Privacy Policy
This Privacy Policy ("Policy") explains how Fiveset d.o.o. ("Fiveset," "we," "us," or "our") collects, uses, processes, and protects personal data when you access and use the Aplume AI mobile application, website, and related services, including its AI-powered journaling features (collectively, the "Service").
We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
Because Aplume AI is a journaling application, the content you choose to write, record, or upload ("Journal Entries") may include sensitive information about yourself or others. This Policy explains, in particular, how Journal Entries are handled, including when they are processed by third-party artificial intelligence providers to generate AplumeAI insights. Please read Sections 2, 3, and 5 carefully.
By creating an account, accessing, or using the Service, you acknowledge that you have read and understood this Policy.
Table of Contents
1. Data Controller
For the purposes of the GDPR, the data controller is:
Fiveset d.o.o.
Trg Sunca br.4, Kancelarija br.24
85310 Budva
Montenegro
info@fiveset.io
If you have questions regarding this Policy or your personal data, you may contact us at the above address, via email at info@fiveset.io, or using the details in Section 14.
Top2. Categories of Personal Data Collected
We collect and process the following categories of personal data, depending on your interaction with the Service:
Identification Data: name, date of birth, username, account details.
Contact Data: email address, telephone number, postal address.
Journal Content Data: the text, voice recordings, transcriptions, images, mood logs, tags, and other content of your Journal Entries, including any reflective prompts you respond to.
Special Category Data: health data (including mental health), information about sex life or sexual orientation, religious or philosophical beliefs, political opinions, or other data afforded heightened protection under Article 9 GDPR, where you choose to include such information in a Journal Entry. We do not require or request this data, but because Aplume AI is a personal journaling product, we recognize it may be present in content you submit; see Section 3 regarding the explicit consent basis for this category.
Technical Data: device identifiers, IP address, operating system, browser type, app usage statistics, crash reports.
Subscription and Payment Data: billing address, payment method details (processed via secure third-party providers), subscription plan type, invoices.
Profile Data: preferences, saved settings, account activity.
Communications Data: messages, support requests, survey responses, and other communications with us.
Derived or Analytical Data: AplumeAI-generated insights, summaries, and prompts; de-identified usage data; aggregated statistics.
We do not knowingly collect Special Category Data about you through any means other than content you voluntarily include in a Journal Entry. Please avoid including sensitive information about third parties in your Journal Entries without their knowledge, where doing so would violate their own privacy rights.
Top3. Purposes and Legal Bases of Processing
We process your personal data only where there is a valid legal basis under Article 6 (and, where applicable, Article 9) of the GDPR. Specifically:
Performance of Contract (Art. 6(1)(b) GDPR)
- To provide access to the Service (Free Plan or Subscription Plan).
- To process payments, billing, and account management.
- To store your Journal Entries and generate AplumeAI insights, summaries, and prompts that you request.
Explicit Consent for Special Category Data (Art. 9(2)(a) GDPR)
Where a Journal Entry you submit to an AplumeAI feature contains Special Category Data, we rely on your explicit consent, given by knowingly submitting that content to the feature after being presented with the disclosures in this Policy and our Terms of Service. You may withdraw this consent at any time; see Section 7.
Legitimate Interests (Art. 6(1)(f) GDPR)
- To improve, optimize, and secure the Service.
- To prevent fraud, misuse, or unauthorized access.
- To analyze de-identified usage data for product development.
- To communicate important updates about the Service.
Consent (Art. 6(1)(a) GDPR)
- For optional marketing communications.
- For the use of non-essential cookies, analytics, and tracking technologies.
- For enabling optional AplumeAI features that you may choose to turn on or off, as described in Section 5.1 and our Terms of Service.
Legal Obligations (Art. 6(1)(c) GDPR)
- To comply with applicable laws, tax, and regulatory reporting obligations.
- To respond to lawful requests from authorities.
4. Data Retention
We will retain your personal data only for as long as necessary to fulfill the purposes set forth in this Policy, and thereafter as required by law. Retention periods include:
Account Data: retained for the lifetime of your account, and deleted within 90 days following account closure.
Journal Content Data: retained for the lifetime of your account so that you can access your journaling history, and deleted or de-identified within 90 days following account closure or your specific deletion request for an individual entry.
Data held by Third-Party AI Sub-processors: content transmitted to Third-Party AI Sub-processors to generate an AplumeAI output is retained by such providers only for as long as needed to generate that output and, per our contractual terms with each provider, is not retained thereafter for their own purposes (see Section 5.2 and our Sub-processor list).
Financial Data: retained for up to 10 years to comply with tax, accounting, and regulatory obligations.
Technical and Analytics Data: retained up to 24 months in de-identified or aggregated form.
Marketing Data: retained until you withdraw consent or opt out.
Top5. Disclosure of Data to Third Parties
We may share your personal data with the following categories of recipients:
Service Providers: trusted third parties who process data on our behalf (e.g., cloud hosting, payment processors, analytics providers). Such providers are bound by contractual obligations ensuring compliance with GDPR.
Third-Party AI Sub-processors: providers of the large language models ("LLMs") and related AI infrastructure used to generate AplumeAI insights, summaries, and prompts (for example, providers of foundation models such as those offered by Anthropic, OpenAI, Google, or Microsoft, or comparable providers). See Section 5.1 and 5.2 below, and the current list at our Sub-processor list.
Professional Advisors: legal, tax, or accounting advisors where necessary for our business.
Authorities and Regulators: where required by law, regulation, or judicial order.
