Privacy Policy

1. Introduction

ANIMUNDI ("we", "our") is committed to protecting your privacy. This policy describes what data we collect, how we use it, and what your rights are. ANIMUNDI is a service provided by JpMercury LLC.

Our fundamental principle: your data is yours. We do not sell personal data. We do not profile for advertising purposes. We do not share your information with third parties for marketing purposes.

2. Data we collect

2.1 Data you provide directly

• Registration data: name, email address, date of birth (optional)
• Profile: profile photo, biography, interests, location (all optional)
• Content: posts, comments, multimedia content you choose to share
• Communications: support messages you send us

2.2 Automatically collected data

• Technical data: device type, operating system, app version
• Usage data: features used, access timestamps (aggregated, not individual)
• IP address: only for security and abuse prevention, never for profiling

2.3 Data we do NOT collect

• Content of E2E encrypted messages (technically impossible)
• Content of P2P video calls
• Files exchanged via P2P
• Precise geolocation data
• Your phone contacts

3. How we use your data

• Provide you with the ANIMUNDI service and its features
• Manage your account and preferences
• Send you important service communications
• Prevent abuse and ensure platform security
• Improve the service through aggregate and anonymous analysis

4. Legal bases for processing (Art. 6 GDPR)

The processing of your personal data is based on the following legal bases:

• Performance of contract (Art. 6(1)(b)): service provision, account management, service communications
• Consent (Art. 6(1)(a)): marketing communications, functional cookies, processing of special categories of data
• Legitimate interest (Art. 6(1)(f)): platform security, abuse prevention, service improvement (see Section 12)
• Legal obligation (Art. 6(1)(c)): tax compliance, responding to requests from competent authorities

5. Third parties

We share data only with the following essential service providers:

• Stripe: for secure payment processing. Stripe receives only the data necessary for the transaction.
• Firebase Cloud Messaging: exclusively for push notification delivery. No content data is shared.

We do not use Google Analytics, Facebook Pixel, or any other third-party tracking tool.

6. Data Processors (Art. 28 GDPR)

The following entities act as Data Processors under Art. 28 GDPR:

All data processors are bound by Data Processing Agreements (DPAs) compliant with Art. 28 GDPR and Standard Contractual Clauses (SCCs) for extra-EU transfers under Art. 46 GDPR.

7. International Data Transfers (Art. 44-49 GDPR)

Some of our data processors are based in the United States of America. In accordance with the Court of Justice of the European Union ruling C-311/18 ("Schrems II"), we adopt the following measures to ensure an adequate level of protection for personal data transferred outside the European Economic Area:

• Standard Contractual Clauses (SCCs): all transfers to the USA are governed by SCCs approved by the European Commission (Implementing Decision (EU) 2021/914), signed with each data processor.
• Supplementary measures: end-to-end (E2E) encryption of private messages ensures that communication content is not accessible even to data processors, providing a supplementary protection measure under EDPB Recommendations 01/2020 on measures supplementing transfer tools.
• Transfer Impact Assessment (TIA): a transfer impact assessment has been conducted for each transfer, available upon request to the DPO.

8. Data retention

• Account data: retained as long as your account is active
• Published content: retained until you delete it yourself
• E2E messages: stored only on users' devices
• Security logs: retained for a maximum of 90 days
• Payment data: managed and retained by Stripe according to their policies

After account deletion, all personal data is deleted within 30 days. Backups are deleted within 90 days.

9. Your rights (GDPR)

In accordance with the European General Data Protection Regulation (GDPR), you have the right to:

• Access (Art. 15): request a complete copy of all your personal data
• Rectification (Art. 16): correct inaccurate or incomplete personal data
• Erasure (Art. 17): request the deletion of all your data ("right to be forgotten")
• Portability (Art. 20): export your data in a structured and readable format
• Objection (Art. 21): object to the processing of your data for specific purposes
• Restriction (Art. 18): request the restriction of processing of your data
• Withdrawal of consent (Art. 7(3)): withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal

To exercise any of these rights, you can use your account settings or contact our DPO.

Response times: We will respond to your request within 30 days of receipt (Art. 12(3) GDPR). In complex cases, the deadline may be extended by an additional 60 days with prior notice.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali - www.garanteprivacy.it) under Art. 77 GDPR.

10. Data export

You can export all your data at any time from your account settings. The export includes: profile, posts, comments, connections, and settings. The export format is JSON, readable and importable.

