Privacy Policy for Bestie

Bestie is provided by Cosalite Inc. ("Cosalite," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and otherwise process information when you use the Bestie mobile application, related websites, communications, and other products or services that link to this policy (collectively, the "Service").

Bestie is an AI companion service that lets users chat, share messages, images, and audio, participate in voice experiences, and receive personalized responses, summaries, reflections, memories, and related insights over time. This Privacy Policy does not form a contract, but it is important because it explains how the Service handles information.

Contact Information

Cosalite Inc.
169 Madison Ave #38377
New York, NY 10016
[email protected]

Scope

This Privacy Policy applies to information we collect when you access or use the Service, communicate with us, or otherwise interact with us in connection with Bestie.

Information We Collect

We collect information you provide directly, information collected automatically, information generated through your use of Bestie, and information we receive from third parties.

A. Information You Provide

• account information, such as a pseudonymous account identifier created automatically when you first use Bestie, authentication tokens, and related account access data;
• profile and onboarding information, such as your display name, pronouns, birthday, interests, relationship status, occupation, location, languages, preferences, sensitivities, and other details you choose to provide;
• content you submit, such as messages, prompts, text, photos, images, audio messages, voice inputs, voice recordings, transcripts, shared links, imported content, feedback, and support communications; and
• subscription or purchase-related information we receive from Apple, such as product identifiers, subscription status, expiration dates, renewal status, and related transaction metadata.

B. Information Collected Automatically

• device and app information, such as device model, operating system, app version, build number, locale, language, time zone, network state, and low power mode status;
• usage and analytics information, such as screens viewed, features used, events, timestamps, and performance metrics;
• push notification tokens;
• attribution and referral information, including Apple AdServices attribution data and privacy-preserving Apple AdAttributionKit or SKAdNetwork postback copies where available;
• IP address, request metadata, timestamps, and related server logs; and
• crash, diagnostics, and technical performance information, including data we receive from Apple platform features such as MetricKit.

C. Information Generated Through Your Use of Bestie

• conversation history and context;
• AI-generated summaries, reflections, recaps, memories, and personalization data;
• inferred preferences, interests, patterns, and related profile insights;
• prompt context used to generate responses, such as prior chats, profile details, summaries, memories, reflections, and sensitivities; and
• safety, abuse-prevention, moderation, and quality signals.

D. Information from Third Parties

We may receive transaction, subscription, restore, billing, and entitlement-related signals from Apple and app distribution platforms, as well as information from analytics, attribution, hosting, storage, communications, moderation, diagnostics, transcription, synthesis, and infrastructure providers that help us operate the Service.

How We Collect Information

We collect information:

• directly from you when you create an account, complete onboarding, send messages, upload images, send audio, start a voice session, contact support, or make a purchase;
• automatically from your device and your use of the Service; and
• from third parties such as Apple, analytics providers, attribution providers, hosting providers, and service providers that help us operate the Service.

How We Use Information

We use information to:

• provide, operate, maintain, secure, and improve the Service;
• create and manage your account and authenticate access;
• process messages, prompts, images, audio, voice sessions, recordings, and other content you submit;
• generate responses, summaries, reflections, recaps, memories, and other outputs;
• personalize your experience based on your profile, preferences, conversation history, and prior interactions;
• process subscriptions, purchases, and related support requests;
• send notifications, service communications, updates, and administrative messages;
• measure ad campaign performance, referral source, app install, re-engagement, onboarding, messaging, and subscription outcomes using Apple privacy-preserving attribution tools and first-party analytics;
• monitor, analyze, debug, and improve product quality, safety, reliability, and performance;
• detect, investigate, and prevent fraud, abuse, misuse, and unsafe conduct; and
• comply with legal obligations and protect the rights, safety, and property of users, Cosalite, and others.

We may also use de-identified, aggregated, or otherwise transformed information to develop, refine, improve, and support our products, services, systems, and features where appropriate.

We do not use your personal data or content you submit to train general-purpose AI models. We may use personal data, submitted content, and related service data to provide, maintain, personalize, support, safeguard, and improve Bestie, including for quality assurance, safety systems, moderation, abuse prevention, diagnostics, analytics, troubleshooting, and feature development.

Third-Party AI Services

Bestie uses third-party AI service providers to power core features such as AI chat, image understanding, transcription, voice features, safety review, and personalization.

Before Bestie sends personal data to third-party AI service providers, the app presents an AI data-sharing disclosure that identifies the providers, describes what data may be sent, explains why the data is sent, and asks you to tap an allow/continue control. If you do not allow this sharing, you should not continue to AI-powered features or submit content for AI processing.

