newsletters and promotional communications

We may process your contact data and basic subscription information to send you newsletters and promotional

messages about Amorza, such as information about new features, updates, or special offers.

Categories of personal data processed:

• Contact info, Identifiers, Subscription data.

Legal basis: Your freely given consent under Art. 6(1)(a) GDPR. You may withdraw this consent at any time by

clicking the unsubscribe link in any promotional email or by contacting us. The withdrawal of consent shall not

affect the lawfulness of processing based on consent before its withdrawal.

Retention period: Data is processed for the period of your active account, or until you withdraw your consent,

whichever is earlier.

B.6 Fulfilling legal obligations

We may process your personal data in order to comply with our legal obligations, particularly in the area of tax

and accounting. At the same time, we need to be prepared to provide cooperation to state authorities if we are

required to do so by law.

Categories of personal data processed:

• Identifiers, Contact info, Subscription data.

Legal basis: Fulfilment of our legal obligations under Art. 6(1)(c) GDPR.

Retention period: Data is processed for the period required by law. Specifically, up to 10 years for tax and

accounting purposes.

B.7 Internal records, statistics, and protection of our rights

We may process your data for the purposes of keeping internal records within our company, producing

aggregated statistical reports, improving the App based on anonymized or aggregated data, protecting our

rights and legal claims, and ensuring that our App is used in accordance with its terms.

Categories of personal data processed:

• Identifiers, Contact info, User content, Usage and activity data, Technical and diagnostic data,

Subscription data.

Legal basis: Our legitimate interest in keeping internal records, producing statistics, improving the service, and

protecting our rights under Art. 6(1)(f) GDPR.

Retention period: Data is processed for a maximum of 10 years after the termination of the contractual

relationship (or longer in the event of a legal dispute), or for a maximum of 3 years after the collection of

personal data if no contract has been concluded.

B.8 App diagnostics and analytics

We process your personal data for the purpose of monitoring the App’s performance, diagnosing errors,

ensuring stability, and improving the overall user experience.

Categories of personal data processed:

• Identifiers, Usage and activity data, Technical and diagnostic data.

Legal basis: Legitimate interest in monitoring performance, ensuring stability, and improving the App under

Art. 6(1)(f) GDPR.

Retention period: Crash logs are retained for 90 days. Other analytics and diagnostic data are retained only as

long as necessary for this purpose, at a maximum for the duration of your active account.

C. SHARING OF PERSONAL DATA

We do not transfer or disclose your information to third parties for purposes other than the ones provided in

this Privacy Policy (Part B).

At the same time, we may share personal information with third parties who help us provide our App to you.

Data recipients:

AI service providers

• OpenRouter, Inc. – Personal data (content of your conversations) may be transferred to the United

States. Such transfers are based on Standard Contractual Clauses (SCCs).

• ElevenLabs, Inc. – US based provider. Sharing is based under Data Privacy Framework and SCCs.

Chat infrastructure

• Stream.io, Inc. – Chat messaging infrastructure and storage of conversations. US-based provider.

Personal data (messages, content) may be transferred to the United States. Stream.io is registered

under Data Privacy Framework.

Subscription and payment management

• RevenueCat, Inc. – Subscription management and payment status validation. US-based provider.

Transfers of personal data to the US are based on SCCs.

• Apple Distribution International Limited and Google Ireland Limited – App distribution platforms and

in-app purchase processing. EU-based entities. Amorza does not have access to your payment card

details; all financial transactions are handled directly by Apple or Google.

Cloud infrastructure and security

• Google Cloud EMEA Limited (GCP) – Cloud hosting, database services (Cloud SQL), and file storage

(Firebase Storage). EU-based entity. Data is stored in the EU region (Belgium). Personal data may be

subject to transfers to the US in limited circumstances, such transfers are based on SCCs and/or the

Data Privacy Framework, as described in Google’s data processing terms.

• Cloudflare, Inc. – Content delivery, DDoS protection, and rate limiting. US-based provider. Personal

data (IP address, request metadata) may be transferred to the United States. Such transfers are based

on SCCs and/or the Data Privacy Framework.

Authentication platforms

• Google OAuth – Login via Google account. Service provided by Google Ireland Limited. Personal data

may be transferred to the US under SCCs and/or the Data Privacy Framework.

• Apple Sign-In – Login via Apple ID. Service provided by Apple Distribution International Limited.

Personal data may be transferred to the US under SCCs and/or the Data Privacy Framework.

External service providers

• External legal and accounting advisory services. Czech Republic.

• Cleevio s.r.o. – Development contractor operating and maintaining the App. Czech Republic.

