EVOLUX XP — PRIVACY POLICY

Last Updated: June 2026 Effective Date: Upon account creation

This Privacy Policy explains how Evolux XP ("we," "us," "our") collects, uses, stores, and protects your personal information when you access or use the Platform. It applies to all users globally, with specific provisions for users in the EU, UK, Portugal, Brazil, United States, Canada, and Mozambique.

We comply with:

GDPR — EU General Data Protection Regulation (2016/679)
UK GDPR + Data Protection Act 2018 + Consumer Contracts Regulations 2013
Portuguese Law 58/2019 (implementing GDPR in Portuguese national law)
LGPD — Brazil's Lei Geral de Proteção de Dados (Lei nº 13.709/2018)
CCPA — California Consumer Privacy Act (as amended by CPRA)
PIPEDA — Canada's Personal Information Protection and Electronic Documents Act + Quebec Law 25 (Law 64)
Mozambican consumer and digital framework: Consumer Protection Law (Lei n.º 22/2009, de 28 de Setembro), Consumer Protection Regulations (Decreto n.º 27/2016, de 18 de Julho), Electronic Transactions Law (Lei n.º 3/2017, de 9 de Janeiro), and constitutional privacy protections under the Constitution of the Republic of Mozambique (Articles 41 and 86), and the Civil Code (Decree-Law no. 47344)
COPPA — Children's Online Privacy Protection Act (US)

1. WHO WE ARE

Evolux XP is operated by an individual creator based in Portugal. As the operator, we act as the data controller responsible for your personal data under applicable law.

Data Protection Contact: Email: support@evolux-xp.com Subject line: PRIVACY REQUEST

For EU and UK users: Our primary supervisory authority is the CNPD (Comissão Nacional de Proteção de Dados), Portugal's national data protection authority. You may also contact the supervisory authority in your own EU member state.

For Mozambican users: The competent authority for consumer complaints is the Instituto de Defesa do Consumidor (INAM) and the Instituto Nacional das Tecnologias de Informação e Comunicação (INTIC), which oversees e-commerce and electronic transaction compliance under Lei n.º 3/2017.

2. DATA WE COLLECT

2.1 Data You Provide

| Category | Examples | |---|---| | Account data | Email address, hashed password, date of birth (age group only) | | Profile data | Display name, selected visual theme and archetype, avatar image | | Financial organization data | Budget account names, income figures, expense amounts, transaction descriptions, category names — all user-entered and simulated only | | Task and goal data | Task titles, deadlines, goal descriptions, challenge entries | | Habit data | Habit names, daily completion records, streak history | | Anti-habit data | Anti-habit names, relapse records, SOS session logs — only collected with your explicit separate consent (see Section 11.2) | | Focus session data | Pomodoro session durations, linked tasks | | Consent records | Timestamps and content of consent actions you perform in the Platform (see Section 11.3) | | Support communications | Messages you send to support@evolux-xp.com |

2.2 Data Collected Automatically

| Category | Examples | |---|---| | Usage data | Features accessed, session duration, in-Platform actions performed | | Device and technical data | Browser type, operating system, screen size, IP address | | Session data | Login timestamps, session identifiers | | Performance data | Error logs, load times |

2.3 Data We Do NOT Collect

Real bank account numbers, credit card details, or any banking credentials (payment data is handled exclusively by Stripe, our PCI-DSS compliant processor)
Biometric data of any kind
Your precise GPS location or physical address
Any data for advertising or profiling for commercial purposes
Health records, medical history, or clinical diagnoses
Real transaction data from any bank, payment processor, or financial institution

3. LEGAL BASIS FOR PROCESSING

| Processing Activity | Legal Basis | |---|---| | Creating and managing your account | Contract performance | | Delivering all core Platform features (tasks, habits, goals, focus timer, gamification) | Contract performance | | Financial organization data (Flow Budget) | Contract performance + explicit consent at feature activation | | Anti-habit and health-adjacent behavioral data | Explicit, separate, freely given consent (required; feature is inaccessible without it) | | Platform analytics and improvement | Legitimate interest | | Security and fraud prevention | Legitimate interest | | Consent record storage | Legal obligation + legitimate interest | | Marketing communications | Consent | | Legal compliance obligations | Legal obligation |

Withdrawing consent: You may withdraw any consent you have given at any time via your account settings (Profile → Data & Privacy) or by contacting support@evolux-xp.com. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent for anti-habit data will disable access to the Anti-Habits module.

