Privacy Policy

Allyon — International Jurisdiction (GDPR)

Last updated: September 25, 2026

This Privacy Policy (hereinafter referred to as the "Policy") describes the procedures for the collection, processing, storage, transfer, and protection of personal data and other information of users of the Allyon service (hereinafter referred to as the "Service", "Platform"), accessible on the Internet at: allyon.ai (hereinafter referred to as the "Website"), as well as in the form of the Allyon mobile application (hereinafter referred to as the "Application").

This Policy has been prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), Directive 2002/58/EC (ePrivacy Directive), and Regulation (EU) 2024/1689 (EU AI Act) with respect to transparency requirements for artificial intelligence systems.

By using the Service, You confirm that You have read this Policy and agree to its terms. If You do not agree with any provisions of the Policy, You should discontinue use of the Service.

1. Scope of This Policy

1.1. This Policy governs the relationship between the personal data controller (hereinafter referred to as the "Controller", "Operator", "We") and the individual (hereinafter referred to as the "User", "You", "Data Subject") using the Allyon Service with respect to the collection, processing, storage, and protection of personal data in accordance with Articles 13 and 14 GDPR.

1.2. Allyon is a service for conversation with a software companion based on artificial intelligence.

1.3. The Policy applies to all personal data that the Controller may obtain about the User while the User uses the Service, including:

• personal data provided by the User during registration and profile completion;

• data collected automatically during use of the Service (cookies, IP address, device data);

• the User's text and voice messages to the AI companion, the companion's replies, attachments and companion settings;

• the companion's memory, reminders and notes;

• the User's contacts, chat profile and correspondence in the "Friends" section;

• data processed when using screens of other applications of the AI² Platform imported by the User into the Service, including a sample of one's own voice (Section 4.9);

• data related to payment transactions, the subscription and the internal AI² Token wallet (without bank card details);

• data processed using artificial intelligence technologies;

• information belonging to special categories of personal data (Article 9 GDPR), if the User shares it on their own initiative.

1.4. The Policy applies to the Controller's domain: allyon.ai, as well as to the Allyon mobile application.

1.5. This Policy does not apply to third-party resources to which links from the Service may lead. The Controller is not responsible for the actions of third parties who have gained access to the User's data as a result of the User's use of third-party resources.

2. Who Processes the Information

2.1. Data Controller

Next Transaction sp. z o.o

• NIP: 5214066223

• KRS: 0001100939

• Registration court: Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego

• Share capital: PLN 700,850.00

• LEI: 984500O45B78FE678560

• Registered and business address: ul. Hoża 86/410, 00-682 Warszawa, Poland

• Email: support@allyon.ai

• Phone: +48 573 588 194

• Website: https://allyon.ai

2.2. Data Protection Officer (DPO)

In accordance with Articles 37–39 of the GDPR, the Controller has appointed a Data Protection Officer. For all matters related to the processing and protection of personal data, You may contact the DPO:

• Email: info@allyon.ai

• Postal address: ul. Hoża 86/410, 00-682 Warszawa, Poland — marked "Data Protection Officer"

The DPO ensures compliance with GDPR requirements, handles data subject requests, and liaises with supervisory authorities.

2.3. Applicable Law

Personal data processing is carried out in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR);

• Directive 2002/58/EC (ePrivacy Directive) — with respect to cookies and electronic communications;

• Regulation (EU) 2024/1689 (EU AI Act) — with respect to transparency and accountability of artificial intelligence systems;

• applicable national legislation of EU/EEA Member States in which Users reside.

3. Purpose of the Policy

3.1. The purpose of this Policy is to ensure adequate protection of Users' personal data against unauthorized access and disclosure, as well as to fulfill the Controller's information obligations in accordance with Articles 13 and 14 of the GDPR.

3.2. The Policy defines:

• the list of personal data subject to processing;

• purposes and legal bases for processing (Articles 6 and 9 GDPR);

• measures to ensure the security of personal data;

• data subject rights (Articles 15–22 GDPR);

• procedures for handling data subject requests;

• procedures for transferring data to third parties and international transfers;

• retention periods and procedures for the destruction of personal data;

• information about cookies and consent for their use;

• information about the use of artificial intelligence technologies.

3.3. The Controller undertakes not to process personal data in a manner incompatible with the purposes for which it was collected, nor to process data that is excessive in relation to the stated purposes (principle of data minimization, Article 5(1)(c) GDPR).

3.4. The Policy is intended to ensure transparency in the processing of personal data (Article 5(1)(a) GDPR), enabling the User to make informed decisions about using the Service and providing their data.

4. What Information We Collect

4.1. Data Provided During Registration

When creating an account in the Service, the User provides the following data:

• Name (display name in the Service);

• Email address (used for authorization and communication);

• Phone number (if provided, at the User's discretion);

• Date of birth (for age verification — must be at least 18 years old);

• Country and city (at the User's discretion, for the language and time zone);

• Password (stored in hashed form using the bcrypt algorithm).