Your personal information may also be shared with advertising or analytics networks if we have obtained your

consent for such sharing. As of the current version of the App, no third-party advertising or analytics SDKs are

embedded in the mobile application.

In addition, if we process your personal data for fulfilling legal obligations, we may share your personal data

with certain third parties as data controllers where we are obliged to do so under applicable legislation (in

particular, administrative authorities, police authorities, and judicial authorities).

We require any third party with whom we share personal data to implement appropriate technical and

organizational measures to protect personal data and to process your data only in accordance with our

documented instructions and this Privacy Policy.

D. YOUR RIGHTS IN PROCESSING AND THE POSSIBILITY OF EXERCISING THEM

Just as we have rights and obligations when processing your personal data, you have certain rights when it

comes to the processing of your personal data as set out below. You have the right to:

• request access to your personal data;

• withdraw your consent;

• request rectification of your personal data;

• request erasure of your personal data;

• request restriction of the processing of your personal data;

• request portability of your personal data;

• object to the processing of your personal data; and

• lodge a complaint with the relevant supervisory authority.

In all matters related to the processing of your personal data, whether it is a question, the exercise of rights, or

sending a complaint, you can contact us at support@amorza.com.

Your request will be processed without undue delay, at most within 1 month. In exceptional cases, in particular

due to the complexity of your request, we are entitled to extend this period by a further 2 months. We will, of

course, always inform you of any such extension and the reason for it.

Right of access

You have the right to obtain confirmation from us as to whether or not we are processing your personal data. If

we process your personal data, you also have the right to request access to information about the purpose and

scope of the processing, the recipients of the data, the duration of the processing, the right to rectification,

erasure, restriction of processing and to object to the processing, the right to lodge a complaint with a

supervisory authority, and the sources of the personal data. You can also ask us for a copy of the personal data

we process. We provide the first copy free of charge; further copies may be subject to a reasonable fee.

Right to withdraw consent

You have the right to withdraw your consent to the processing of personal data at any time. However, the

withdrawal of consent does not affect the lawfulness of the processing prior to such withdrawal.

For the Amorza App, withdrawing your consent to the processing of special category data (sexual orientation)

or to the core data processing means that we will no longer be able to provide you with the service. In such

case, we will delete your account and all associated data. You can withdraw consent by contacting us at

support@amorza.com or by deleting your account directly in the App (Profile → Delete Account).

Right to rectification

You have the right to request us to correct inaccurate personal data concerning you. Depending on the purpose

of the processing, you may also have the right to have incomplete personal data completed. You can update

some of your profile data directly in the App settings.

Right to erasure (right to be forgotten)

You have the right to request the deletion of your personal data in cases where:

• we no longer need your personal data for the purposes for which it was collected or processed;

• you withdraw the consent on the basis of which the personal data was processed and there is no

further reason for processing;

• you object to processing and there are no other overriding reasons for processing, or you object to

processing for direct marketing purposes; or

• personal data is processed in violation of the law.

However, you cannot exercise this right where the processing is necessary for compliance with our legal

obligations or for the establishment, exercise, or defense of legal claims.

You can request account deletion directly in the App (Profile → Delete Account). Upon deletion, all your data

will be removed within 30 days, including from backups within 7 days.

Right to restriction of processing

You have the right to request restriction of the processing of your personal data in cases where you contest the

accuracy of your personal data, the processing is contrary to the law and you request restriction instead of

erasure, we no longer need your personal data but you require it for legal claims, or you have objected to

processing and verification is pending.

Right to portability

You have the right to obtain a copy of your personal data that we process by automated means on the basis of

your consent or for the performance of a contract, in a commonly used and machine-readable format. You can

request a data export by contacting us at support@amorza.com.

Right to object

You have the right to object to the processing of your personal data that we process on the basis of our

legitimate interest. We will stop processing your data if there are no other overriding reasons for processing, if

the processing is not necessary for the establishment, exercise, or defense of legal claims, or if you object to

processing for direct marketing purposes.

E. RIGHT TO FILE A COMPLAINT

In addition to the possibility of exercising your rights with our company, you can also file a complaint with the

relevant supervisory authority. For users in the Czech Republic, the relevant supervisory authority is the Office

for Personal Data Protection (Úřad pro ochranu osobních údajů), located at Pplk. Sochora 27, 170 00 Prague 7

(www.uoou.cz). If you are located in another EU Member State, you may file a complaint with the supervisory

authority in your country of habitual residence.

F. CHANGES TO THIS PRIVACY POLICY

We are entitled to change this Privacy Policy from time to time, so please check it regularly. We will post any

changes to this document within the App and on our Website. If we make material changes to how we process

your personal data, we will notify you through the App before the changes take effect.