4. HOW WE USE YOUR DATA

We use your personal data exclusively to:

Create, authenticate, and manage your account
Provide all features of the Platform, including gamification scoring, rankings, and financial organization tools
Process subscription payments through Stripe
Send essential service communications (account alerts, billing notifications, policy updates)
Detect and prevent fraud, abuse, and security threats
Analyse usage patterns in aggregate to improve the Platform
Respond to your support requests and inquiries
Comply with legal obligations applicable to us

We do not:

Sell your personal data to any third party, under any circumstances
Share your financial data with any third party for any purpose
Use your data for targeted advertising of any kind
Make automated decisions with legal or similarly significant real-world effects about you
Use your data to assess your creditworthiness or financial position
Share your anti-habit or behavioral data with any third party

5. DATA SHARING

We share your data only as follows:

| Recipient | Purpose | Safeguard | |---|---|---| | Supabase | Database storage and authentication infrastructure | Data Processing Agreement, Standard Contractual Clauses (EU-approved) | | Stripe | Subscription payment processing | Stripe's PCI-DSS compliance; Stripe's own privacy policy governs payment data | | Vercel | Platform hosting and delivery | Data Processing Agreement | | Legal authorities | Compliance with lawful, verified legal orders only | Only when legally compelled after verification of the order |

We do not sell, rent, barter, or trade your personal data. We do not share your data with advertisers, data brokers, or social media platforms.

6. DATA RETENTION

| Data Type | Retention Period | |---|---| | Account and profile data | Duration of account + 30 days after deletion | | Financial organization data | Duration of account + 30 days after deletion | | Habit and task data | Duration of account + 30 days after deletion | | Anti-habit data | Duration of account + 30 days after deletion (or immediately upon consent withdrawal) | | Consent records | Minimum 3 years from date of consent (legal compliance requirement) | | Usage and analytics logs | 12 months rolling | | Security and access logs | 24 months | | Backup copies | Up to 90 days after deletion request | | Support communications | 24 months from last communication |

When you delete your account, all personal data is permanently deleted within 30 days, except for consent records (retained for the mandatory 3-year period) and data we are legally required to retain. We will inform you of any mandatory retention obligations at the time of your deletion request.

7. YOUR RIGHTS

7.1 All Users

Access: Request a copy of all personal data we hold about you, including your consent records
Correction: Request correction of any inaccurate data
Deletion: Request permanent deletion of your account and all associated data, subject to mandatory retention obligations
Portability: Receive your data in a structured, machine-readable format (JSON or CSV)

7.2 EU and UK Users (GDPR / UK GDPR)

All of the above, plus:

Restriction: Request that we pause processing while a dispute is being resolved
Objection: Object to processing based on legitimate interests
Complaint: Lodge a complaint with the CNPD (Portugal) at cnpd.pt, or with your local EU member state supervisory authority, or the ICO (UK) at ico.org.uk

7.3 Brazilian Users (LGPD)

All general rights above. Requests will be fulfilled within 15 days (as required by the LGPD). You also have the right to information about any third parties with whom your data has been shared, and the right to revoke consent at any time.

The national supervisory authority for data protection in Brazil is the ANPD (Autoridade Nacional de Proteção de Dados) at gov.br/anpd.

7.4 California Users (CCPA / CPRA)

Right to know what personal information is collected and how it is used
Right to deletion of personal information
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information — we do not sell or share personal information
Right to limit the use and disclosure of sensitive personal information
Right to non-discrimination for exercising your privacy rights

"Do Not Sell or Share My Personal Information": We do not sell or share personal information for advertising or cross-context behavioral advertising purposes. No opt-out is needed because we do not engage in these practices.

