Privacy Policy
Last updated: March 20, 20261. Introduction
Envisioning LLC-FZ ("Company", "we", "us", or "our") is a Free Zone limited liability company registered in the Emirate of Dubai, United Arab Emirates. We are committed to protecting your privacy and handling your personal data responsibly.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have in relation to your data when you use our website and early access sign-up page for Envisioning ("Services").
This policy is designed to comply with applicable privacy and data protection laws, including:
- The European Union General Data Protection Regulation (GDPR, Regulation (EU) 2016/679)
- The United Kingdom General Data Protection Regulation (UK GDPR)
- The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)
- The UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
Please read this policy carefully before using our Services.
2. Data Controller
Envisioning LLC-FZ is the data controller responsible for your personal data under this Privacy Policy. This means we determine the purposes and means of processing your personal data.
If you have any questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, you can contact us at:
Envisioning LLC-FZ
Dubai, United Arab Emirates
Email: privacy@envisioning.group
We aim to respond to all privacy-related inquiries within 30 days of receipt, or within the shorter timeframe required by applicable law.
3. Information We Collect
We collect different categories of data depending on which features you use and the consents you provide. Some data is necessary to provide the service, some is collected on the basis of legitimate interest, and some requires your explicit consent before we collect it at all. The table below sets out everything we collect and why. Rows marked 'Your consent' apply only if you choose to enable that feature — they are never collected by default.
| Data Category | What We Collect | Legal Basis |
|---|---|---|
| Account & profile | Email address, display name, profile photo, auth provider ID, Stripe customer ID, onboarding status, IP address | Contract — required to provide the service |
| AI companion settings | Companion name, personality archetype, voice preferences, relationship parameters, AI-generated personality document | Contract — required to provide the service |
| Conversations | Text conversation history, messages to/from your AI companion, source channel (web, Telegram, etc.). Third party channel conversations only if you choose to connect them. | Contract — required to provide the service |
| Life organization | Goals, tasks, projects, notes, daily logs, personal knowledge you create | Contract — required to provide the service |
| Basic system data | Session timestamps, token/credit usage, authentication and system logs | Contract — required to provide the service |
| Behavioral & usage data | Feature usage patterns, priority predictions, interaction signals | Legitimate interest — service improvement and personalisation |
| Basic memory | Semantic memories (basic facts you share), procedural memory (preferences, routines) | Legitimate interest — core personalisation |
| Gmail integration | Email content and metadata accessed via Google OAuth | Your consent — requested when you connect Gmail |
| Google Calendar integration | Calendar events, schedules, attendees | Your consent — requested when you connect Calendar |
| Voice data | Voice inputs (transcribed); audio recordings only if you enable storage | Your consent — notice shown before first voice use |
| Uploaded documents | File content from PDFs or other uploads; may contain third-party information | Your consent — informed at point of upload |
| Sensitive data | Health, financial, and emotional information you choose to share | Your explicit consent — prompted in-app when you first share sensitive information |
| Advanced profiling & deep memory | Emotional memories, companion bond progression, dynamic trust score, disagreement style, behavioural scoring, episodic memories | Your consent — 'Enhanced Personalisation & Memory' toggle in settings |
| Knowledge graph | Entity map of people, places, organisations; relationship mapping; contradiction records | Your consent — 'Enhanced Personalisation & Memory' toggle in settings |
| Cross-product data (Vibrantly) | Data from Vibrantly, including health-related information, used to enrich Envisioning personalisation | Your explicit consent — separate, standalone consent step |
| Marketing Communications | Email address, first name | Your consent — provided via sign up or opt-in |
Data in the "Your consent" rows above is never collected or processed unless you actively enable the relevant feature. Consent is always requested at the point where it is relevant — not bundled into general Terms acceptance or onboarding.
You can disable the Enhanced Personalisation & Memory features within your account settings at any time. If you choose to opt out, Envisioning will no longer use advanced AI personalisation, though standard service features will remain available.
3.3 Information We Do Not Collect
We want to be transparent about what we do not collect:
- We do not use analytics tracking tools (such as Google Analytics) on this Service.
- We do not use marketing or advertising cookies or pixels.
3.4 Consent
Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To withdraw your consent:
- Email us at privacy@envisioning.group with the subject line "Withdraw Consent"
- Use the unsubscribe link included in any email we send you
3.5 What We Do Not Do With Your Data
- We do not sell your personal data to any third party.
- We do not share your personal data for cross-context behavioral advertising.
- We do not use your personal data for automated decision-making or profiling.
- We do not use your data for any purpose other than those described in this Privacy Policy.
5. Who We Share Your Information With
We do not sell or rent your personal data. We share your information only with the service providers listed below, acting as data processors on our behalf. Each provider is bound by a Data Processing Agreement (DPA) or equivalent contractual obligations.
| Service Provider | What They Do | Data Shared |
|---|---|---|
| Google Cloud Platform (GCP / Firebase / Firestore) | Cloud infrastructure — hosting, databases, and application operations. Acts as a data processor under a DPA. | All account and service data |
| Anthropic (Claude AI) | AI language model powering conversational responses. | Conversation data sent per session |
| OpenAI | AI language model used for certain processing features. | Conversation data sent per session |
| Deepgram | Voice-to-text transcription for voice interaction features. | Voice input data (when voice is enabled) |
| Pinecone | Vector database for AI Memory and knowledge graph storage and retrieval. | Memory and knowledge graph data |
| Stripe, Inc. | Payment processing. Stripe's privacy policy governs your payment data. We do not store your full card details. | Payment information only |
Legal and regulatory authorities
We may disclose your personal data if required by law, regulation, legal process, or a valid governmental request, including court orders and requests from law enforcement.
