Privacy Policy

Pali ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services. Pali is operated by RLGrowth OÜ, an Estonian private limited company (registry code 17607918, registered office: Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b, 10115 Estonia). For GDPR purposes, RLGrowth OÜ is the data controller.

Pali is operated by RLGrowth OÜ, registry code 17607918, registered office at Tartu mnt 67/1-13b, 10115 Tallinn, Estonia.

Change of controller: until 24 September 2026, the controller for Pali was RLGrowth, a Dutch sole proprietorship. As of 25 September 2026, the controller is RLGrowth OÜ. Existing Pali data, user accounts and the associated rights and obligations are transitioning to RLGrowth OÜ as part of the transfer of the Pali business. Your GDPR rights to access, export, correct, delete, object to and restrict processing of your data are unchanged.

Privacy and support contact: ronan@meetpali.com. General company contact: hello@growthmarketing.solutions.

We process your personal data on the following legal bases under the GDPR:

• Contract performance (Art. 6(1)(b)): Account management, providing the coaching service, tracking course progress.
• Legitimate interest (Art. 6(1)(f)): Improving our service, security monitoring, push notifications you've opted into.
• Explicit consent (Art. 9(2)(a)): Processing of special category data (see Section 4).

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Account Information: Email address and password when you create an account.

Profile Data: Display name, selected goals, and notification preferences you provide.

Journal & Mood Data: Mood entries, journal notes, and reflections you voluntarily submit.

Course Progress: Lesson completions, growth points, and streaks.

Chat Conversations: Messages exchanged with our AI coach for the purpose of providing personalized responses.

Wellbeing Check-ins: Self-assessment responses (e.g., relationship satisfaction, wellbeing index) you voluntarily complete.

Safety Screening Responses: Responses to safety questions used solely for crisis routing (never for outcome tracking or diagnosis).

Device Information: Push notification tokens (if you enable notifications), device type (e.g., iOS, Android, desktop), and basic performance data (page load times, error reports) to monitor app stability and improve the experience.

Some data you provide to Pali may constitute special category personal data under Article 9 of the GDPR, specifically:

• Health-related data: Mood logs, emotional wellbeing check-ins, and safety screening responses.
• Data concerning sex life or sexual orientation: Content shared in intimacy-related courses, journal entries, or chat conversations on these topics.

We process this data only with your explicit consent (Art. 9(2)(a) GDPR), which we obtain before you first use features that involve special category data (e.g., the AI consent modal, assessment disclaimers). You can withdraw this consent and delete all associated data at any time via Profile → Reset Data or Delete Account.

Safeguards: Special category data is encrypted at rest and in transit, protected by Row Level Security (only you can access your data), and is never used for marketing, profiling, or sold to third parties. Safety screening data is used exclusively for crisis routing and is never displayed as diagnostic scores.

We use your information to:

• Provide and personalize the Pali coaching experience
• Track your progress and provide relevant course recommendations
• Generate AI-powered insights and journal prompts (with your consent)
• Route to crisis resources when safety concerns are detected (deterministic, rule-based, not AI-driven)
• Send push notifications you've opted into
• Monitor app performance, detect crashes, and improve stability (device type, load times, error reports, never linked to personal content)
• Improve our content and services (aggregated, anonymised data only)

Pali uses AI to provide personalized coaching conversations and journal prompts. Your messages are processed by third-party AI services to generate responses. Before using these features, you are asked for explicit consent via an in-app modal.

Data minimisation: We minimise the data sent to AI providers. If you disable "AI Personalisation" in your profile, no personal context (name, progress, journal history) is included in AI requests, only your current message.

We do not use your private data to train AI models. You can report any AI-generated content that seems inappropriate using the "Report" button on any message. All AI-generated content is labelled with a "🤖 AI-generated" indicator for transparency.

Crisis responses are never AI-generated. When safety-related keywords are detected, a deterministic, rule-based system provides hardcoded crisis resources, the AI is completely bypassed.

We use the following categories of third-party data processors:

• Cloud infrastructure & database: Our backend infrastructure provider hosts your encrypted data in EU-region data centres. A Data Processing Agreement (DPA) is in place.
• AI service providers: Used to generate coaching responses. Data is processed per-request and not retained by the provider for training. DPAs are in place.
• Push notification services: Web push tokens are stored to deliver notifications you've opted into.

We ensure all processors provide adequate safeguards under GDPR Article 28 and, where data leaves the EEA, appropriate transfer mechanisms (e.g., Standard Contractual Clauses) are in place.

We retain your data according to the following schedule:

• Account & profile data: Retained while your account is active. Deleted within 30 days of account deletion.
• Journal entries, mood logs, chat history: Retained while your account is active. Permanently deleted upon account deletion or data reset.
• Course progress & growth points: Retained while your account is active. Deleted upon account deletion or data reset.
• Safety screening responses: Retained while your account is active. Deleted upon account deletion. Never used for longitudinal monitoring.
• Assessment responses: Retained while your account is active. Deleted upon account deletion or data reset.
• Push notification tokens: Deleted when you disable notifications or delete your account.
• Performance & telemetry data: Automatically purged after 90 days. Cannot be linked to personal content (journals, chats).
• Anonymised, aggregated analytics: May be retained indefinitely as they cannot be linked back to you.

You can delete all your data at any time via Profile → Reset All Data (keeps account) or Delete Account (removes everything including your account).

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We use Row Level Security (RLS) to ensure your data is only accessible to your authenticated session. We do not sell, rent, or share your personal data with third parties for marketing purposes.

Additional safeguards for special category data include: access controls limited to the authenticated user, no admin dashboard access to individual user content, and deterministic (non-AI) handling of safety-critical data.

Given that Pali processes special category data (health, sex life) at scale and uses automated decision-making (AI-generated content, safety screening routing), we have conducted a Data Protection Impact Assessment (DPIA) in accordance with GDPR Article 35. The DPIA evaluates risks to data subjects and documents the safeguards we have implemented, including:

• Explicit consent collection before processing special category data
• Data minimisation in AI processing
• Deterministic (non-AI) crisis routing to prevent unsafe AI-generated responses
• User-controlled data deletion and AI personalisation opt-out
• Hard-gating of partner-paired features when safety risks are detected
• Encryption and Row Level Security for all personal data

The DPIA is reviewed and updated periodically, or when significant changes are made to data processing activities.

Pali is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we learn that we have collected information from a minor, we will delete it promptly.

Under the GDPR, you have the right to:

• Access (Art. 15): Request a copy of the personal data we hold about you.
• Rectification (Art. 16): Request correction of inaccurate data.
• Erasure (Art. 17): Delete your account and all associated data via Profile settings, or request erasure by contacting us.
• Restriction (Art. 18): Request restriction of processing in certain circumstances.
• Data portability (Art. 20): Request your data in a structured, machine-readable format.
• Object (Art. 21): Object to processing based on legitimate interest.
• Withdraw consent (Art. 7(3)): Withdraw consent for special category data processing at any time.
• Lodge a complaint: You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority in the EU/EEA country where you live or work.

If you want to exercise any of these rights or have privacy-related questions, please reach out to ronan@meetpali.com.

This Privacy Policy is governed by the laws of Estonia and the EU General Data Protection Regulation (GDPR). This does not affect your right to complain to, or seek a remedy before, the supervisory authority or courts of the EU/EEA country where you live or work.

If you have questions about this Privacy Policy, your data, or wish to exercise your rights, please reach out to: ronan@meetpali.com