When authorizing through third-party services (OAuth), the following additional data may be obtained:

• Google OAuth: name, email, profile photo, Google identifier;

• Telegram OAuth: name, username, Telegram identifier, photo (if available).

The AI² account is single for all applications of the AI² Platform: account data (name, email, date of birth, password) is shared among the applications of the Platform. The Wallet of the Service is separate from the wallets of other products of the Platform.

4.2. Correspondence with the AI Companion

The main function of the Service is the User's dialogue with a software companion based on large language models.

Data composition:

• the text of the User's messages and the companion's replies;

• the date and time of each message;

• the companion settings chosen by the User (name, role, manner of communication);

• service information about conversations (the list of conversations, their titles, the context of the conversation);

• the number of messages per day (for tracking the free-mode limit).

Purpose of processing: providing the main function of the Service — the companion must remember the course of the conversation, otherwise a dialogue is impossible.

Legal basis: performance of a contract with the User (Article 6(1)(b) GDPR).

The content of correspondence is not used for advertising, is not transferred to third-party artificial intelligence service providers and is not transferred to third parties beyond the limits described in Section 7. Replies are generated by the Operator's own language models on the Operator's servers.

4.3. Companion Memory, Reminders and Notes

Companion memory — information that the AI companion saves about the User from conversations so that a conversation does not start from scratch each time (for example, what to call You, what You do, what You asked it to remember).

• You can view what the companion remembers about You, delete individual items of information, ask the companion to forget them or clear the memory entirely;

• You can disable memory in the settings of the Service: in this case, the companion neither reads nor adds to the memory, and the conversation history is kept as history;

• memory is used only for the AI companion's replies in the Service and is not used for advertising.

Reminders — created by the AI companion at Your request ("remind me…"). The following are processed: the text of the reminder, the date and time it is due, the time zone, the conversation into which the reminder will be delivered, and the status (scheduled, completed, cancelled).

Notes — notes that You save in the Service.

Legal basis: performance of a contract (Article 6(1)(b) GDPR). Information belonging to special categories that You have personally shared with the companion and that has entered the memory is processed on the basis of Your explicit consent (Article 9(2)(a) GDPR) — see Section 11.

4.4. Voice Messages and Attachments

• Voice messages — audio recordings that You send to the AI companion. The speech is recognized and converted into text; the recognized text is used to generate a reply in the same way as a text message and is stored in the conversation history;

• Voiced replies — the companion's replies may be voiced by a synthesized voice; the synthesized voice is created by software and does not belong to a human being;

• Attachments — images, voice recordings and documents that You send to the AI companion (if the feature is available); the content of attachments is processed to generate a reply.

Speech recognition and synthesis are performed on the Operator's servers. The voice is used solely for speech recognition (on the sample of one's own voice, see Section 4.9). The Service does not create voice biometric templates and does not use the voice to identify the User.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

4.5. Profile and Photo

• Profile photo (avatar) — uploaded at the User's discretion and shown to contacts in the "Friends" section;

• "About me" text — at the User's discretion.

The Service does not carry out biometric face verification and does not create biometric templates. The photo is stored as an ordinary image.

4.6. The "Friends" Section

The "Friends" section is a messenger for correspondence with people whom You have personally added to Your contacts by exact username or identifier. Searching for people by name and browsing the User database are not provided.

Data composition:

• Chat profile — first name, last name, username, phone number, date of birth; filled in at Your discretion and becomes visible to Your contacts only after You save it;

• Contacts — the list of people You have added to Your contacts;

• Messages — the text and emoji of messages, the date and time of sending and reading, the identifiers of the participants;

• Conversation settings — muting notifications, appearance, "read" marks, clearing history and deleting a chat (these apply only on Your side).

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Messages that You have sent to another person are also part of that person's correspondence: they remain in that person's history even if You have cleared the history on Your side or deleted Your account.

4.7. Payment Data and AI² Token

• Internal wallet data — the balance in AI² tokens, transaction history (top-ups, debits, refunds);

• Subscription data — the subscription period, start and end dates, payment method (the Wallet of the Service or an app store);

• Payment transactions — transaction identifiers, amounts, currency, payment statuses;

• Digital activation codes — codes of cards and flyers activated by the User to top up the AI² Token wallet;

• App store purchase data — the purchase identifier and subscription status that the app store transmits to the Controller.

Important: The Controller does not store Users' bank card data. Payment details are entered on the side of the payment institution or app store; the Service receives only the result of the transaction.

4.8. Technical Data

The following data is automatically collected during use of the Service:

• IP address of the User;

• User-Agent — information about the browser, device and operating system, the version of the Application;

• Interface language and time zone;

• Cookie data — session identifiers, interface settings, language preferences (see Section 10 regarding cookie consent);

• Push notification data — the browser's push notification subscription or the device token in the Application (subject to consent);

• Analytics data — information collected by the Google Analytics system (pages viewed, user actions) — only subject to consent;

• Access logs — dates and times of access to the Service, requested URLs, server response codes.

