Gailuh Privacy Policy
This policy explains what personal data we process when you use Gailuh —the iPhone and Apple Watch app, its widgets and complications— and the gailuh.com website, what for, who we share it with, how long we keep it and how to exercise your rights. If anything is unclear, write to us.
Last updated: 14 October 2026 · Version 2.2
1. The essentials
| Controller | Irakai Studio SL (Spanish tax ID B95935615) · hola@gailuh.com |
| What for | To provide the service (your account and your records, synced across your devices), to manage your Pro subscription, to protect the service, to fix errors and, unless you turn it off, to measure app usage in pseudonymised form so we can improve it; we also count website visits, without cookies. |
| Why we may | Contract, to provide the service you ask for; legitimate interest, which you can object to, for security, error diagnostics and analytics. |
| Who else processes it | Providers working on our behalf (hosting, sync, subscriptions, email, analytics and diagnostics). We do not sell your data or use it for advertising. |
| Outside the EU | RevenueCat and Resend process data in the United States and Google uses its worldwide network; the others host your data in the EU, although they may access it from outside. Always under standard contractual clauses or an adequacy decision of the European Commission (section 9). |
| Your rights | Access, rectification, erasure, objection, restriction and portability, and the right to complain to the Spanish Data Protection Agency (AEPD) or the authority in your country. You can delete your account from within the app. If you live outside the EU, see also section 19. |
- Your progress photos NEVER leave your iPhone for our servers or for any of our providers: only the date, the body zone and the item of each photo reach the server. Outside the app they can only be, under your control and Apple’s, in your iPhone’s iCloud Backup and, if you turn on “Save a copy to iPhone Photos”, in your photo library (section 4).
- We do not track you across other companies’ apps or websites, we do not use the advertising identifier (IDFA) and we show no ads.
- Product analytics is on by default and you can turn it off at any time in Settings → Privacy → Product analytics.
- You can delete your account and your data from Settings → Delete account.
2. Who the controller is
- Controller: Irakai Studio SL
- Tax ID (NIF): B95935615
- Registered with the Bizkaia Commercial Registry: volume 5806, folio 108, section 8, sheet BI-72383
- Registered office: C/ Ramón y Kareaga 13, 6º D, 48970 Basauri (Bizkaia), Spain
- Contact and privacy email: hola@gailuh.com
Data Protection Officer: we have not appointed one because none of the cases that require one applies (Article 37 of the General Data Protection Regulation, GDPR, and Article 34 of Spain’s Organic Law 3/2018, LOPDGDD). For any privacy matter, write to the contact email.
3. What data we process
3.1. Your account data
- Email, name and, if you sign up with email, your password, which is stored hashed and which we never see. If you sign in with Apple or Google, we receive the name and email you share (with Apple you can hide your email and we receive a relay address); Google also gives us the address of your profile picture, which we do not use or display.
- The identifier of the provider you sign in with (Apple or Google), an internal user identifier, the dates of sign-up and last sign-in and the sessions open on your devices.
- If you sign in with Apple on your iPhone, an Apple token kept encrypted, only to revoke Gailuh’s access to your Apple Account when you delete your account (section 11).
3.2. What you record in the app
Your beauty devices (catalogue model or the name, brand and technology you type, body zones and their labels, duration and status), your fitness and supplement routines (name, category, duration, zones and notes), your schedules and reminders (weekly goal, days and time, and their change history) and your usage records: when you mark something as done and where from (app, widget, Apple Watch or notification), pauses, freezes and counters. Streaks are calculated on your device.
3.3. Data about your photos (without the image)
For each progress photo, only the date, the body zone and the device or routine it belongs to, to order your series and apply your plan’s limits; and your save a copy to Photos preference and the date we suggested turning it on, so your choice is respected on all your devices.
3.4. Suggestions for the device catalogue
If you manually add a device that is not in the catalogue, we keep its name, brand and technologies as a suggestion to grow the shared catalogue. Only the generic product listing goes into the catalogue, never who suggested it.
3.5. Purchases and subscription
- Your Pro access status: product (monthly or one-off), store, purchase and expiry dates, billing issues or refunds, and environment (live or test).
- Transaction identifiers and the technical purchase notifications RevenueCat sends us, which may include the price, currency, store country and RevenueCat’s user identifiers.
- We do not process your payment details (card, bank account): Apple handles the payment.
