Privacy Policy

The entity responsible for the processing of your personal data (the "Data Controller") is:

If you have any questions regarding the processing of your personal data, please contact us at the address above.

This Privacy Policy applies to all personal data collected and processed through:

• —Our website at trendventures.de
• —Our mobile application AURA AI: Texting Assistant
• —Our mobile application SaveMate
• —Our mobile application Holy AI
• —Our mobile application AbsUp
• —Our mobile application Zappy AI
• —Our mobile application Impact AI
• —Any communication you send to us via e-mail, support tickets, or other channels

This policy does not apply to the data practices of third-party services that our applications may link to or integrate with. We encourage you to review the privacy policies of any third-party services you use.

3.1 Data You Provide Directly

• —Account information: Name, e-mail address, and password when you create an account
• —Profile data: Optional profile picture, display name, and preferences you set within the app
• —Payment information: We do not store payment card data directly. All payment data is handled by Apple's In-App Purchase system and RevenueCat. We receive only non-sensitive purchase confirmation data
• —Support communications: Any information you provide when contacting our support team
• —User-generated content: Text inputs, prompts, or other content you create within our applications

3.2 Data Collected Automatically

• —Device information: Device model, operating system and version, unique device identifiers (IDFV)
• —Usage data: Features used, session duration, frequency of use, in-app navigation patterns
• —Log data: IP address, access timestamps, error logs, crash reports
• —Performance data: App launch time, response times, and other technical performance metrics

3.3 App-Specific Data

We use the data we collect for the following purposes:

• —Service provision: To operate, maintain, and deliver the features of our applications to you
• —Account management: To create and manage your user account and authenticate your identity
• —AI response generation: To process your inputs and generate AI-powered responses using large language models
• —Personalization: To remember your preferences and tailor the experience to your usage patterns
• —Subscription management: To process and manage your in-app subscriptions and purchases
• —Customer support: To respond to your inquiries, troubleshoot issues, and provide technical assistance
• —Safety & security: To detect, prevent, and address fraud, abuse, and security incidents
• —Product improvement: To analyze usage patterns (in aggregated or anonymized form) and improve our applications
• —Legal compliance: To comply with applicable laws, regulations, and legal processes
• —Communication: To send you important service-related announcements and, with your consent, promotional communications

We do not sell your personal data to third parties. We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human oversight.

Under the GDPR, we are required to identify a legal basis for each processing activity. The legal bases we rely on are:

For the processing of special categories of personal data (such as data reflecting religious beliefs within Holy AI), we rely on your explicit consent (Art. 9(2)(a) GDPR). You may withdraw this consent at any time.

Our AI-powered applications (AURA AI, Holy AI, Zappy AI, and Impact AI) process your text inputs to generate AI responses. The following applies to all AI-powered features:

6.1 Input Transmission

Text prompts you submit are transmitted securely to AI model providers (which may include OpenAI, Anthropic, or similar services) for processing. These providers act as data processors on our behalf under data processing agreements compliant with GDPR Art. 28.

6.2 Conversation History

Depending on the application, conversation history may be stored locally on your device or in our cloud infrastructure to enable continuity of conversations across sessions. You may delete your conversation history at any time through the application's settings.

6.3 Model Training

We do not use your personal inputs to train our own AI models. However, third-party AI providers may have their own policies regarding model training. We configure our integrations to opt out of training where available and contractually prohibit our processors from using your data for their own model training.

6.4 Holy AI — Sensitive Data

Inputs submitted to Holy AI may reflect your religious beliefs, which constitute special category data under Art. 9 GDPR. We apply additional safeguards to this data, including encryption at rest and in transit, and strictly limited access controls.

We use RevenueCat to manage in-app subscriptions across our applications. RevenueCat processes purchase data on our behalf and provides us with subscription status, entitlement management, and analytics about subscription performance.

Data shared with RevenueCat includes: your Apple anonymized subscriber ID, subscription tier and status, purchase timestamps, and app identifiers. RevenueCat does not receive your payment card details — these remain with Apple.

RevenueCat acts as a data processor under our data processing agreement. For more information about RevenueCat's data practices, please review their privacy policy at revenuecat.com/privacy.

