Privacy Policy

Effective [Date]

Previous Version: [Link if applicable]

Innermost AI, Inc. ("Innermost," "we," "us," or "our") is a Delaware corporation that builds AI-powered mental wellness tools designed to help users reflect, grow, and build healthier habits through personalized AI guide interactions.

We are committed to respecting your privacy and keeping secure any information we obtain from you or about you. This Privacy Policy describes our practices with respect to personal data ("Personal Data") that we collect from or about you when you use our website at getinnermost.com and our mobile application (collectively, the "Services").

This Privacy Policy also describes your privacy rights. More information about your rights, and how to exercise them, is set out in Section 5 ("Your Rights and Choices").

Important Note About Third-Party AI Providers

Innermost uses third-party large language model ("LLM") providers — including Anthropic (Claude), OpenAI (ChatGPT), and Google (Gemini) — to power the AI guide conversations within our app. When you interact with an AI guide, your inputs are sent to one or more of these providers for processing in order to generate your guide's responses.

We select and configure these providers with your privacy in mind. We use their API services, which means your conversation data is not used by these providers to train their general-purpose models under the terms of our agreements with them. However, each provider's data handling is also governed by their own privacy policies, which we encourage you to review:

• Anthropic Privacy Policy
• OpenAI Privacy Policy
• Google Privacy Policy

A note about AI accuracy: Our AI guides generate responses by predicting helpful and relevant text based on your inputs. In some cases, responses may not be fully accurate, complete, or appropriate for your specific situation. You should not rely on AI guide responses as a substitute for professional advice. If you believe a response contains inaccurate information about you, please contact us at privacy@getinnermost.com and we will make reasonable efforts to address it.

1. Personal Data We Collect

Personal Data You Provide

Account Information. When you create an account, we collect information associated with your account, including your name, email address, date of birth, account credentials, and subscription or transaction history (collectively, "Account Information").

Payment Information. If you purchase a subscription to Innermost Pro, your payment is processed through third-party payment processors (e.g., Apple App Store, Google Play Store, or Stripe). We receive limited transaction information from these processors but do not store full credit card numbers on our servers.

Onboarding and Profile Data. During onboarding, you may provide information about your wellness goals, areas of focus, and preferences. You also select a personalized AI guide, and we store that selection as part of your profile.

Conversations. When you interact with your AI guide through chat-based conversations ("Conversations"), we collect the content of those interactions — including your messages (inputs) and the AI guide's responses (outputs). Conversations may contain personal, sensitive, or health-related information that you choose to share.

Check-In Data. You provide data through daily check-ins, which may include mood ratings, sleep quality, energy levels, and optional free-text reflections. We collect and store this information to provide and personalize the Services.

Feedback. If you provide feedback — including ratings (e.g., thumbs up/thumbs down on a response), ideas, or suggestions — we collect that feedback along with the related conversation context.

Communication Information. If you communicate with us via email, in-app support, or other channels, we collect your name, contact information, and the contents of any messages you send.

Other Information You Provide. We may collect other information you provide to us, such as when you participate in surveys, respond to questionnaires, or otherwise voluntarily provide information through the Services.

Personal Data We Receive Automatically

When you use the Services, we receive certain technical data automatically (collectively, "Technical Information"), including:

Log Data. Your device or browser automatically sends us information when you use our Services, including your Internet Protocol (IP) address, browser type and settings, the date and time of your requests, and how you interact with our Services.

Usage Data. We collect information about your use and activity within the Services, such as the features you use and actions you take, the types of content you engage with, session duration, check-in frequency, conversation patterns, your time zone, country, the dates and times of access, device type, and operating system.

Cookies & Similar Technologies. We and our service providers use cookies, scripts, or similar technologies on our website to manage the Services and collect information about you and your use of the Services.

2. How We Use Personal Data

We use your Personal Data for the following purposes:

To provide, maintain, and improve the Services, including powering AI guide conversations, delivering daily check-ins, tracking streaks and progress, personalizing your experience, and remembering context between sessions.

To communicate with you, including sending you information about the Services, responding to support inquiries, and notifying you of updates, security alerts, or changes to our policies.

To create and administer your account, including managing your subscription, guide selection, preferences, and account settings.

To facilitate payments for subscription services through our third-party payment processors.

To improve guide quality and develop new features, including analyzing usage patterns and check-in trends in aggregate or de-identified form, evaluating guide performance, and conducting internal research to improve the user experience.

To ensure safety and enforce our policies, including reviewing flagged conversations to detect harmful content, enforce our Terms of Service and Usage Policy, and protect users from unsafe interactions.

To prevent and investigate fraud, abuse, and violations, including protecting the integrity of our platform and the rights and safety of our users.

To comply with legal obligations and respond to lawful requests from governmental authorities.

To enforce our Terms of Service and other applicable agreements.

How We Handle Your Conversations

Your Conversations with AI guides are stored to provide continuity in your experience — for example, so your guide can reference prior context within a session. We may review Conversations in de-identified or aggregated form to improve guide quality and the overall service.

