Effective Date: 1st October 2026
At Extramile, we are committed to transparency and accountability in how we handle your personal data, ensuring you have clear insights and control over your information while seamlessly enjoying our products.
This Privacy Policy (the “Privacy”) sets out the main principles on which the data collected from you, or that you provide to us, will be processed by us in connection with your use of “Oncely” (the “App”), in connection with your use of our memoir writing service: our websites and web properties (including our landing pages, quizzes, results pages, paywalls and checkout pages), the private writing workspace in which you create your book, our blog, all related services, and the printed books we produce and deliver to you (collectively the “Service”) provided by Extramile Limited, a company incorporated in Cyprus, company number ΗΕ 445953, whose registered office is located at Prodromou, 75, Oneworld Parkview House, Floor 4, 2063, Nicosia, Cyprus (“we”, “us”, “our” or the “Company”).
We encourage you to review our Privacy Policy in its entirety to gain insight into our personal data handling practices.
We have carefully designed this Privacy Policy to be clear, transparent, and accessible. However, if you have any questions or concerns regarding your privacy rights or how we handle your personal data, please feel free to contact us through:
Online: support@oncely.app
Mailing Address: Extramile Limited, Prodromou, 75, Oneworld Parkview House, Floor 4, 2063, Nicosia, Cyprus
Email: dpo@extramile-cy.com
We may revise this Privacy Policy from time to time to reflect:
Staying Informed. We encourage you to review this page periodically to stay informed about how we protect your personal data. The "Effective Date" at the top of this Privacy Policy indicates when the most recent changes were made.
Notification of Significant Changes. If we make material changes to this Privacy Policy that affect your rights or require your consent, we will notify you in advance through appropriate channels, such as:
This Privacy Policy is a notice, not a contract, and there is nothing for you to accept. Where a change requires your consent, we will ask for it before the change applies to you.
“Personal Data” refers to any information that identifies you as an individual or relates to an identifiable individual. Extramile Limited acts as the ‘controller’ of your Personal Data. As the controller, we determine the purposes and means of the processing of your personal data when you use our Service.
For the purposes of data protection laws in the European Union, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Cyprus Law 125(I)/2018 on the Protection of Natural Persons with regard to the Processing of Personal Data (“Personal Data Protection Law”), Extramile Limited is the controller of your personal data.
Certain aspects of our Service may be provided by our authorized partner Fulfilling Inc. This means that:
As you access and use our Service, we gather certain personal data through the following means:
Data collected before you have an account.
Much of the data described in this Privacy Policy is collected before you create an account or make a purchase — when you arrive from an advertisement, browse a landing page, take a quiz or view your results. At that stage we identify your session by a device or cookie identifier rather than by name. If you go on to subscribe, we link that session to your account. If you do not, support@oncely.app.
Data Directly Provided by You:
Basic Information. We collect the information necessary to personalize your account and provide you with tailored Service. This includes: your name, gender, age, email address, account and profile credentials, any other information you choose to share to personalize your account or profile, and optional information, such as preferences or interests, that you provide during onboarding or while using the Service.
Purchase and Subscription Information. Payment information is required to process your subscription. This includes subscription plan details, and payment information. We do not receive or store your card number, expiry date or security code: those are handled directly by our payment providers. We do receive and hold information about your transaction and subscription, including plan, price, billing period, purchase and renewal dates, refunds and cancellations.
Personalization and Service Interaction Information. We may collect and process information you provide during onboarding, through quizzes or assessments, or while using the Service, as well as information about your interactions with the Service. This may include your answers to the questions in the marketing quiz, the topic you selected, your progress through the guided questions, which chapters you have completed, and how you use the writing workspace. We use this information to provide and personalize the Service, recommend relevant Content, track your progress, and provide insights and recommendations based on your interests and use of the Service.
Profiles and inferences. We do not only store the answers you give. We use them, together with how you use the Service, to draw conclusions about you — for example your likely goals, your level of experience, and which content is likely to suit you — and we store those conclusions as part of your profile. Those conclusions are personal data about you, and you have the same rights over them as over the information you gave us directly.
