Version 2.0
Effective date: 01.10.2026
Data requests: legal@santasy.app

This Privacy Policy ("Policy") describes how LLC Santasy ("Santasy", "we", "us") processes personal data when you use the Santasy mobile application for iOS and Android (the "App"), the website santasy.app (the "Site") and related services (together, the "Services").

LLC Santasy is a limited liability company registered in Georgia. Registered address: Georgia, Batumi, Giorgi Leonidze street N 4, building N2, floor 6, flat N75, postal code 6000. LLC Santasy is the controller of the personal data described in this Policy.

This Policy is available in the App (Profile, Privacy Policy) and on the Site. It forms part of the Terms of Use.

"Account" means the user account you create in the App.
"Content" means the audio programs, sessions, video, images, text and quotes made available in the App.
"Listening Data" means the records described in Section 4.2.
"Stores" means the Apple App Store and Google Play.
"Store Subscription" means an auto-renewing subscription purchased through a Store.

The Services are intended for persons aged 18 or older, or the age of majority in their country of residence if higher. We do not knowingly process personal data of anyone below that age. If we learn that an Account belongs to such a person, we delete the Account and its data. Reports: legal@santasy.app.

Each subsection states what data we process, where it comes from, why we process it, on which legal basis, who receives it and how long we keep it. Retention periods are collected in Section 10.

Data: email address; password (stored by Firebase Authentication in hashed form; we do not have access to it); display name you enter (2 to 50 characters); for Sign in with Apple: Apple user identifier, name, and either your email address or an Apple "Hide My Email" relay address, as you choose on Apple's screen; for Google Sign-In: Google account identifier, name, email address, profile picture URL; email verification status; Account creation date; an internal user identifier assigned by Firebase.
Source: you; Apple; Google.
Purpose: creating and securing the Account; signing you in; password reset; showing your name and picture in the App; linking your Store Subscription to the Account; contacting you about the Account.
Legal basis: performance of the Terms of Use.
Recipients: Google (Firebase Authentication); RevenueCat receives the internal user identifier only.
Retention: until Account deletion.

Our own servers store only the internal user identifier and the sign-in provider name. Your email address, name and picture are held by Firebase Authentication and are read by the App when you sign in.

Data: which programs and sessions you start, complete, mark as favourite and download; your playback position in a session; the time of your last listening; total seconds listened and programs completed. Each record is linked to your Account.
Source: your use of the App. When you are offline, the App stores these records on your device and sends them when a connection is available.
Purpose: saving your progress, favourites and downloads and restoring them when you sign in on another device or reinstall the App; showing which Content you have completed; counting programs completed and time listened in your profile.
Sensitivity: part of the Content concerns sensuality and intimate well-being, so Listening Data can show your interest in that Content, and some jurisdictions treat such data as sensitive personal data. We store it only for the purposes above. We do not use it for advertising, we do not sell it, and we do not share it with anyone other than our hosting provider.
Legal basis: your consent. The sign-in screen states that by continuing you accept the Terms of Use and this Policy; creating the Account is your consent to the storage of Listening Data linked to the Account. The Services cannot save your progress without Listening Data, so an Account cannot be used without this consent. You withdraw consent by deleting the Account (Section 11); we then delete the Listening Data. Withdrawal does not affect processing that took place before it.
Recipients: Amazon Web Services (hosting). Listening Data is not sent to Firebase, RevenueCat or AppsFlyer.
Retention: until Account deletion.

Playing Content requires your device to request it from our servers. Those requests, including the identifier of the program or session requested, appear in application logs for 30 days (Section 4.8).