The categories of data that may be transmitted to third-party AI service providers include:

• messages, prompts, and chat content you submit;
• profile details, onboarding answers, preferences, sensitivities, and other profile information you provide;
• prior conversation history and related context used to generate responses;
• summaries, reflections, memories, recaps, sensitivities, and personalization context associated with your account;
• photos, images, image metadata, and image-related prompts;
• audio messages, voice inputs, live voice audio, transcripts, and related metadata; and
• related technical metadata necessary to provide the requested AI feature.

The third-party AI service providers that may receive this data for AI-powered features are:

• OpenAI
• Google Gemini (Google)

These providers process data on our behalf to generate responses, analyze images, transcribe audio, synthesize voice, apply safety or moderation systems, and support related AI functionality.

We configure and contract with these providers so they process data for service delivery and related support, safety, and reliability purposes on our behalf. We require each third-party AI service provider that receives user data from us to provide the same or equal protection for user data as stated in this Privacy Policy and required by applicable App Store Review Guidelines and law. Based on the provider settings and terms available to us, we do not permit them to use your personal data to train their general-purpose models. We also do not use your personal data or content you submit to train general-purpose AI models of our own.

If we add or replace a third-party AI service provider that would receive personal data, we will update this Privacy Policy and the in-app disclosure before sharing personal data with that provider.

AI-generated outputs may be inaccurate, incomplete, outdated, offensive, or otherwise inappropriate in some circumstances. You should not rely on Bestie for medical, mental health, legal, financial, or other professional advice.

Voice, Audio, and Sensitive Information

If you use voice or audio features, we may process live voice audio, audio messages, transcripts, and related metadata to provide the Service, including transcription, synthesis, moderation, quality review, and conversation continuity. We treat voice content as sensitive information and do not use it to identify you biometrically.

If you choose to share sensitive information in messages, images, audio, voice interactions, or profile fields, you acknowledge that such information may be processed by the Service and transmitted to third-party AI service providers as described in this Privacy Policy. You are not required to share sensitive information to use the core features of Bestie.

How We Share Information

We may share information in the following circumstances:

A. Service Providers

We share information with vendors and service providers that help us operate the Service, including providers of hosting, cloud storage, analytics, communications, authentication, subscriptions, customer support, diagnostics, security, moderation, and infrastructure.

We require each service provider that receives user data from us to provide the same or equal protection for user data as stated in this Privacy Policy and required by applicable App Store Review Guidelines and law.

B. Third-Party AI Service Providers

We share the data described in Section 6 with third-party AI service providers, currently OpenAI and Google Gemini (Google), to provide and support Bestie's AI-powered features.

C. Legal and Safety Disclosures

We may disclose information if we believe in good faith that doing so is necessary to comply with applicable law, regulation, legal process, or governmental request, to enforce our agreements, or to protect the rights, safety, and property of Cosalite, our users, or others.

D. Business Transfers

We may disclose information in connection with a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction.

E. With Your Direction or Consent

We may disclose information when you ask us to do so or otherwise consent.

F. Internal Access and Administrative Tools

Authorized personnel and service providers acting on our behalf may access information when reasonably necessary to operate, support, secure, moderate, investigate, debug, audit, or improve the Service. This may include access to profile information, messages, memories, reflections, summaries, voice transcripts, stored media, analytics data, and diagnostic information.

G. Aggregated or De-Identified Information

We may use, disclose, and publish aggregated, anonymized, or de-identified information for lawful business purposes.

Subscriptions, Purchases, and Virtual Items

If you purchase a subscription or virtual item through Apple, billing and payment processing are handled by Apple. We may receive transaction-related information such as product identifiers, subscription status, renewal state, expiration dates, and related purchase metadata in order to provide access, validate purchases, restore entitlements, and support users.

Push Notifications and Communications

If you enable notifications, we may send service-related, transactional, promotional, engagement, or product-related notifications, subject to your device settings and applicable law. These notifications may be informed by your account activity, conversation history, follow-ups, streaks, inactivity, or similar engagement signals, and may include personalized text delivered through Apple Push Notification service.

You can manage notification preferences through your device settings and, where available, within the app.

Sharing and Imported Content

Bestie may allow you to import or share text, links, images, audio, or other content from your device or from other apps. If you choose to use those features, we will process, upload, store, and analyze the imported content to provide the Service.

