ReFeel Privacy Policy

Effective date: TODO Q14 date of publication Last updated: TODO Q14

This Privacy Policy explains how Digital Waves Business, S.L. ("we", "us") handles personal data when you use the ReFeel app for Android and iOS, the ReFeel website and the pages where ReFeels are watched (together, "ReFeel").

ReFeel is a camera that listens. While a ReFeel is on, your phone takes the photos you choose, records the sound around you and notes where you are. When you finish, our servers use artificial intelligence (AI) to turn that moment into a personal song, a video and a story. That means we handle very personal information, including what you and the people around you say. We have tried to explain exactly what happens to it, in plain words.

1. At a glance

• You decide when ReFeel records. Recording only starts when you start a ReFeel, and a notification stays on screen for as long as it runs.
• Nothing of a ReFeel leaves your phone until you choose "Create my ReFeel". If you discard a ReFeel, its photos, words and sound stay on your phone and are then deleted there.
• What we receive to make your ReFeel: the photos and videos you took, the text of what was said (transcribed on your phone) and where you were. The sound itself is never kept or sent to us: it is used only to write the text, as it is heard. APP-FIX X32
• Who processes it: only our own servers, and AI models that run on servers we rent and operate ourselves in the European Union (France and the Netherlands). We do not send your content to third-party AI services such as OpenAI, Anthropic or Google. APP-FIX X18
• We do not use your content to train AI models.
• Your ReFeel is private until you share it. Each finished ReFeel has a private link; anyone you give that link to can watch it.
• We do not sell your data, we do not show ads, and we do not track you across other apps or websites.
• You can delete any ReFeel, or your whole account, at any time from the app. See section 10.

2. Who is responsible and how to contact us

The data controller is:

• Digital Waves Business, S.L.
• Registered office: C/ Bolsa, 10, 4º B, 29015 Málaga, Spain
• Tax ID (NIF): B92896471
• Registered in the Registro Mercantil de Málaga (Commercial Registry of Málaga), hoja MA-95172, tomo 4438, folio 196 (EUID ES29023.000335252)
• Email for privacy matters: privacy@refeel.it
• Phone: +34 611 888 436

TODO L1 whether a Data Protection Officer must be appointed; if so, add their contact here.

3. What we collect

3.1 Your account

• When you sign up with email: your first name, last name, email address, password and the languages you use the app in. We store the password only as a one-way hash; we cannot read it.
• When you sign in with Google: Google sends us your Google account identifier, email address, whether it is verified, your name and your profile picture.
• TODO Q5 when Sign in with Apple is added on iOS, add: "When you sign in with Apple: Apple sends us an identifier and the email address you choose to share, which may be a private relay address, and your name if you allow it."

3.2 What a ReFeel captures

A ReFeel is recorded while it happens. While a ReFeel is on, the app collects the following on your phone. It is sent to our servers only when you choose "Create my ReFeel".

• Photos and videos you take with the ReFeel camera, with their technical details: when they were taken, the camera settings and, if location is on, where they were taken.
• The text of what was said. The app listens through the microphone and turns speech into text on your phone, using your phone's own speech recognition. We receive only the text and the time it was said; the sound is not kept or sent to us. This text may include the words of other people near you (see section 5). TODO Q6 on phones that cannot recognise speech on the device, the app uses the phone's standard speech service (on most Android phones, Google's), which may send the sound to its provider to turn it into text. Either the app stops doing that, or this sentence must say so and name the provider.
• Where you were. While a ReFeel is on, the app records your location (precise coordinates and time) and where each photo was taken. You can turn this off in Settings → Location tracking → Record location during a ReFeel; it is on by default.
• What you tell ReFeel about the song, such as a music style you type or dictate, and any description you add to a moment.

If you turn on Mask sensitive data (Settings → Privacy & security), the app hides phone numbers, email addresses, names and places in the text before it is uploaded. It is off by default.

