# Privacy policy for the Endel app

## General Information

We, Endel Sound GmbH, Sophienstraße 21, 10178 Berlin (hereinafter referred to as “Endel”), collect and process your personal data in connection with the Endel App (hereinafter referred to as “App”). We are the “controller” within the meaning of the EU General Data Protection Regulation (GDPR) and comply with applicable US data protection laws, including the California Consumer Privacy Act (CCPA).

## Definitions

**Personal Data:** Any information that relates to an identified or identifiable individual, such as name, identification number, location data, or online identifier.

**Processing:** Any operation performed on personal data, including collection, recording, organization, storage, alteration, retrieval, use, disclosure, and erasure.

The protection and confidentiality of your data is very important to us. We therefore process your data only to the extent that:  
- this is necessary to provide the services you requested from the App,  
- you have consented to the Processing or we are otherwise legally authorized to do so.

If you have any questions, suggestions or comments, please feel free to contact Endel Sound GmbH, Sophienstraße 21, 10178 Berlin: E-Mail: ask@endel.io.  
You can contact our data protection officer: security@endel.io

## What data do we collect from you and for what purpose?

### a. Information collected during download

When you download the App, certain required information is submitted to the App Store, including your Apple ID, time of download, payment information (e.g. credit card, bank account) and your individual device ID number. The processing of this data occurs exclusively through the respective App Store or the respective payment system (e.g. Stripe) and is beyond our control. We do not store or process this data.

### b. Information that is automatically collected when using the app

As part of your use of the App, we automatically collect certain data required for the use of the App. This includes, for example, your device model, system version, and IP address of your mobile device.

This data is automatically Processed by us to:  
1. provide you with the App and related features;  
2. improve the features and functionality of the App;  
3. prevent and correct misuse and malfunctions.

### c. Creation of a user account (registration) and login

To use the App we can ask you to create a user account. For this purpose, it is necessary to enter your e-mail address (“mandatory information”). The mandatory information enables and guarantees access and administration of your user account. Mandatory information is marked with an asterisk and is required for the conclusion of the user contract. If you do not provide this mandatory information, you will not be able to create a user account.

In addition, you can voluntarily enter your date of birth during the registration process.

We use the mandatory information to authenticate you when you log in and to follow up requests to reset your password. The data entered by you during registration or login will be processed and used by us to:  
1. verify your authorization to manage your user account;  
2. enforce the App’s terms and conditions;  
3. contact you with technical or legal notices, updates, security messages, or other messages regarding the management of your user account.

### d. Registration and log-in with Facebook Connect

Facebook Connect makes it easy for you to register for and log into an account. Instead of entering the required information, you can log in with your Facebook login information. You will be redirected to the Facebook page to enter your information.

Registration in this form links your user account to your Facebook profile. We receive Personal Data about you from Facebook, namely your e-mail address and your name. We use these Personal Data only in order to identify you at registration and login.

### e. Data syncing: Connecting certain Personal Data to your account

If you create an account, you will have access to our data syncing feature. This means that we will connect your health data, subscription length and originating platform (iOS, Android etc.) to your account, enabling you to enjoy your personalized ENDEL sound environment from several devices.

### f. Generic mode

If you use the app without providing further data or permission, we will not Process any Personal Data to create a personalized sound environment for you. You will receive a generic sound environment.

### g. Personalized sound environment

If you want to personalize your sound environment, you can share various information and manage these shares, including your heart rate and location. This data is Processed to provide the service, in particular to provide the functionality of the app.

### h. Reports and highlights

We will inform you periodically, usually once a week, about your weekly highlights when using the app and show you statistical analyses. For this purpose we process data about your activity in the app.

### i. Payments

For payment processing, only the data relevant to payment is transmitted to Apple Pay, Google Play, Stripe and PayPal.

### j. Advertising and newsletter

With your consent, you can allow us to send you advertising and our newsletter, which will inform you about our new products and services and other relevant information. The legal basis for this Processing is Art. 6 para. 1 sentence 1 lit. a GDPR.

## Where we store your data; who has access to your data.

We store your data on your device and on the servers of our IT service provider Amazon Web Services SARL. Processing shall only take place on our behalf and on the basis of a data processing agreement.

Data transfers to the US are secured by the EU-US Data Privacy Framework (DPF), which ensures that personal data receives adequate protection during such transfers.

### Analytics tools

Endel partially commissions third party providers to provide services for the analysis and evaluation of data. Processing is only carried out on our behalf. We use the following tools:

**a. Tableau:** We use Tableau, a business intelligence and data visualization platform.

**b. Google Firebase:** We use Google Firebase service to send push notifications, using encrypted, anonymous device IDs.

**c. Crashlytics:** We work with Crashlytics to collect information about system crashes and bugs.

**d. Plug-ins:** We currently use social media plug-ins from Facebook and Spotify.

**e. Mailchimp:** Our newsletter is sent using Mailchimp, which tracks newsletter opens, clicks, and other metrics.

**f. Push-notifications:** We use OneSignal to send you push notifications.

## How long your data will be stored and how you can delete it

We store your data for the time period for which you use the app. You can delete your data by visiting the data management section in your settings.

## Your data rights

Depending on the circumstances of the specific case, you have the following rights:

- The right of access (Art. 15 GDPR)
- The right to rectification (Art. 16 GDPR)
- The right to erasure (Art. 17 GDPR)
- The right to restriction of processing (Art. 18 GDPR)
- The right to data portability (Art. 20 GDPR)
- The right to take legal action or to file a complaint (Art. 77 GDPR)

In addition, you have the right to object to the Processing of your Personal Data for purposes of direct marketing.

Under the CCPA, California residents have the right to:
- Request information about the categories of personal data we have collected or disclosed.
- Request access to specific pieces of personal data collected about them.
- Request the deletion of personal data.

We do not sell your personal data as defined by the CCPA.

## Changes to our privacy policy

We reserve the right to amend this privacy policy. You will find the current version on our website.

Version: 1.5 ; Date: 15 October 2024