Privacy Policy

Effective date: 1 October 2026 (section 7 automated age check: 26 September 2026 for accounts created from that day, 26 October 2026 for existing accounts; section 12 age rules: 25 September / 25 October 2026) · Version 2.8

This policy tells you what personal data we process when you use APERTURESyndicate, why we process it, what legal basis we rely on, who else sees it, how long we keep it, and what you can do about it. It is the information notice required by Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").

We have tried to write it so that you can actually read it. Where another document is the authoritative source — retention periods, the list of sub-processors — we link to it rather than repeat it, because duplicated facts drift apart.

We write these documents in good faith and keep them accurate to how the platform actually works. They have not yet been reviewed by qualified Estonian legal counsel.

---

1. Who is responsible for your data

The data controller is:

APERTURESyndicate OÜ Registry code 17384111 · VAT EE102972654 Priisle tee 8, Lasnamäe linnaosa, Tallinn, Harju maakond, 13914, Estonia Company Registration & Imprint

Contact for anything privacy-related: [email protected] — use the subject line "GDPR request". We accept requests in English or Estonian.

We have not appointed a Data Protection Officer. Article 37(1) GDPR requires one only where the controller is a public authority, where the core activity consists of regular and systematic monitoring of data subjects on a large scale, or where the core activity is large-scale processing of special-category or criminal-offence data. None of those apply to us: we are a micro enterprise, we do not carry out large-scale monitoring, and we do not build our business on special-category data. Privacy requests therefore go to the address above and are handled by the company directly. If that changes, we will appoint a DPO and publish the contact here.

2. What we process, why, and on what basis

This is the core of the notice. The retention column is drawn from the same source as our Data Retention Schedule — that document is authoritative and has the detail, including exceptions and legal holds. The recipients column gives categories; the providers are listed in Data Processing & Sub-processors.

Category	What it includes	Why we process it	Legal basis (Art. 6)	How long	Who else sees it
Account	Email address, nickname, internal account identifier, display name, avatar and banner, bio, links, language and theme settings, badges, follows	To create and run your account, show you to other users the way you chose, and let you use the products	Contract — Art. 6(1)(b)	While the account exists, then purged after ~30 days	EU hosting provider; CDN/edge provider
Authentication & security	Password hash, two-factor (TOTP) secret in encrypted form, sessions and refresh tokens, sign-in events, IP addresses, user agent, rate-limit and abuse signals	To sign you in, keep sessions valid, detect and stop account takeover, brute force, spam and denial-of-service	Contract — Art. 6(1)(b) for sign-in; legitimate interests — Art. 6(1)(f) for security and anti-abuse, our interest being to keep accounts and the platform safe	Server logs and IP addresses 30 days; sessions until they expire or you sign out	EU hosting provider; CDN/edge and security provider
Payments	Subscription and plan records, invoices, payment status, billing country, VAT treatment, partial card metadata returned by the processor	To take payment, run subscriptions, issue invoices, handle refunds and meet accounting and tax duties	Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) for accounting records	Invoices and accounting records 7 years, as Estonian accounting law requires	Payment processor (Stripe); for purchases inside our iOS and Android apps, Apple or Google, which take the payment as the seller; our accountant and the tax authority where required
Content you create	Posts, profile content, uploaded images and audio, support requests and attachments, AI prompts and conversations, datasets, listening activity in Resonance	To store, deliver and display what you create to the audience you chose, and to provide the product features you use	Contract — Art. 6(1)(b); consent — Art. 6(1)(a) where a feature is optional and you switch it on (for example AI training on your content)	Until you delete it or close your account; then soft-deleted and purged	EU hosting and object storage; AI providers — our own servers and, in quiet hours, Together AI for our ASAI Mini and ASAI Arc models, and Anthropic and OpenAI for their models — only for the content you send to an AI feature; CDN for public media
Technical telemetry	Error reports and stack traces, performance timings, aggregate usage counters, device and browser type	To find and fix faults, keep the service stable and understand which features are used	Legitimate interests — Art. 6(1)(f), our interest being a service that works	Raw events ~30 days; aggregates longer, in non-identifying form	No one outside our EU hosting
Product analytics (ASAI)	Under a random number instead of your name: the screens you open, the buttons you press, errors and failed requests, sign-in method, platform, app version and where you first came from (for example an advertising link); for ASAI conversations — that a message was sent, how long it was and how the model answered, not the text. A member of our team may also read a conversation of a person who left the app, to understand why: for accounts that accepted the ASAI terms on 23 October 2026 or later — from the moment they accepted, for others — messages from 8 November 2026; if you yourself allowed our team to see your chats — all your chats until you withdraw that permission (consent — Art. 6(1)(a)) — see Trust & Safety, Section 3.5	To see where people get stuck, what fails and why they leave, and fix it	Legitimate interests — Art. 6(1)(f), our interest being a product that works for the people who try it. You can object at any time with one switch in ASAI Settings → Privacy	Raw events ~30 days; erased with your account	No one outside our EU hosting
Connected accounts and devices	Identifiers, names and tokens of accounts you sign in with or link — Google, Apple, GitHub, Discord, ListenBrainz, ASAI connectors; push-notification tokens of our mobile apps; your email and notification preferences	To sign you in, show what you chose to show, run the integrations you switched on, and deliver the notifications you allow	Contract — Art. 6(1)(b)	Until you unlink the account, revoke the permission or close your account	The service you connected; our push-delivery provider
Support	Emails you send us, the account they relate to, and our replies	To answer you, follow up, and resolve disputes	Legitimate interests — Art. 6(1)(f), our interest being to support and defend our service; legal obligation where the request is a statutory one	~2 years	Our email provider; Telegram, which hosts our internal support group (see Section 4)
The game Rebellion	Squad invitations and the "in game" mark; if you are signed in — your skin (a 64×192-pixel unfolding drawing) and player statistics (counters over all your time in the game: souls, kills, floors, runs, hours played, weapons and so on), and your choice of what to hide on the open card	To form squads of friends, show your skin to your allies, and move the skin and statistics between your computers with your account, and let you hide the skin and statistics on the open card	Contract — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) for the statistics and their open card without a nickname or handle	Invitations and squads — while the account exists; the skin and statistics — until you reset the skin, delete your Rebellion data in Settings → Privacy, or close your account: they are part of the export and are erased with the account (Rebellion Privacy Notice, Section 11)	Your squad members see the skin; the skin sits in public storage and is visible by its link; the game's open address returns the skin and statistics by account identifier without a nickname or handle (unless you hid them); EU hosting and object storage; CDN for public media

