PRIVACY POLICY

Last updated July 5, 2026

This Privacy Notice for Batuhan Bayır (doing business as Pixo) ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Download and use our mobile application (Pixo), or any other application of ours that links to this Privacy Notice
• Use Pixo. Pixo is a mobile application designed to help users build and maintain daily routines and healthy habits. Key features include an AI-powered coach ("Pixo") for real-time conversation and routine planning, a personalized daily routine screen with events, tasks, and reminders, habit trackers (such as sleep, water, nutrition, movement, and mood), AI-assisted meal photo analysis, voice input, progress analytics, and achievements. The application is available on iOS and Android and may offer subscription-based access to its features.
• Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at pixo.helpdesk@gmail.com.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by using the table of contents below to find the section you are looking for.

• What personal information do we process? When you use our Services, we process account information (such as your name and email address), your onboarding answers (including health-related details such as age range, gender, height, and weight), the content you create in the app (chat messages with the AI coach, tracker entries, tasks, routines, photos, and voice input), and technical data needed to run the app.
• Do we process any sensitive personal information? Yes. Because Pixo is a wellness and routine-coaching app, some of the information you choose to share with us is health-related (for example your height, weight, mood, sleep, nutrition, and activity). We process this information only with your consent and only to provide the coaching features of the app. We never sell it and never use it for advertising.
• Do we collect any information from third parties? We do not collect information from data brokers or advertising networks. If you sign in with Google or Apple, we receive basic profile information (name and email) from that provider.
• How do we process your information? To provide and personalize the AI coaching experience, operate your trackers and routines, send you reminders and notifications you enable, manage your subscription, keep the Services secure, and comply with law.
• In what situations and with which parties do we share personal information? Only with the service providers needed to run the app — our cloud infrastructure (Google Firebase / Google Cloud) and the named AI providers listed in Section 5 — and in specific legal situations such as business transfers. We do not sell or rent your personal information to anyone.
• How do we keep your information safe? Your data is encrypted in transit and at rest, protected by per-user security rules, and accessible only to your authenticated account. See Section 9.
• What are your rights? Depending on where you are located, you may have rights to access, correct, or delete your personal information. You can delete your account and all associated data at any time directly in the app.
• How do you exercise your rights? The easiest way is in the app (Profile → Settings → Delete Account) or by emailing us at pixo.helpdesk@gmail.com.

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the features you use. The personal information we collect may include the following:

• Account information — your name (or display name), email address, and authentication credentials. If you use email/password sign-in, your password is handled and stored by Firebase Authentication; we never see or store your plain-text password.
• Onboarding profile — when you first set up Pixo, we ask a short series of questions so the AI coach can personalize your experience. These may include your age range, gender, height, weight, your goals (for example "Feel healthier" or "Be more productive"), the challenges you face, your preferred coaching style, how intensively you want to track habits, and how you define success. You may skip questions you do not wish to answer.
• Chat content — the messages you exchange with the Pixo AI coach, including any files or photos you attach to a conversation.
• Tracker and routine data — the habits and metrics you choose to track (such as sleep, water intake, nutrition, movement, and mood), tracker history and snapshots, your daily routines, events, tasks, reminders, and achievements.
• Photos — photos you voluntarily attach in chat, including meal photos you submit for AI-assisted nutrition analysis. Photos are only collected when you actively select or capture them; we never access your photo library in the background.
• Voice input — if you use the voice input feature, your audio recording is sent for transcription and converted to text. See Section 6 for details on how audio is handled.
• AI coach memory — to act as a consistent coach, Pixo maintains a memory of your conversations: a core memory (stable facts you have shared, such as your goals and preferences), episodic memories (summaries of notable past interactions), and short-term context. This memory is derived from what you tell the coach and is stored in your private account space.
• Push notification tokens — if you enable notifications, we store the device token needed to deliver reminders and coaching notifications to your device.
• Support communications — if you contact us by email, we receive your email address and the contents of your message.

Sensitive Information

In Short: With your consent, we process a limited amount of health-related information that you choose to share, solely to provide the app's coaching features.

Because Pixo is a wellness and routine-coaching application, some of the information described above is health-related and may be considered sensitive personal information under certain laws. Specifically, and only when you choose to provide it, we may process:

• Your height, weight, age range, and gender from onboarding, used to personalize coaching and nutrition estimates;
• Wellness metrics you log or discuss with the coach, such as sleep, water intake, nutrition, physical activity, and mood;
• Meal photos you submit for nutrition analysis;
• Health-related topics you voluntarily raise in conversation with the AI coach.