3.3 What stays on your phone

Some things the app works with are kept only on your phone and are never sent to us:

• A ReFeel you discard, or have not created yet. Its photos, text and sound stay on your phone.
• The sound. The app uses the microphone only to turn speech into text as it is heard. It does not keep the recording on your phone and never sends it to us. APP-FIX X32
• Photos you import from your gallery to help the app recognise people and places.
• Grouping your photos by people on your phone. The app can group the photos in its gallery by the people and things in them, including the faces in photos that friends share with you. To do this it analyses them on your phone and creates a numeric description of each face. That description stays on your phone and is never sent to us. TODO Q13 the app team to confirm this for iOS and the store build.

3.4 Notifications

We send notifications, for example when your ReFeel is ready, only if you allow them.

3.5 Sharing ReFeels with other people

• Your link. Each finished ReFeel can be watched at a private web address with a long random code. We do not publish it anywhere. If you send it to someone, anyone who has the link can watch the ReFeel, including its photos, song and story, without signing in.
• "From friends". When someone shares a ReFeel with you and you save it in the app, we keep the link in your library, together with the sender's name and picture. The person who shared it can see neither your account nor your library.
• When you delete a ReFeel, its link stops working and it disappears from the libraries of everyone who saved it.

3.6 Device, diagnostics and usage

• Device information: device model and brand, operating system and version, app version, language and an identifier for this installation of the app.
• Notification token: an identifier that lets us send notifications to your phone.
• Diagnostic events: technical events about recording, speech recognition, location, the camera and the app's lifecycle, so we can find and fix problems.
• Usage statistics: which screens and options you use and for how long. They never contain the content of your ReFeels.
• Crash reports: when the app crashes, a report with the technical state of the app and the device is sent to Firebase Crashlytics (Google).
• Connection data: like any web service, our servers record the IP address and time of requests.

3.7 Purchases

If you subscribe, the purchase is made through Google Play or the Apple App Store. We receive from the store, through RevenueCat, your plan, its status, its dates and an identifier for the purchase, and we count how many ReFeels you have used. We never receive your card or bank details.

3.8 When you contact us

If you write to us, we keep your message and our reply.

3.9 What we do not collect

We do not access your contacts, your calendar, your messages, your health data or your phone number, and we do not use advertising identifiers.

4. How AI makes your ReFeel

When you create a ReFeel, our servers (the "Maker") use AI models to:

• read the transcript, the photos and the places of your ReFeel, and find the moments worth telling;
• write the lyrics and compose the music of your song;
• write your story and read it aloud with a narrator voice;
• find the faces in your photos and recognise when the same person appears in several of them, so that each person is framed well in the video. For this the Maker computes a numeric description of each face while your ReFeel is being made; it does not keep those descriptions, only which photos show the same person, as part of the ReFeel's working files TODO Q13 Bruno to confirm that the descriptions are not stored TODO L22;
• animate some of your photos and assemble the video.

Where the AI runs. These models run on servers that we rent from Leaseweb, in data centres in France and the Netherlands, and operate ourselves. Your content is not sent to third-party AI services such as OpenAI, Anthropic or Google, and no AI provider uses it for its own purposes. APP-FIX X18 true once the production Maker cannot reach OpenRouter at all.

What we try to leave out. ReFeel is designed to avoid putting sensitive details that are not needed for the story into the song and the story. AI is not perfect and this cannot be guaranteed.

AI makes mistakes. Songs, stories and videos are generated automatically. They may be inaccurate, mix things up or contain things that were never said.

Training AI models. We do not use your ReFeels, photos or transcripts to train AI models. If that ever changes, we will update this policy and ask for your permission first.

People at ReFeel. Authorised members of our team access an account's data only for three reasons: to give you the support you ask for, to review a report about a ReFeel, and to keep ReFeel and its users secure, including when the law requires it. They do not look at your ReFeels for any other reason. APP-FIX X21 TODO L20

No automated decisions about you. We do not make decisions that have legal or similarly significant effects on you based only on automated processing.

5. People around you

ReFeel records the conversations around you, so it also captures the words and voices of the people you are with. Their words can appear in your transcript and your story, and their face in your photos. Their voices are not kept: the sound is used only to write the text, and it is never sent to us.

• Tell the people with you that ReFeel is on, and pause or stop it if someone does not want to be recorded. In many places the law requires everyone's consent before a conversation is recorded. See our Terms.
• We use what other people say only to make the ReFeel of the person who recorded it.
• Anyone who believes they appear in a ReFeel can write to us at privacy@refeel.it. We will look into it and, where the law gives them that right, delete or restrict the data about them.

