Legal

Privacy Policy

Effective date: 2026-06-24

Bio Wallet Inc. (“we,” “us,” or the “Company”) respects your privacy and is the data controller for the personal data processed through our app, BioButt, and our website (together, the “Service”). This policy explains what we collect, why, and the rights you have — including under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

1. Data we collect

Account data: email address, password (or social-login identifier), and display name.
Service data: de-identified derived signals computed from voice check-ins, self-entered health inputs (mood, meals, activity), and optional age range and sex.
Automatically collected: device information (model, OS version), app usage, access logs, and push-notification tokens.
Payment: payment details are handled by the App Store, Google Play, or a payment processor; we receive only confirmation of purchase and subscription status.

We do not collect your raw voice recordings. Original audio is processed on your device only and is never transmitted to or stored on our servers. We receive only de-identified analytical signals derived from it.

2. How we use your data

To identify you, provide and operate the Service.
To offer personalized healthy-habit guidance and content.
To improve the Service, develop features, and produce de-identified analytics.
To respond to inquiries and send service notices.
To meet legal obligations and handle disputes.

3. Legal bases (GDPR)

Where the GDPR applies, we rely on the following legal bases:

Consent — for processing health-related data, which is special-category data under Article 9. We obtain your explicit, opt-in consent through a separate, clearly worded request, and you may withdraw it at any time.
Performance of a contract — to provide the Service you sign up for.
Legitimate interests — to secure, maintain, and improve the Service, balanced against your rights.
Legal obligation — where processing is required by law.

Withdrawing consent does not affect the lawfulness of processing before withdrawal, and you may continue to use features that do not depend on the withdrawn consent.

4. Health and sensitive data

Self-entered health inputs and voice-derived signals may constitute sensitive or special-category data. We process them only to support healthy daily habits — never for diagnosis or treatment — and only after your explicit opt-in. We do not sell this data.

5. Data retention

Account data: until you delete your account, then promptly erased.
Contract and payment records: retained as required by applicable law.
Access logs: retained for a limited period for security, then deleted.

6. Sharing and processors

We do not sell your personal data. We may share it with service providers (processors) who help us operate the Service — for example, cloud infrastructure, payment processing, and customer support — under contracts that require them to protect your data and process it only on our instructions.

7. International transfers

We are based in the Republic of Korea, which the European Commission recognizes as providing an adequate level of data protection. Where data is transferred to other countries, we use appropriate safeguards such as Standard Contractual Clauses.

8. Your rights under the GDPR

If you are in the EU/UK, you have the right to:

access, correct, or delete your personal data;
restrict or object to processing;
data portability;
withdraw consent at any time; and
lodge a complaint with your supervisory authority.

To exercise these rights, use the in-app settings or contactprivacy@biobutt.com. We respond without undue delay and within the time limits required by law.

9. Your rights under the CCPA/CPRA (California)

If you are a California resident, you have the right to:

know what personal information we collect, use, and disclose;
request deletion of your personal information;
correct inaccurate personal information;
limit the use of sensitive personal information; and
opt out of any “sale” or “sharing” of personal information.

Do Not Sell or Share My Personal Information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. To make any privacy request, contact privacy@biobutt.com; we honor valid requests within 45 days and recognized opt-out signals such as Global Privacy Control.

10. Security

We protect your data with encryption in transit and at rest, access controls, and audit logging, and we review our safeguards regularly.

11. Children

The Service is not directed to children under 16 (or the age of digital consent in your jurisdiction), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

12. Contact and data protection

Controller: Bio Wallet Inc. (주식회사 바이오월렛)
Address: 1106 Room, 116, Seosomun-ro, Jung-gu, Seoul 04513, Republic of Korea
Privacy contact: privacy@biobutt.com

13. Changes to this policy

We may update this policy as laws or the Service change. We will post the effective date and notify you of material changes; where required, we will seek fresh consent.

This document is a standard template provided for general information and does not constitute legal advice. We recommend review by a qualified attorney before use.