4.9. Screens of Other AI² Applications and One's Own Voice

The Service is a constructor: You can, at Your own choice, import into the Service screens of other applications of the AI² Platform (AI² Fans, TwinCard, AI² Space).

• When an imported screen is used, data for the corresponding feature is also processed in accordance with the privacy policy and user agreement of the application to which the screen belongs;

• Sample of one's own voice — if, through an imported screen, You upload a recording of Your voice to create a synthesized voice, the sample is processed solely to create that voice and use it at Your request; it is stored until You delete it or until the account is deleted; it is not used to identify the User, and no voice biometric templates are created;

• by default, the Service has no feature for creating one's own voice.

Legal basis: performance of a contract (Article 6(1)(b) GDPR) — provision of a feature chosen by You.

4.10. What Data the Service Does Not Collect

• gender and a preferences questionnaire;

• answers to psychological tests and questionnaires (the Service does not conduct them);

• biometric data (face, voice biometric templates);

• bank card details.

5. Legal Bases and Purposes of Processing

5.1. Legal Bases for Processing (Articles 6 and 9 GDPR)

The Controller processes personal data on the following legal bases:

a) Performance of a contract (Article 6(1)(b) GDPR):

• account registration;

• providing the main features of the Service (dialogue with the AI companion, including by voice, conversation history, the companion's memory, reminders and notes);

• correspondence with contacts in the "Friends" section;

• processing payments, maintaining the internal AI² Token wallet and fulfilling obligations under the subscription;

• tracking the free-mode limit;

• sending service notifications within the Service.

b) Consent of the data subject (Article 6(1)(a) GDPR):

• sending push notifications;

• use of analytical cookies (Google Analytics);

• sending promotional and marketing messages.

c) Explicit consent for processing special categories of data (Article 9(2)(a) GDPR):

• processing of information on health, intimate life, beliefs and other special categories that the User shares with the AI companion on their own initiative (see Section 11).

d) Legitimate interest of the Controller (Article 6(1)(f) GDPR):

• ensuring the security of the Service, limiting the frequency of requests and sign-in attempts;

• preventing fraud and abuse, reviewing complaints and moderation;

• improvement of Service quality and user experience;

• analysis of aggregated anonymized data for the development of the Service.

The Controller has conducted a Legitimate Interest Assessment for each case of processing based on legitimate interest, establishing that the interests, rights, and freedoms of data subjects do not override the legitimate interests of the Controller. You may request the results of this assessment by contacting the DPO (info@allyon.ai).

e) Legal obligation (Article 6(1)(c) GDPR):

• age verification (must be at least 18 years old);

• storage of transaction data in accordance with tax and financial legislation requirements;

• reporting confirmed child sexual abuse material to the competent authorities;

• responding to lawful requests from competent authorities.

5.2. Purposes of Personal Data Processing

The Controller processes personal data for the following purposes:

• Registration and identification — creating an account, authorization, age check;

• Dialogue with the AI companion — generating replies taking into account the course of the conversation and the chosen settings, recognizing voice messages and voicing replies;

• Dialogue memory — saving the context of the conversation and information in the companion's memory so that the companion remembers what was said earlier;

• Reminders — creating reminders at the User's request and delivering them at the scheduled time;

• Enabling communication — correspondence with contacts in the "Friends" section, sending notifications;

• Payment processing — accepting payments, maintaining the AI² Token wallet, activating digital codes, tracking the subscription, including one taken out through an app store;

• Ensuring security — detecting and preventing fraud, fake accounts and violations of the rules of the Service, reviewing complaints, child protection;

• Improving the Service — analysis of anonymized statistical data to improve the quality of replies and the interface.

5.3. Principle of Data Minimization (Article 5(1)(c) GDPR)

The Controller collects only the data necessary to achieve the stated purposes of processing. Filling in the "About me" field, uploading a profile photo, providing a phone number, country and city, filling in the chat profile in the "Friends" section, and using voice communication and the companion's memory are voluntary and do not affect access to the main function of the Service.

6. How We Protect Information

6.1. Organizational Measures

The Controller implements the following organizational measures to protect personal data:

• appointment of a Data Protection Officer (DPO) in accordance with Article 37 GDPR;

• development and approval of internal policies on data processing and protection;

• restriction of personnel with access to personal data and segregation of access rights (principle of least privilege);

• regular training of employees on GDPR requirements and internal security policies;

• carrying out a Data Protection Impact Assessment (DPIA, Article 35 GDPR) in the cases provided for by the GDPR;

• maintaining a Record of Processing Activities (Article 30 GDPR);

• regular internal audits of personal data processing compliance with GDPR requirements.

6.2. Technical Measures

Data Encryption:

• HTTPS/TLS 1.2+ — all data is transmitted over a secure channel;

• bcrypt — hashing of user passwords;

• HMAC-SHA256 — signing of inter-service requests (Mars LLM Service, payment gateway);

• RFC 8291 — encryption of push notifications in the browser (ECDH + HKDF + AES-128-GCM).

