top of page

EmoEx Privacy Policy

Effective Date: October 8, 2026

​

1. Introduction and Overview

EmoEx Technology Limited ("EmoEx AI", "we", "our", or "us") provides conversational AI-powered companion applications, emotional well-being tracking, and related digital wellness services across web, iOS, and Android platforms.

​

We are committed to protecting the privacy, confidentiality, and security of your personal data. This Privacy Policy describes how we collect, use, store, process, and protect your information when you access or use our applications, websites, and associated services (collectively, the "Services"), as well as your choices and statutory rights regarding that data.

​

Please read this policy carefully. By accessing or using the Services, you acknowledge the processing practices described herein. If you have questions or concerns, you may contact our Data Protection Officer or our privacy team at privacy@emoexai.com.

​

2. Data Controller and Contact Information

EmoEx Technology Limited is the data controller responsible for the personal data collected through the EmoEx website, mobile applications, bot interactions, and related services.

​

Company Name: EmoEx Technology Limited
Registered Address: 14 Manawa Road, Remuera, Auckland 1050, New Zealand
General Inquiries: info@emoexai.com

Data Protection Officer (DPO): We have appointed an internal Data Protection Officer to oversee our privacy and data protection practices:

​

European Union (EU) Representative (GDPR Article 27): Pursuant to Article 27 of the General Data Protection Regulation (GDPR), EmoEx Technology Limited has appointed Instant EU GDPR Representative Ltd as its representative in the European Union:

​

United Kingdom (UK) Representative (UK GDPR Article 27): For individuals located in the United Kingdom:

​

3. Age Requirement and Minimum Age Policy

EmoEx services and mobile applications are strictly intended for individuals who are at least 18 years of age. We do not provide our services to minors, nor do we knowingly collect or solicit personal data from anyone under the age of 18. If we learn or have reason to believe that a user is under 18 years of age, we will immediately deactivate the account and delete all associated personal information from our systems.

​

4. Information We Collect

We collect information across the following categories to provide, maintain, and enhance our services:

  • Personal Account Data: Email address, username, password credentials, and authentication tokens used for account creation, login security, and service communications.

  • Demographic Information: Non-specific demographic data, such as gender or age bracket (18+), provided voluntarily to tailor conversation tone and user experience.

  • Conversational Dialogue & Wellness Entries: Chat text, spoken voice inputs, transcribed dialogue, FeelLog journals, self-reported mood check-in scores, and contextual reflection notes. This content is processed solely as non-clinical conversational context. We do not use this data to perform medical triage, provide therapy, diagnose health conditions, or compile health records.

  • Crisis Escalation Triggers: When an interaction indicates acute distress or self-harm risk, our system flags relevant keywords solely to display independent, professional emergency support resources immediately. These flags are transient routing triggers and are not used to classify, profile, or evaluate you.

  • Technical, Diagnostic & Usage Data: IP addresses, operating system version, browser type, device identifiers, session metadata, diagnostic telemetry, and system interaction logs.

  • Device Permissions & Hardware Features: With your explicit permission, our mobile applications may request camera or photo access for profile customization and FeelLog attachments. Biometric authentication features (such as Apple Face ID, Touch ID, or Android Biometric Unlock) execute strictly on your local device hardware; EmoEx does not collect, access, or store raw biometric identifiers.

  • Excluded Data Categories: EmoEx does not collect or process GDPR Article 9 special category data, including medical health records, genetic data, biometric templates, philosophical beliefs, or government-issued identification numbers.

​

5. Special Notice for Heartline Connect (New Zealand)

Heartline Connect is a therapist directory service available exclusively to individuals residing in New Zealand:

  • Directory & Referral Conduit: Heartline Connect enables users to browse a directory of qualified independent practitioners and initiate contact. EmoEx operates strictly as a technical transmission conduit.

  • Zero Storage of Referral Forms: When you submit an enquiry form through the app, EmoEx transmits your name, contact details, preferred appointment times, and optional note directly to the practitioner via encrypted email. EmoEx does not store, retain, or access your form details on our backend servers once dispatched.

  • Delivery Receipts: We retain only a temporary, technical delivery receipt (recording transmission timestamp and delivery status, excluding your personal note and contact details) for up to 90 days solely to verify transmission and prevent duplicate submissions.

  • Independent Relationship: All therapeutic consultations, clinical care, medical records, confidentiality arrangements, and professional fees exist strictly between you and the chosen practitioner. EmoEx is not a health care provider or a party to any arrangement you make with a practitioner. This service is governed by the New Zealand Privacy Act 2020.

