Privacy Notice

1. Who is responsible

The data controller is the LifeOrg operator identified above. Privacy and data-rights requests may be sent to privacy@lifeorg.app. General support is available at support@lifeorg.app.

If LifeOrg appoints a data protection officer or EU representative, their contact details will be added here before the relevant legal obligation applies.

2. Data we process

• Account and identity data: account identifier, email address, username, language, registration and login information.
• Profile and preferences: name, avatar, description, city, timezone, currency, schedule, goals and settings.
• Content you add: calendars, tasks, notes, contacts, imported address-book files, meal and nutrition records, workouts, metrics, check-ins, finance records, receipts and uploaded images.
• Health-related and other sensitive inferences: body measurements, sleep, activity, nutrition, wellbeing signals and AI-generated observations when you enable the relevant features.
• AI data: prompts, selected LifeOrg context, images submitted for recognition, outputs, provider/model identifiers and usage metadata.
• Technical and security data: IP address, device/browser information, authentication events, diagnostics, audit events and abuse-prevention signals.
• Support data: name, email, message content and any information you voluntarily include in a support request.

3. Why we use data and our legal bases

• Contract: create and secure your account, sync your data, provide the organizer features you request and respond to support requests.
• Explicit consent: process health-related data and transmit selected context to an AI provider for optional health, nutrition, sport, metrics and personalized-advice features. You can withdraw this consent at any time without affecting earlier lawful processing.
• Legitimate interests: protect the service, prevent fraud and abuse, diagnose failures and improve reliability, balanced against your rights.
• Legal obligation: keep records or respond to authorities where applicable law requires it.
• Separate consent: send marketing or use non-essential analytics/cookies if those features are introduced. LifeOrg does not currently rely on bundled consent for them.

4. AI processing and automated decisions

AI features are optional. Before health-related context is sent, LifeOrg must obtain a separate explicit consent in the product. The request may include only the context needed for the selected feature. Details are in the Health & AI Notice.

LifeOrg does not use AI output to make decisions that produce legal or similarly significant effects about you. AI output can be inaccurate and must not be treated as medical, legal or financial advice.

5. Recipients and international transfers

We disclose data only to service providers needed to operate a feature, to professional advisers under confidentiality, to a buyer in a lawful corporate transaction, or when law requires disclosure. We do not sell personal data or use health data for advertising.

The current provider register is published on the Subprocessors page. Where data leaves Serbia, the EEA or another protected jurisdiction, the operator must use an applicable transfer mechanism, such as an adequacy decision or standard contractual clauses, and assess supplementary safeguards.

6. Retention

• Active account content: until you delete it or close the account, unless a shorter in-product period is stated.
• Deleted account data: removed from live systems without undue delay; backup copies expire on the documented backup cycle, targeted at no more than 90 days.
• Security and access logs: normally 90 days, extended only for an active security investigation or legal requirement.
• Support requests: normally 24 months after closure.
• Consent and legal-acceptance evidence: for the account lifetime and up to 6 years afterwards where needed to establish or defend legal claims.
• Billing and tax records: for the statutory period that applies after paid features are introduced.

7. Your choices and rights

Subject to applicable law, you may request access, a portable copy, correction, deletion, restriction, objection and information about processing; withdraw consent; and complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection or your competent EEA authority.

Use in-product controls where available or email privacy@lifeorg.app. We may verify your identity and will respond within the legally required period. Withdrawing health/AI consent disables the relevant processing; you may separately request deletion of data already stored by LifeOrg.

8. Security, children and changes

LifeOrg uses authentication, authorization and encryption in transit. Private-by-default storage for new user files is implemented; before public registration opens, the operator must verify production object ACLs and complete monitoring, backup tests and incident procedures described on the Security page. No system is completely secure. Please report suspected issues to security@lifeorg.app.

LifeOrg is intended only for people aged 18 or older. We do not knowingly offer accounts to children.

We will publish material changes and, where required, notify you or obtain a new consent before applying a new purpose to sensitive data.