Data Retention

We retain information for as long as reasonably necessary to provide the Service, operate our business, comply with legal obligations, resolve disputes, enforce agreements, and protect our rights and users.

Retention periods may vary depending on the type of information, how it is used, system requirements, legal obligations, safety needs, backup cycles, and whether deletion has been requested. We may retain certain information after account closure or deletion where reasonably necessary for legal compliance, fraud prevention, abuse prevention, auditing, enforcement, backup integrity, or legitimate business purposes.

Your Choices

You may:

• choose not to upload images, audio, or other content;
• manage notifications through device settings;
• update some profile information in the app; and
• request deletion of your account through the app or by contacting [email protected].

You may revoke consent for third-party AI sharing by stopping use of AI-powered features and contacting [email protected] or requesting account deletion. Because third-party AI processing is required for Bestie's core AI companion features, revoking consent may prevent you from using some or all of the Service.

When you request account deletion, we will take steps to delete or de-identify your personal information within a reasonable period, subject to legal obligations, security needs, fraud-prevention needs, technical limitations, and backup retention. Deletion is not immediate across all systems; some information may remain in backups or logs until overwritten in the ordinary course. If you have an Apple subscription, deleting your account does not automatically cancel billing. You must manage that separately through your Apple account settings.

Children

Bestie is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a user under 13 has provided personal information without appropriate authorization, we will take steps to delete the account and associated information as required by applicable law. If you believe a child under 13 has provided information to us, contact us at [email protected].

Your Rights

We do not sell your personal data. We also do not share personal information for cross-context behavioral advertising.

Depending on where you live and subject to applicable law, you may have the right to access, correct, delete, or obtain a portable copy of your personal data; to opt out of processing for targeted advertising or profiling that produces significant decisions; and to appeal a denial of a privacy request.

To make a privacy request, contact [email protected]. We will respond within 45 days of receipt, with a possible extension of an additional 45 days where reasonably necessary. We may need to verify your identity before responding.

International Processing

We may process and store information in the United States and other countries where we or our service providers operate. When you use the Service, you understand that your information may be transferred to, stored in, and processed in countries outside your place of residence, including the United States. Where required by applicable law, we take steps designed to provide an appropriate level of protection for cross-border transfers.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect information. However, no security measure is perfect, and we cannot guarantee absolute security.

You are responsible for maintaining the security of your device, credentials, and account access.

Third-Party Services

The Service may link to or integrate with third-party services, websites, platforms, or tools. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. We encourage you to review their policies separately.

Do Not Track

Your device may offer Do Not Track settings. Because there is no universally accepted standard for responding to such signals, we may not respond to them.

Region-Specific Disclosures

A. Delaware Residents

If you are a Delaware resident, you have rights under the Delaware Personal Data Privacy Act (DPDPA), including the rights to access, correct, delete, and obtain a portable copy of your personal data; to opt out of processing for targeted advertising; and to opt out of profiling for decisions with legal or similarly significant effects. We do not sell your personal data. To exercise your rights, contact [email protected]. If we deny your request, you may appeal by contacting us with "DPDPA Appeal" in the subject line. If your appeal is denied, you may contact the Delaware Department of Justice at https://ago.delaware.gov.

B. California Residents

If you are a California resident, you have rights under the CCPA as amended by the CPRA, including the rights to know, delete, correct, and obtain a portable copy of your personal information; to opt out of the sale or sharing of your personal information; to limit use of sensitive personal information; and to not be discriminated against for exercising your rights. We do not sell personal information or share it for cross-context behavioral advertising. To exercise your California rights, contact [email protected] with "California Privacy Request" in the subject line.

C. Residents of Other U.S. States

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of certain processing. To make a request, contact [email protected].

D. Users in the EEA, UK, Switzerland, Australia, and Canada

Where required by applicable law, we process personal information on one or more of the following legal bases: to perform our contract with you and provide the Service; with your consent; to comply with legal obligations; or for our legitimate interests where not overridden by your rights. You may have the right to access, correct, delete, restrict, or port your personal information, to withdraw consent where processing is based on consent, and to lodge a complaint with a supervisory authority or privacy commissioner in your jurisdiction. To exercise any of these rights, contact [email protected].

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make changes, we will revise the Last Updated date and, where required by law, provide additional notice. Your continued use of the Service after the updated Privacy Policy becomes effective is subject to the revised policy.

Contact

If you have questions or privacy requests, contact:

Cosalite Inc.
169 Madison Ave #38377
New York, NY 10016
[email protected]