We do not sell your Conversation data. We do not use your Conversations to train general-purpose AI models. If Conversations are flagged for safety review, we may review them to enforce our policies and improve our safety systems.

3. How We Disclose Personal Data

We disclose Personal Data to the following categories of third parties for the purposes described in this policy:

AI Service Providers. Conversation inputs are processed by third-party AI providers (currently Anthropic, OpenAI, and/or Google) to generate guide responses. We share only the data necessary to facilitate these interactions via their API services.

Infrastructure and Service Providers. We disclose Personal Data to service providers who assist with hosting, data storage, analytics, payment processing, email delivery, customer support, and other operational functions. These providers process data on our behalf under contractual obligations to protect your information.

App Store Partners. If you subscribe through the Apple App Store or Google Play Store, those platforms process your payment and share limited transaction information with us.

As Part of a Corporate Transaction. If Innermost is involved in a merger, acquisition, financing, bankruptcy, or other transfer of business assets, your Personal Data may be disclosed as part of that transaction.

Pursuant to Legal Requirements. We may disclose Personal Data to governmental or regulatory authorities as required by law, in response to legal process, or to protect the rights, safety, or property of Innermost, our users, or others.

With Your Consent. We will disclose Personal Data when you give us permission or direct us to do so.

We also aggregate or de-identify Personal Data so that it no longer identifies you and may share such data with third parties for the purposes described above, such as to help improve our Services.

Innermost does not "sell" your Personal Data or "share" Personal Data for cross-contextual behavioral advertising, as those terms are defined under applicable U.S. state privacy laws. We do not process sensitive Personal Data for the purposes of inferring characteristics about you. We do not use your Personal Data for targeted advertising.

4. Data Retention

We retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Data depends on the type of data, how we use it, and in many cases your choices:

Information we retain until you delete it. You can delete individual Conversations from your history within the app, or delete your account entirely. Once you choose to delete Personal Data, we will remove it from our active systems within 30 days, unless we need to retain it for longer as described below.

Information we retain for a defined period. Some data is retained for a set period to fulfill our operational, safety, or compliance needs. For example:

• Check-in data and usage analytics may be retained in de-identified form to improve the Services.
• Log data and Technical Information are generally retained for a limited period for debugging, security, and performance monitoring purposes.

Information we may retain for longer. In certain circumstances, we may retain Personal Data beyond the periods described above:

• When content has been flagged for safety review or policy violations, we may retain that data to protect our Services and users.
• When we are legally required to retain data (for instance, in response to a lawful subpoena or regulatory obligation).
• When we are party to a financial transaction, we may retain payment and transaction-related information for accounting, dispute resolution, and compliance purposes.
• When you request deletion of your Personal Data, we retain an audit record of the erasure request to verify that we have complied.

Aggregated and De-Identified Data. We may process Personal Data in aggregated or de-identified form to analyze the effectiveness of our Services, study usage patterns, and improve guide quality. This information does not identify individual users and may be retained indefinitely.

5. Your Rights and Choices

Privacy Rights

Depending on where you live and applicable laws, you may have certain rights regarding your Personal Data:

• Right to Know: The right to know what Personal Data we process about you, the categories of sources from which it is collected, the purposes for collection, and the categories of third parties to whom we disclose it.
• Access & Data Portability: The right to request a copy of the Personal Data we process about you, in a portable format where applicable.
• Deletion: The right to request deletion of your Personal Data collected through the Services, subject to certain exceptions.
• Correction: The right to request correction of inaccurate Personal Data. Please note that because AI-generated responses are produced through language prediction rather than data retrieval, we cannot guarantee the factual accuracy of all outputs. If outputs contain inaccurate information about you, you can submit a correction request and we will make reasonable efforts to address it — but due to the technical nature of AI systems, it may not always be possible to do so.
• Opt-Out of Sale/Sharing: Innermost does not sell your Personal Data and does not share it for cross-contextual behavioral advertising.
• Withdrawal of Consent: Where processing is based on consent, you have the right to withdraw consent at any time.

How to Exercise Your Rights

To exercise your rights, you or an authorized agent may submit a request by emailing us at privacy@getinnermost.com.

Verification. To protect your Personal Data from unauthorized access, modification, or deletion, we may require you to verify your identity before we process your request. If you do not have an account with us, or if we suspect fraudulent or malicious activity, we may ask you to provide additional information for verification. If we cannot verify your identity, we may not be able to fulfill your request.

Authorized Agents. You may submit a rights request through an authorized agent. If you do so, the agent must present signed written permission to act on your behalf, and you may also be required to independently verify your identity with us. Authorized agent requests can be submitted to privacy@getinnermost.com.

Appeals. Depending on where you live, you may have the right to appeal a decision we make relating to your request. To appeal a decision, please email privacy@getinnermost.com.

Non-Discrimination. Innermost will not discriminate against you for exercising your privacy rights.

In-App Data Controls

Our Services provide you with controls over your Personal Data:

• Delete individual Conversations from your history at any time.
• Delete your account entirely, which will remove your Personal Data from our active systems within 30 days (subject to legal retention obligations).
• Export your data — you may request a copy of your data by contacting us at privacy@getinnermost.com.
• Manage your subscription through your device's app store settings.