Business transfers
In the event of a merger, acquisition, reorganisation, or sale of assets, your data may be transferred to the acquiring entity. We will notify you by email before your data becomes subject to a materially different privacy policy.
6. International Data Transfers
Envisioning LLC-FZ is based in Dubai, UAE. Your personal data may be transferred to and processed in:
- The United Arab Emirates, where our company is registered
- The United States or other countries where Google Cloud Platform operates its data centers
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, these countries may not provide an equivalent level of data protection. We protect your data by relying on:
- Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our agreements with service providers
- Supplementary measures where necessary, such as encryption of data in transit and at rest
You may request a copy of these safeguards by contacting privacy@envisioning.group.
7. Data Retention
We retain your data only as long as necessary to provide the service and fulfill the purposes described in this policy. You may delete your account to remove your data, subject to technical and legal requirements.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit using TLS/HTTPS
- Google Cloud Platform's built-in encryption at rest
- Rate limiting on form submissions to prevent abuse
- Content Security Policy (CSP) headers to protect against injection attacks
- Least-privilege access controls for our application
No method of transmission over the Internet is completely secure, and we cannot guarantee absolute security. We will promptly notify affected individuals and relevant authorities in the event of a data breach, in accordance with applicable law.
9. Your Rights
9.1 Rights for All Users
Regardless of your location, you have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your personal data.
- Withdraw consent: Withdraw your consent to processing at any time.
- Opt out: Unsubscribe from email communications at any time.
9.2 Additional Rights for EU/EEA and UK Residents (GDPR / UK GDPR)
- Restriction of processing: Request restriction in certain circumstances (e.g., while we verify accuracy).
- Data portability: Receive your data in a structured, machine-readable format (e.g., CSV or JSON).
- Object to processing: Object to processing based on legitimate interests. We will stop unless we demonstrate compelling grounds.
- Lodge a complaint: File a complaint with your local supervisory authority. A list is available at edpb.europa.eu. UK residents may contact the ICO at ico.org.uk.
9.3 Additional Rights for California Residents (CCPA/CPRA)
- Right to know: Request disclosure of the categories and specific pieces of personal information collected, sources, purposes, and third parties we share with.
- Right to delete: Request deletion, subject to legal exceptions.
- Right to correct: Request correction of inaccurate information.
- Right to opt out of sale/sharing: We do not sell your personal information. We do not share it for cross-context behavioral advertising.
- Right to non-discrimination: We will not discriminate against you for exercising your rights.
CCPA disclosure — categories of personal information collected in the preceding 12 months:
| Category of Personal Information | Source | Business Purpose | Categories of Recipients |
|---|---|---|---|
| Identifiers: name, email address, IP address, auth provider ID | Directly from you at sign-up | Account creation, authentication, and communication | GCP, Stripe |
| Payment information: Stripe customer ID, masked billing records | Directly from you at checkout | Processing your Subscription | Stripe |
| Conversation and content data: chat history, notes, goals, tasks | Directly from you through the app | Delivering the AI Assistant and core service features | GCP, Anthropic, OpenAI, Pinecone |
| Internet / electronic network activity: usage logs, session data, system logs | Automatically via the app | Security, fraud prevention, and service improvement | GCP |
| Audio / voice data (with consent): voice transcripts, voice interaction logs | Directly from you when you use voice features | Enabling voice interactions with your AI Assistant | Deepgram, GCP |
| Sensitive personal information (with consent): health data, emotional state, financial insights | Directly from you or via Vibrantly (with separate consent) | Personalised assistance and insights, solely as requested by you | GCP, Anthropic, OpenAI, Pinecone |
| Inferences / profiling (with consent): behavioral scoring, emotional memories, knowledge graph | Derived from your interactions when Enhanced Personalisation is enabled | Deep personalisation of your AI Assistant | GCP, Pinecone |
9.4 Additional Rights for UAE Residents (PDPL)
Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), you have the right to access, correct, and delete your personal data, and to withdraw consent.
9.5 How to Exercise Your Rights
Email: privacy@envisioning.group
Include your full name and the email address you used to sign up so we can verify your identity and locate your records. We will respond within 30 days (or within the timeframe required by applicable law). We will not require you to create an account to submit a request.
10. Cookies and Tracking Technologies
Our website does not currently use cookies for analytics or marketing purposes. We do not use third-party tracking scripts, pixels, or similar technologies.
If we introduce cookies or tracking in the future, we will update this Privacy Policy and, where required by law, obtain your consent before placing non-essential cookies.
11. Children's Privacy
Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@envisioning.group and we will delete it promptly.
12. Do Not Track Signals
Some browsers transmit "Do Not Track" (DNT) signals. As we do not use tracking technologies for advertising or analytics, our response to DNT signals has no practical effect. We do not track users across third-party websites.
13. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. If we make any material change/s to the Policy, we will endeavor to provide appropriate notice, or as required by applicable law. You can see when the Policy was last updated by checking the date at the bottom of this page. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective from when they are posted on this page.
14. Contact Us
If you have any questions, wish to exercise your rights, or have a complaint, contact us at:
Envisioning LLC-FZ
Dubai, United Arab Emirates
Email: privacy@envisioning.group
If you are not satisfied with our response:
- EU/EEA residents may file a complaint with their local supervisory authority.
- UK residents may contact the ICO at ico.org.uk.
- California residents may contact the California Attorney General at oag.ca.gov/privacy.
- UAE residents may contact the UAE Data Office.