Business Transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the business, subject to the same or materially similar privacy commitments.
We do not sell your personal data to third parties for monetary consideration.
5.1 Your Control Over AI Processing
AplumeAI features are used to generate insights from your Journal Entries only when you actively request them (for example, by tapping "generate insight" or enabling an ongoing AI feature). You may disable AplumeAI features entirely in Account settings, in which case your Journal Entries will not be transmitted to any Third-Party AI Sub-processor, and the Service will continue to function as a plain journal.
5.2 What We Share With Third-Party AI Sub-processors
When you use an AplumeAI feature, we transmit the relevant Journal Entry content and minimal contextual metadata (such as timestamp or feature type) to the applicable Third-Party AI Sub-processor - only as necessary to generate the output you requested. We do not include your name, email address, or billing details in that content, and we use pseudonymous identifiers (e.g., a hashed account ID) instead of direct identifiers wherever technically feasible. We contractually prohibit Third-Party AI Sub-processors from using your data to train or improve their general-purpose models, and require deletion or non-retention of transmitted content beyond the period needed to generate the output, subject to each provider's data-handling terms referenced in our Sub-processor list. Because Journal Entry content may itself contain Personal Data or Special Category Data you have chosen to write about, we do not represent that this sharing excludes all personal information - see Section 3 regarding the explicit consent basis that applies to such content.
6. International Data Transfers
Where personal data - including Journal Content Data sent to Third-Party AI Sub-processors - is transferred outside the European Economic Area (EEA) or United Kingdom, we ensure that such transfers are made in compliance with GDPR, using appropriate safeguards such as:
- The European Commission's Standard Contractual Clauses (SCCs), or the UK International Data Transfer Addendum, as applicable;
- Adequacy decisions for certain jurisdictions;
- Binding Corporate Rules (BCRs), where applicable.
7. Data Subject Rights
7.1 EEA, UK, and Other GDPR-Equivalent Jurisdictions
Under GDPR, you have the following rights regarding your personal data:
- Right of Access (Art. 15 GDPR) – to obtain confirmation of whether we process your data and access to such data.
- Right to Rectification (Art. 16 GDPR) – to correct inaccurate or incomplete data.
- Right to Erasure (Art. 17 GDPR) – to request deletion of your data ("right to be forgotten"), including specific Journal Entries.
- Right to Restriction of Processing (Art. 18 GDPR) – to limit how we use your data.
- Right to Data Portability (Art. 20 GDPR) – to receive your data, including your Journal Entries, in a structured, commonly used, and machine-readable format and transfer it to another controller.
- Right to Object (Art. 21 GDPR) – to object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent (Art. 7(3) GDPR) – where processing is based on consent, including the explicit consent described in Section 3 for Special Category Data submitted to AplumeAI features, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
- Right to Lodge a Complaint (Art. 77 GDPR) – to file a complaint with your local supervisory authority.
Requests to exercise your rights may be submitted to info@fiveset.io. We will respond within the statutory deadlines set forth under GDPR.
7.2 California and Other U.S. State Privacy Rights
If the CCPA or another comparable U.S. state privacy law applies to you, you have the right to:
- Know what personal data we have collected, used, disclosed, or (if applicable) sold or shared about you, and for what purpose, including disclosures to Third-Party AI Sub-processors described in Section 5.2;
- Request deletion of your personal data, including specific Journal Entries;
- Correct inaccurate personal data;
- Opt out of the sale or sharing of personal data, and limit the use of Sensitive Personal Information (which may include health-related content in your Journal Entries) to purposes necessary to provide the Service; and
- Not receive discriminatory treatment for exercising these rights.
We do not sell your personal data for monetary consideration. You may submit a rights request via info@fiveset.io , and we will verify and respond to your request within the timeframes required by applicable law.
Top8. Security of Data
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Data encryption (in transit and at rest).
- Secure authentication and access controls.
- Regular system monitoring, logging, and intrusion detection.
- Data minimization and pseudonymization where appropriate, including in transmissions to Third-Party AI Sub-processors.
However, no system is entirely secure, and we cannot guarantee absolute security against unauthorized access, alteration, or destruction of data beyond our reasonable control.
Top10. Automated Decision-Making and Profiling
AplumeAI uses automated processing to generate insights, summaries, mood analyses, and prompts based on the Journal Entries you submit. Such processing is limited to informational and personal-reflection purposes only, does not constitute medical, mental health, or professional advice, and does not produce legal or similarly significant effects concerning you within the meaning of Article 22 GDPR.
You have the right to request human review, express your point of view, and contest any automated processing you believe is inaccurate or unfair, and to opt out of AplumeAI features entirely as described in Section 5.1.
Top11. Children's Privacy
The Service is not directed at children under the age of 16, and is not directed at children under 13 (or the equivalent minimum age under local law) in any circumstance. We do not knowingly collect personal data from such children. If we learn that we have collected such data, we will delete it promptly.
Top12. Changes to this Policy
We reserve the right to amend this Policy at any time. Material changes - including changes that expand the categories of data shared with Third-Party AI Sub-processors, add a new Third-Party AI Sub-processor, or change the purposes of such sharing - will be communicated via the Service or by email at least14 days prior to becoming effective and, where required by applicable law, will require your renewed affirmative consent before applying to Special Category Data already submitted. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.
Top13. Contact Information
If you have questions, concerns, or requests relating to this Policy or your personal data, please contact:
Fiveset d.o.o.
Trg Sunca br.4, Kancelarija br.24
85310 Budva
Montenegro
info@fiveset.io