Resulty

Privacy Policy

Effective date: April 23, 2026 | Company: UnderLimitSoft

1. Data Controller

The data controller responsible for the processing of your personal data is:

Company name: UnderLimitSoft
Email: [email protected]
Data Protection Officer (DPO): [email protected]

This Privacy Policy explains how UnderLimitSoft collects, uses, stores, and protects your personal data when you use the Resulty mobile application and related services. It complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable EU data protection laws.

2. Data We Collect

We collect the following categories of personal data:

Category	Data points	Source
Identity data	First name, last name (if provided via OAuth), profile picture (optional)	You / OAuth provider
Contact data	Email address	You / OAuth provider
Goal and coaching data	Goals you set, progress updates, reflections, AI coaching conversations	You (entered in the app)
Usage data	App interactions, feature usage, session timestamps, crash reports, device type and OS version	Automatically collected
Payment data	Subscription status, transaction ID (we do not store full payment card data)	App store platform
Technical data	IP address (for security/fraud prevention), app version, locale/language settings	Automatically collected

We do not collect sensitive categories of data (special category data under GDPR Art. 9) unless you voluntarily include such information in the content of your goals or coaching conversations.

3. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the Resulty Service you have signed up for, including your account, goals, and AI coaching features.
Legitimate interests (Art. 6(1)(f)): Improving the Service, ensuring security, preventing fraud, and conducting analytics to understand how users engage with the app, provided such interests are not overridden by your rights and freedoms.
Legal obligation (Art. 6(1)(c)): Compliance with applicable laws, including financial record-keeping and responding to lawful requests from authorities.
Consent (Art. 6(1)(a)): Where we rely on consent (e.g., for optional marketing communications), you may withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.

4. How We Use Your Data

We use your personal data for the following purposes:

Creating and managing your account.
Providing AI coaching features, including sending your goals and session data to the AI model to generate personalised responses.
Processing subscription payments and managing billing.
Sending transactional communications (e.g., account confirmations, subscription receipts).
Improving and debugging the app through usage analytics and crash reports.
Detecting and preventing fraudulent or abusive activity.
Complying with legal and regulatory obligations.

5. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Policy:

Account and goal data: Retained for the duration of your account. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.
Billing records: Retained for 7 years in accordance with applicable EU financial and tax regulations.
Usage and analytics data: Retained in aggregated or anonymised form for up to 2 years.
Technical logs (IP addresses, security logs): Retained for up to 90 days.

After the applicable retention period, data is securely deleted or anonymised.

6. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

Right of access (Art. 15): You can request a copy of the personal data we hold about you.
Right to rectification (Art. 16): You can request that we correct inaccurate or incomplete personal data.
Right to erasure / "right to be forgotten" (Art. 17): You can request the deletion of your personal data, subject to applicable legal obligations.
Right to restriction of processing (Art. 18): You can request that we restrict the processing of your data in certain circumstances.
Right to data portability (Art. 20): You can request your personal data in a structured, commonly used, machine-readable format.
Right to object (Art. 21): You can object to the processing of your data based on legitimate interests or for direct marketing purposes.
Rights related to automated decision-making (Art. 22): You have the right not to be subject to a decision based solely on automated processing that significantly affects you.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection supervisory authority.

7. Third-Party Services and Data Sharing

We share your data with the following third parties only to the extent necessary to provide the Service:

Third party	Purpose	Data shared
Google LLC (Google OAuth)	Authentication	Email, name, profile picture (as authorised by you)
Apple Inc. (Sign in with Apple)	Authentication	Email (real or private relay), name
OpenRouter AI	AI coaching responses	Goal content and coaching session data (no direct identifiers sent)
Apple App Store / Google Play	Payment processing and subscription management	Transaction IDs, subscription status
Cloud infrastructure provider	Hosting and data storage	All data (processed under Data Processing Agreement)

We do not sell your personal data to third parties. We do not share your data with advertising networks for targeted advertising purposes.

When data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

8. Cookies and Tracking

Resulty is a mobile application and does not use traditional browser cookies. However, we may use the following tracking technologies within the app:

Device identifiers: Used for analytics and crash reporting to understand app performance.
Session tokens: Used to maintain your authenticated session securely.
Analytics SDKs: If integrated, used to collect anonymised usage statistics. No personally identifiable information is shared with analytics providers.

You can opt out of analytics data collection via the app settings. Opting out will not affect the core functionality of the Service.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

Encryption of data in transit (TLS/HTTPS) and at rest.
Access controls limiting data access to authorised personnel only.
Regular security assessments and monitoring.
Secure handling of authentication tokens.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify you directly.

10. Children's Privacy

Resulty is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete that information as quickly as possible.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you via the app or by email before the changes take effect. The revised Policy will be identified by an updated "Effective date".

Your continued use of the Service after the effective date of the updated Policy constitutes your acceptance of the changes.

12. Contact and DPO Information

For any questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact:

General privacy enquiries: [email protected]
Data Protection Officer: [email protected]
Company: UnderLimitSoft

You have the right to lodge a complaint with the data protection supervisory authority in your EU member state. A list of EU supervisory authorities is available at https://edpb.europa.eu.