Data: plan purchased (monthly or annual); trial status; purchase, renewal, expiry and cancellation dates; Store transaction identifiers; Store country and currency; subscription status; your internal user identifier, which we use as the RevenueCat customer identifier.
Source: the Stores, through RevenueCat.
Purpose: activating and maintaining premium access; restoring purchases on a new device; preventing fraud; accounting and tax records.
Legal basis: performance of the Terms of Use; legal obligation (tax and accounting law of Georgia).
Recipients: RevenueCat; the Stores; Amazon Web Services (hosting).
Retention: the RevenueCat customer record is deleted on Account deletion. Transaction and subscription event records on our servers are kept for 3 years from the end of the calendar year of the transaction, as required by the Tax Code of Georgia.

We never receive your card number, bank details or billing address. The Stores hold them.

Data: push notification token issued by Apple or Google; a random installation identifier generated by the App; platform (iOS or Android); App version; device language; time zone; notification permission status; delivery records for notifications sent.
Source: your device.
Purpose: delivering notifications about new Content and about your Account and subscription.
Legal basis: your consent, given through the operating system's notification permission. You can withdraw it at any time in your device settings. We do not use notifications for offers, discounts or other promotions unless you separately opt in inside the App.
Recipients: Google (Firebase Cloud Messaging); Apple (Apple Push Notification service); Amazon Web Services (hosting).
Retention: token and installation identifier until you revoke the permission, sign out or delete the Account; delivery records 40 days.

The installation identifier is generated by the App. It is not an advertising identifier and is not shared with advertisers.

Data: events in the App (screen views; a program or session started or completed, without identifying which one; paywall opened; trial started; subscription purchased; sign-in method used); device model; operating system version; App version; language; approximate country derived from IP address; session duration; a Firebase app-instance identifier specific to the App on your device.
Source: the App, through the Google Analytics for Firebase SDK.
Purpose: measuring how the App is used; finding defects; deciding which features to develop.
Legal basis: our legitimate interest in understanding and improving the Services. Analytics events do not identify the Content you use, so they do not reveal Listening Data. You can stop collection at any time by deleting the App, which also resets the app-instance identifier, and you may object under Section 12.
Recipients: Google (Google Analytics for Firebase).
Retention: user-level data up to 14 months in Google Analytics; aggregated reports without user-level data are kept indefinitely.

Analytics data is not linked to your email address or name.

Data: the fact and time of the App's installation; events after installation (sign-up, trial started, subscription purchased); device model; operating system version; App version; language; IP address; identifier for vendor (IDFV) on iOS; an AppsFlyer identifier generated for the App on your device. On iOS we do not use the advertising identifier (IDFA) and the App does not show the App Tracking Transparency prompt. On Android the Google Advertising ID is used only if you have not disabled it in your device settings.
Source: the App, through the AppsFlyer SDK; advertising platforms on which we place ads, which report clicks and impressions to AppsFlyer.
Purpose: determining whether an installation followed one of our advertising campaigns and measuring campaign performance.
Legal basis: our legitimate interest in measuring our own advertising. Collection stops when you delete the App, and you may object under Section 12.
Recipients: AppsFlyer Ltd.; the advertising platform that served the ad receives only aggregated conversion counts, not your identity.
Retention: user-level data in AppsFlyer for the period set in our AppsFlyer account, which does not exceed 24 months; aggregated reports indefinitely.

We do not "track" you as defined by Apple: we do not link data collected in the App with data collected by other companies' apps or websites for advertising or measurement purposes, and we do not share your data with data brokers.

Data: device model; operating system version; App version; time of the crash or error; a Firebase installation identifier; technical stack trace; error type; three fixed technical labels (stage, category, operation identifier).
Source: the App, through Firebase Crashlytics. Before a report leaves the device, the App removes email addresses, authentication tokens, links containing signatures and other free text.
Purpose: detecting and fixing defects.
Legal basis: our legitimate interest in keeping the App working.
Recipients: Google (Firebase Crashlytics).
Retention: 90 days.

Data: IP address; time of request; requested endpoint, which for Content requests includes the identifier of the program or session; App version; language setting; authentication result.
Source: your device's connections to our servers and to our content delivery network.
Purpose: operating the Services; security; investigating abuse.
Legal basis: our legitimate interest in operating a secure service.
Recipients: Amazon Web Services (hosting, CloudWatch logs, CloudFront content delivery).
Retention: application logs 30 days. Our content delivery network and load balancer do not keep access logs.