3.6. Apple Watch
So that the watch has its own session, we process a watch identifier (the vendor identifier iOS assigns to Gailuh on that Apple Watch), its session credentials (on the server, only as a hash) and, if you sign in on the watch with a code, your email to send it to you.
3.7. Service security
To prevent abuse we keep attempt counters linked to a fingerprint of the IP address or of the watch (computed with a secret key, so the IP cannot be derived from it) or to your internal identifier, and a record of each account deletion process with the status of its steps. Our server providers also log the IP address and technical data of each connection.
3.8. Product analytics (PostHog)
Unless you turn it off (section 13), the app sends usage events (for example, whether a sign-in worked and with which method, whether a purchase completed or whether a use was marked) and the analytics component adds automatic events, such as the app being opened, installed or updated, or repeated taps on a screen, with its technical name. Our server also records, with the same identifier and only if you have not turned analytics off, the outcome of some Apple Watch session operations. A filter drops device and routine names, text you type, photos, emails and names before sending. The events carry:
- a non-reversible hashed identifier, computed from your internal identifier (or a random one before you sign in). Because anyone who knows the internal identifier can recompute it, we treat it as pseudonymised data, not anonymous data;
- technical data: iPhone model, iOS and app versions, language and time zone;
- no location: we ask PostHog not to derive it from the IP address, and the IP address is not stored.
3.9. Error diagnostics (Sentry)
When the app or our server hits an error, we send a technical report: type of error, where in the code it happened, device model and system and app versions; for app errors, also a pseudonym of your account (a fragment of a salted hash of your internal identifier). Before sending, we remove or mask messages, text and identifiers that could contain personal data. For iPhone errors, the report includes a screen replay of the moments before and, where applicable, the rest of that usage session, configured to mask all text and all images. It does not depend on the analytics setting (section 13).
3.10. Communicating with you
- Service emails: codes to reset your password or sign in on the watch, and account confirmations. We do not send advertising or newsletters today; if we ever do, we will ask for your permission first and you will be able to withdraw it at any time.
- Support: if you write to us, we process what you tell us and your email or Instagram username in order to reply.
3.11. The gailuh.com website
- Hosting: our hosting provider logs the IP address and technical data of each visit.
- Visit measurement (PostHog, EU): to know how many
people visit the website, where they come from and whether they tap the
buttons to Instagram or the stores, the website page reads from your
browser and sends PostHog the address of the page
visited (with the link’s parameters, such as the
utmones), the referring page or campaign, the button tapped and technical data about the browser (browser and version, device type, operating system, language, time zone and screen size). We use no cookies and store nothing in your browser. To count visits without identifying you, PostHog derives from your IP address and browser a temporary identifier that changes every day (using a secret key it renews daily), does not keep the IP address and does not infer your location. These visits are stored in the same PostHog project as the app analytics, but with no link to your account or to your app identifier. If your browser sends the Global Privacy Control or Do Not Track signal, we do not measure your visit.
3.12. Data that never reaches our servers
Your progress photos, the share cards (which only go to the app or contact you choose), your Face ID, appearance and analytics preferences and your scheduled reminders never reach our servers or our providers’ servers: they stay on your iPhone or Apple Watch and, if it is on, in your iPhone’s iCloud Backup (section 4). The app also keeps a copy of your data on the device so it can work offline and show it in widgets and on the watch.
3.13. What we do not process
We do not access your GPS location, contacts, calendar, microphone or Apple Health (HealthKit), or process data about your menstrual cycle (section 4). We do not use the advertising identifier (IDFA), our providers do not receive it, and we do not track you across other companies’ apps or websites; that is why the app does not show you Apple’s tracking request.
3.14. Is this health data?
Gailuh does not ask about illnesses, diagnoses, medication, weight or your menstrual cycle, and we do not infer information about your health from your records or build profiles with them. That is why we treat them as ordinary personal data, with the same safeguards as everything else, and never for advertising or marketing. Please do not write information about your health in the free-text fields (names, zone labels and notes); if you do, that text is only stored, synced and shown to you, without being analysed or sent to analytics or error diagnostics.
4. Your progress photos, Face ID and backups
- Where they live. Photos you take or pick in the app are stored in Gailuh’s private storage on your iPhone, encrypted by iOS and without EXIF metadata (such as location). There is no copy of your photos on our servers or our providers’ servers and nobody on our team can see them: we do not carry out any processing of them or any facial recognition.