We process this information only with your consent and only for the purpose of providing the Services to you — personalizing your coaching, your routines, and your tracker insights. We do not use health-related information for advertising, we do not sell it, we do not share it with data brokers, and we do not disclose it to third parties except the infrastructure and AI providers listed in Sections 4 and 5, strictly as needed to deliver the features you use. You can decline to provide any of this information, and you can delete all of it at any time by deleting your account (see Section 17). Pixo is not a medical device and does not provide medical advice, diagnosis, or treatment.

Payment Data

If you purchase a subscription, the payment is processed entirely by Apple (App Store) or Google (Google Play). We never receive or store your payment card number or full billing details. Our subscription-management provider, RevenueCat, provides us with an anonymized record of your subscription status (such as whether your subscription is active and when it renews) linked to your account identifier. You can find RevenueCat's privacy notice here.

Social Media Login Data

We provide you with the option to register with us using your existing Google or Apple account. If you choose to do this, we will receive certain profile information about you from the provider — typically your name and email address. With Sign in with Apple, you may choose to hide your email address, in which case we receive only a private relay address. We use the information we receive only for the purposes described in this Privacy Notice. We recommend that you review the provider's privacy notice to understand how they collect, use, and share your personal information.

Information automatically collected

In Short: Some information — such as device characteristics and basic diagnostic data — is collected automatically when you use our Services.

We automatically collect certain information when you use the Services. This information does not reveal your specific identity but may include device and usage information, such as your device model, operating system and version, app version, language preferences, crash logs, and diagnostic information. This information is primarily needed to maintain the security and operation of our Services, to troubleshoot problems, and for our internal analytics. This data is collected through Google Firebase services. We do not use third-party advertising SDKs and we do not track you across other companies' apps or websites.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We process your information so you can create and log in to your account, and keep it in working order.
• To deliver the AI coaching experience. Your chat messages, onboarding profile, coach memory, and relevant tracker context are processed by our AI providers (see Section 5) to generate the coach's responses, plan your routines, and provide personalized suggestions.
• To operate your trackers, routines, tasks, and reminders. We store and process the data you log so the app can show your history, progress analytics, and achievements.
• To analyze meal photos. When you submit a meal photo, it is processed by our AI provider to estimate the nutritional content and log it to your nutrition tracker.
• To transcribe voice input. When you use voice input, your audio is transcribed to text so it can be used as a chat message.
• To send you reminders and notifications. If you enable notifications, we process your device token and routine/tracker data to send you the reminders and proactive coaching nudges you have opted into. You can turn these off at any time in your device settings.
• To manage your subscription. We process subscription status information to determine your access to paid features, and to handle purchases and restores.
• To respond to user inquiries and offer support. We process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and abuse prevention.
• To comply with our legal obligations. We may process your information to comply with law, respond to legal requests, and exercise, establish, or defend our legal rights.

We do not process your information to show you third-party advertising, and we do not sell your personal information.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law — with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU, UK, or a jurisdiction with similar requirements

The General Data Protection Regulation (GDPR), UK GDPR, and similar laws require us to explain the valid legal bases we rely on to process your personal information. As such, we may rely on the following legal bases:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. This is the basis we rely on for all health-related information described in Section 1, for optional features such as voice input and meal photo analysis, and for push notifications. You can withdraw your consent at any time — for example by not using a feature, disabling notifications, or deleting your account.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing the core features of the app and managing your account and subscription.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms — for example, diagnosing problems with the app, preventing fraud and abuse, and improving the reliability of the Services.
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time. In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example: if collection is clearly in the interests of an individual and consent cannot be obtained in a timely way; for investigations and fraud detection and prevention; if it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim; if disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records; or if the information is publicly available and is specified by the regulations.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information only with the vendors and service providers needed to run the app, and in specific legal situations. We never sell your personal information.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.

The third parties we may share personal information with are as follows:

Provider	Purpose	Data involved
Google Firebase / Google Cloud (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging)	Core infrastructure: account authentication, database, file storage, backend processing, and push notification delivery. Data is stored in Google Cloud's us-central1 (United States) region.	Account information, onboarding profile, chat content, coach memory, trackers, routines, tasks, photos, notification tokens, diagnostic data
Google Cloud Vertex AI	AI processing for the coach (see Section 5)	Chat messages, relevant profile/memory/tracker context, meal photos submitted for analysis
Groq	Voice-to-text transcription (see Section 5)	Voice recordings you submit via the voice input feature
Tavily	Web search used by the coach to find up-to-date suggestions (see Section 5)	Search queries derived from your request (not your identity)
RevenueCat	Subscription management and entitlement checks	Account identifier, purchase and subscription status (no payment card details)
Apple / Google	Payment processing (App Store / Google Play) and optional sign-in (Sign in with Apple / Google Sign-In)	Handled under Apple's and Google's own privacy policies

We also may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Legal Obligations. We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process.

We do not share your personal information with advertisers, ad networks, or data brokers, and we do not sell or rent it to anyone.