​

6. Special Notice for ADHD & Autism Ally

ADHD & Autism Ally provides AI-supported communication assistance, daily routine structuring, self-reflection, and conversational companionship tailored for neurodivergent individuals and related communities:

  • Non-Clinical Scope: ADHD & Autism Ally is designed for personal self-reflection, organization, and communication support. It is not a medical device, diagnostic assessment, clinical therapy tool, or substitute for professional psychiatric, behavioral, or medical care.

  • No Clinical Records: User reflections, executive functioning notes, sensory preference logs, and conversational exchanges are processed strictly as personal wellness context. EmoEx does not generate medical diagnoses, clinical evaluations, or disability assessments.

  • Anti-Surveillance & Personal Use Guarantee: In compliance with ethical AI standards and the EU Artificial Intelligence Act, ADHD & Autism Ally is designed solely for individual personal support. Our systems are never used for emotion tracking, behavioral surveillance, or performance evaluation in workplace or educational settings, nor are outputs shared with employers, schools, or academic institutions.

​

7. Legal Bases for Processing Personal Data

Under the GDPR, UK GDPR, and applicable privacy laws, we process each category of personal data under a clearly defined lawful basis:

  • Performance of a Contract (GDPR Article 6(1)(b)):

    • Account Management & Authentication: Processing contact credentials and login tokens to establish and maintain your user account.

    • Core Companion & Wellness Services: Processing conversational messages, transcribed voice dialogue, FeelLog journals, and companion interactions to deliver interactive dialogue, generate supportive reflections, and provide session continuity.

    • Subscription Management: Processing orders, active entitlements, and service access.

  • Legitimate Interests (GDPR Article 6(1)(f)):

    • Security, Infrastructure & Fraud Prevention: Processing IP addresses, technical logs, and session metadata to safeguard platform security, mitigate DDoS attacks, and prevent fraudulent misuse.

    • System Reliability & Diagnostics: Analyzing aggregated crash reports and operational telemetry to diagnose bugs and maintain high service availability.

    • Transmission Verification: Retaining technical delivery receipts for Heartline Connect referrals for up to 90 days to verify delivery integrity and prevent duplicate messaging.

    • Trust, Safety & Legal Defense: Retaining records of severe usage policy violations, harassment, or self-harm triggers to prevent imminent harm, comply with duty-of-care obligations, and defend against potential legal claims.

  • Consent (GDPR Article 6(1)(a)):

    • Deploying optional analytics, non-essential cookies, and requesting optional mobile hardware permissions (such as microphone access for speech-to-text input). You may withdraw consent at any time through your device or browser settings.

  • Legal Obligations (GDPR Article 6(1)(c)):

    • Retaining financial invoices, transaction records, tax reporting data, and accounting ledgers in compliance with statutory corporate and financial regulations.

​

8. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to ensure our website functions correctly, remember user preferences, maintain session security, and analyze aggregate traffic trends. You can manage your cookie preferences through your web browser settings at any time.

​

9. Third-Party Service Providers and AI Processing

We do not sell, rent, or trade your personal information. To provide and operate the EmoEx platform, we share necessary data with vetted third-party service providers who process data strictly on our behalf under written contractual agreements:

  • Cloud Infrastructure and Storage: Enterprise cloud server infrastructure, database hosting, and file storage (such as Google Cloud Platform and Firebase). Deletion of account data and stored objects is initiated via platform APIs upon account closure; residual copies and archival overwrites in cloud storage are governed by platform data processing terms.

  • Artificial Intelligence Processing & Feature Scope: We integrate advanced Large Language Models (LLMs) through enterprise API agreements with vetted providers (such as OpenAI and Anthropic). AI processing is utilized specifically for:

    • Conversational Dialogue: Generating real-time, context-aware conversational responses from the EmoEx Bot and Ally companion based on your immediate dialogue and rolling 12-month memory context.

    • FeelLog Summaries & Reflections: Synthesizing daily journal entries and situational keywords into personalized, empathetic written summaries and visual reflection prompts.

    • Voice Interaction & Speech Processing: Transcribing spoken user audio into text and synthesizing companion responses into speech audio.

    • Safety & Crisis Detection: Automated scanning of conversational turn inputs for severe self-harm or distress terminology to trigger immediate display of certified emergency support contacts.

    • Context Lifecycle: Where conversational context is retained with our AI providers to maintain conversation continuity, this data is programmatically deleted upon thread deletion or account closure. Provider-level abuse-monitoring logs are retained for up to 30 days pursuant to standard enterprise API terms.