- Face ID. By default, the progress gallery, the comparison view and “My photos” are protected with Face ID (or your device’s unlock method). Apple checks it on your device: Gailuh never receives any data about your face, only the result. You turn it off in Settings → Privacy → Protect photos with Face ID.
- Copy to Photos (optional, off by default). The app only copies your photos to your photo library if you turn on “Save a copy to iPhone Photos”: it saves them to a “Gailuh” album and can recover them from it if you reinstall the app. Those copies (also in iCloud Photos, if you use it) are under your control and Apple’s.
- iCloud Backup of your iPhone. If it is on, iOS includes the app’s content in it, your photos too, so you can recover them when you restore or change your iPhone. That backup is in your Apple Account, not on our servers or our providers’ servers, and we have no access to it. To exclude Gailuh: iOS Settings → your name → iCloud → Storage (or Manage Account Storage) → Backups → your iPhone; Apple then removes Gailuh’s information from iCloud and you will no longer be able to recover your photos from there.
- If you uninstall the app, its data is erased, photos included, and the iPhone backup stops including them when it is updated: you will only keep the ones you saved to Photos.
- Cycle notice. Before an abdomen photo, the app may suggest waiting a few days because of possible cycle-related bloating. It depends only on the zone: we do not store or send any data about your cycle.
5. What we use your data for and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Your account: creating it, signing in, recovering access and deleting it, including revoking Gailuh’s access to your Apple Account | 3.1, 3.10 | Performance of the contract (Art. 6(1)(b)) |
| Providing the service: storing and syncing your records across iPhone, Apple Watch and widgets, calculating your progress and scheduling reminders | 3.2, 3.3, 3.6 | Performance of the contract (Art. 6(1)(b)) |
| Pro subscription: each plan’s limits, restoring purchases and billing issues | 3.5 | Performance of the contract (Art. 6(1)(b)); for purchase notifications not linked to an account, legitimate interest in resolving billing issues and defending ourselves against claims (Art. 6(1)(f)) |
| Growing the shared catalogue with your suggestions | 3.4 | Legitimate interest in improving the catalogue for all users (Art. 6(1)(f)) |
| Security: watch sessions, attempt limits, recording account deletions | 3.6, 3.7 | Legitimate interest in the security of the service (Art. 6(1)(f)) |
| Detecting and fixing errors (Sentry) | 3.9 | Legitimate interest in the app working in a stable and secure way (Art. 6(1)(f)) |
| Pseudonymised analytics to improve the app (PostHog) | 3.8 | Legitimate interest in improving the product (Art. 6(1)(f)); you can turn it off in Settings |
| Helping you when you write to us | 3.10 | Performance of the contract (Art. 6(1)(b)) or, if you are not a user, legitimate interest in replying (Art. 6(1)(f)) |
| Sending you advertising or newsletters, only if we turn this on (we do not today) | Your email (3.1) | Consent (Art. 6(1)(a)), which we will ask for first and you can withdraw at any time |
| Serving and protecting the website | 3.11 | Legitimate interest (Art. 6(1)(f)) |
| Measuring website visits and the use of its buttons, without cookies (PostHog) | 3.11 | Legitimate interest in knowing what works on the website (Art. 6(1)(f)); we do not measure when your browser sends Global Privacy Control or Do Not Track |
| Complying with legal obligations and defending ourselves against claims | Whatever is needed in each case | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
About legitimate interest. We have weighed each case (you can ask us for the detail): security and error diagnostics are essential for the service, and analytics carries no content, uses a pseudonymised identifier and is hosted in the EU, with no advertising purposes. You can object (section 12).
Which data is required. Only an email (or your Apple or Google account) to create the account, without which we cannot sync your data or provide the service. Everything else is up to you. Using Pro does not depend on accepting analytics.
No new uses. We do not use your data for other purposes without telling you first and, where the law requires it, asking for your consent.
6. iPhone permissions
The app asks for each permission only when it needs it, and you can withdraw it in iOS Settings → Gailuh: Camera, for your progress photos; Photos, to pick a photo and, only if you turn on copies or recovery, to use the “Gailuh” album; Face ID, to protect your photos; and Notifications, for your reminders. Without a permission, the rest of the app keeps working.
7. Notifications, widgets, Apple Watch and complications
- Reminders. They are scheduled by your iPhone, not a server. They show the name of the device or routine and may be visible on the lock screen and on your Apple Watch; hide their content in iOS Settings → Notifications → Gailuh → Show Previews.