Survey and Communication Information. We may collect any information you voluntarily provide when: participating in surveys, questionnaires, or Service testing, communicating with us or directed to us via letters, emails, and social media, or submitting reviews or testimonials regarding our Service. If you participate in any promotions or competitions we may run, we process information relevant to your participation. This data is processed to assess user opinions, improve our Service, and support the development of new features.
User Content. We process any content you publish or upload on our Service, in accordance with the provisions set out in our Terms regarding User Content.
Your book and what is in it.
What we hold. Everything you write in answer to the guided questions or in your own questions; the photographs you upload; any audio you record for dictation; the text a speech-to-text provider returns; the versions of your text before and after AI refinement; and the print-ready file we generate from all of it.
Why this is different. A memoir is not ordinary profile data. What people write here routinely includes information about their own health and the health of their family, their religious or philosophical beliefs, their political opinions, their sex life or sexual orientation, their ethnic origin, and sometimes criminal matters. Under the GDPR that is special category data under Article 9, and it is special category data whether we asked for it or not.
AI refinement. When you ask us to refine a passage, we send that text to a third-party large-language-model provider, which returns a suggested version. We show you both and you choose. We keep your original text. We contract with the provider on terms that prohibit the use of your content to train its models, and we do not train any model on your content. Prompts and the text returned are retained for two (2) months for quality control and then deleted.
Voice dictation. When you dictate, your audio is streamed to a third-party speech-to-text provider and returned as text. We keep the audio for one (1) month so that we can investigate problems, and then delete it.
Photographs. Photographs you upload are converted and resized on our servers and stored privately. They may contain location and device metadata, and they may show other people, including children.
People who appear in your book. Where your book contains information about other people, you are responsible for what you write and for the photographs you add, as set out in our Terms. We do not contact the people mentioned in your book.
How we handle it. We do not read your book except where a member of staff must review the print file before it goes to the printer, or where you ask us for support and give us access; we do not use anything in your book to build a profile of you, to target advertising, or to train any model. We do not disclose it to anyone except the print vendor, for the purpose of printing your book, and the speech-to-text and AI providers when you use those features. Access by our staff is limited, logged and confined to the purposes just described.
Data Automatically Collected by Us:
Log and Technical Information. When you access our website or use the App, certain information is automatically collected by your browser or device. This may include: your IP address, browser type, time zone, language settings, the date and time of your access, details about the features you use, actions you take within the Service, interactions with specific areas of the interface, and patterns of App usage, including session frequency and duration.
Device-Related Information. We collect information about the device you use to access our Service, including device model, type, unique device identifiers, operating system version, Internet service provider details, mobile carrier information, and hardware ID.
Other Sources. We may augment the information you provide with data obtained from third parties or other external sources. This additional data may include: details about how you interact with our Service or information from third parties to support marketing communications (only where you have opted in), refine our research, or enhance the delivery of our Service.
Data Collected via Cookies.
To provide you with an enhanced experience, our Service relies on technologies such as cookies, SDKs, and similar tools. These technologies assist us in tailoring your interactions, delivering relevant advertisements, and gaining insights into how our Service is used. Technologies that are not strictly necessary to provide the Service — including analytics, personalisation, advertising and attribution technologies, whether they operate through cookies on our websites or through software development kits in our App — are used only where you have given your consent, through our consent banner or, in the App, through the in-app consent prompt. You can withdraw your consent at any time contacting us via support@oncely.app or dpo@extramile-cy.com. Strictly necessary technologies, which are limited to those required to deliver the Service you have asked for, operate without consent.
Please note that this Privacy Policy does not apply to information collected by:
Third-Party Service. Any third party, including through any application or content (including advertising) that may link to or be accessible from or through our Service.
Personnel and Job Applicants: This Privacy Notice does not apply to the collection of personal data from employees, job applicants, contractors, business owners, directors, officers, or other staff members except for California Residents.
Non-Personal Data: Information that cannot reasonably identify, relate to, describe, or be linked (directly or indirectly) to a specific individual is not considered personal data. This Privacy Notice does not govern the processing of such non-personal information.
We collect and process personal data to deliver, enhance, and secure our Service, ensuring a seamless and personalized experience. Below, we outline the purposes for which your data is processed:
To Ensure Access to and Proper Delivery of our Service. We process your personal data to enable your access to and use of our Service, including Content, the information and content you provide to create your book, personalized recommendations, quizzes, interactive features, and other functionality available through the Service. This includes: verifying your identity and providing uninterrupted access to our Service, promptly addressing any operational or technical problems.