Do you have to give us this data? To have an account, yes — an email address and credentials are necessary to conclude and perform the contract with us, and without them we cannot provide the Services. Everything else — profile details, uploads, optional features — is yours to give or withhold.

Cookies and similar technologies are covered separately in the Cookie Policy.

Product-specific detail. Resonance listening history and its privacy controls are described in the Resonance Privacy Addendum. How AI features use your data, and how to turn training off, is in AI Data & Training. What the game Rebellion keeps on your computer, what passes through its multiplayer relay, what it uploads to our server (the player's skin and statistics) and what it receives from Resonance is in the Rebellion Privacy Notice.

3. Your identifiers and what is public

Your nickname, avatar, banner, bio and links are visible to other users where you have chosen to publish them.

Your internal account identifier ("handle") is what our own services use to link your account across the platform. It is not a public identity: we do not show it to other users or disclose it to third-party applications. Outside our own servers it reaches only providers that store data on our behalf — for example the storage behind ASAI memory.

Your email address is never shown to other users.

4. Support requests

When you contact support from your account, the request and our replies are stored with your account so both sides can see the history. They travel over TLS and sit on encrypted storage, and they are readable by us — that is the point of asking us for help.

Only the people who handle support see them. We answer requests from a private group on Telegram: every request — whether you wrote on the website or to our Telegram bot — is mirrored there with your nickname, never your internal handle. You can also open a request by writing to the bot itself. Our replies are sent from a single support identity rather than from a named person's account, so nobody can impersonate us by writing to you directly.

You can close a request when it is resolved. Closing it does not delete it: the history is kept under the schedule in Data Retention, because a support conversation is often the evidence of what was agreed.

If you write to us by email instead, that email is handled the same way — see the "Support" row in the table above.

5. Who else receives your data

We do not sell your personal data, and we do not share it with advertisers or use it for advertising profiling.

Your data is shared only with:

