O que você escreve aqui fica com você.

This Privacy Policy explains how Entheos Tech Ltd (“we”, “us” or “our”) collects, uses, shares and protects your personal data when you use Ulvi, our AI wellbeing companion application (the “App”), our website and related services (together, the “Services”).

We are the data controller responsible for your personal data. Entheos Tech Ltd is a company registered in England and Wales under company number 17061994, with its registered office at 66 Paul Street, London, England, EC2A 4NA.

We are committed to protecting your personal data and to processing it in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other applicable data protection laws. Where we serve users in the European Economic Area, we also have regard to the EU General Data Protection Regulation (Regulation (EU) 2016/679).

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.

What this policy applies to

This Privacy Policy applies to all personal data we collect through or in connection with the Services, including when you browse our website, join a waitlist, complete our onboarding quiz, create an account, interact with the App and its AI characters, or otherwise communicate with us.

Our website and the App may contain links to third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

This Privacy Policy should be read together with our Cookie Policy, which explains in detail how we use cookies and similar tracking technologies and how you can manage your consent preferences.

Personal data we collect

We collect and process the following categories of personal data about you:

• Account and identity data, including your name, username, email address, password (stored in encrypted form), date of birth or age, and account preferences.
• Conversation and wellbeing data, including the text of your interactions with the App and its AI characters, mood ratings, thought-pattern classifications, and other content you choose to share through the Services.
• Usage and analytics data, including information about how you use the website and App, the pages and features you view, session duration, interaction events, and metrics relating to product and marketing performance (see also our Cookie Policy).
• Technical and device data, including your internet protocol (IP) address, device type, operating system, browser type, time zone setting, and other technical identifiers collected through cookies and similar technologies.
• Communications data, including the content and metadata of any messages, support requests, feedback or other communications you send to us.
• Transaction data (where applicable), including records of subscriptions, purchases and payments. Payment card details are processed directly by our payment provider and are not stored by us.

Special category data

Some of the data we process through the App, in particular your mood ratings, thought-pattern classifications and the content of your conversations, may reveal information about your mental or emotional wellbeing. We treat this data as special category data concerning health under Article 9 of the UK GDPR and handle it with additional care.

Where we process special category data, we rely on your explicit consent under Article 9(2)(a) of the UK GDPR. You give this consent when you choose to provide such information through the Services. You may withdraw your consent at any time by contacting us using the details below or by closing your account, although this will not affect the lawfulness of any processing carried out before withdrawal.

Ulvi is a wellbeing and self-reflection tool. It is not a medical device and does not provide therapy, diagnosis, medical advice or crisis intervention. We do not process your wellbeing data for the purposes of medical treatment.

Children and users under 18

We do not permit users under the age of 18 to use our Services, and the Services are not intended for use by children under 18. If you believe we have collected personal data from a child without appropriate consent, please contact us using the details below and we will take steps to delete that data.

How we collect your personal data

We collect personal data through the following means:

• Directly from you, when you join our waitlist, complete our onboarding quiz, create an account, interact with the App, make a purchase, or contact us.
• Automatically, through cookies, server logs, analytics tools and similar technologies when you use the website and App, as described in our Cookie Policy.
• From third parties, such as our analytics, payment and authentication providers, where you have consented or where they are otherwise permitted to share that data with us.

How we use your personal data and our lawful bases

We use your personal data only where the law allows us to. The lawful bases we rely on under the UK GDPR are set out below.

Performance of a contract

We process your account, transaction and conversation data to provide the Services to you, including to create and manage your account, deliver the App’s functionality, process your subscriptions and respond to your requests. The lawful basis for this processing is the performance of our contract with you under Article 6(1)(b) of the UK GDPR.

Legitimate interests

We process usage, analytics and technical data to operate, secure, improve and develop the Services, to understand how our features and marketing perform, and to prevent fraud and misuse. The lawful basis for this processing is our legitimate interests under Article 6(1)(f) of the UK GDPR, where those interests are not overridden by your rights. Where analytics or tracking technologies require consent under the Privacy and Electronic Communications Regulations 2003, we obtain that consent as described in our Cookie Policy before setting non-essential cookies.

Consent

We rely on your consent under Article 6(1)(a) of the UK GDPR, and your explicit consent under Article 9(2)(a) for special category data, where you provide wellbeing information through the App, where we send you marketing communications, and where we use non-essential cookies and analytics. You may withdraw your consent at any time.