Server Security:

• firewall implementation;

• use of intrusion detection and prevention systems;

• regular software updates and vulnerability patching;

• maintaining access logs for information systems;

• encrypted data backups;

• Data Protection by Design and by Default (Article 25 GDPR).

Authorization Protection:

• JWT tokens (JSON Web Token) with limited validity period;

• authorization verification on every request via middleware;

• limiting the number of authorization attempts.

Protection of correspondence:

• correspondence with the AI companion and in the "Friends" section is stored on the Platform's servers; access to it is limited to operational necessity (reviewing complaints, protection against violations);

• requests to the language models are transmitted in pseudonymized form (Section 7.4);

• the content of correspondence is not used for advertising and is not transferred to third parties beyond Section 7.

6.3. Payment Data Protection

The Controller does not store payment card data. Payments are accepted through certified payment gateways compliant with the PCI DSS Level 1 standard, as well as through app stores. Data exchange with the payment gateway is protected by an HMAC key and carried out over an encrypted HTTPS channel.

6.4. Incident Response (Articles 33–34 GDPR)

In the event of a personal data breach or other information security incident, the Controller undertakes to:

• immediately take measures to mitigate the consequences of the incident;

• notify the supervisory authority within 72 hours of becoming aware of the breach (Article 33 GDPR);

• notify the affected data subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR);

• document all incidents, including circumstances, consequences, and corrective measures taken;

• conduct an internal investigation and take measures to prevent recurrence.

7. To Whom Information Is Disclosed

7.1. General Principles

The Controller does not sell, rent, or transfer personal data to third parties for commercial purposes. Data is disclosed only in the cases described in this section and to the minimum extent necessary to achieve the relevant purposes. All data recipients (processors, Article 28 GDPR) are bound by appropriate Data Processing Agreements.

7.2. Payment Gateways

When the User makes payments through the Service interface, data is transmitted to the payment gateway to process the transaction. Data transmitted includes:

• transaction identifier;

• payment amount and currency;

• payment description (subscription or wallet top-up);

• User's email (for receipt delivery).

Payment gateways process bank card data independently in accordance with their own privacy policies and PCI DSS standards.

7.3. App Stores

When a subscription is taken out in the Application through an app store (Apple App Store, Google Play), the payment is processed by the relevant store as an independent controller in accordance with its own privacy policy. The Controller receives from the store only the information necessary to track the subscription (purchase identifier, subscription period and status).

7.4. The Operator's Own Language Models (Mars LLM Service)

The AI companion's replies are generated by the Operator's own language models running on the Operator's servers. Requests are processed by the Operator's internal service Mars LLM Service; data is transmitted to Mars in pseudonymized form (without direct User identifiers such as email and phone number).

Requests to the language models contain the text of the current conversation, the chosen companion settings, information from the companion's memory (if memory is enabled), the recognized text of voice messages and the content of attachments.

Conversation data is not transferred to third-party artificial intelligence service providers. The Controller does not use third-party language models to generate the AI companion's replies.

7.5. Speech Recognition and Synthesis

Speech recognition and voice synthesis are performed by the Operator's services on the Operator's servers: voice messages are converted into text, and the texts of the companion's replies are voiced. This data is not transferred to third parties and is used only to perform the relevant operation.

7.6. Push Notification Services

Push notifications are delivered using the push notification services of browsers and mobile platforms (Google FCM, Mozilla Push Service, Apple Push Notification Service). In the browser, only the encrypted payload of notifications is transmitted; push providers are unable to decrypt its content (encryption under the RFC 8291 protocol). In the Application, only the minimum necessary notification information (title and short text) is transmitted.

7.7. Web Analytics Systems

• Google Analytics (Google LLC) — collection of de-identified data on website traffic, user behavior, and traffic sources. Data is transmitted to Google servers and processed in accordance with Google's privacy policy. Activated only after obtaining User consent (in accordance with the ePrivacy Directive).

The User may opt out of data collection by analytics systems by withdrawing cookie consent (see Section 10).

7.8. OAuth Providers

When authorizing through Google or Telegram, the respective providers receive information about the User's authorization in the Service. The scope of data obtained from OAuth providers is determined by their own privacy policies and requested permissions (scopes).

7.9. Your Contacts in the "Friends" Section

People whom You have added to Your contacts or to whom You have written can see:

• display name and profile photo;

• the chat profile details that You have saved Yourself (first name, last name, username, phone number, date of birth);

• the messages You have sent them and read receipts.

If Your contact is registered in the Platform's cabinet of another country, the messages and chat profile details necessary for the correspondence are also transferred to and stored on the Platform's servers in the country of the other party's cabinet (see Section 9).

Not displayed to other Users: email (unless You have provided it Yourself), conversations with the AI companion, the companion's memory, reminders and notes, payment information.

7.10. Disclosure of Data as Required by Law

The Controller may disclose personal data upon a lawful request from authorized government authorities in the manner established by applicable law, where there is an appropriate legal basis. The Controller will notify the data subject of such a request unless prohibited by law. Information on confirmed child sexual abuse material is transmitted to the competent authorities, including the National Center for Missing & Exploited Children (NCMEC), as required by applicable law.