TODO L2

6. Why we use your data, and our legal basis

7. Who receives your data

We do not sell your data and we do not share it for advertising. We share it only with the service providers below, who process it on our behalf and on our instructions, under contracts that require them to protect it at least as strictly as this policy does.

We may also disclose data when the law requires it (for example, to a court or a public authority), to protect the rights and safety of our users or of ReFeel, or to a buyer or successor if our business is sold or merged; in that case this policy keeps applying to your data and we will tell you.

Other people see your data only if you share a ReFeel with them (section 3.5).

8. Where your data is stored and international transfers

Your ReFeels are made and stored in the European Union. Our servers and databases are in France (OVH), the servers that run our AI models are in France and the Netherlands (Leaseweb), and our file storage is kept in the EU (Cloudflare R2, EU jurisdiction).

Some providers in section 7 are based in the United States. When data goes outside the European Economic Area, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards at privacy@refeel.it.

9. How long we keep your data

10. Deleting ReFeels and your account

• Delete a ReFeel: open it in your library and choose delete. What happens next is in section 9.
• Delete your account: in the app, go to Settings → Account → Delete account. You can also ask us without the app; see our account deletion page.
• What is deleted: your account, every ReFeel and everything they contain, your places, your devices' registrations and your library, on our servers and on the servers that make ReFeels. Every link to your ReFeels stops working, and they disappear from the libraries of the people you shared them with. APP-FIX X7 the backend still keeps a few records after the account is deleted (a device registry row, purchase notification records, account preferences on the processing servers) and does not yet delete the RevenueCat record. Fix this, or list exactly what is kept here.
• What we keep: invoices and subscription records that the law requires us to keep, for the period in section 9.
• Subscriptions: deleting your account does not cancel a subscription bought through Google Play or the App Store. Cancel it in the store first.

11. Your rights and choices

You have the right to access your data, to correct it, to have it deleted, to restrict or object to its use, to receive the data you gave us in a portable format, and to withdraw your consent at any time. Withdrawing consent does not affect what was done before.

How to use them:

• Stop recording: stop or discard the ReFeel. Recording never runs outside a ReFeel.
• Your consent to ReFeel: untick "I understand and agree" on the card shown before a ReFeel. Without it, ReFeel does not record.
• Location: turn off Settings → Location tracking → Record location during a ReFeel, or remove the permission in your phone's settings.
• Notifications: turn them off in your phone's settings.
• Delete: see section 10.
• Everything else (access, a copy of your data, correction, objection): write to privacy@refeel.it from the email address of your account. We will answer within one month. We may ask you to confirm your identity.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority of the EU country where you live. We would appreciate the chance to fix it first.

12. How we protect your data

• All connections between the app and our servers are encrypted (HTTPS).
• Passwords are stored only as one-way hashes.
• Our databases and processing servers are reachable only from our own private networks, and only staff who need it have access.
• We make regular backups so that your data is not lost.
• On your phone, you can lock the app with a PIN or biometrics and block screenshots (Settings → Privacy & security).

No system is completely secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

13. Age

ReFeel is not for children. You must be at least 16 to use it. We do not knowingly collect data from anyone under that age. If you believe a child has an account, write to privacy@refeel.it and we will delete it.

14. Our website and cookies

The ReFeel website does not use any cookies. The pages where ReFeels are watched do not use cookies for advertising or analytics; at most they use a cookie that is strictly needed to open a protected invitation, for up to a day.

15. Changes to this policy

We will publish any change on this page with a new date. If a change is important, we will tell you in the app or by email at least 30 days before it applies, and we will ask for your consent again where the law requires it.

16. Contact

• Digital Waves Business, S.L.
• Registered office: C/ Bolsa, 10, 4º B, 29015 Málaga, Spain
• Tax ID (NIF): B92896471
• Registered in the Registro Mercantil de Málaga (Commercial Registry of Málaga), hoja MA-95172, tomo 4438, folio 196 (EUID ES29023.000335252)
• Privacy: privacy@refeel.it
• Phone: +34 611 888 436
• Support: support@refeel.it — see our support page