To Fulfil Transactions. We collect the information required to process your transactions, which includes managing subscription payments and providing any related services to ensure seamless access to the features you have subscribed to.
To Print and Deliver Your Book. We process your personal data to produce and deliver your personalized book. This includes using the information and content you provide to create and print your book, arranging its delivery to the recipient and delivery address you specify, and contacting you regarding the production, dispatch, or delivery of your book.
To Customize Your Experience. We process your personal data to tailor the Service to your interests, goals, preferences, and interactions with the Service. This may include personalizing educational Content, recommendations, quizzes, activities, and other features based on information you provide and your use of the Service.
To Analyse Usage and Performance. We use your personal data to gain insights into how you interact with our websites and App. This helps us identify the most popular features, assess the effectiveness of our content, and understand user behavior. These insights are used to refine functionality, improve usability, and ensure that the Service operates effectively and efficiently for all users.
To Improve the Service. We process personal data to enhance the overall quality and functionality of the Service. By refining features and developing new tools, we ensure that the Service evolves to meet your needs. Data is also used to optimize our offerings, conduct research and surveys, and perform financial analyses to assess billing, pricing, and other processes that may require improvement. These efforts enable us to create a better user experience and provide innovative, value-driven solutions.
For Advertising and Marketing Purposes. We may process your personal data to enhance and deliver targeted advertising within our Service and on third-party platforms. Your information helps us display personalized ads and content that reflect your interests and preferences. We work with external advertising networks, social media platforms, and analytics providers to promote our Service across various channels. We may add your email address to our marketing list, provided we receive consent or otherwise establish a legal basis for sending you marketing communications. As a result, you will receive information about our products, such as for example, special offers. Additionally, we analyse the performance of our marketing campaigns to assess their effectiveness and refine our advertising strategies for better engagement.
To Ensure the Security and Integrity of our Service. We process your personal data to safeguard the security and stability of our systems, networks, and users. Measures are taken to prevent unauthorized access, detect misuse or fraudulent activities, and ensure the integrity of our IT infrastructure through consistent monitoring and maintenance.
To Provide Support and Communicate with You. When you reach out to us with inquiries, concerns, or feedback, we process your personal data to assist you and address your requests. This may include sending responses via email, providing updates related to your use of our Service, or resolving reported issues. We may also review communications and interactions with you to ensure the quality of our support, improve staff training, and effectively handle any complaints you raise. Where applicable, we may use AI-powered tools to assist in analysing and responding to support requests. Such tools are used to support our personnel and do not make autonomous decisions that produce legal or similarly significant effects concerning you.
To Comply with Legal Obligations. We process your personal data to meet our responsibilities under applicable laws and regulations. This may involve using your information to investigate disputes or claims related to our Service or to respond to legal, governmental, or regulatory requests. Your information may also be processed to fulfil obligations related to anti-money laundering measures, fraud prevention efforts, tax compliance, sanctions adherence, or other legal requirements. We may use your personal data to assert or protect our legal rights when appropriate.
We are committed to transparency in how we collect, use, and process your personal data. Under applicable data protection laws and other relevant regulations, we rely on specific legal bases for processing your personal data. The legal basis varies depending on the purpose of personal data processing, as outlined below.
