隱私政策（歐盟）

Privacy Policy Summary

Slumber Copilot respects and protects the privacy of all users. This privacy policy explains how we collect, use, store, and protect your personal information when using our website, especially information related to sleep, health, and personal data.

Important Notice: This privacy policy complies fully with the General Data Protection Regulation (GDPR) and EU data protection requirements. Your personal data is protected under GDPR.

1. Data Collection

We collect the following types of personal data:

• Account Information: Name, email address, password hash
• Sleep Records: Sleep time, sleep quality, wake time, and other self-reported sleep data
• Health Data: Insomnia Severity Index (ISI) and Pittsburgh Sleep Quality Index (PSQI) scores
• Personal Information: Age, gender, and self-reported health information
• Technical Data: IP address, browser type, access time, page visit records
• Communication Data: Any messages or inquiries you send us
• Payment Information: VIP subscriptions are processed through Apple App Store (iOS) or Google Play (Android). We do not directly store your payment information; we only retain subscription receipts and status provided by the platform for membership verification.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

• Contract Performance: Processing necessary to provide our services
• Legal Obligation: Processing to comply with applicable laws
• Legitimate Interests: Processing for fraud detection, security, and service improvement
• Consent: Where you have given explicit consent (e.g., for marketing)

3. Data Processing and Use

We use your personal data for the following purposes:

• Providing and improving Slumber Copilot services
• Generating personalized AI sleep coach recommendations
• Conducting data analysis to improve user experience
• Complying with legal obligations
• Detecting and preventing fraud or security issues
• Communicating important service updates or policy changes
• Direct marketing (only if you have opted in)

4. Data Security and Storage

• Storage Location: Your personal data is stored in secure data centers with GDPR compliance
• Encryption: Sensitive data (such as passwords) is encrypted using industry-standard algorithms
• Access Control: Only authorized personnel can access personal data
• Regular Backups: Regular backups ensure data availability and recovery
• Security Monitoring: 24/7 security monitoring to prevent unauthorized access
• Staff Training: All staff handling personal data receive privacy and data security training

5. Your Rights Under GDPR

You have the following rights regarding your personal data under GDPR:

• Right of Access: Right to obtain a copy of your personal data
• Right to Rectification: Right to correct inaccurate personal data
• Right to Erasure: Right to request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Right to restrict processing of your personal data
• Right to Data Portability: Right to receive your personal data in a portable format
• Right to Object: Right to object to processing, including for direct marketing
• Rights Related to Automated Processing: Right not to be subject to automated decision-making
• Right to Lodge a Complaint: Right to lodge a complaint with your local supervisory authority

Exercising Your Rights: To exercise any of these rights, please contact us at [email protected] with your request and verification information.

6. Data Sharing and Third Parties

• We do not sell your personal data to third parties
• We do not share personal data with third parties without your explicit consent
• We may share data with limited service providers (such as cloud storage providers) who are bound by strict confidentiality agreements and GDPR requirements
• We may be required to disclose personal data if legally required by competent authorities

Third-Party AI Service Providers: The AI sleep coaching and dream analysis features of this App use Moonshot AI and Alibaba Qwen as analysis engines. All personally identifiable information (name, email, user ID) is removed before transmission. Data is not used for advertising targeting or user profiling.

7. Data Retention

• Active Account: While your account is active, we retain all personal data
• Account Deletion: When you request account deletion, we delete all personal data within 30 days
• Legal Retention: We may retain certain data longer if required by law
• Anonymized Data: Aggregated statistical data (fully anonymized) may be retained indefinitely

8. International Data Transfers

If we transfer your personal data outside the EU/EEA, we ensure appropriate safeguards under GDPR, including Standard Contractual Clauses or other approved mechanisms.

9. Data Breach Notification

If we discover that your personal data has been unlawfully accessed or breached, we will notify you and the relevant supervisory authority as required by GDPR within 72 hours of discovery.

10. Data Protection Officer

We have appointed a Data Protection Officer to oversee our GDPR compliance. For data protection inquiries, you may contact our DPO.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve user experience and analyze website usage. You can control cookies through your browser settings. Refusing cookies may affect certain features.

12. Children's Privacy Protection

This service is not directed at individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will delete it immediately.

13. Policy Updates

We may update this privacy policy as needed. Updates will be posted on this page with an updated "Last Modified Date". Your continued use of our service constitutes acceptance of the updated privacy policy.