- Widgets. They read what is due today from your iPhone, with no connection to our servers.
- Apple Watch. It shows your items by name, with its own session on our servers (section 3.6); your iPhone sends it, directly, the day’s count and whether you have Pro.
- Complications. They only show numbers and your Pro status. The watch may register with Apple’s notification service to update them; today that registration does not reach our servers.
8. Who we share your data with
8.1. Providers that process data on our behalf
They are processors: they only use your data to provide their service to us, following our instructions, and their processing contract (Art. 28 GDPR) obliges them to protect it, keep it confidential, help us with your rights, tell us about any breach and delete it when the service ends. None of them receives your progress photos.
| Provider | What for | Data | Where it is processed | Contract |
|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, authentication and server functions | Account and everything you record (3.1 to 3.7) | EU: Ireland (AWS eu-west-1) | DPA |
| PowerSync (Journey Mobile, Inc., US) | Sync between your iPhone, your Apple Watch and the server | The data that is synced (3.2, 3.3, 3.5) | EU: Ireland (AWS eu-west-1), with possible access from the US | DPA · sub-processors |
| RevenueCat, Inc. | Managing purchases and subscriptions | Your internal identifier, purchases and subscription status (3.5) | United States | DPA |
| PostHog, Inc. | Product analytics and website measurement | Pseudonymised usage events (3.8) and website visits, without cookies (3.11) | EU: Germany (PostHog EU Cloud) | DPA · sub-processors |
| Sentry (Functional Software, Inc.) | Error diagnostics | Pseudonymised technical reports (3.9) | EU: Germany (Frankfurt) | DPA · sub-processors |
| Resend (Plus Five Five, Inc.) | Sending service emails | Your email and the message content (3.10) | United States (sends from Ireland, but stores messages and logs in the US) | DPA · sub-processors |
| Google (Firebase Hosting) | Hosting gailuh.com | IP and technical data of the visit (3.11) | Google’s global network | Firebase data processing terms · Firebase privacy |
| Google (Google Workspace) | Irakai’s email, including the support and privacy mailbox | What you write to us and your email address (3.10) | Google’s worldwide network of data centres | Google Cloud Data Processing Addendum |
The safeguards for each transfer are in section 9. These providers in turn rely on sub-processors (for example, Amazon Web Services), listed in the links in the table.
8.2. Companies that process data as independent controllers
These companies process your data under their own policies when you use their services:
- Apple: if you sign in with Apple, buy in the App Store, use Face ID, iCloud Photos, iCloud Backup or the notification service. Apple Privacy Policy.
- Google: if you sign in with Google. Google Privacy Policy.
- Meta (Instagram): if you write to us on Instagram or share an achievement card there. Meta Privacy Policy.
8.3. Other recipients
We will only disclose your data to authorities, judges or courts when a law requires us to. We do not sell your data, we do not share it with third parties for advertising and we do not work with data brokers.
9. International transfers
We host data in the European Union with every provider that allows it. Even so, there are international transfers, because some providers are outside the EU and may access the data from there, or process it outside the European Economic Area. Each one has its safeguard, incorporated into the provider’s contract (section 8.1):
| Provider | Why there is a transfer | Safeguard |
|---|---|---|
| Supabase | Singapore company (data in Ireland) | The European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) |
| PowerSync | Its staff and infrastructure may access the data from the US, for example to provide support (data in Ireland) | Standard contractual clauses (Decision 2021/914) |
| PostHog and Sentry | US companies (data in Germany) | EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which both are certified, and standard contractual clauses |
| RevenueCat | Subscription data in the US | Standard contractual clauses (Decision 2021/914) |
| Resend | Service emails and sending logs stored in the US | Standard contractual clauses and the EU-US Data Privacy Framework, under which it is certified |
| Worldwide network: website (Firebase Hosting) and our email, including the support mailbox (Google Workspace) | EU-US Data Privacy Framework, under which it is certified, and, as a fallback, standard contractual clauses |
You can ask us for a copy of the safeguards at hola@gailuh.com.