6. Security

We implement commercially reasonable technical, administrative, and organizational security measures designed to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security reviews.

However, no internet transmission or electronic storage method is completely secure, and we cannot guarantee absolute security. You should take care when deciding what information you share through the Services, particularly given the sensitive nature of wellness-related conversations. We are not responsible for circumvention of any privacy settings or security measures within the Services.

7. Sensitive Personal Data and Mental Wellness Information

Innermost is a mental wellness app, and your interactions with AI guides may include sensitive personal information about your mental, emotional, and physical health. We treat this data with heightened care and apply the following commitments:

• No advertising use. We do not use your Conversation data or check-in data for advertising purposes.
• No third-party profiling. We do not share your wellness-related data with employers, insurers, data brokers, or other third parties for their independent use or to infer characteristics about you.
• AI provider restrictions. Conversation data sent to our AI providers via their API services is used solely to generate guide responses and is not used to train their general-purpose models under the terms of our agreements with them.
• No diagnosis or treatment. Our AI guides do not diagnose medical or mental health conditions, prescribe treatments, or provide clinical recommendations.

Innermost is not a substitute for professional mental health care. Our AI guides are not licensed therapists, psychologists, psychiatrists, counselors, or medical professionals. If you are in crisis or need professional support, please contact a qualified mental health provider or call the 988 Suicide and Crisis Lifeline (call or text 988 in the U.S.).

If you are located in Washington State or a state with similar consumer health data laws, please note that certain wellness-related data you provide may be classified as "consumer health data" under applicable law. We do not sell or share consumer health data and will comply with applicable consumer health data privacy requirements.

8. Third-Party Websites and Services

Our Services may contain links to, or integrations with, websites, apps, and services managed by third parties. When you interact with these third parties, you may be providing information directly to them, and their use of your information is governed by their own privacy policies — not this one. We encourage you to review the privacy policies of any third-party services before sharing information with them. Our linking to a third-party site or service does not constitute an endorsement of that party.

9. Children

Our Services are not directed toward, and we do not knowingly collect Personal Data from, children under the age of 13. We do not knowingly collect, use, disclose, or sell information from children under 13. If you have reason to believe that a child under 13 has provided Personal Data to us through the Services, please email us at privacy@getinnermost.com. We will investigate and, if appropriate, delete the Personal Data from our systems.

Users between the ages of 13 and 18 must have permission from their parent or guardian to use our Services.

10. Data Transfers

Innermost AI, Inc. is headquartered in the United States. Your Personal Data may be transferred to, processed, and stored in the United States and other jurisdictions where our service providers and AI providers operate.

While data protection law varies by jurisdiction, we apply the protections described in this policy to your Personal Data regardless of where it is processed, and only transfer data pursuant to legally valid transfer mechanisms. If you are located outside the United States, by using our Services you acknowledge that your Personal Data will be transferred to and processed in jurisdictions that may not provide the same level of data protection as your home jurisdiction.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date on this page. We will notify you of any material changes as appropriate — for example, by posting a notice within the app, sending you an email, or other means required by applicable law. We encourage you to review this page periodically.

12. Contact Information

If you have any questions about this Privacy Policy, or have any questions, complaints, or requests regarding your Personal Data, you can contact us:

Innermost AI, Inc.

[Registered Address]

[City, State, ZIP]

Email: privacy@getinnermost.com

13. Supplemental Disclosures for U.S. State Privacy Laws

For Residents of California

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), requires specific disclosures. The following provides additional information about the categories of Personal Data we collect and how we use and disclose that information.

Categories of Personal Data Collected:

Use and Disclosure. We use and disclose Personal Data for the purposes described in Sections 2 and 3 of this policy.

Sale and Sharing. Innermost does not "sell" your Personal Data and does not "share" Personal Data for cross-contextual behavioral advertising, as those terms are defined under the CCPA. We do not process sensitive Personal Data for the purposes of inferring characteristics about you.

Retention. We retain Personal Data as described in Section 4 of this policy.

Your California Privacy Rights:

• The right to know what Personal Data we collect, use, and disclose about you.
• The right to access your Personal Data, including in a portable format.
• The right to request deletion of your Personal Data, subject to certain exceptions.
• The right to request correction of inaccurate Personal Data.
• The right to opt out of the sale or sharing of Personal Data (Innermost does not sell or share your data).
• The right to limit the use of sensitive Personal Data (Innermost uses sensitive Personal Data only as necessary to provide the Services).
• The right to non-discrimination for exercising your privacy rights.

To exercise your rights, contact us at privacy@getinnermost.com. You may also designate an authorized agent to make a request on your behalf.

For Residents of Other U.S. States with Privacy Laws

If you reside in a state with applicable consumer privacy legislation (e.g., Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or others), you may have similar rights to those described in the California section above, including rights to access, delete, correct, and port your Personal Data, as well as the right to opt out of certain processing activities. To exercise your rights, please contact us at privacy@getinnermost.com.

This privacy policy is a draft prepared for review by legal counsel. It should be reviewed and finalized by a qualified attorney before publication.