Privacy Policy

1. Who is responsible

Eary is a product of NutMeg Projects (sole proprietorship), Winschoterdiep 50, 9723 AB Groningen, the Netherlands. KvK 95331840, VAT NL005147009B21. We are the controller for the personal data processed through the Eary app and eary.ai, as meant in article 4(7) GDPR. Questions: contact@eary.ai.

2. The short version

Your diary is yours. We do not sell it, we do not advertise against it, and we do not use it to train AI models. We process it to give you Eary — transcription, reflection, search, artwork — and for nothing else.

3. What we process

• Account data: your e-mail address, your display name and the name you give Eary, your language and your settings.
• Your diary: written entries, voice recordings, their transcripts, titles and summaries, the topics you assign, and artwork, poems or songs made from them.
• Conversations with Eary: what is said in a voice or text conversation, and the summaries and memory made from it so Eary can remember you between conversations.
• Usage counters: minutes spoken, exchanges and creations per month — we need these to apply your plan’s limits.
• Subscription data: your plan, its status and period, and the customer, mandate and subscription identifiers Mollie gives us. We never receive or store your bank account number or card details.
• Connect: only what you explicitly choose to share, plus the messages you send there.
• Technical data: session tokens, error logs, and a push token if you turn on notifications. eary.ai uses no tracking cookies and no analytics — the only things stored in your browser are what is needed to keep you signed in.

A diary can contain special category data as meant in article 9 GDPR — your health, your beliefs, your relationships. We only process it for the purpose you use Eary for, on the basis of your explicit consent, which you give by writing or speaking it and can withdraw at any time by deleting the entry or your account.

4. Why, and on what legal basis

• Performing our agreement (art. 6(1)(b)) — creating and managing your account, transcribing, reflecting, making creations, running your subscription and sending service e-mails.
• Your explicit consent (art. 6(1)(a), art. 9(2)(a)) — processing the content of your diary and conversations, Eary’s memory of you, Connect, and push notifications.
• Legitimate interest (art. 6(1)(f)) — security, abuse prevention and technical monitoring.
• Legal obligation (art. 6(1)(c)) — keeping financial records for the statutory period.

5. Who processes data for us

• Supabase Inc. — database, authentication and file storage. Hosted in the EU (Frankfurt). Data processing agreement in place.
• OpenAI, LLC (United States) — transcription, conversation, summaries and image generation. Used through the API, where content is not used to train their models. Data processing agreement and EU Standard Contractual Clauses in place.
• Mollie B.V. (the Netherlands) — payments and direct debit. Mollie is an independent controller for the payment data it collects.
• Vercel Inc. — hosting of eary.ai. TransIP B.V. (the Netherlands) — domain and outgoing mail. Expo / Apple — app distribution and push notifications.

For providers outside the European Economic Area we rely on Standard Contractual Clauses under Implementing Decision (EU) 2021/914. We share nothing with third parties for advertising or marketing, ever.

6. How long we keep it

• Your diary, conversations and creations: until you delete them or close your account.
• Account data: up to 2 years after your last activity, unless you ask us to delete it sooner.
• Financial records: 7 years, as Dutch tax law requires.
• Error logs and technical logs: at most 6 months.

7. Security

Everything travels over TLS. Data is stored in the EU with row level security, so one account cannot read another’s. Access to administration is limited and logged, sessions expire, and we collect no more than we need.

8. Your rights

You have the right to access, correct, delete, restrict, object to and receive a copy of your data (art. 15–22 GDPR), and to withdraw consent at any time. Mail contact@eary.ai and we answer within one month; account deletion is carried out within 30 days. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

9. Data breaches

If a breach is likely to put your rights at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours, and we tell you directly if the risk is high.

10. Children

Eary is not meant for people under 16. If we find out we hold data of someone younger without a parent’s consent, we delete it right away.

11. Changes

If this policy changes in a way that matters to you, we will tell you by e-mail before it takes effect. The version and date at the top always say which text applies.