Apple processes payment transactions through its In-App Purchase infrastructure. Payment data is subject to Apple's Privacy Policy, available at apple.com/legal/privacy.

We use analytics and crash reporting tools to understand how our applications are used and to identify technical issues. These tools may collect:

• —Device type, model, and operating system version
• —App version and build number
• —Session duration and screen views
• —Feature interaction events (e.g., button taps, feature usage counts)
• —Stack traces and error logs in the event of a crash

Analytics data is collected in aggregated or pseudonymized form. We do not use analytics to build individual behavioral profiles for advertising purposes. Where required by law or our legitimate interest assessment, analytics are only enabled after you have given consent (e.g., via an opt-in prompt at first launch).

We engage the following categories of third-party service providers who may process your personal data on our behalf:

All third-party processors are bound by data processing agreements that require them to process your data only on our instructions and in compliance with applicable data protection law.

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by applicable law:

• —Account data: Retained for the duration of your account. Upon account deletion, account data is deleted within 30 days, except where retention is required by law
• —AI conversation history: Retained for the duration of your account or until you delete it manually via the app settings
• —Usage & analytics data: Retained in aggregated form for up to 24 months
• —Crash logs & error reports: Retained for up to 90 days
• —Purchase records: Retained for 10 years to comply with German commercial and tax law (§ 147 AO, § 257 HGB)
• —Support communications: Retained for up to 3 years after the last contact
• —SaveMate financial data: Retained for the duration of your account; deleted within 30 days of account deletion

Some of our service providers are located outside the European Economic Area (EEA), including in the United States. When we transfer your personal data outside the EEA, we ensure an adequate level of protection by relying on one or more of the following mechanisms:

• —Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR
• —Adequacy decisions issued by the European Commission for the recipient country
• —Binding Corporate Rules (BCRs) of the recipient organization

You may request a copy of the safeguards applicable to a specific international transfer by contacting us at privacy@trendventures.de.

Our services are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us immediately at privacy@trendventures.de.

If we discover that we have collected personal data from a child under 13, we will take steps to delete that information as quickly as possible.

Certain applications, particularly Holy AI and AbsUp, may be used by minors aged 13–17. In such cases, we recommend parental guidance and rely on parental consent where required by applicable law (e.g., Art. 8 GDPR for consent-based processing).

As a data subject under the GDPR, you have the following rights with respect to your personal data:

To exercise any of these rights, please contact us at privacy@trendventures.de. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

Our website (trendventures.de) uses cookies and similar tracking technologies. Our mobile applications do not use browser cookies but may use equivalent mobile identifiers (such as IDFV) as described in Section 3.

14.1 Types of Cookies

• —Strictly necessary cookies: Required for the website to function correctly. No consent is needed for these.
• —Analytics cookies: Help us understand how visitors use our website. Only set with your consent.
• —Preference cookies: Remember your settings and preferences. Only set with your consent.

14.2 Managing Cookies

You can control and manage cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. You can also opt out of analytics tracking via our cookie consent banner.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. These measures include:

• —Encryption of data in transit using TLS 1.2 or higher
• —Encryption of data at rest using industry-standard algorithms
• —Access controls limiting employee access to personal data on a need-to-know basis
• —Regular security assessments and vulnerability testing
• —Secure software development lifecycle (SDLC) practices
• —Incident response procedures for detecting and responding to data breaches

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Art. 34 GDPR. We will also notify the competent supervisory authority within 72 hours of becoming aware of the breach, as required by Art. 33 GDPR.

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or our services. We will notify you of material changes by updating the "Effective date" at the top of this page and, where appropriate, by sending an in-app notification.

We encourage you to review this Privacy Policy periodically. Your continued use of our applications after any changes constitutes your acknowledgment of the updated policy. If changes are material and require your re-consent, we will present a consent prompt within the relevant application.

For any privacy-related questions, data subject rights requests, or concerns, please contact us:

You also have the right to lodge a complaint with your local supervisory authority. In Germany, you can find your competent state data protection authority via the Federal Commissioner for Data Protection and Freedom of Information (BfDI).