7.5 Canadian Users (PIPEDA / Quebec Law 25)

All general rights above apply. Quebec users additionally have the right to be informed of any automated profiling. The gamification attribute system (Radar Chart) constitutes automated scoring based on your in-Platform actions; you may request information about how your attributes are calculated at any time.

7.6 Mozambican Users

Under the Consumer Protection Law (Lei n.º 22/2009) and the Electronic Transactions Law (Lei n.º 3/2017), and consistent with the constitutional right to privacy under the Constitution of the Republic of Mozambique, you have the following rights:

Right to information: To be informed clearly about what data is collected, why, and how it is used, before or at the time of collection
Right to access: To request a copy of the personal data we hold about you
Right to correction: To request correction of inaccurate or incomplete data
Right to deletion: To request that your data be deleted when it is no longer necessary for the stated purpose, or when you withdraw consent
Right to fair treatment: To be treated without discrimination and to be free from deceptive, coercive, or unfair data practices
Right to redress: To lodge a complaint with the Instituto de Defesa do Consumidor (INAM) if you believe your rights have been violated

Complaints relating to electronic transactions and digital platform conduct may also be addressed to the INTIC (Instituto Nacional das Tecnologias de Informação e Comunicação), which is responsible for oversight of e-commerce compliance under Lei n.º 3/2017.

We will respond to data requests from Mozambican users within 30 days of receipt.

7.7 How to Exercise Your Rights

Contact us at support@evolux-xp.com with the subject line PRIVACY REQUEST, or use the data management options available in your account settings under Profile → Data & Privacy.

Response timelines:

Brazil (LGPD): 15 days
EU and UK (GDPR / UK GDPR): 30 days
California (CCPA/CPRA): 45 days
Mozambique: 30 days
All other jurisdictions: 30 days

Identity verification may be required before we process your request.

8. COOKIES

We use cookies and similar technologies as described in our Cookie Policy, which is incorporated into this Privacy Policy by reference. By continuing to use the Platform after accepting the cookie consent notice, you consent to our use of cookies as described therein.

9. DATA SECURITY

We implement the following security measures:

All data transmitted between your device and the Platform is encrypted via HTTPS/TLS
All data stored in our database is encrypted at rest via Supabase's infrastructure
Row Level Security (RLS) is enforced on all database tables, ensuring you can only access your own data
Access to production systems is restricted to the minimum necessary personnel
We conduct periodic reviews of our security practices and access controls

Data Breach Notification: In the event of a personal data breach that poses a risk to your rights and freedoms:

We will notify the relevant supervisory authority within 72 hours (GDPR / UK GDPR requirement)
We will notify affected users without undue delay
Mozambican users: we will comply with notification obligations under the Electronic Transactions Law (Lei n.º 3/2017) and general principles of good faith and consumer protection under Lei n.º 22/2009

10. CHILDREN'S PRIVACY

The Platform is not directed at children. The following minimum age requirements apply:

| Jurisdiction | Minimum Age | |---|---| | European Union | 16 years (or lower age permitted by national law, minimum 13) | | United Kingdom | 13 years | | United States (COPPA) | 13 years | | Brazil | 13 years | | All other jurisdictions | 13 years |

We implement a technical age gate during account registration. If the date of birth entered indicates a user is below the applicable minimum age, account creation is blocked automatically and no data is stored.

If we become aware that we have collected data from a child below the applicable minimum age without proper consent, we will delete all associated data immediately.

Parents or guardians who believe their child has registered without consent should contact us at support@evolux-xp.com with the subject line CHILD PRIVACY. We treat all such reports with absolute priority.

11. SPECIAL CATEGORIES OF DATA AND MANDATORY CONSENT GATES

11.1 Financial Organization Data

All financial data entered into the Flow Budget module is treated with heightened care. It is used solely to provide the budgeting and financial organization features you have requested. It is:

Never shared with third parties for any purpose
Never used for advertising
Never used to assess creditworthiness
Never connected to or synchronized with any bank, financial institution, or payment account

The Flow Budget module operates entirely as a personal simulation environment — the equivalent of a digital spreadsheet with envelope budgeting features. No real money is moved, held, or transferred by the Platform.