  • Zero AI Model Training Commitment: EmoEx does not train, fine-tune, or improve any proprietary artificial intelligence models using your personal conversations, voice recordings, transcripts, FeelLog journals, or personal background notes. Furthermore, our third-party inference providers process data under commercial enterprise Data Processing Addenda (DPAs) and are contractually prohibited from using your data to train or improve their models.

  • Real-Time Communication: Real-time conversational audio streams are processed ephemerally using real-time communication bridges (such as LiveKit Cloud) and are not recorded or stored after transmission. Technical agent observability and diagnostic traces are retained for 30 days before automatic deletion.

  • Payment Gateways and Mobile App Stores: Transaction processing, recurring subscriptions, and app store purchase validations are handled directly by payment and platform partners (such as Stripe, Apple, and Google Play) under their respective terms.

  • Authentication and Security: Identity management, DDoS mitigation, and continuous security monitoring services.

All service providers are bound by strict contractual terms to maintain appropriate confidentiality, technical security, and data protection safeguards in compliance with applicable privacy laws.

​

10. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the specific purposes for which it was collected, satisfy our statutory legal and accounting obligations, and ensure the safety and integrity of our platform. When personal data reaches the end of its retention period, it is securely deleted or anonymized.

​

Conversational and Emotional Context

  • Active and Archived Chat Threads: The application operates with one active conversation thread at a time. When a conversation summary is generated—either manually by you or automatically after 24 hours—a new active chat thread begins, while the previous conversation thread remains securely archived in your account history. Users cannot selectively delete individual conversation threads within the app interface; full conversation history is retained while your account remains active and is permanently deleted as part of account deletion. When you request account deletion, all active and archived conversational threads, transcripts, and audio are removed from access immediately and permanently purged from production databases within 30 days.

  • Long-Term Conversational Memory: To maintain conversational continuity, our companion retains memory context and background history for a rolling period of 12 months while your account is active. Memory records older than 12 months automatically expire and are permanently purged on a rolling schedule. All accumulated memory is permanently deleted within 30 days of account closure.

  • FeelLog Journals and Mood Tracking: Retained for the duration of your active account; removed from your interface immediately upon deletion and permanently deleted from production databases within 30 days.

  • Transient AI and Communication Telemetry: Ephemeral inference debugging tokens, provider abuse-monitoring logs, and real-time agent observability traces are retained for up to 30 days before automatic deletion. Real-time voice streams are not recorded or retained.

​

Account, Feedback, and Safety Records

  • Account Information: Retained for the active duration of your account. When you close your account, your personal details, credentials, and profile attributes are permanently deleted from active production databases within 30 days. Provider-managed identity and storage records are initiated for deletion immediately, with residual copies deleted according to provider processing terms.

  • User Feedback and NPS Submissions: Ratings, thumbs up/down feedback, and submitted bug reports are retained for 5 years in a de-identified format to evaluate platform stability and guide product development.

  • Trust, Safety, and Policy Violations: If an account or interaction is flagged by automated filters or reported for severe violations of our Terms of Service (such as self-harm risk, severe harassment, or abuse), flagged prompts and outputs are retained for 2 years, and trust and safety classification scores are retained for 7 years to satisfy legal reporting duties, prevent imminent harm, and defend against legal claims.

​

Analytics, Diagnostics, and Operational Logs

  • Product Analytics: When a user requests data deletion, user-level identifiers are removed from active reporting views within approximately 24 hours, and permanently purged from analytics backend storage within up to 63 days. Aggregated, non-identifiable usage statistics are retained indefinitely.

  • Crash and Diagnostic Telemetry: Application crash logs and diagnostic stack traces are retained for 90 days, after which rolling platform-level deletion begins. Because crash reporting does not capture user account IDs, historical crash reports cannot be linked to individual user profiles and cannot be selectively deleted on an individual request basis.

  • Heartline Connect Delivery Receipts: Temporary technical dispatch receipts for New Zealand therapist referral forms are retained for up to 90 days strictly to prevent duplicate sends and confirm delivery.

  • Security and System Logs: Infrastructure, API access, and operational security logs under our direct control are retained for 90 days in active storage and archived for up to 1 year for security auditing and incident investigation. Emailed communications in corporate mail systems are purged from active folders within 30 days upon verified deletion requests.