• Service providers acting on our instructions (processors) — hosting, storage, CDN, payments, AI, email delivery, push notifications. Each is bound by data-protection terms under Article 28 GDPR. They are listed with their purpose and region — by name, and for the infrastructure behind our AI products by category — in Data Processing & Sub-processors.
• Apple and Google, when you buy inside our iOS or Android app. They take the payment as the seller, under their own terms, and tell us only what we need to grant the purchase to your account.
• Services you choose to connect — an account you link (Discord, ListenBrainz), a connector or MCP server in ASAI, or an AI model you connect with your own key. They receive what the integration needs, and you can disconnect them at any time.
• Third-party applications you explicitly authorise. If you connect an application through our OAuth flow, it receives only the data covered by the scopes shown on the consent screen — typically nickname, email address, avatar and banner. You choose whether to approve it, and you can revoke access in your account settings. We never share passwords, two-factor secrets or session tokens.
• AI agents you connect through our MCP connector (Claude, ChatGPT and others). The agent receives what the tools of the permissions you allowed return — the account data you asked it to look at — and passes it to its provider, which processes it under its own policy. It never receives your email address, internal username, password or sessions. What is available and how to disconnect an agent: AI Agents (MCP Connector).
• Competent authorities, where we are required to disclose data by law or by a valid order, and where responding is necessary to establish, exercise or defend legal claims. We assess each request and disclose the minimum required.
• A successor, if our business or part of it is transferred. You would be informed, and your rights would not be reduced.

6. Where your data is, and international transfers

Personal data is hosted within the European Union — our servers and file storage are in Finland, and the storage behind ASAI memory is in Germany.

Some providers process data outside the EU/EEA. Where that happens, the transfer is covered by one or more of the safeguards in Chapter V of the GDPR:

• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), supported by transfer risk assessments and additional technical and organisational measures where appropriate; and/or
• an adequacy decision of the European Commission covering the recipient country or framework.

Which provider relies on which mechanism is set out per provider in Data Processing & Sub-processors. You can ask us for a copy of the relevant safeguards at [email protected].

7. Automated processing and profiling — what is actually automated

Some things here are decided by software, and you should know which.

Automated systems act on their own for infrastructure protection: rate limiting, spam and bot detection, fraud signals from our payment processor, and detection of anomalous account activity such as sign-in patterns consistent with credential stuffing. These systems can automatically slow a request, block traffic, require re-authentication, or temporarily lock an account. Recommendations and personalised feeds inside products such as Resonance are also generated automatically from your own activity.

Decisions that meaningfully affect you are made by people. Removing your content, restricting features, suspending or terminating your account, and refusing a refund are human decisions. Automated signals may raise the case; they do not close it.

Your rights here. Where a decision affecting you was reached with the help of automated processing, you can ask us to explain it, express your point of view, and have a person review it. Write to [email protected] with the subject line "Appeal". We do not carry out automated decision-making producing legal effects or similarly significant effects on you within the meaning of Article 22 GDPR; if that ever changes, we will say so here first.

Automated age check. Accounts are open from age 13 and some features are restricted by age, so software looks for signs that an account holder may be younger than the date of birth they entered. It works in three places:

• a date of birth more than 100 years ago: the account is created, but access is paused until support confirms your age;
• a date of birth more than 40 years ago: the account gets an internal "possible minor" flag, and nothing else changes;
• in ASAI, a small language model periodically reads a sample of your own recent messages — not the assistant's replies, not other people's messages — and looks for four things: you stating an age under 18, talking about your own life as a school pupil, parents limiting you the way children are limited, and many spelling mistakes of the kind a schoolchild makes. Typos, slang, deliberate internet spelling and writing in a language that is not your own do not count. Roleplay is treated as fiction unless you step out of the story to talk about yourself. A signal that matches the age on your account (school talk when you said you are 15) is discarded.

What we keep: the kind of signal, the evidence (a short quote or the misspelled words) and the date, stored with your APERTURESyndicate profile and visible only to support staff. Apart from the paused access described above, a flag does not block, restrict or change anything. A person reviews it; if the signs look real, support may write to you and ask you to confirm your age. The legal basis is our legitimate interest in keeping people under 13 off the platform and protecting minors (Article 6(1)(f) GDPR). The flags are part of your data export, are deleted with your account, and you can ask [email protected] which flags your account carries and object to them.

8. Security

We apply technical and organisational measures proportionate to the risk: encryption in transit and at rest, hashed passwords, encrypted two-factor secrets, least-privilege access control, network isolation of our database layer, logging and monitoring, and vendor diligence before we engage a processor.

No system is perfect. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify Andmekaitse Inspektsioon within 72 hours of becoming aware of it, as Article 33 GDPR requires, and we will inform you directly where the risk is high.

Found a vulnerability? Please tell us — see Responsible Disclosure.

9. Your rights

Under the GDPR you have the following rights over your personal data.

Access — a copy of the data we hold about you and an explanation of how it is used.

Rectification — correction of inaccurate data. Most of it you can fix yourself in account settings; anything you cannot edit there, we correct on request.