11.2 Health-Related and Behavioral Data (Anti-Habits Module) — Mandatory Explicit Consent Gate

The Anti-Habits module allows users to track behaviors they wish to reduce or eliminate, which may include behaviors related to health (such as smoking, alcohol consumption, impulse spending, or other habitual behaviors). This type of data is classified as sensitive personal data under the GDPR (Article 9), and as data requiring heightened protection under the LGPD and equivalent frameworks.

This module is inaccessible unless and until you provide explicit, informed, separately obtained consent.

The consent gate operates as follows:

The first time you navigate to the Anti-Habits page, a mandatory consent modal is displayed
The modal clearly states the nature of the data being collected and its sole purpose (personal behavioral tracking within the Platform)
The modal clearly states that this data is not shared with any third party, not used for medical purposes, and that Evolux XP is not a healthcare provider
You must actively check a confirmation checkbox and tap the "I confirm and proceed" button — the modal cannot be bypassed or dismissed without making an explicit choice
If you decline, you are redirected away from the Anti-Habits module, which remains locked until you provide consent
Your choice (accepted or declined) is stored as a consent record (see Section 11.3)

Important disclaimers displayed within the consent modal:

The Anti-Habits module is a personal organizational tool for behavior tracking only. It is not a medical device, not a clinical tool, and does not provide medical advice, psychological diagnosis, or addiction treatment. Evolux XP is not a healthcare provider. If you are experiencing difficulties related to addiction, mental health, or any health condition, please seek help from a qualified healthcare professional.

11.3 Consent Record Storage

For every consent action you take in the Platform — including acceptance of these Terms, acceptance of this Privacy Policy, acceptance of the Anti-Habits data consent, and acceptance of subscription billing terms — we store a consent record containing:

The unique user identifier (anonymized)
The date and time of consent (UTC)
The version of the document or feature to which consent was given
A hash of the consent document text presented to the user at the time of consent
The user's explicit action (e.g., checkbox confirmed + button clicked)
The IP address and device type at the time of consent

These records are stored in a dedicated, append-only consent_records table in our Supabase database, protected by Row Level Security. They are retained for a minimum of 3 years to comply with the FTC Negative Option Rule (US), the GDPR (EU/UK), the LGPD (Brazil), and equivalent regulations. They cannot be deleted by the user and cannot be deleted by us except where legally required.

12. INTERNATIONAL DATA TRANSFERS

Your data is stored on Supabase infrastructure, which may process data in multiple regions. When data is transferred to or processed in countries outside the European Economic Area (EEA) or the United Kingdom, we ensure appropriate safeguards are in place, including:

Standard Contractual Clauses (SCCs) approved by the European Commission
UK International Data Transfer Agreements (IDTAs) where applicable

For Mozambican users: data transfers are governed by the principles of purpose limitation, proportionality, and data minimization established in the Electronic Transactions Law (Lei n.º 3/2017) and the Consumer Protection Law (Lei n.º 22/2009). We maintain Data Processing Agreements with all sub-processors.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy. If you do not agree to a material change, you may delete your account before the change takes effect.

14. SUPERVISORY AUTHORITY CONTACTS

| Jurisdiction | Authority | Contact | |---|---|---| | Portugal / EU primary | CNPD | cnpd.pt | | United Kingdom | ICO | ico.org.uk | | Brazil | ANPD | gov.br/anpd | | Canada | OPC | priv.gc.ca | | United States | FTC | ftc.gov | | Mozambique (consumer protection) | INAM | — | | Mozambique (e-commerce / digital) | INTIC | intic.gov.mz |

15. CONTACT

For all privacy-related requests, questions, or concerns:

Email: support@evolux-xp.com Subject: PRIVACY REQUEST

We aim to respond to all privacy-related inquiries within 5 business days, and within the statutory periods defined in Section 7.7 for formal rights requests.