| PURPOSE OF THE PROCESSING | LEGAL BASIS | CATEGORIES OF PERSONAL DATA |
|---|---|---|
|
To Ensure Access to and Proper Delivery of our Service |
Performance of a Contract (Article 6(1)(b) GDPR) Legitimate Interests (Article 6(1)(f) GDPR) Explicit consent (Article 9(2)(a) GDPR)** |
All categories of data. |
|
To Fulfil Transactions* |
Performance of a Contract (Article 6(1)(b) GDPR) Legitimate Interests (Article 6(1)(f) GDPR) |
Payment details e.g., subscription payments, billing information, service usage history related to transactions etc. |
|
To Print Your Book |
Performance of a Contract (Article 6(1)(b) GDPR) |
Details contained within your memoir, recipient identity, delivery destination, and contact phone number. |
|
To Customize Your Experience |
Performance of a Contract (Article 6(1)(b) GDPR) Legitimate Interests (Article 6(1)(f) GDPR) |
User preferences and settings, interaction and behavioural data, customization preferences. |
|
To Analyse Usage and Performance |
Legitimate Interests (Article 6(1)(f) GDPR) |
Websites and App interaction data, feature usage statistics, engagement metrics (e.g., time spent, navigation patterns), etc. |
|
To Improve the Service |
Legitimate Interests (Article 6(1)(f) GDPR) |
User feedback and survey responses, performance data on features and tools, financial analysis related to billing and pricing etc. |
|
For Advertising and Marketing Purposes |
Consent (Article 6(1)(a) GDPR), and consent under Article 5(3) of the ePrivacy Directive for the storage of, or access to, information on your device. |
Ad engagement data, targeting and audience segmentation data, information shared with third-party advertisers and analytics providers etc. |
|
To Ensure the Security and Integrity of our Service |
Legitimate Interests (Article 6(1)(f) GDPR) |
Authentication and access logs, security monitoring and threat detection data, fraud prevention indicators etc. |
|
To Provide Support and Communicate with You |
Performance of a Contract (Article 6(1)(b) GDPR) Legitimate Interests (Article 6(1)(f) GDPR) |
Inquiries and support requests, subscription status and details, billing period, tone analysis data processed via the AI API to personalize responses and route requests, communication logs (e.g., email, chat), customer service interactions and quality assurance data, etc. |
|
To Comply with Legal Obligations |
Compliance with Legal Obligations (Article 6(1)(c) GDPR). |
Information required for regulatory compliance (e.g., anti-money laundering, tax compliance), dispute resolution and claims-related data, government and law enforcement request responses etc. |
*We provide you with the option to make purchases directly within our App or through our websites. Your payment information is processed securely through third-party payment systems and providers, and we do not collect, store, or process your card number, expiry date or security code. We do receive information about the transaction itself, as described above.
** Some pieces of information we collect may be regarded as a special category of personal data or sensitive data under certain data protection laws that we are subject to. This may include certain information you share to create your book. When this is the case, including but not limited to the examples mentioned above, we will strive to ask your consent for processing of such data. You may withdraw or update your preferences regarding the processing of your sensitive data at any time by adjusting your preferences directly in your profile in the App or by contacting us at dpo@extramile-cy.com.
In-App Purchases. If you purchase within our App, your payment will be processed through third-party payment providers, such as:
These platforms handle all payment transactions independently, and we do not have access to, or store, your payment card details.
Website Purchases. If you choose to purchase a subscription or other services directly through our websites, the payment will be processed through an authorized third-party payment provider. In this case:
Payments on our website may be processed through Stripe, PayPal, Primer, Braintree, and Fulfilling Inc., as applicable. Fulfilling Inc. acts as a billing partner in connection with the relevant payment flows.
Payment Provider Privacy Policies. For all transactions, we strongly recommend reviewing the Privacy Policy of the payment provider processing your transaction. For example:
Security and Compliance. We take your financial security seriously and ensure that all payment providers we work with:
To provide our Service effectively, we may need to share your personal data with certain third parties. Such sharing will be carried out in compliance with applicable privacy laws.
Third-Party Service Providers. We may share your personal data with carefully selected service providers that assist in operating, maintaining, and enhancing our Service.
These may include but are not limited to:
These third parties will only process your personal data under contractual obligations ensuring they adhere to strict data protection standards, and they are prohibited from using your personal data for any purpose other than those specified in our Privacy Policy.
Third-Party Marketing Partners. Where you have consented to marketing communications, we share your contact details with the provider that sends them on our behalf. You can withdraw consent at any time. Separately, where you have consented, we may provide advertising platforms such as Meta, Google and TikTok with a list of contact details, in a hashed form, so that they can show our advertising to you or to people with similar characteristics. Those platforms decide for themselves how they use that information and act as controllers in their own right, not as our service providers. You may withdraw your consent at any time by following the unsubscribe instructions provided in our emails by the support team.