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: Yes — the Pixo coach is powered by third-party AI models. Here is exactly which providers we use, what they receive, and what they are not allowed to do with your data.

We offer products, features, and tools powered by artificial intelligence, machine learning, and similar technologies (collectively, "AI Products"). These are the core of the Pixo experience: the conversational coach, routine planning, proactive suggestions, meal photo analysis, and voice input.

Our AI service providers

We provide the AI Products through the following third-party service providers. Your input is shared with these providers only to the extent necessary to deliver the feature you are using at that moment:

AI provider	Model(s)	Used for
Google Cloud Vertex AI	Gemini 2.5 Flash, Gemini 2.5 Flash-Lite	The Pixo coach's conversations, routine and task planning, proactive coaching suggestions, and meal photo nutrition analysis
Groq	Whisper Large v3 Turbo	Transcribing your voice input to text
Tavily	Web search API	Searching the web when the coach needs current information for a suggestion (for example, finding a workout video)

What our AI providers receive — and what they may not do

• When you chat with the coach, your message, the recent conversation, and the relevant parts of your profile, coach memory, and tracker data are sent to Google Cloud Vertex AI to generate a response. All AI processing takes place in Google Cloud's us-central1 region. Under Google Cloud's terms, customer data submitted to Vertex AI is not used to train Google's models.
• When you use voice input, your audio recording is sent to Groq solely for transcription. The resulting text becomes your chat message; we do not retain the raw audio on our servers after transcription.
• When the coach searches the web, only the search query is sent to Tavily — never your name, email, or account identifier.
• All information processed through our AI Products is handled in line with this Privacy Notice and our agreements with these providers, which prohibit them from using your personal information for their own purposes, including model training on their own behalf.

AI-generated coaching content can be inaccurate or incomplete. Pixo's suggestions are for general wellness and productivity purposes only and are not medical, psychological, nutritional, or other professional advice.

6. HOW DO WE HANDLE YOUR CHATS, PHOTOS, AND VOICE INPUT?

In Short: Your content stays in your private account space, is used only to power your own coaching experience, and is deleted when you delete your account.

• Chats. Your conversations with the coach are stored in your private account space so that you can revisit them and so the coach can remember context across sessions. We do not read your conversations except where necessary to investigate abuse, comply with law, or debug a problem at your request.
• Coach memory. The coach's memory (core memory, episodic memories, and short-term context) is generated from your conversations and stored in your account. It exists solely to make your own coach more helpful; it is never shared with other users and never used to train AI models.
• Photos. Photos you attach in chat (including meal photos) are uploaded to your private storage space at a path tied to your account, and are accessible only by your authenticated account. Meal photos are sent to our AI provider once for analysis when you submit them.
• Voice input. Audio is recorded only while you actively use the voice input feature, sent for transcription as described in Section 5, and not retained on our servers as audio. The microphone is never accessed in the background.
• Deletion. All of the above — chats, memory, photos, trackers, and every other piece of your content — is permanently deleted when you delete your account (see Section 17).

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We store and process your information on servers located in the United States.

Our Services are hosted on Google Cloud infrastructure located in the us-central1 (Iowa, United States) region. If you access our Services from outside the United States, please be aware that your information is transferred to, stored, and processed by us and our service providers in the United States and possibly other countries. If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. Our service providers — including Google, Groq, Tavily, and RevenueCat — rely on recognized transfer mechanisms, such as the European Commission's Standard Contractual Clauses and/or participation in the EU-U.S. Data Privacy Framework, to protect personal information transferred internationally. We will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as you have an account with us, unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). In practice, this means your data is retained for as long as your account exists.

When you delete your account, we permanently and irreversibly delete your entire account record — including your profile, onboarding answers, chats, coach memory, trackers, routines, tasks, achievements, and all uploaded files (photos and attachments) — from our database and file storage. Residual copies in encrypted backups, if any, expire on the backup provider's standard rotation schedule. Anonymized subscription records may be retained by RevenueCat and Apple/Google as required for financial reporting.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process, including:

• All data is encrypted in transit (TLS) and at rest on Google Cloud infrastructure;
• Per-user security rules ensure that your data can only be read or written by your own authenticated account;
• Backend functions require a signed-in, authenticated user and validate the caller's identity before processing;
• API keys and secrets are stored in a managed secret store, never in the app itself;
• Passwords are handled entirely by Firebase Authentication using industry-standard hashing; we never store plain-text passwords;
• Access to production systems is limited to the developer and protected by multi-factor authentication.

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at pixo.helpdesk@gmail.com.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us using the contact details provided below, by disabling the relevant feature (for example, turning off notifications in your device settings or simply not using voice input or photo analysis), or by deleting your account. However, please note that this will not affect the lawfulness of the processing before its withdrawal.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Open the app and go to Profile → Settings to update your details;
• Use Profile → Settings → Delete Account to permanently delete your account and all associated data;
• Or contact us at pixo.helpdesk@gmail.com.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases as described in Section 8.