Erasure — deletion of your account and personal data. This is a genuine hard deletion, carried through every service that held a copy, not just a hidden profile. Some records survive where the law requires — invoices in particular must be kept for 7 years — and we keep a minimal record that an erasure happened so we can prove we honoured it. Copies inside our encrypted database backups are not edited one by one; they disappear as the backups roll over, on the schedule in Data Retention.

Restriction — pausing processing while a dispute about accuracy or about our legitimate interests is resolved.

Objection — you can object to processing based on legitimate interests, including profiling. We stop unless we can show compelling legitimate grounds that override your interests.

Portability — a copy of the data you provided to us, in a structured, commonly used, machine-readable format, and where technically feasible transmitted directly to another controller. Export everything in the privacy settings of your account downloads what each of our services stores about you, as plain SYNX files — all at once or service by service. ASAI also has its own export of your chats in its privacy settings. If something you need is not in the export, ask us and we will produce it within the response time in Section 10.

Withdrawal of consent — where we rely on your consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect processing that already took place.

Complaint to a supervisory authority — see Section 11.

None of these rights is affected by exercising another, and exercising them is free.

10. How to exercise your rights

Write to [email protected] from the email address registered to your account, with the subject line "GDPR request", and say which right you want to exercise.

If we cannot tie a request to an account, we may ask for something further to confirm it is yours. We ask for the minimum needed and do not keep it afterwards.

We answer within 30 days of receiving the request. If the request is unusually complex or you have made several, we may extend this by up to 2 further months, and we will tell you within the first month if that happens.

Requests are free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive — and we will explain why.

11. If you are not satisfied

Please come to us first at [email protected] — most complaints turn out to be something we can simply fix.

You also have the right to lodge a complaint with a supervisory authority under Article 77 GDPR. Ours is:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Tatari 39, 10134 Tallinn, Estonia https://www.aki.ee/en · [email protected]

You may also complain to the supervisory authority of the EU member state where you live or work, or where the alleged infringement took place. Nothing here limits your right to a judicial remedy.

12. Children and parental consent

Accounts are for people aged 13 and over. We do not knowingly process the personal data of anyone under 13: registration does not accept a date of birth below that, and if we learn that an existing account belongs to someone under 13, we restrict access, then close the account and delete the associated personal data. If you believe a child under 13 has given us personal data, contact [email protected] and we will act. Signs that an account holder may be younger than they said are looked for automatically — see "Automated age check" in section 7.

Between 13 and the age of digital consent in your country (GDPR Article 8(1): from 13 to 16 in the EU and EEA, and 16 for any other country or when we cannot tell), we process your data on the basis of a parent's or guardian's consent (Article 8(2)). At registration we ask for their email address and send them a one-time link, valid for 14 days; until they confirm, the account is marked as awaiting consent. As a record that consent was given we keep their email address and the date and IP address of the confirmation for as long as the account exists. The country is taken from the connection you register from. A parent or guardian can withdraw consent at any time by writing to [email protected].

We keep your date of birth to apply these rules and to derive an age group (13–15, 16–17, 18+) that our products may use to adjust what they offer. The date itself is never shown on your public profile; you enter it once and correct it through support.

Some content and features are additionally restricted to users aged 18 and over.

13. Marketing

We do not run a marketing newsletter and we do not have a marketing mailing list.

Most email we send you is service email: account verification, security alerts, password and sign-in notices, billing and invoice messages, and notices about changes to these documents. That email is necessary to perform our contract with you and to meet our legal duties, so it is not something you can unsubscribe from while keeping an account — though you can close the account at any time.

We also send notification email about things on the platform you would expect to hear about — for example a new follower, a new release from an artist you follow, a birthday greeting, or a weekly digest that is off unless you turn it on. Each kind can be switched off in your notification settings, and every such email carries a one-click unsubscribe link. The legal basis is our legitimate interest in telling you about activity on your account (Article 6(1)(f) GDPR); switching a kind off always wins.

If we ever introduce marketing email, it will be opt-in, based on your consent under Article 6(1)(a) GDPR, with a working unsubscribe link, and this section will be updated before the first message goes out.

14. Changes to this policy

We may update this policy — for example when we add a product, change a provider, or the law changes.

For any material change we will give you at least 30 days' notice by email to the address on your account or by a clear notice in the product, and we will update the "Effective date" at the top of this page. Minor corrections — typos, clarified wording, updated links — may be made without notice.

Previous versions are available on request at [email protected].

15. Language

This policy is published in English and in translation. The English version is the controlling version. If a translation and the English version differ, the English version applies. This does not affect any right you have under mandatory law to receive information in your own language.

