Your words are yours.

This Privacy Policy explains what personal information Solace collects, why, how we protect it, and the rights you have over it. Solace is provided by Therapy Friend Limited ("Therapy Friend", "we", "us", "our"). Please read it alongside our Terms of Service.

We've tried to write this plainly. Where the law needs particular language (for example, the legal bases we rely on), we've included it and explained what it means.

In one line: Your conversations are yours. We treat what you share as sensitive, we ask your consent before we use it, we never sell it, we don't use it to train third-party models, and you can turn memory off or delete everything at any time.

1. Who we are (the "data controller")

Therapy Friend Limited is the controller responsible for your personal information.

• Company: Therapy Friend Limited, registered in England & Wales, company number 16488441
• Registered address: 8a Stafford Street, United Kingdom
• Contact: support@therapyfriend.ai

If you have any questions about how we handle your information, or you want to exercise your rights, contact us at support@therapyfriend.ai.

2. What we collect

Information you give us

• Account details: your email address, and sign-in information if you use Apple, Google, or another sign-in provider.
• Your conversations with Solace: the messages you type or speak, and Solace's replies. When you speak, your audio is turned into text so Solace can understand and respond (see "Your voice" below).
• Anything you add to your profile or journal: for example a name you choose to share, an "about me", reflections, mood check-ins, saved anchors, or images you choose to attach.
• Payment information: handled by our payment processors (Stripe on the web; Apple or Google for in-app purchases). We receive confirmation of your subscription and basic billing records; we do not receive or store your full card number.

Information we collect automatically

• Basic technical and usage data needed to run the service and keep it secure: app version, device type, general region, crash and error logs, and limited analytics about how features are used. We keep this to the minimum needed and hold it separately from your conversation content.

We do not collect more than we need, and we do not build advertising profiles about you.

3. Sensitive information, and the consent we ask for

Because Solace is a companion for emotional reflection, the things you share may reveal information about your mental or emotional health, and sometimes other sensitive matters (such as beliefs or personal relationships). Under UK and EU data-protection law this is "special category data" (Article 9 UK/EU GDPR). Some US state laws treat it as "consumer health data" or "sensitive personal information".

We treat all of your conversation content as sensitive by default, and we handle it with extra care.

Our legal bases (UK/EU GDPR). We rely on:

• Your explicit consent (Article 9(2)(a)) to process the sensitive information in your conversations, together with consent as our lawful basis (Article 6(1)(a)); and
• Our legitimate interests or the performance of our contract with you for non-sensitive operational data (such as keeping the service secure and processing your subscription).

You are always in control of your consent. When you start using Solace, we ask you to give or decline separate, specific permissions. Nothing is pre-ticked or bundled into "accept the Terms". You can withdraw any consent at any time in your profile settings, as easily as you gave it. Withdrawing consent stops that use going forward; it doesn't affect anything we lawfully did before you withdrew.

The permissions we ask for are separate, so you can say yes to some and no to others:

1. Have conversations with Solace: needed to provide the core service you're asking for.
2. Memory: storing your conversations and reflections so Solace can remember you between sessions. Memory is optional. For users aged 16 to 17, memory is off by default and can be turned on from the profile.
3. Helping us improve: allowing us to use de-identified conversation content to improve how Solace responds. This is optional and off unless you choose it, and it is separate from the core service.
4. Human help when you ask for it: allowing a member of our team to look at a specific conversation only when you ask us to (for example, to troubleshoot something you've reported).

4. How we use your information

We use your information only to provide and protect the service to you:

• to reply to your messages and generate Solace's written and spoken responses;
• to remember you between sessions and surface your reflections when you return (only if memory is on);
• to personalise how Solace responds to you (see "Personalisation and automated decisions" below);
• to run the tools in the app (breathing, grounding, journaling, session timeline);
• to process your subscription, prevent fraud, and keep accounts secure;
• to respond to your support requests; and
• to meet our legal obligations.

We do not sell your personal information. We do not share your conversations for advertising. We do not use your conversations to train third-party AI models. We do not use tracking pixels or advertising SDKs that would transmit your conversation content or health-related data to advertising platforms.

5. Your voice

When you use live voice, your speech is turned into text so Solace can understand you and respond.

• We do not keep raw audio recordings of your live sessions beyond the brief moment needed to carry the call and transcribe it.
• We do not create a "voiceprint" or voice template, and we do not use your voice to identify or authenticate you. We do not use your voice for any biometric purpose, and we do not sell voice data.
• Only the text of the conversation is saved, and only if memory is on. You can turn memory off or delete everything from your profile at any time.

The providers who help turn your speech into text act only on our instructions, are contractually prohibited from creating voiceprints or using your voice for their own purposes, and do not retain your audio.

6. Who else handles your data

To run Solace, a small number of trusted providers process your data on our behalf and only to deliver the service. They act on our documented instructions, under contract (data-processing agreements), and cannot use your conversations for their own purposes. They are:

• the technology partners that generate Solace's written and spoken replies and carry your live voice sessions;
• our speech-to-text provider(s);
• our hosting, infrastructure, and sign-in providers;
• our payment processors: Stripe (web), and Apple or Google (in-app purchases).

We keep an up-to-date list of the categories of providers we use and will share more detail on request at support@therapyfriend.ai.

We never sell your data, and we don't use your conversations to train third-party models.

7. Can anyone read your conversations?

No one on our team reads your conversations. They stay yours. Your words are processed automatically to give you the service, and nothing else.

The only time a person would ever look at a specific conversation is if you ask us to, for example if you contact support about something specific and give us permission to look, so we can help. Nothing is browsed, reviewed, or read behind your back.