11. Security

We use state-of-the-art security measures to protect your data:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• End-to-end encryption for private messages (Signal Protocol)
• P2P video calls without passing through our servers
• Two-factor authentication (2FA)
• Regular security audits

12. Cookie Policy

ANIMUNDI uses only technical and functional cookies strictly necessary for the service to function. We do not use profiling, marketing, or third-party cookies for advertising purposes.

We do not use profiling, marketing, or third-party cookies for advertising purposes.

You can manage your cookie preferences at any time from the cookie settings or from your browser settings. For detailed information, see our dedicated Cookie Policy.

13. Legitimate interest (Art. 6(1)(f) GDPR)

ANIMUNDI relies on legitimate interest as the legal basis for the following processing purposes, for which a Legitimate Interest Assessment (LIA) has been conducted and documented:

• Platform security: IP address logging and abuse prevention. The LIA is documented and available upon request to the DPO.
• Service improvement: aggregate and anonymous analysis of platform usage. Data is always aggregated and never attributable to individual users. The LIA is documented and available upon request to the DPO.

Under Art. 21 GDPR, you have the right to object at any time to the processing of your personal data based on legitimate interest. In case of objection, we will cease processing unless there are compelling legitimate grounds that override your interests, rights, and freedoms.

14. Special Categories of Data (Art. 9 GDPR)

ANIMUNDI's "Spiritual Path" feature may involve the processing of data relating to philosophical and religious beliefs, which constitute special categories of personal data under Art. 9 GDPR.

• The processing of such data is carried out exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR), collected separately and distinctly from the general consent to data processing.
• Consent to the processing of special categories of data may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• In case of consent withdrawal, data related to the spiritual path will be deleted immediately, without waiting for the ordinary retention periods.

15. Data Breach Notification

In case of a personal data breach that may pose a risk to the rights and freedoms of natural persons, ANIMUNDI commits to:

• Notification to supervisory authority (Art. 33 GDPR): notify the breach to the Italian Data Protection Authority (Garante della Privacy) within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to the rights and freedoms of natural persons.
• Communication to data subjects (Art. 34 GDPR): where the breach is likely to result in a high risk to the rights and freedoms of natural persons, communicate the breach to the data subject without undue delay, describing the nature of the breach, the likely consequences, and the measures taken or proposed.

To report a suspected security incident, immediately contact the DPO at dpo@animundi.love.

16. Processing of Minors' Data (Art. 8 GDPR)

In accordance with Art. 8 GDPR and the Italian implementing legislation (D.Lgs. 101/2018), ANIMUNDI applies the following rules for the processing of minors' data:

• Minimum age: the service is intended for users at least 16 years of age. Users under 16 may use the service only with the consent of the holder of parental responsibility.
• Parental consent verification: parental or guardian consent is obtained and verified through an email verification procedure, with confirmation of the parent/guardian's identity.
• Right to erasure: data collected from minor users may be deleted at any time upon request of the minor (once they reach the age of majority) or of the holder of parental responsibility.
• Prohibition of profiling: ANIMUNDI does not carry out any automated profiling of users under 18 years of age.

17. Data Protection Impact Assessment (DPIA - Art. 35 GDPR)

In accordance with Art. 35 GDPR, ANIMUNDI has conducted a Data Protection Impact Assessment (DPIA) for the following processing operations that may present a high risk to the rights and freedoms of natural persons:

• End-to-end encrypted messaging (E2E): assessment of security measures and data protection architecture
• AI-powered content moderation: assessment of the impact of automated decision-making
• Geolocation data processing: assessment of risks related to location data processing

Complete DPIAs are available upon request to the DPO. Last updated: March 22, 2026.

18. DPO Contact

For any questions about privacy or to exercise your rights, contact our Data Protection Officer:

• Email: dpo@animundi.love
• PEC: privacy@pec.animundi.love

The DPO is registered with the Italian Data Protection Authority — Reg. no. [TO BE COMPLETED].

19. Changes to the Privacy Policy

Any changes to this policy will be communicated at least 30 days in advance via email and in-app notification. Substantial changes will require your explicit consent.

AI safety and responsibility

ANIMUNDI uses AI models (local Ollama and Anthropic) to generate spiritual content, reflections and interpretations. These responses are creative prompts, not clinical advice.

AI responses may contain errors, oversimplifications or inaccuracies. Do not use them for medical, psychological, financial or legal decisions. ANIMUNDI applies a safety layer that detects potential crisis signals and surfaces support resources.

Models and data

Conversations with the AI Coach are stored to improve the service and power features such as achievements and spiritual memory (SOUL/GUIDE plans). You can delete them at any time from Settings or via GDPR export.

Going through a hard time? Open crisis resources.