10. How long we keep your data
| Data | Period |
|---|---|
| Account and everything you record | While you have the account; deleted when you delete it (section 11). |
| Items you delete in the app | They disappear from view immediately and are kept marked as deleted until you delete the account, so the deletion reaches all your devices. If you want us to erase them sooner, write to us. |
| Subscription and purchase notifications for your account | While you have the account; deleted when you delete it, including at RevenueCat. If another account’s notification mentions you (for example, because of a purchase transfer), it is kept for that account with your identifier replaced by a “deleted account” marker. |
| Purchase notifications the store does not link to an account (for example, a transfer) | Full content, 30 days, to resolve billing issues; after that, a minimal record with none of your data (identifier, type, environment and date) so it is not processed twice. If it mentions your account and you delete it, its content is erased at that moment. |
| Apple token | Encrypted, while you have the account; when you delete it, it is revoked with Apple and erased (if revocation remains pending, once it completes). |
| Record of each account deletion | 7 days after it completes or fails without having erased anything. If a step remains pending, it is kept meanwhile and retried every hour for 7 days and daily after that; if the only pending step is revoking Apple access and there is no token, it is treated as complete. |
| Attempt counters | 1 day (only fingerprint or identifier, time window and number of attempts); those for your account, also when you delete it. |
| Apple Watch sessions | One-time codes, 1 day after expiry; credentials, 30 days after expiry or revocation; everything, when you delete the account. |
| Providers’ technical logs (connections, website visits, email sending) | The limited time each keeps them to operate and protect its service; website logs (Google), a few months. |
| Analytics (PostHog) | When you delete your account we ask PostHog to delete your profile and events, which it completes shortly afterwards; the event recording that deletion carries no identifier. Turning analytics off does not erase what was already sent: if you want us to erase it, write to us. |
| Website visits (PostHog) | Nothing that can recognise you: the temporary identifier changes every day and is not linked to your account. Kept as visit statistics for at most 24 months. |
| Error diagnostics (Sentry) | Deleted automatically after 90 days at most. |
| Support conversations | As long as needed to help you and, afterwards, while related claims may arise. |
| Requests to exercise rights and our reply | Up to 3 years, as proof (limitation period for infringements, Art. 72 LOPDGDD). |
| Database backups | Daily, overwritten within about 7 days; deleted data disappears with them and is not restored. |
| Content on your iPhone | Until you delete it, delete the account or uninstall the app; your photos may remain in iCloud Backup until it is updated (section 4). |
Where the law requires us to keep some data for longer (for example, following a court order), we will keep it blocked, only for that purpose and period.
11. Deleting your account
In Settings → Delete account. It is permanent. When you confirm, we erase from our database everything linked to your account (devices, routines, records, photo data, preferences, subscription and purchase notifications), delete your customer record at RevenueCat, ask PostHog to delete your profile and events, revoke with Apple Gailuh’s access to your Apple Account if you signed in with Apple on your iPhone, delete your account and close your sessions (including the watch one) and erase the app’s content, photos included, on the iPhone you delete it from.
Please note:
- The account becomes inaccessible immediately; a step with a provider may finish shortly afterwards and, if it fails, it is retried automatically (section 10).
- Sentry does not allow deleting reports per person: since they only carry a pseudonym, they expire after 90 days at most.
- If you signed in with Apple only on the Apple Watch or on a device that did not give us the token, we may not be able to revoke access: do it in iOS Settings → your name → Sign in with Apple → Gailuh.
- On another iPhone with Gailuh you are signed out and, when it detects that the account no longer exists, it erases its local content, photos included; if it does not detect it, the photos stay on it, inaccessible from the app, until you uninstall Gailuh.
- We cannot delete your copies in Photos or iCloud: delete them from Photos. Those in iCloud Backup stay there until it is updated or you exclude Gailuh (section 4).
- Deleting your account does not cancel your subscription: cancel it in iOS Settings → your name → Subscriptions or Apple will keep charging you.
Signing out is not deleting your account: your data stays on our servers, and the local copy and your photos on your iPhone, inaccessible to any other account, until you sign in again.
12. Your rights and how to exercise them
You have the right to:
- Access your data and get a copy (Art. 15 GDPR).
- Rectify it (Art. 16); almost everything can be edited in the app.
- Erase it (Art. 17); also from the app (section 11).
- Restrict its processing in some cases (Art. 18).
- Port it: receive the data you gave us in a structured, commonly used format such as JSON (Art. 20).
- Object to processing based on legitimate interest (Art. 21): analytics is turned off in Settings → Privacy; website measurement, by turning on Global Privacy Control or Do Not Track in your browser; for everything else, write to us.
- Withdraw your consent where we have asked for it (for example, for newsletters), without affecting earlier processing (Art. 7(3)).
- Not be subject to automated decisions with legal or similarly significant effects (Art. 22; section 14).