8. Retention Period

8.1. General Rules (Article 5(1)(e) GDPR)

Personal data is retained no longer than necessary for the purposes of processing (principle of storage limitation). Upon expiration of the retention period, data is deleted or anonymized.

8.2. Retention Periods by Data Category

| Data Category | Retention Period | Legal Basis |

|---|---|---|

| Account data (profile) | The entire period of use of the Service + 30 days after the account deletion request | Performance of a contract, Art. 6(1)(b) |

| Conversations with the AI companion, voice messages, attachments | The entire period of use of the Service or until deleted by the User | Performance of a contract, Art. 6(1)(b) |

| Companion settings | The entire period of use of the Service | Performance of a contract, Art. 6(1)(b) |

| Companion memory | Until the information is deleted by the User, the memory is cleared or the account is deleted | Performance of a contract, Art. 6(1)(b) |

| Reminders and notes | Until cancelled or deleted by the User or until the account is deleted | Performance of a contract, Art. 6(1)(b) |

| Profile photo | The entire period of use of the Service + 30 days | Performance of a contract, Art. 6(1)(b) |

| Chat profile, contacts and correspondence in the "Friends" section | The entire period of use of the Service or until the account is deleted (for the other party — in their history) | Performance of a contract, Art. 6(1)(b) |

| Sample of one's own voice and the created voice (imported screen) | Until deleted by the User or until the account is deleted | Performance of a contract, Art. 6(1)(b) |

| Payment transactions | For the period established by applicable tax and financial legislation | Legal obligation, Art. 6(1)(c) |

| Complaints and moderation data | For the period necessary for review and for the defense of legal claims | Legitimate interest, Art. 6(1)(f) |

| Cookies and analytics data | Up to 2 years from the last visit | Consent, Art. 6(1)(a) |

| Push subscription data | Until unsubscription or account deletion | Consent, Art. 6(1)(a) |

| Access logs | 6 months | Legitimate interest, Art. 6(1)(f) |

8.3. Data Destruction

Upon expiry of the retention period or once the purposes of processing have been achieved, personal data is destroyed or anonymized within 30 days. Destruction is carried out by:

• deleting records from the database or replacing them with anonymized marks;

• deleting files (photos, voice recordings, attachments) from the servers;

• recording the fact of destruction in a log.

8.4. Account Deletion

You can delete Your account in the Application ("Profile" → "Delete account") or by writing to info@allyon.ai from the address with which the account is registered. A reply is sent within 30 days.

The AI² account is one for all applications of the Platform; therefore, deletion closes it entirely.

Deletion procedure:

1. Immediately after the request, the account is hidden.

2. 30 days — the cancellation period: if You sign in during this time, everything will be restored.

3. After 30 days, personal data is replaced with anonymized marks. It cannot be restored thereafter.

4. Anonymized records that the law requires to be retained are permanently deleted upon expiry of the statutory period.

Deleted: the profile (name, photo, language and settings); conversations with the AI companion, including voice conversations; the companion's memory — everything it has remembered about You; reminders and notes; contacts and correspondence in the "Friends" section; the sample of one's own voice and the voice created from it (if created).

Retained: messages You have sent to other people, in their history (this is also their correspondence); payment information — in anonymized form for as long as required by law; anonymized statistical data, which does not constitute personal data within the meaning of the GDPR.

9. International Data Transfers

9.1. General Principles (Chapter V GDPR, Articles 44–49)

The Controller may transfer personal data to countries outside the European Economic Area (EEA) only where adequate safeguards as provided for by the GDPR are in place.

9.2. Transfers Outside the EEA

The following processing operations may involve data transfers outside the EEA:

a) The Controller and the Platform's infrastructure:

• Data category: all categories of data of the Service listed in Section 4, including the processing of conversations by the Operator's own language models;

• Destination country: the countries outside the EEA where the Platform's servers are located (the Controller itself is located in the Republic of Poland, within the EEA);

• Safeguards: Standard Contractual Clauses (SCC) approved by Commission Implementing Decision (EU) 2021/914, and the technical measures of Section 6.

b) The "Friends" section — correspondence with contacts from other countries:

• Data category: messages and chat profile details necessary for the correspondence;

• Destination country: the country of the Platform's cabinet in which Your conversation partner is registered;

• Basis: the transfer is necessary for the performance of a contract — delivery of messages to the conversation partner chosen by You (Article 49(1)(b) GDPR), as well as the applicable safeguards of Article 46 GDPR.

c) Google Analytics:

• Data category: de-identified analytics data (IP address anonymized);

• Destination country: USA/EU (Google offers storage in the EU region);

• Safeguards: Standard Contractual Clauses (SCC); EU-U.S. Data Privacy Framework.

d) Push providers (Google FCM, Mozilla, Apple):

• Data category: notification payload (in the browser — in encrypted form);

• Safeguards: encryption (RFC 8291) in the browser; minimal information in notifications of the Application.