Legal obligation

We process personal data where necessary to comply with our legal obligations, for example in connection with tax, accounting and responding to lawful requests from regulators or authorities. The lawful basis for this processing is Article 6(1)(c) of the UK GDPR.

Analytics and marketing

We use product analytics tools, including PostHog, to understand how users interact with the website and App and to measure product and marketing performance. Where these tools rely on cookies or similar technologies that require consent, we will only deploy them after you have given consent through our cookie consent banner. You can manage your preferences at any time as described in our Cookie Policy.

We may send you marketing communications about Ulvi where you have consented or where we are otherwise permitted to do so. You can opt out of marketing at any time by using the unsubscribe link in our emails or by contacting us.

Who we share your personal data with

We do not sell your personal data. We share personal data with the following categories of recipients, who act as our processors or service providers and are bound by appropriate contractual obligations to protect your data:

• Hosting and infrastructure providers, including Hetzner (hosting and backups), RustFS for object storage, and our cloud infrastructure providers, which store our core user data within the European Union.
• AI inference and model providers, including Langfuse, our LLM tracing tool, and AWS Bedrock, which process conversation content to generate the App’s responses.
• Engineering, monitoring and observability providers, including Sentry (error reporting), which may process technical data for debugging and quality purposes.
• Analytics and communications providers, including PostHog (product analytics), Cloudflare (DNS, proxy and email routing) and Loops (marketing email).
• Payment providers, including Stripe, and, for in-app purchases, Apple and Google, which process payment and transaction data.

We may also disclose personal data where required to do so by law, to enforce our terms, to protect our rights, property or safety or those of others, or in connection with a corporate transaction such as a merger, acquisition or sale of assets.

International transfers

Currently all of our core user data, including our database, stored objects and backups, is hosted within the UK or European Union. Where our processors are located outside the United Kingdom and therefore we transfer personal data outside the UK, we ensure that an appropriate safeguard is in place, including one or more of the following:

• transfers to countries that the UK government has determined provide an adequate level of protection for personal data, including the European Economic Area;
• the International Data Transfer Agreement (IDTA) issued by the Information Commissioner’s Office; or
• the UK Addendum to the EU Standard Contractual Clauses and the EU Standard Contractual Clauses for transfers from the European Economic Area, supplemented by additional technical and organisational measures where appropriate.

Any updated locations will be set out in this privacy policy. You may contact us using the details below for further information about the safeguards we have in place for international transfers.

How long we keep your personal data

We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it, including to provide the Services, to comply with our legal, accounting and reporting obligations, and to resolve disputes.

When you close your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain certain data to comply with legal obligations or where retention is necessary to establish, exercise or defend legal claims. We may retain aggregated or de-identified data that does not identify you for analytics and product improvement purposes.

Your data protection rights

Subject to certain conditions and exemptions under data protection law, you have the following rights in relation to your personal data:

• the right to be informed about how we use your personal data;
• the right to access the personal data we hold about you;
• the right to request correction of inaccurate or incomplete personal data;
• the right to request erasure of your personal data in certain circumstances;
• the right to restrict or object to our processing of your personal data in certain circumstances;
• the right to data portability, allowing you to obtain and reuse your personal data;
• the right to withdraw consent at any time where we rely on consent to process your personal data; and
• the right to object to direct marketing.

To exercise any of these rights, please contact us using the details below. We will respond to your request within one month, although we may extend this period for complex requests. We will not usually charge a fee, and we may need to verify your identity before responding.

Security

We have implemented appropriate technical and organisational measures designed to protect your personal data against unauthorised access, loss, misuse or alteration. These measures include encryption of passwords, access controls, secure hosting within the European Union and contractual safeguards with our processors.

No method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security. We will notify you and the relevant regulator of any personal data breach where we are required to do so by law.

Complaints

If you have any concerns about how we handle your personal data, please contact us first using the details below so that we can try to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at www.ico.org.uk or by calling 0303 123 1113. If you are in the European Economic Area, you may also lodge a complaint with your local data protection authority.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services or legal requirements. When we make material changes, we will notify you through the Services or by other appropriate means. The date this Privacy Policy was last updated is set out below.

Contact us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

Entheos Tech Ltd
Registered office: 66 Paul Street, London, England, EC2A 4NA
https://ulvi.ai/contact - [email protected]

Last updated: 18 Jul 2026 – 11:21