16. Related documents

• Terms of Service — the agreement itself
• GDPR & Your Data — your rights, in more detail
• Data Retention Schedule — authoritative retention periods
• Data Processing & Sub-processors — who processes what, and transfer safeguards
• Cookie Policy — cookies and similar technologies
• AI Data & Training — how AI features use your data
• Resonance Privacy Addendum — listening history and its controls
• Rebellion Privacy Notice — the game's local files, squads, multiplayer relay, and the player's skin and statistics
• Security · Responsible Disclosure
• Company Registration & Imprint

Contact

Purpose	Contact
Privacy and data-subject requests	[email protected] — subject "GDPR request"
General support	[email protected]
Security vulnerabilities	[email protected] — subject "SECURITY"
Website	https://aperturesyndicate.com

APERTURESyndicate OÜ · Registry code 17384111 · VAT EE102972654 Priisle tee 8, Lasnamäe linnaosa, Tallinn, Harju maakond, 13914, Estonia

---

Version history

• v2.7 — 22 October 2026 — In the row "Product analytics (ASAI)" of Section 2: for accounts that accepted the ASAI terms on 23 October 2026 or later, conversations may be read from the moment they accepted (for others, still from 8 November 2026); added the permission "Let the team see my chats", based on your consent — off by default and withdrawable in Settings → Privacy.
• v2.6 — 14 October 2026 — In the row "Content you create" of Section 2, Together AI is named as the provider that runs ASAI Mini and ASAI Arc in quiet hours, when few people are online; at regular load they run on our own servers. Nothing else changes.
• v2.5 — 9 October 2026 — New row "Product analytics (ASAI)" in Section 2: what the ASAI product journal records under a random number, its legal basis (legitimate interests, with a switch to object in Settings → Privacy), retention, and that from 8 November 2026 a conversation may be read to understand why someone left (Trust & Safety, Section 3.5).
• v2.4.3 — 5 October 2026 — In the row "The game Rebellion" of Section 2: the skin, the statistics and the card's privacy switches are part of the export and are erased with the account and by the per-service deletion button; the skin and statistics can now be hidden on the open card (Rebellion Privacy Notice). Nothing else changes.
• v2.4.2 — 5 October 2026 — A row "The game Rebellion" is added to the table in Section 2: the player's skin and statistics if you are signed in, their bases, retention, and the fact that they are not yet deleted automatically with the account (Rebellion Privacy Notice). Nothing else changes.
• v2.4.1 — 2026-10-04 — Section 2 and Section 16 point to the new Rebellion Privacy Notice. Nothing else changes.
• v2.4 — 2026-10-01 — Recipients brought up to date: Apple and Google for purchases inside our mobile apps, Anthropic and OpenAI for their AI models alongside the infrastructure behind our own models, the Telegram group where we answer support requests (Section 4), services you choose to connect, and a new "Connected accounts and devices" row. Telemetry no longer names an error-monitoring provider — none is used. Section 3 says where the internal handle can be stored; Section 6 gives the server location as Finland, with the ASAI memory store in Germany. Section 7 explains the reason for the age check without describing our audience. Section 9 describes the self-service data export and how backups expire after erasure. Section 13 describes notification email and how to switch it off.
• v2.3 — 2026-09-26 — Section 7: the automated age check — a paused account for a date of birth more than 100 years ago, an internal flag for one more than 40 years ago, and the scan of your own ASAI messages for signs of a younger age; what is kept, who sees it, the legal basis and how to object. Existing account holders were notified by email on 26 September 2026; for them this version applies from 26 October 2026. Section 12 points to it.
• v2.2 — 2026-09-25 — Section 12 rewritten for the new age model: minimum age 13 (was 16); between 13 and the age of digital consent in your country the account runs on a parent's or guardian's consent, requested by email; what we keep as a record of that consent; the age group derived from the date of birth. Existing account holders were notified by email on 25 September 2026; for them this version applies from 25 October 2026.
• v2.1 — 2026-08-04 — Section 9 corrected on portability: ASAI does have a self-service export in its privacy settings, so the flat claim that no export button existed anywhere was wrong. What is true — and now stated — is that no single button exports the whole account.
• v2.0 — 2026-07-31 — Full rewrite: controller identity and contact, category-by-category table with Article 6 legal bases, retention and recipient categories, international transfers and safeguards, the full set of data-subject rights with an honest note on portability, complaint route to Andmekaitse Inspektsioon, the reason no DPO is appointed, what is and is not automated, children, and language precedence. Removed the claim that chat is stored encrypted end-to-end, the description of the internal handle as public, and the promise of a newsletter that does not exist.
• v1.0 — 2026-06-22 — Initial publication.