If you have questions or comments about your privacy rights, you may email us at pixo.helpdesk@gmail.com.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice. Note that Pixo does not track you across third-party apps or websites in any case.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of a US state with a comprehensive consumer privacy law (such as California, Colorado, Connecticut, Texas, or Virginia), you may have specific rights regarding your personal information, including the right to access, correct, and delete your data.

Categories of Personal Information We Collect

We have collected the following categories of personal information in the past twelve (12) months:

Category	Examples	Collected
A. Identifiers	Name, email address, account ID	YES
B. Personal information as defined in the California Customer Records statute	Name, contact information	YES
C. Protected classification characteristics under state or federal law	Gender, age range (provided voluntarily during onboarding)	YES
D. Commercial information	Subscription status and purchase history (via RevenueCat/Apple/Google)	YES
E. Biometric information	Fingerprints and voiceprints	NO
F. Internet or other similar network activity	In-app interactions, crash and diagnostic data	YES
G. Geolocation data	Precise device location	NO
H. Audio, electronic, sensory, or similar information	Voice recordings you submit for transcription; photos you attach	YES
I. Professional or employment-related information	Job title, work history	NO
J. Education information	Student records	NO
K. Inferences drawn from collected personal information	Coach memory and personalization derived from your conversations and trackers	YES
L. Sensitive personal information	Health-related data you voluntarily provide (height, weight, mood, sleep, nutrition, activity)	YES

We collect this information only through your direct interactions with the app, as described in Section 1. We will use and retain the collected personal information as needed to provide the Services and as described in Section 8.

Sensitive personal information. We process sensitive personal information (health-related data) only for the purpose of providing the Services you request, with your consent. We do not use or disclose sensitive personal information for purposes other than providing the Services, and we do not use it to infer characteristics about you for advertising.

Sale and sharing. We have not sold or shared (for cross-context behavioral advertising) any personal information in the preceding twelve (12) months, and we do not sell or share personal information. We do not use or disclose personal information for targeted advertising.

Your Rights

You may have certain rights under applicable US state privacy laws, subject to certain limits. These rights include:

• Right to know whether or not we are processing your personal data and to access such data;
• Right to correct inaccuracies in your personal data;
• Right to delete your personal data;
• Right to obtain a copy of the personal data you previously shared with us (data portability);
• Right to non-discrimination for exercising your rights;
• Right to opt out of the sale of personal data, sharing for targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in any of these practices).

To exercise these rights, you can delete your account directly in the app (Profile → Settings → Delete Account) or contact us by email at pixo.helpdesk@gmail.com. We will honor your request as required by applicable law. If your request is denied, you may appeal our decision by replying to our response email.

14. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: You may have additional rights based on the country you reside in.

Turkey (KVKK)

If you are located in Turkey, we process your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK"). As the data controller, we process your data on the legal grounds of explicit consent (for health-related data and optional features) and the necessity of processing for the performance of a contract. Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed, request information about the processing, learn the purpose of processing, know the third parties to whom your data is transferred, request correction or deletion, and object to results that arise against you through automated analysis. You may exercise these rights by contacting us at pixo.helpdesk@gmail.com or at the postal address in Section 16.

Australia and New Zealand

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020 (Privacy Act). The main purposes for which we collect, use, and disclose your personal information are described in this Privacy Notice. If you do not wish to provide the personal information necessary to fulfill their applicable purpose, it may affect our ability to provide our Services. At any time, you have the right to request access to or correction of your personal information by contacting us as described in Section 17. If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner and a breach of New Zealand's Privacy Principles to the Office of New Zealand Privacy Commissioner.

Republic of South Africa

At any time, you have the right to request access to or correction of your personal information by contacting us as described in Section 17. If you are unsatisfied with the manner in which we address any complaint with regard to our processing of personal information, you can contact the office of the regulator: The Information Regulator (South Africa), General enquiries: enquiries@inforegulator.org.za, Complaints: PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za.

15. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at pixo.helpdesk@gmail.com or contact us by post at:

Batuhan Bayır
Dumlupınar Mh. Ilıca Sk. Demir Çağla Apt. No:2/6
Nilüfer / Bursa 16285
Turkey

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

The fastest way to delete your data: open the app and go to Profile → Settings → Delete Account. This immediately and permanently deletes your account together with all associated data — profile, onboarding answers, chats, coach memory, trackers, routines, tasks, achievements, and every uploaded photo and attachment — from our database and file storage.

To request to review, update, or delete your personal information, you can also contact us at pixo.helpdesk@gmail.com. We will act upon your request in accordance with applicable data protection laws.