8. International data transfers

We are based in the United Kingdom, and some of our providers are located outside the UK and the European Economic Area (including in the United States). When your information is transferred internationally, we protect it using safeguards recognised under UK and EU law:

• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and/or the UK Extension to the EU-US Data Privacy Framework, for transfers from the UK; and
• the EU Standard Contractual Clauses, and/or the EU-US Data Privacy Framework where the provider is certified, for transfers from the EEA.

We assess the risk of each transfer before we make it. You can ask us for a copy of the relevant safeguards at support@therapyfriend.ai.

9. Personalisation and automated decisions

Solace personalises how it responds to you based on your conversations and, if enabled, your memory. This is a form of "profiling", and we've explained it here so it's transparent.

Solace does not make legal or similarly significant decisions about you by solely automated means. If our systems flag that you may be at risk (for example, signs of self-harm) and show you crisis resources, that is a safety feature designed to help you, not a decision that affects your legal rights, and it does not replace human judgment. You can contact us about any automated processing at support@therapyfriend.ai.

10. Your rights and choices

Depending on where you live, you have rights over your personal information. We honour these rights for all our users wherever we can, and in every case where the law requires. You can:

• access the information we hold about you, and receive a copy (portability);
• correct information that's wrong;
• delete your conversations, your account, or everything, permanently;
• turn memory off, or withdraw any consent, at any time;
• object to or restrict certain processing;
• opt out of "sale" or "sharing" of personal information and of targeted advertising (we do not sell or share your data for advertising, but you can still register your choice); and
• appeal a decision we make about your request, and complain to a regulator.

You can do most of this yourself in your profile (export, delete individual conversations, turn memory off, delete your account). For anything else, email support@therapyfriend.ai and we'll respond within the time the law requires (usually within one month in the UK/EU).

For California residents: mental- and emotional-health information is "sensitive personal information". You can direct us to limit the use of your sensitive personal information and to not sell or share your personal information, and we honour recognised opt-out preference signals (such as Global Privacy Control). We do not use or disclose your sensitive personal information except to provide the service you asked for.

For Washington, Nevada, Connecticut, and other US consumer-health-data states: we treat your conversations and mood information as consumer health data. We ask for your separate consent before collecting it and, separately, before sharing it; we do not sell it; and we do not use geofencing to locate, track, or advertise to you around health-related locations. Our Consumer Health Data statement is set out in Section 15.

How to complain. If you're in the UK, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you're in the EU, you can complain to your local Data Protection Authority in the country where you live. We'd always prefer you come to us first so we can put things right.

11. How long we keep it

We keep your account details and conversations only for as long as your account is open, so Solace can remember you and be there when you return. You can delete individual conversations, turn memory off, or erase everything from your profile at any time.

When you delete your data or close your account, it is permanently removed from our live systems within 30 days, and from our encrypted backups within a further 90 days. Raw voice audio is not retained beyond the moment needed to carry and transcribe a session. We keep only the minimum records the law requires, for example basic payment records, for as long as we are legally required to, and nothing more.

12. How we protect your information

We use technical and organisational measures appropriate to how sensitive this information is: encryption in transit and at rest, access controls that keep staff out of your conversations, separation of conversation content from technical data, and vetting of the providers we work with. You can also lock Solace behind Face ID or a passcode on your device.

No system is ever perfectly secure, but if a data breach ever put your rights at serious risk, we will notify you and the relevant regulator as the law requires.

13. Children and younger users

Solace is for people aged 16 and older. It is not intended for children under 16, and we do not knowingly collect their information. If you believe someone under 16 has created an account, contact us and we will remove it.

For accounts registered as 16 or 17, we apply higher-privacy defaults:

• cross-session memory is off by default, and profiling is minimised, unless the young person turns it on;
• we design these accounts with their best interests in mind, in line with the UK's Age Appropriate Design Code (Children's Code);
• we remind users that Solace is an AI companion, not a therapist or crisis service, and we signpost emergency services and crisis lines throughout the app.

We encourage 16 to 17-year-olds to use Solace with the awareness of a parent or guardian.

14. Safety

Solace is an AI companion, not a therapist, doctor, or crisis service. If you are in crisis or thinking about harming yourself, please contact your local emergency services, or a crisis line such as the Samaritans on 116 123 (UK & Ireland), the 988 Suicide & Crisis Lifeline (US, call or text 988), or your local equivalent. Solace cannot contact emergency services for you.

15. US Consumer Health Data statement

This section applies to residents of US states with consumer-health-data laws (including Washington's My Health My Data Act, Nevada, and Connecticut) and forms part of this Privacy Policy.

• What we collect: your conversation content and mood/emotional information, which may be "consumer health data".
• Why: solely to provide the Solace service to you (responding to you, and remembering you if memory is on).
• Sources: you (what you type or say) and, where memory is on, information derived from your conversations.
• Who we share it with: only the service providers listed in Section 6, acting on our instructions to deliver the service. We do not sell consumer health data, and we do not share it for advertising.
• Consent: we collect this data with your consent and ask separately before any sharing beyond delivering the service.
• No geofencing: we do not use geofences around health-care or other sensitive locations.
• Your rights: you can access, delete, and withdraw consent as described in Section 10. To exercise these rights, or to appeal, email support@therapyfriend.ai.

16. Changes to this policy

We may update this policy from time to time. If we make a material change, we'll post the new version here and update the date at the top, and, where the change affects how we use your sensitive information, we'll ask for your consent again where the law requires.

17. Contact

Questions about your privacy, or want to exercise a right?

• Email: support@therapyfriend.ai
• Post: Therapy Friend Limited, 8a Stafford Street, United Kingdom

We're here to help, and we'll always try to put things right.