Media files are delivered through Amazon CloudFront using time-limited signed links. The App downloads translations and feature settings from Firebase Remote Config; this involves no personal data beyond the connection data above.

Data: your email address; the content of your message; information you choose to attach.
Source: you.
Purpose: answering your request; keeping a record of requests concerning legal rights.
Legal basis: our legitimate interest in answering requests; legal obligation where you exercise a legal right.
Recipients: our email provider.
Retention: 12 months after the request is closed.

We do not collect precise location, contacts, photos, camera or microphone input, calendar data, data from Apple Health or Google Fit, or biometric data. We do not collect payment card or bank details. We do not use the IDFA and do not show the App Tracking Transparency prompt. There is no third-party advertising in the App. The App has no chat, comments, uploads or profiles visible to other users.

Each processor acts on our documented instructions under a written data processing agreement that requires it to protect personal data to a standard no lower than this Policy and to use it only to provide its service to us.

We may also disclose personal data where required by law or a binding order of a court or authority; to establish, exercise or defend legal claims; or to a successor in a merger, acquisition or sale of assets, who will be bound by this Policy. We will inform you of a change of controller.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising.

Analytics and marketing measurement (Sections 4.5 and 4.6) are based on our legitimate interest and do not require consent. Collection stops when you delete the App, and you may object under Section 12.
We do not send marketing emails at the effective date of this Policy. Service emails (email verification, password reset) are sent by Firebase Authentication on our behalf and cannot be switched off while the Account exists.

Withdrawing a consent does not affect the lawfulness of processing before withdrawal. Paid functionality does not depend on notification or marketing consents.

Performance of contract (Article 6(1)(b) GDPR): Sections 4.1, 4.3.
Explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR): Section 4.2, given when the Account is created.
Consent (Article 6(1)(a) GDPR): Section 4.4.
Legitimate interests (Article 6(1)(f) GDPR): Sections 4.5, 4.6, 4.7, 4.8, 4.9, as described there. You may object under Section 12.
Legal obligation (Article 6(1)(c) GDPR): tax and accounting records in Section 4.3; responses to authorities in Section 5.

We do not make decisions producing legal or similarly significant effects on you based solely on automated processing.

Our servers and processors are located mainly in the United States. If you are in the EEA, the United Kingdom or Switzerland, your personal data is transferred outside those territories. We rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss amendments where applicable) concluded with each processor, and, where the recipient is certified, on the EU-U.S. Data Privacy Framework. Georgia, where we are established, is not covered by an EU adequacy decision; access to personal data from Georgia is limited to what is needed to operate the Services and answer your requests, and is protected by the same safeguards. A copy of the relevant clauses can be requested at legal@santasy.app.

We apply the following measures: TLS encryption for all connections between the App and our servers; encryption at rest for our database and media storage on Amazon Web Services; time-limited signed links for media files; storage of authentication tokens in the device's secure storage; removal of email addresses, tokens and signed links from crash reports before they leave the device; access to production systems restricted to authorised personnel; daily encrypted database backups.

No system is free of risk. If a personal data breach is likely to result in a risk to you, we will notify you and the competent authority within the time required by applicable law.

• Account data at Firebase Authentication (4.1): Deleted at Account deletion.
• Listening Data (4.2): Deleted at Account deletion.
• RevenueCat customer record (4.3): Deleted at Account deletion.
• Residual Account records on our servers: internal identifier, sign-in provider, disabled push tokens:Deactivated at Account deletion; permanently erased within 30 days.
• Transaction and subscription event records (4.3): 3 years from the end of the calendar year of the transaction.
• Push token, installation identifier (4.4): Until permission is revoked, sign-out or Account deletion.
• Notification delivery records (4.4): 40 days.
• Analytics data (4.5): User-level up to 14 months; aggregated indefinitely.
• Marketing measurement data (4.6): User-level not more than 24 months; aggregated indefinitely.
• Crash and error data (4.7): 90 days.
• Application logs (4.8): 30 days.
• Support correspondence (4.9): 12 months after closure.
• Database backups: 7 days, then overwritten.

