Privacy Policy

1. Scope and Summary

This Privacy Policy explains how AppBird Technologies, Inc. ("Company", "we", "us", "our") collects, uses, shares, and protects your information when you use the AppBird AI platform at appbird.ai, including our web application and APIs (the "Service"). It applies to all users of the Service, whether or not you create an account.

In short: We collect only what we need to operate the Service. Analytics and marketing tracking are off by default and only activate after you opt in. We do not sell your personal data. You can manage your cookie preferences at any time.

2. Data Controller

The data controller responsible for your personal data is AppBird Technologies, Inc., a Delaware corporation. For any data protection inquiries, contact us at hello@appbird.ai.

3. What We Collect

"Personal data" means information that identifies or could reasonably identify you. "Aggregated" or "anonymized" data has been processed so it can no longer identify any individual; this policy does not restrict our use of aggregated or anonymized data.

Account and Profile Information

• Email address and full name (provided at registration or via Google OAuth).
• Hashed password (email/password accounts only — we never store plaintext passwords).
• Profile picture (if provided via Google OAuth).

Authentication and Security Data

• Session tokens and refresh tokens (stored as HTTP-only cookies).
• Login timestamps, IP addresses, and browser/device information associated with login events.
• CAPTCHA verification data (processed by Cloudflare Turnstile).

Usage and Device Data

• Pages visited, features used, search queries, and interaction patterns.
• Browser type, operating system, screen resolution, and device identifiers.
• Referring URLs and general geographic location derived from IP address.

Payment and Billing Data

• If you purchase a subscription, payment information (such as card details) is collected and processed directly by our third-party payment processor. We do not store your full credit card number on our servers. We may receive limited billing details such as the last four digits of your card, expiration date, and billing address for record-keeping and support purposes.

Communications and Support Data

• If you contact us (via email, feedback forms, or other channels), we retain the content of your communications and any information you choose to provide to assist with your inquiry.

4. Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies to operate and improve the Service. A "cookie" is a small data file stored on your device. Local storage works similarly but may hold more data. We classify these technologies into three categories:

Default state: Analytics and marketing scripts are not loaded until you explicitly opt in via the cookie consent banner. No tracking requests are sent before consent is granted.

Managing preferences: You can change your cookie preferences at any time using the "Cookie Settings" link in the site footer. Withdrawing consent will immediately stop the relevant tracking and remove the associated scripts.

5. How We Use Your Data

• To provide, operate, maintain, and improve the Service.
• To authenticate you, manage your account, and process payments.
• To send transactional communications (password resets, billing receipts, account notifications).
• To analyze usage patterns and improve the user experience (only with your consent for analytics).
• To measure advertising effectiveness (only with your consent for marketing).
• To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms.
• To respond to your support inquiries and feedback.
• To comply with legal obligations and enforce our agreements.

6. Legal Bases for Processing (GDPR Art. 6)

If you are in the EU/UK or another jurisdiction that requires a legal basis, we rely on the following:

• Contract performance — processing necessary to provide the Service you registered for, manage your account, and process transactions.
• Consent — analytics and marketing (Google Pixel) tracking are activated only after your explicit opt-in. You can withdraw consent at any time via Cookie Settings.
• Legitimate interest — security monitoring, fraud prevention, and maintaining the integrity of the Service. We balance these interests against your rights and do not use this basis for analytics or advertising.
• Legal obligation — where we are required to process data by applicable law or regulation.

7. Data Sharing

We do not sell your personal data. We share personal data only with the following categories of service providers and processors, and only to the extent necessary for the stated purposes:

• Google (marketing processor / OAuth provider) — receives marketing data only when you have granted marketing consent. If you sign in with Google, Google receives authentication data necessary for OAuth.
• Cloudflare (infrastructure provider) — provides CDN, DDoS protection, and CAPTCHA verification. Cloudflare may process IP addresses and request metadata as part of its security services.
• Payment processors — if you purchase a subscription, your payment data is handled directly by our payment processor. We do not store full card details.
• Professional advisors — we may share data with legal, financial, or accounting advisors where necessary for our business operations.
• Law enforcement and legal requirements — we may disclose data when required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Corporate transactions — in connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy commitments.

8. Data Retention

• Account data is retained for as long as your account is active and as needed to provide the Service.
• Upon account deletion, we will delete or anonymize your personal data within 30 days where feasible. Residual copies in encrypted backups will be overwritten through the normal backup cycle within a reasonable period.
• Security and access logs are retained for up to 90 days for security monitoring and incident investigation, then deleted or anonymized.
• Analytics data is aggregated and anonymized and does not contain personally identifiable information.
• Legal holds: We may retain data longer where required by applicable law, regulation, or legal proceedings.

9. Security

We implement industry-standard technical and organizational measures to protect your data, including: encrypted data transmission (TLS/HTTPS), hashed passwords, HTTP-only cookies for session tokens, role-based access controls, and regular security reviews.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a security breach that affects your personal data, we will notify you and relevant authorities as required by applicable law.

10. Your Rights (EU/UK)

If you are located in the EU or UK, you have the following rights under GDPR:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Objection — object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
• Withdraw consent — withdraw cookie or marketing consent at any time via the Cookie Settings link in the footer. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Complaint — lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email us at hello@appbird.ai. To protect your privacy, we may ask you to verify your identity before processing your request (for example, by confirming ownership of the email address on your account). We will respond within 30 days, or inform you if we need an extension.

11. U.S. State Privacy Rights

Depending on your state of residence (including California, Colorado, Connecticut, Virginia, and others with applicable privacy laws), you may have additional rights, such as:

• The right to know what personal data we collect and how it is used.
• The right to request deletion or correction of your personal data.
• The right to opt out of targeted advertising or the "sale" or "sharing" of personal data.

We do not sell your personal data. Marketing tracking (Google Pixel) is optional, only activates with your explicit consent, and can be disabled at any time via Cookie Settings. If you consider consent-based marketing tracking to constitute "sharing" under your state's privacy law, the Cookie Settings link serves as your opt-out mechanism.

To submit a request, contact us at hello@appbird.ai. We will not discriminate against you for exercising your privacy rights.

12. International Data Transfers

Your data may be transferred to and processed in the United States, where the Company is incorporated. If you are located outside the United States, please be aware that data protection laws in the U.S. may differ from those in your jurisdiction.

Where required by applicable law, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to ensure that your data receives an adequate level of protection when transferred internationally.

13. Children

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us at hello@appbird.ai and we will promptly delete the data.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will post the revised policy with a new "Last updated" date. For material changes, we will provide additional notice via email or a prominent notice within the Service. Continued use of the Service after the updated policy becomes effective constitutes acceptance. If you do not agree with any changes, you should stop using the Service and contact us to request deletion of your data.

15. Contact

For privacy-related questions, data protection requests, or concerns, contact us at:

• Email: hello@appbird.ai

We aim to respond to all legitimate requests within 30 days. If your request is particularly complex, we may notify you that we need additional time (up to 60 days total for EU/UK requests, as permitted by GDPR).