​

Commercial, Financial, and Platform Exceptions

  • Invoices and Accounting Ledgers: Subscription payments, invoices, and accounting records under our direct control are retained for 7 years following the end of the relevant financial year to comply with statutory corporate, tax, and accounting laws.

  • Payment Platform Records: Purchase, subscription, chargeback, and settlement records held by payment processors and mobile platform operators (such as Stripe, Apple, and Google Play) are retained in accordance with their respective regulatory, anti-money laundering (AML), and fraud-prevention obligations. These platform records are legally mandated exceptions and cannot be expunged pursuant to a general consumer account deletion request.

​

Backups, Disaster Recovery, and Legacy Stores

  • Database Point-in-Time Recovery (PITR): Automated transaction logs are retained for up to 14 days to enable operational disaster recovery.

  • Database Automated Backups: Automated daily database backups are retained on a 30-backup rotation schedule. Backups use managed cloud encryption and naturally age out as older snapshots are overwritten by the rotation. If a historical database backup is ever restored, verified customer deletion requests are automatically re-applied immediately upon restoration.

  • Legacy Recovery Data: Legacy recovery archives and migration snapshots are protected with customer-managed encryption keys and retained in cold storage for up to 90 days prior to permanent cryptographic erasure.

​

Technical Safeguards

All customer data in transit is encrypted using TLS 1.2 or higher, and stored data is encrypted at rest using industry-standard AES-256 encryption.

​

11. Compelled Legal Disclosures

We may disclose personal data if required to do so by law, court order, search warrant, subpoena, or valid regulatory demand. Upon receipt of any such legal request, we verify the validity and scope of the demand and disclose only the specific information strictly required by law.

​

12. International Data Transfers

EmoEx is headquartered in New Zealand, and our cloud infrastructure and third-party service providers operate in the United States, Australia, and other global regions.
When personal data originating from the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred internationally to countries that have not received an adequacy decision from the European Commission, we implement appropriate safeguards, including:

  • Standard Contractual Clauses (EU SCCs) approved by the European Commission.

  • The UK International Data Transfer Addendum to the EU SCCs.

  • Recognized adequacy decisions, including the European Commission’s adequacy decision for New Zealand.

​

13. Your Data Protection Rights

Under GDPR, UK GDPR, and applicable data privacy regulations, you have the following rights regarding your personal data:

  • Right of Access: You may request confirmation of processing and a copy of your personal data.

  • Right to Rectification: You may request the correction of inaccurate or incomplete personal information.

  • Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data when it is no longer needed for the purposes for which it was collected.

  • Right to Restriction: You may request that we temporarily suspend the processing of your personal data under certain statutory conditions.

  • Right to Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format.

  • Right to Object: You have the right to object at any time to data processing based on our legitimate interests or direct marketing.

  • Automated Decision-Making and Profiling: EmoEx does not carry out any automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you under GDPR Article 22. All conversational outputs, mood summaries, and reflections are generated solely for your personal reflection and well-being. They carry no legal, clinical, employment, financial, or eligibility consequences.

​

Managing Your Conversations and Account Deletion

  • Thread Management: As our application architecture maintains one active thread at a time and automatically archives previous conversations upon summary generation, selective in-app deletion of individual past threads is not supported.

  • Account Deletion & Data Erasure: Full conversational history is permanently deleted upon account closure. If you wish to delete your conversation history, wipe your companion's memory, or permanently delete your account, you can initiate an account deletion in the app or submit a verified erasure request to our privacy team. Upon request, all active and archived conversational threads and memories are removed immediately from view and permanently purged from backend production databases within 30 days.

  • Rolling Memory Expiration: Historical long-term memory facts automatically expire and are purged after 12 months on a rolling basis without requiring manual user intervention.

​

How to Exercise Your Rights

​

We will verify your identity, acknowledge your request within 3 business days, and complete the response within one calendar month (30 days).

​

Right to Lodge a Complaint

If you believe our processing of your personal data infringes applicable data protection laws, you have the right to lodge a formal complaint with a competent supervisory authority:

  • EU/EEA Residents: You may lodge a complaint with the Data Protection Commission (DPC) in Ireland (where our EU representative is established) or your local national Data Protection Authority.

  • UK Residents: You may lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

  • New Zealand Residents: You may lodge a complaint with the Office of the Privacy Commissioner (OPC) at privacy.org.nz

​

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our legal obligations, product features, or data practices. When updates are published, we will revise the “Effective Date” at the top of this document. Continued use of our platform after revisions become effective indicates your acknowledgment of the updated policy.

​

​

​

bottom of page