9.3. Your Rights Regarding International Transfers

You have the right to obtain a copy of the appropriate safeguards applied to international data transfers by contacting the DPO at info@allyon.ai.

10. Cookies and Consent (ePrivacy)

10.1. What Are Cookies

Cookies are small text files that are stored on Your device when You visit the Service. They allow the Service to remember information about You and Your preferences.

10.2. Types of Cookies Used

a) Strictly necessary cookies (do not require consent):

• session identifier (JWT token);

• interface language settings;

• cookie consent state.

These cookies are necessary for the functioning of the Service and are set on the basis of legitimate interest (Article 6(1)(f) GDPR) and the exemption from the consent requirement under Article 5(3) of the ePrivacy Directive.

b) Functional cookies (require consent):

• display preferences (theme);

• push notification subscription data;

• the installation status of the web application.

c) Analytical cookies (require consent):

• Google Analytics — tracking of traffic, user behavior and traffic sources (in anonymized form).

Analytical cookies are set only after obtaining the User's explicit consent through a cookie banner in accordance with the ePrivacy Directive.

A detailed list of cookies and their retention periods is provided in the Cookie Policy.

10.3. Managing Cookies

You can manage cookies in the following ways:

• Via the cookie consent banner — upon Your first visit to the Service, You are offered a choice of cookie categories to which You give consent;

• In browser settings — configuring blocking, deletion, or warnings about cookies;

• For Google Analytics — via the Google Analytics Opt-out Add-on (https://tools.google.com/dlpage/gaoptout);

• Withdrawing consent — You may withdraw previously given cookie consent at any time through the Service settings or by clearing cookies in Your browser.

Please note: disabling strictly necessary cookies may result in the inability to use the Service.

10.4. Local Storage

In addition to cookies, the Service uses browser Local Storage technology to store:

• authorization token (JWT);

• cached profile data;

• interface settings;

• Service Worker data (for the operation of the web application and push notifications).

Local Storage data is not automatically transmitted to the server with each request (unlike cookies) and is used exclusively on the browser side.

11. Special Categories of Personal Data (Article 9 GDPR)

11.1. General Provisions

In accordance with Article 9(1) GDPR, the processing of special categories of personal data (information on racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life or sexual orientation, genetic and biometric data) is prohibited, except in the cases provided for by Article 9(2) GDPR.

11.2. What the Service Does Not Do

• The Service does not request special categories of personal data: the Service has no questionnaires about intimate life, information on health, racial and ethnic origin, political opinions or religious beliefs;

• The Service does not carry out biometric face verification and does not create or store biometric templates of the face or voice;

• The Service does not use such information for personalization, advertising, assessment of the User or making decisions about the User.

11.3. Information Shared by the User on Their Own Initiative

The AI companion is a companion for talking about anything, and the User may, on their own initiative, tell it about their health, personal life, beliefs and other circumstances.

Legal basis: such information is processed on the basis of the explicit consent of the data subject (Article 9(2)(a) GDPR), which the User expresses by personally sharing it with the AI companion after reading this Policy. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR).

How such information is processed:

• it is used only for the AI companion's reply and to maintain the coherence of the conversation;

• it is stored in the conversation history and may be kept in the companion's memory (if memory is enabled);

• it is not singled out into a separate category, is not transferred to other persons beyond Section 7 and is not used for advertising.

How to withdraw consent: delete the relevant conversation, delete the information from the companion's memory or clear the memory, disable memory in the settings, or delete Your account. You may also contact the DPO at info@allyon.ai. Withdrawal of consent in respect of this information does not entail deletion of the account.

The User has the right to delete the correspondence at any time — such information is deleted together with it.

12. Your Rights (Articles 15–22 GDPR)

As a data subject, You have the following rights under the GDPR. To exercise any of the rights listed below, contact the DPO at info@allyon.ai or at the postal address specified in Section 2.2. The Controller undertakes to respond to Your request within one month (Article 12(3) GDPR), with the possibility of an extension of up to two additional months where necessary.

12.1. Right of Access (Article 15 GDPR)

You have the right to obtain confirmation from the Controller as to whether Your personal data is being processed, as well as the following information:

• purposes of processing;

• categories of data being processed;

• recipients or categories of recipients of the data;

• envisaged retention periods;

• information about Your rights (rectification, erasure, restriction, objection);

• information about the sources of data (if not obtained from You);

• information about automated decision-making, including profiling (Article 22 GDPR);

• information about international transfers and safeguards (Article 46 GDPR).

You have the right to receive a copy of the personal data being processed free of charge. A reasonable fee may be charged for additional copies. You can view the information saved in the companion's memory Yourself in the settings of the Service.

12.2. Right to Rectification (Article 16 GDPR)

You have the right to request the immediate rectification of inaccurate personal data, as well as the completion of incomplete data. You can correct most data Yourself through the interface of the Service (editing the profile and the chat profile, companion settings, deleting inaccurate information from the companion's memory).

