Legal
Privacy Policy
1. Introduction
INNATE is a video journal. What you record in it is personal, and we treat it that way. This Privacy Policy explains what personal data we collect, why, who processes it for us, how long we keep it, and the rights you have.
This policy applies to the INNATE mobile app and covers our compliance with:
- The General Data Protection Regulation (GDPR): EU Regulation 2016/679
- The UK GDPR and the Data Protection Act 2018, for users in the United Kingdom
- The California Consumer Privacy Act (CCPA) as amended by the CPRA, for California residents
- Lei n.º 58/2019 (the Portuguese GDPR implementation law)
2. Data We Collect
2.1 Account information
- First name, last name and email address
- Your password, stored only as a secure hash
- A profile picture, if you add one
- Your time zone, so reminders arrive at the right hour
- Your settings, such as reminders and whether the AI is on
- A record of what you agreed to and when: the version and date of the Terms, this Privacy Policy and the AI consent you accepted or withdrew (no IP address or device details are kept with it)
2.2 Your video entries (special category data)
When you record an entry we collect:
- The video itself, with its sound, and a still image used as its thumbnail
- The date, time and length of the recording
- The question or Journey day it answers, and the earlier entry it replies to, if it is a Respond
- The feelings you choose for it, how strongly you felt them, and any topics you tag
2.3 Feelings and patterns (special category data)
- The feelings you tag over time and the patterns the app draws from them for you (Rewire)
- Which earlier entries came back to you. If you say how a returned entry landed, that one-word answer is counted in our usage analytics (Section 2.5) and is not stored with your account
- If you turn the AI on: a text transcript of what you said, and the feelings the AI suggested (see Section 4)
2.4 Journeys and community
- The Journeys you join and how far through them you are
- Posts you choose to share with a Journey's community (a video entry and any text you add) and your replies to other people's posts
- Reports you make about a post, people you block, and moderation decisions about your own posts
- Invitations you send or accept
Sharing is always your choice, post by post. A shared post is visible only to members of that Journey's community. Your transcript and the AI's suggestions are never shared.
2.5 Technical and usage data
- A push notification token for your device
- Device model, operating system and app version
- How the app is used (for example: which screens are opened, that a recording was started or saved, that a Journey was joined) and error reports when the app fails. These are linked to a random account ID, never to your name or email, and never include your videos, transcripts or the words you write.
- Server logs and server error reports
- Session tokens, kept in encrypted storage on your device
2.6 Signing in with Apple or Google
If you sign in with Apple or Google, we receive your name and email address from them (with Apple, this may be a private relay address). We never receive your Apple or Google password.
2.7 On our website (www.innate.love)
- The early-access list. If you ask for an invitation, we store your email address, your name, which phone you use, how you heard about us and the campaign link you arrived from, if any. To be able to show that you agreed, we also store the time, the wording you agreed to, your browser type and a one-way scrambled form of your IP address (never the address itself).
- Emails. Your email address and name are sent to Mailchimp, who deliver our emails. Every email has an unsubscribe link. When you unsubscribe, we keep only your address and the date, so that we never email you again.
- Visitor statistics. We count page views with Vercel Web Analytics. It sets no cookies and stores nothing on your device. Each visit is identified only by a scrambled value that changes every day, so you cannot be recognised from one day to the next or across other websites.
- Google Analytics, only if you accept it. If you click Accept in the cookie banner, Google Analytics sets cookies and records which pages you visit, roughly where from and on what kind of device. If you reject it or ignore the banner, it is never loaded. You can change your choice from Cookie settings in the footer.
See our Cookie Policy for every cookie and how long it lasts.
3. Legal Basis for Processing
(GDPR and UK GDPR, which share the same article numbering)
| Data | Legal basis |
|---|---|
| Account information, Journeys, community posts and replies | Performance of our contract with you (Art. 6(1)(b)) |
| Video entries, feelings and patterns | Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| AI transcripts and suggested feelings | Explicit consent, given separately in the app (Art. 6(1)(a) and Art. 9(2)(a)) |
| Push notifications | Consent (Art. 6(1)(a)), managed in your device settings |
| Usage analytics, error reports and security logs | Legitimate interests in keeping the app working, safe and improving (Art. 6(1)(f)) |
| Reports, blocks and moderation | Legitimate interests in keeping the community safe (Art. 6(1)(f)) |
| Website early-access list and emails | Consent, given with the tick box on the form (Art. 6(1)(a)) |
| Website visitor statistics | Legitimate interests in knowing how the website is used (Art. 6(1)(f)). No cookies, nothing stored on your device |
| Website Google Analytics | Consent, given in the cookie banner (Art. 6(1)(a) and Lei n.º 41/2004 Art. 5) |
| Records of your consent | Legal obligation to be able to demonstrate consent (Art. 6(1)(c), Art. 7(1)) |
4. The AI, and What It Reads
If you turn the AI on, each new entry goes through these steps, all inside Amazon Web Services:
4.1 Transcription (Amazon Transcribe)
- The sound is separated from the video and converted into a text transcript
- The working copies made along the way are deleted as soon as the transcript is ready
- The transcript is saved with your entry, and only you can read it
4.2 Suggested feelings (Amazon Bedrock, running Claude by Anthropic)
- The transcript, and nothing else, is read by a large language model that suggests which of eight feelings may be present: Joy, Peace, Love, Power, Fear, Anger, Grief, Apathy
- The suggestions are shown to you when you tag the entry. You decide what is saved; the AI decides nothing on its own
- The model runs inside AWS in the European Union. Amazon does not share your transcript with the model's maker and does not use it to train models
- For security and abuse monitoring, the requests sent to the model are kept in a protected AWS log for 30 days and then deleted
4.3 What the AI never does
- It never analyses your face, your expressions or your video. No biometric data is created
- It never shares your transcript or its suggestions with other users
- It is never used for advertising or to build a profile of you outside the app
If you turn the AI off, new entries are no longer transcribed or analysed. Transcripts and suggestions made while it was on stay with those entries until you delete the entries or your account.
