Privacy Policy

This Privacy Notice for Palette Holdings LLC (“we,” “us,” or “our”) describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you download and use our mobile application (That Girl), or any other application of ours that links to this Privacy Notice, or engage with us in other related ways, including any sales, marketing, or events.

If you do not agree with our policies and practices, please do not use our Services. Questions or concerns? Contact us at contact@thatgirlapp.ai.

• What personal information do we process? We may process personal information depending on how you interact with us and the Services, the choices you make, and the features you use.
• Do we process sensitive personal information? We do not process sensitive personal information such as racial or ethnic origins, sexual orientation, or religious beliefs.
• Do we collect information from third parties? We do not collect any information from third parties.
• How do we process your information? To provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law — only when we have a valid legal reason.
• How do we keep your information safe? We have organizational and technical measures in place, though no transmission or storage technology can be guaranteed 100% secure.
• What are your rights? Depending on where you live, applicable privacy law may give you certain rights over your personal information. The easiest way to exercise them is to email us.

Personal information you disclose to us. We collect personal information you voluntarily provide: your name; your personal goals across the life areas you choose to work on (such as mind, money, appearance and wellness routines, home, and relationships); the text of your check-ins; your responses to in-app onboarding questions; your history of completed and skipped actions; referral or invite codes you enter; and any other information you provide through in-app questionnaires or prompts to personalize your experience.

Sensitive information. Depending on what you share in free-text fields such as goals and check-ins, some data may be considered sensitive in certain jurisdictions. We process it only as you voluntarily provide it and solely to personalize your experience.

Payment data. We may collect data necessary to process your payment if you make purchases. All payment data is handled and stored by Apple — see Apple's App Store privacy notice.

Application data. With your permission we may send push notifications (such as reminders about your daily actions and weekly plan; you can turn these off in your device settings) and collect mobile device data such as device ID, model, manufacturer, operating system and version, application identification numbers, hardware model, carrier or ISP, and IP address.

Information collected automatically. Log and usage data (IP address, device information, date/time stamps, features viewed and used such as completing an action, submitting a check-in, or opening the app, system activity, error reports and hardware settings) and device data. This is primarily needed to maintain the security and operation of the Services and for internal analytics and reporting.

• To deliver and facilitate delivery of services to the user — including generating your personalized weekly plan, daily actions, and check-in responses.
• To attribute referrals — if you enter a referral or invite code, we process it to attribute your signup and apply any associated benefit.
• To save or protect an individual's vital interest, such as to prevent harm.

We may also process your information for other purposes only with your prior explicit consent.

If you are in the EU or UK: we rely on consent, performance of a contract, legal obligations, and vital interests as our legal bases under the GDPR and UK GDPR. You can withdraw consent at any time.

If you are in Canada: we process your information with your express or implied consent, and in limited exceptional cases permitted by law (for example fraud detection and prevention, investigations, or where required by a subpoena or court order).

We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us and require access to do that work. We have contracts in place designed to safeguard your personal information; they cannot use it for their own purposes.

Categories of third parties: Data Analytics Services; Cloud Computing and Hosting Services; AI and Machine Learning Service Providers; Subscription and Payment Infrastructure Services; Email Delivery Services.

• Business transfers — in connection with any merger, sale of assets, financing, or acquisition.
• Affiliates — who are required to honor this Privacy Notice.
• Business partners — to offer you certain products, services, or promotions. Sponsored content is labelled, and partners never receive the content of your goals or check-ins.

Our servers are located in the United States. If you access the Services from elsewhere, your information may be transferred to, stored, and processed in the United States and other countries. For transfers from the EEA, UK, or Switzerland we use the European Commission's Standard Contractual Clauses, which can be provided upon request.

Only as long as necessary for the purposes set out in this notice, unless a longer period is required or permitted by law. When we have no ongoing legitimate business need, we delete or anonymize your information, or securely store and isolate it until deletion is possible.

We have implemented appropriate technical and organizational security measures. However, no electronic transmission or storage technology can be guaranteed 100% secure, so transmission of personal information to and from our Services is at your own risk.

The Services are not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect data from or market to them. By using the Services you represent that you are at least 13 (or that minimum age). If you are under 18, you must have your parent or legal guardian's permission to use the Services, and they should review this notice with you. If we learn that we have collected data from a child under the applicable minimum age without verifiable parental consent, we will deactivate the account and promptly delete the data. Contact contact@thatgirlapp.ai if you become aware of any such data.

Depending on where you live, you may have the right to request access to and a copy of your personal information, request rectification or erasure, restrict processing, request data portability, and not be subject to automated decision-making. If a decision with legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review.

You may review, change, or terminate your account at any time. To exercise any right, email contact@thatgirlapp.ai. EEA/UK residents may also complain to their data protection authority; Swiss residents may contact the Federal Data Protection and Information Commissioner.

No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to DNT browser signals. If a standard is adopted that we must follow, we will inform you in a revised version of this notice.

If you are a resident of California, Colorado, Connecticut, Utah, or Virginia, you may have the right to know whether we process your personal data, access it, correct inaccuracies, obtain a copy, request deletion, opt out of targeted advertising, sale, or profiling, and not be discriminated against for exercising these rights.

In the past twelve months we have collected identifiers (such as name, email address, IP address, and account name) and personal information as defined by the California Customer Records statute. We have not sold or shared personal information to third parties for a business or commercial purpose in the preceding twelve months.

To exercise these rights, email contact@thatgirlapp.ai. We will verify your identity before acting on a request, and you may designate an authorized agent with valid written authorization. If we decline to act, you may appeal by emailing us, and if the appeal is denied you may submit a complaint to your state attorney general.

Australia and New Zealand. We collect and process your personal information under Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. You may request access to or correction of your information, and may complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.

Republic of South Africa. You may request access to or correction of your personal information at any time. Complaints may be directed to The Information Regulator (South Africa).

To generate your personalized weekly plan, daily actions (“moves”), and check-in responses, we collect information you voluntarily provide through in-app questionnaires, goal entries, check-in messages, and other inputs. This data is used to generate and deliver personalized plans and responses, including by transmitting it to the AI service providers that perform the generation on our behalf.

We do not permit our AI service providers to use your data to train their models. We may use data in aggregate or de-identified form to improve personalization and develop new features. All user-provided data is encrypted in transit and at rest, with access restricted to systems and personnel required to run the Service. The content of your goals and check-ins is not shared with analytics providers or advertisers.

Yes. The updated version will be indicated by an updated date at the top of this notice. If we make material changes, we may notify you by prominently posting a notice or by sending you a notification directly.

Email contact@thatgirlapp.ai or contact us by post at Palette Holdings LLC. To review, update, or delete the personal information we hold about you, email the same address.