12.3. Right to Erasure / "Right to Be Forgotten" (Article 17 GDPR)

You have the right to request the erasure of Your personal data where:

• the data is no longer necessary for the purposes for which it was collected;

• You withdraw consent and there is no other legal basis for processing;

• You object to processing and there are no overriding legitimate grounds for continued processing;

• the data has been unlawfully processed;

• erasure is required for compliance with a legal obligation.

You can delete individual conversations, items of the companion's memory, reminders and notes in the interface of the Service, and delete Your account in the Application or by sending a request to info@allyon.ai (procedure — Section 8.4).

Exceptions: The Controller may refuse to erase data necessary for compliance with a legal obligation, for the defense of legitimate interests in legal proceedings, and in other cases provided for by Article 17(3) GDPR. Messages that You have sent to other people in the "Friends" section remain in their correspondence history.

12.4. Right to Restriction of Processing (Article 18 GDPR)

You have the right to request the restriction of processing of Your personal data in the following cases:

• You contest the accuracy of the data — for the period of verification;

• the processing is unlawful, but You prefer restriction of processing instead of erasure;

• the Controller no longer needs the data, but it is required by You for the establishment, exercise, or defense of legal claims;

• You have objected to processing (Article 21 GDPR) — pending verification of whether the Controller's legitimate grounds override Yours.

In addition, You can restrict processing Yourself: disable the companion's memory, push notifications and analytics cookies.

12.5. Right to Data Portability (Article 20 GDPR)

You have the right to receive the personal data You have provided in a structured, commonly used, and machine-readable format (JSON), and to transmit that data to another controller without hindrance from the Controller, where processing is based on consent or a contract and is carried out by automated means.

12.6. Right to Object (Article 21 GDPR)

You have the right to object at any time to the processing of Your personal data carried out on the basis of legitimate interest (Article 6(1)(f) GDPR), on grounds relating to Your particular situation. The Controller will cease processing unless it demonstrates compelling legitimate grounds that override Your interests, rights, and freedoms.

In particular, You may object to:

• processing of access logs;

• use of data to improve the Service.

You may object at any time to the processing of data for direct marketing purposes; in that case, such processing ceases.

12.7. Right to Withdraw Consent (Article 7(3) GDPR)

You have the right to withdraw consent for the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Please note: the processing of data necessary for the functioning of the Service is based on the contract; such processing can be terminated by deleting the account.

Withdrawal of consent to the processing of special-category information shared with the AI companion (Section 11.3) does not automatically entail deletion of the account — only the relevant information is deleted.

12.8. Rights Regarding Automated Decision-Making and Profiling (Article 22 GDPR)

The Allyon Service uses automated data processing for:

• generating the AI companion's replies taking into account the course of the conversation and the companion settings;

• saving information in the companion's memory to personalize replies;

• creating reminders at Your request;

• speech recognition and voicing of replies;

• protection against abuse (limiting the frequency of requests and sign-in attempts, tracking the free-mode limit).

Important: these automated processes do not produce decisions with legal effects or that similarly significantly affect the User. The AI companion's replies are auxiliary, informational and entertainment in nature. Decisions to block an account are made with human involvement.

Nevertheless, You have the right to:

• obtain information about the logic of automated processing;

• contest the results of automated processing;

• request human intervention in decision-making;

• express Your point of view.

12.9. Right to Lodge a Complaint with a Supervisory Authority (Article 77 GDPR)

If You believe that the Controller is violating Your data protection rights, You have the right to lodge a complaint with a Data Protection Supervisory Authority in an EU/EEA Member State:

• of Your habitual residence;

• of Your place of work; or

• of the place of the alleged infringement.

A list of EU Supervisory Authorities is available on the European Data Protection Board (EDPB) website: https://edpb.europa.eu/about-edpb/about-edpb/members_en

You may also contact the Controller or DPO directly:

• DPO: info@allyon.ai

• Support: support@allyon.ai

• Phone: +48 573 588 194

The Controller undertakes to review the request within one month from the date of receipt.

13. AI Transparency (EU AI Act)

13.1. General Provisions

In accordance with the requirements of Regulation (EU) 2024/1689 (EU AI Act), the Controller ensures transparency in the use of artificial intelligence technologies in the Service. The AI companion is clearly identified in the Service as artificial intelligence; the AI companion is not a human being, and all its replies, including voiced ones, are generated automatically by software.