5. Who Processes Your Data
We do not sell or rent your personal data. We share it only with the service providers below, to the extent they need it to run INNATE, and with the people you choose to share a post with.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, video storage, email, server logs, and the AI (Transcribe and Bedrock) | All data described above | EU (Ireland, eu-west-1; Bedrock within EU regions) |
| PostHog Inc. | App usage analytics and app error reports | Usage events and error reports, linked to a random account ID | EU (PostHog EU Cloud) |
| Functional Software Inc. (Sentry) | Server error reports | Technical error details, which may include an account ID | USA (SCCs / IDTA) |
| Expo (650 Industries Inc.) | Delivering push notifications, through Apple and Google | Device push token and the notification text | USA (SCCs / IDTA) |
| Apple Inc. and Google LLC | Sign in with Apple and Google, if you use them; push delivery | Name, email, push token | USA (SCCs / IDTA) |
| Supabase Inc. | Database for the website early-access list | The early-access details in Section 2.7 | EU (Frankfurt, eu-central-1) |
| Intuit Inc. (Mailchimp) | Sending our emails to the early-access list | Email address, name, signup date | USA (SCCs / IDTA) |
| Google Ireland Ltd and Google LLC (Google Analytics) | Website statistics, only if you accept them in the cookie banner | Pages visited, device and browser type, approximate location, a cookie identifier | EU and USA (Data Privacy Framework / SCCs) |
| Vercel Inc. | Hosting the website and counting visits without cookies | Website requests, including the early-access form as it is submitted | USA (SCCs / IDTA) |
Each provider is bound by a data processing agreement and may process data only on our instructions. We may also disclose data where the law requires it.
6. International Transfers
Your entries, transcripts and account live on AWS in Ireland, inside the European Economic Area. Usage analytics stay in the EU. Where a provider is based outside the EEA or the UK (Sentry, Expo, Apple or Google for sign-in, and for the website Mailchimp, Vercel and, if you accept it, Google Analytics), we rely on:
- for EU users, the European Commission's Standard Contractual Clauses (Decision 2021/914) or an adequacy decision, including the EU-US Data Privacy Framework where the provider is certified;
- for UK users, the UK International Data Transfer Agreement or Addendum, or UK adequacy regulations, including the UK Extension to the Data Privacy Framework.
7. How Long We Keep Data
We keep personal data only as long as we need it. The full schedule is in our Data Retention Policy; in summary:
| Data | Kept for |
|---|---|
| Account, entries, feelings, transcripts, Journeys and community posts | While your account exists; deleted within 30 days of an account deletion request. You can delete a single entry at any time |
| Transcription working files | Deleted as soon as the transcript is ready |
| Requests sent to the AI model (security log) | 30 days |
| App usage analytics and app error reports (PostHog) | Up to 12 months |
| Server error reports (Sentry) | 90 days |
| Server logs (AWS CloudWatch) | 1 year |
| Database backups | 7 days, on a rolling cycle |
| Website Google Analytics data | 14 months, then deleted by Google |
| Website early-access list | Until you unsubscribe or ask us to delete it. After an unsubscribe we keep only your address and the date, so we do not email you again |
| Anonymised, aggregated statistics | Indefinitely (they cannot be linked to you) |
8. Your Rights
(GDPR and UK GDPR)
Some rights you can use directly in the app, at any time:
- Turn the AI on or off: the You tab, then Settings, then Suggest emotions and transcript
- Delete a single entry: open the entry
- Delete a post you shared: open the post
- Delete your account and everything in it: the You tab, then Your videos and privacy (or Manage account), then Delete account. We confirm the request in the app and complete it within 30 days
If you are in the EU/EEA or the United Kingdom you also have the right of access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests, and to withdraw consent. The AI's suggestions inform your own experience only; they produce no legal or similarly significant effect on you.
To exercise any right, write to hello@innate.love with the subject line "Data Rights Request". We will reply within one month.
You also have the right to complain to a supervisory authority:
- Portugal / EU: CNPD (Comissão Nacional de Proteção de Dados), www.cnpd.pt
- United Kingdom: ICO (Information Commissioner's Office), ico.org.uk
9. California Residents
(CCPA / CPRA)
If you are a California resident you have the right to know, delete and correct the personal information we hold about you, to limit the use of sensitive personal information, and not to be discriminated against for using these rights.
Categories we collect: identifiers (name, email, account ID); internet or electronic network activity (app usage, error reports); audio and visual information (your video entries); sensitive personal information concerning your emotional wellbeing (feelings you tag, and AI transcripts and suggestions if you turn the AI on); and inferences (the patterns shown to you). We collect no biometric information and no precise location.
To make a request, write to hello@innate.love with the subject line "CCPA Privacy Request".
10. Children
INNATE is not intended for anyone under 16, and we do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has an account, write to hello@innate.love and we will delete the account and its data.
11. Security
We protect your data with technical and organisational measures, including:
- Encryption in transit (HTTPS/TLS) and at rest (AWS-managed keys) for the database and video storage
- Sign-in tokens kept in encrypted storage on your device
- Service credentials kept in AWS Secrets Manager
- A web application firewall in front of our API, and network isolation for the database
- Access controls that limit who and what can reach your data
No system is completely secure. If you find a security problem, please tell us at hello@innate.love.
12. Changes to This Policy
When we change this policy in a way that matters, we tell you in the app and ask you to agree to the new version before you continue. The date at the top shows when it last changed.