How: write to hola@gailuh.com from your account’s email or telling us which it is. We will reply at no cost (Art. 12(5) GDPR) within one month, which may be extended by two further months in complex cases, in which case we will let you know. If we have reasonable doubts about your identity, we may ask you to prove it. We prepare access and portability copies on request; there is no automatic download in the app today.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency or with the authority in your country (sections 18 and 19).
13. Analytics and error diagnostics in detail
- Product analytics (PostHog, EU). On by default from the first launch, including before you sign in. You turn it off in Settings → Privacy → Product analytics: sending from that iPhone stops immediately and, on the following launches, the analytics component is not even started. The preference is stored only on that device: turn it off on each iPhone. The server events about the Apple Watch (section 3.8) also respect it. It is not used for advertising, not combined with data from other sources and does not record your screen.
- Error diagnostics (Sentry, EU). It works regardless of that setting because we need it for the app to work properly, and it only sends information when an error occurs (section 3.9). If you object, write to us: since we cannot turn it off for a single person, we will assess your request and explain whether compelling legitimate grounds (the security and stability of the service) prevail or what alternative we can offer.
14. Automated decisions
We do not make automated decisions that produce legal effects on you or similarly significantly affect you, and we do not profile you for such purposes. The app automatically applies your plan’s limits (Free or Pro); if you think they have been applied wrongly, write to us and a person will review it.
15. Minors
You must be at least 18 years old to use Gailuh (see the Terms and Conditions). We do not knowingly collect data from minors and, if we find that an account belongs to someone under 18, we will delete it. If you are a parent or guardian and believe a minor has given us their data, write to us.
16. How we protect your data
Encryption in transit (HTTPS/TLS) and at rest; per-account isolation on the server (row-level security and sync filtered by account) and on the device; sessions in the iOS keychain, watch credentials only as a hash and the Apple token encrypted; minimisation (photos never reach our servers, and analytics and diagnostics contain neither your name nor your email); and restricted access to production systems. No system is infallible: if a breach were likely to result in a high risk to you, we would tell you without undue delay and notify the AEPD where required.
17. Cookies and website
gailuh.com uses no cookies and stores nothing in your browser (no local storage or similar technologies), uses no advertising tools and loads no fonts or scripts from third-party servers: everything the page loads, including PostHog’s measurement component, is served from gailuh.com. To measure the visit, the page reads the technical data from your browser described in section 3.11, unless it sends Global Privacy Control or Do Not Track. We count visits without cookies with PostHog (section 3.11), and Google Firebase Hosting, our hosting provider, processes your IP address and technical browser data to serve the page, prevent abuse and give us aggregated statistics. The third-party sites we link to (App Store, Google Play, Instagram, our providers) have their own policies.
18. Complaints to the supervisory authority
If you believe we are not handling your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) through its electronic office or at www.aepd.es. If you live in another EU country, you can also complain to the data protection authority of your country; outside the EU, see section 19. We would be grateful if you told us first, in case we can solve it.
19. If you live outside the European Union
Gailuh is available worldwide. Wherever you live, we process your data from the EU, with the providers in sections 8 and 9 and the GDPR safeguards described in this policy, and we recognise the rights in section 12, which you exercise through the same channel: hola@gailuh.com. In addition:
- United Kingdom. The UK GDPR also applies, and you can complain to the Information Commissioner’s Office (ICO).
- California and other US states with privacy laws. We do not sell your personal data or share it for cross-context behavioural advertising (based on your activity in other companies’ apps or websites), and we do not carry out profiling with legal or similarly significant effects. You can ask us through the same channel for access, deletion, correction and portability, and we will not treat you differently for exercising these rights.
- Brazil, Canada and other countries. If the law of your country gives you rights over your data, such as the LGPD in Brazil or PIPEDA in Canada, you can exercise them through the same channel and complain to the data protection authority of your country.
20. Changes to this policy
We may update this policy when the app, our providers or the law change. The date and version at the top show when it was last changed. If the change is significant (for example, a new use of your data or a new provider outside the EU), we will write to your account email before it applies and, where needed, ask for your consent.
21. Contact
For any question about this policy or your data:
- Irakai Studio SL (Tax ID B95935615)
- C/ Ramón y Kareaga 13, 6º D, 48970 Basauri (Bizkaia), Spain
- hola@gailuh.com
Last updated: 14 October 2026 · Version 2.2