13.2. AI Systems Used in the Service

a) AI companion (Mars LLM Service):

• Purpose: generating replies in the dialogue with the User taking into account the course of the conversation, the companion settings and the companion's memory;

• Technology: the Operator's own large language models deployed on the Operator's servers (Mars LLM Service — the Operator's internal service); no data is transferred to third-party AI providers;

• Input data: pseudonymized text of the conversation, companion settings, information from the companion's memory, the recognized text of voice messages, the content of attachments;

• Output data: text replies;

• Risk category under the EU AI Act: a system interacting with humans, subject to transparency obligations; does not make decisions on behalf of the User;

• Limitations: the AI companion does not replace professional psychological, medical, legal or financial assistance; replies may be inaccurate.

b) Companion memory:

• Purpose: saving information from conversations so that the companion remembers what was said earlier;

• Technology: extraction of information from the conversation by a language model and its storage in the Service;

• Control: You can view, delete, clear or disable the memory in the settings of the Service;

• Risk category under the EU AI Act: an auxiliary function that does not make decisions.

c) Reminders:

• Purpose: creating reminders at the User's request expressed in a conversation;

• Technology: a language model determines the text and time of the reminder; the reminder is delivered by the scheduler of the Service;

• Limitations: the User is responsible for checking that the created reminder is correct;

• Risk category under the EU AI Act: an auxiliary function that does not make decisions.

d) Speech recognition and synthesis:

• Purpose: converting the User's voice messages into text and voicing the companion's replies;

• Technology: speech recognition and synthesis models running on the Operator's servers;

• Transparency: voiced replies are a synthesized voice and do not belong to a human being; the User's voice, including a sample of one's own voice uploaded through an imported screen (Section 4.9), is not used for identification;

• EU AI Act risk category: does not fall within the high-risk category.

Systems not used in the Service: biometric identification and verification, emotion recognition, matching of people, profile rating, ranking of users.

13.3. Your Rights Regarding AI

In accordance with the EU AI Act and GDPR, You have the right to:

• know that You are interacting with an AI system (the AI companion is clearly identified as AI);

• obtain information about the logic of AI systems;

• contest the results of automated processing (see Section 12.8);

• manage the companion's memory and disable it in the settings of the Service without losing access to the dialogue.

Generating the AI companion's replies is the essence of the service: if You object to it entirely, the Service cannot be provided. In this case, You have the right to delete the conversation history or the account.

14. Policy Amendments and Contact Information

14.1. Procedure for Amendments

The Controller reserves the right to amend this Policy. Grounds for amendments include:

• changes in EU/EEA legislation on personal data protection;

• introduction of new Service features related to personal data processing;

• changes in the categories of data being processed;

• changes in the list of third parties to whom data is disclosed;

• changes in security measures;

• decisions of supervisory authorities or courts.

14.2. Notification of Changes

The Controller shall notify Users of material changes to the Policy by one or more of the following means:

• publication of the updated version of the Policy on the Website;

• push notification within the Service;

• email to the address provided during registration;

• notification in the Service interface upon the next login.

In the event of material changes affecting the legal bases for processing or the scope of data being processed, the Controller will request renewed consent from the User where processing is based on consent.

14.3. Effective Date of Changes

Changes to the Policy take effect from the date of their publication on the Website, unless otherwise specified in the text of the changes. Continued use of the Service after publication of the updated Policy constitutes the User's acceptance of the changes.

In the event of disagreement with the changes, the User must discontinue use of the Service and may request the deletion of their personal data in the manner described in Section 12.

14.4. Version Archive

All previous versions of the Policy are retained by the Controller and are available upon request. The current version of the Policy is available at:

• on the Website allyon.ai — the "Privacy Policy" link during registration and in the settings of the Application.

14.5. Contact Information

For all matters related to the processing and protection of personal data, You may contact:

Controller:

Next Transaction sp. z o.o

• Registration court: Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego

• Share capital: PLN 700,850.00

• Registered and business address: ul. Hoża 86/410, 00-682 Warszawa, Poland

• Email: support@allyon.ai

• Phone: +48 573 588 194

Data Protection Officer (DPO):

• Email: info@allyon.ai

• Postal address: ul. Hoża 86/410, 00-682 Warszawa, Poland — marked "Data Protection Officer"

Child protection: info@allyon.ai

When submitting a request, please include:

• Your full name;

• the email address provided during registration in the Service;

• the nature of the request;

• Your preferred method of communication for receiving a response.

The Controller undertakes to review the request and provide a response within one month from the date of receipt (Article 12(3) GDPR).

Additional Provisions

Age Restriction. The Allyon Service is intended exclusively for individuals who are at least 18 years of age. The Controller does not intentionally collect personal data from minors. If it is discovered that a minor has registered, their account and all personal data will be deleted immediately. The Platform maintains zero tolerance for child sexual abuse and exploitation (CSAE); for details, see the "Child Safety Standards" document.

De-identification and Anonymization of Data. The Controller may anonymize personal data for statistical and research purposes. Anonymized data does not allow the identification of the information's attribution to a specific individual and is not subject to the GDPR (Recital 26).

Non-Discrimination. The Service does not permit discrimination based on racial or ethnic origin, political opinions, religious beliefs, sexual orientation, gender identity, or other protected grounds.

Next Transaction sp. z o.o

NIP: 5214066223

KRS: 0001100939

Registration court: Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego

Share capital: PLN 700,850.00

LEI: 984500O45B78FE678560

ul. Hoża 86/410, 00-682 Warszawa, Poland

support@allyon.ai | +48 573 588 194 | DPO: info@allyon.ai

Date of publication: September 25, 2026