Data in backups is erased when the backup expires. Aggregated statistics that cannot identify you are not subject to these periods.

You can delete the Account in the App without contacting us: Profile, Delete account, confirm. Deletion is immediate and irreversible. Deletion:

1. deletes your Account at Firebase Authentication, including email address, name and sign-in identifiers;
2. deletes your Listening Data from our servers;
3. deletes your customer record at RevenueCat;
4. revokes the Sign in with Apple authorisation, where used;
5. disables push tokens for your devices;
6. signs you out and removes downloaded Content and Listening Data from the device.

Residual records are erased within 30 days (Section 10).

Deletion of the Account does not cancel a Store Subscription. The subscription contract is with the Store, and the Store continues to charge until you cancel it in your Apple ID or Google Play settings. The deletion flow in the App shows a link to those settings. We cannot cancel a Store Subscription for you.

You may also request deletion by email from the address linked to your Account at legal@santasy.app. We will verify that the request comes from the Account holder before acting.

Depending on your country, you have the right to: access your personal data and receive a copy; have inaccurate data corrected; have your data deleted; restrict processing; object to processing based on legitimate interests; receive the data you provided in a machine-readable format; withdraw consent; not be discriminated against for exercising a right; and lodge a complaint with a supervisory authority.

How to exercise them: email legal@santasy.app from the email address linked to your Account, or use Account deletion in the App. We may ask for information needed to verify that you are the Account holder. We respond within one month; if your request is complex we may extend this by two further months and will tell you why. We do not charge for requests unless they are manifestly unfounded or excessive.

Supervisory authorities: in Georgia, the Personal Data Protection Service (pdps.ge); in the EEA, the authority of your country of residence; in the United Kingdom, the Information Commissioner's Office.

United States. If you are a resident of California or another state with a comprehensive privacy law, you have the rights to know, delete, correct and port personal data, to limit the use of sensitive personal information, and to opt out of sale, sharing and targeted advertising. We do not sell or share personal data and do not use sensitive personal information for purposes other than those permitted by law. We do not use personal data for targeted advertising. You may designate an authorised agent to submit a request; we will verify the agent's authority. We have not sold or shared personal data in the preceding 12 months.

Washington State. Listening Data may be consumer health data under the Washington My Health My Data Act. We collect it with the consent you give when you create the Account, share it only with our hosting provider, do not sell it, and delete it at Account deletion. Requests under that Act: legal@santasy.app. If we deny a request, you may appeal by replying to our decision; we will answer the appeal within 45 days and tell you how to contact the Washington Attorney General if you are not satisfied.

Because the Services cannot save your progress without Listening Data, withdrawal of that consent means deletion of the Account (Section 11). We do not offer an Account without Listening Data.

The Services are not directed to children. We do not knowingly collect personal data from anyone under 18. The App is rated for adults in the Stores. If you believe a child has provided us with personal data, contact legal@santasy.app; we will delete it.

The App allows you to share links to Content through messaging and social apps you choose. Whatever you send through those apps is processed by their operators under their own policies. Links from the App to the Stores or other websites lead to services we do not control.

We may amend this Policy. Each version carries a version number and effective date. We post the new version in the App and on the Site. If an amendment materially changes the purposes, the categories of data, the recipients or your rights, we notify you in the App or by email at least 15 days before the effective date and, where the law requires, ask for your consent again. Earlier versions are available on request.

LLC Santasy
Georgia, Batumi, Giorgi Leonidze street N 4, building N2, floor 6, flat N75, postal code 6000
Data requests and privacy: legal@santasy.app
Support: info@santasy.app