Legal Compliance and Protection of Rights. We may disclose your personal data when required to do so under applicable law, regulation, or legal process, including:
Data Transfers Within Our Corporate Group. To support our global business operations and provide seamless services, we may share your personal data with our affiliated entities, subsidiaries, and trusted partners. These transfers are conducted strictly in accordance with applicable data protection laws and are governed by robust data protection agreements.
Data Storage. Our commitment to data security and privacy means that all personal data is stored on secure servers that we either own or license from trusted third-party providers. These servers are protected using industry-standard security measures to prevent unauthorized access, data loss, or misuse.
Data Transfers Outside the EEA. In certain circumstances, we may need to process or transfer your data to trusted third-party service providers outside the EEA to ensure the effective operation and delivery of our Service. This may include servers or partners based in the United States or other jurisdictions. Before engaging any third-party processor located outside these regions, we conduct thorough risk assessments and ensure they meet strict privacy and security requirements aligned with international data protection standards.
Legal Safeguards for International Transfers. Whenever personal data is transferred outside the EEA, we comply with GDPR by implementing legally recognized safeguards, including Standard Contractual Clauses (SCCs) as approved by the European Commission, ensuring an equivalent level of data protection. Where an adequacy decision is unavailable, we apply additional safeguards such as encryption, strict access controls, and security audits to mitigate risks associated with cross-border data transfers.
To learn more about Standard Contractual Clauses under EU law, please visit this link.
Data Minimization and Anonymization. To further enhance privacy and security, we apply principles of data minimization and anonymization, ensuring that only the necessary data is transferred outside the EEA to fulfil specific purposes. This reduces potential risks associated with international data transfers.
| Recipient’s name | Recipient’s privacy policy | Purpose |
|---|---|---|
|
Amplitude |
Tracking user interactions and engagement within the Service. Collecting user behaviour data, event tracking, and Service usage statistics to analyse user behaviour, measure App performance, and improve user experience. |
|
|
AppsFlyer |
Providing mobile attribution and marketing analytics, including deep linking functionality. Collecting device information, user interactions, and attribution data to measure the effectiveness of marketing campaigns, improve user acquisition strategies, and facilitate deep linking within the Service. |
|
|
Firebase Crashlytics |
Tracking and reporting Service crashes and stability issues. Collecting crash reports, device state information, and user interactions leading up to a crash to help us identify and fix bugs, ensuring a stable and reliable Service experience. |
|
|
Firebase Authentication |
Providing secure authentication for users signing in to our Service. Collects user identifiers (e.g., email, phone number) and authentication tokens to manage user sessions and secure access to the App. |
|
|
Firebase Analytics |
Tracking user interactions and engagement within the Service. Collecting user behaviour data, event tracking, and app usage statistics to analyse user behaviour, measure Service performance, and improve user experience. |
|
|
Google Sign-In |
Allowing users to sign in to our Service using their Google account. Collecting user’s Google ID, name, email address, and profile picture to authenticate users and enable a seamless login and personalized experience. |
|
|
AWS AppSync |
Enabling real-time data synchronization between the Service and backend services. Used for querying, mutating, and subscribing to data through a secure GraphQL interface. Collecting and syncing user and application data across devices to maintain app performance, reliability, and data consistency. |
|
|
OpenAI (ChatGPT API) |
Processing customer support inquiries and subscription details to generate personalized responses and analyse tone for routing to appropriate support workflows. |
|
|
Reteno |
Enhancing user engagement through personalized communication and retention strategies, including marketing emails and push notifications. Collecting user activity data, preferences, engagement metrics, and contact information to create personalized user experiences, improve retention efforts, and send targeted marketing emails and push notifications. |
|
|
AppLovin |
Providing advertising, attribution, measurement, and marketing analytics services. Processing device and App information, advertising identifiers, user interactions, event data, and advertising preferences to deliver and personalize advertisements, measure advertising performance, analyse campaign effectiveness, and optimize our marketing activities and user acquisition. |
|
|
Microsoft Clarity |
Providing website and user experience analytics, including session recordings, heatmaps, and interaction analytics. Processing information about users’ interactions with our websites, such as clicks, scrolling, navigation patterns, device and browser information, to understand how users interact with our websites, identify usability issues, and improve website functionality and user experience. |
|
|
Lulu Press Inc. |
To print, bind and ship the copy of your book that your subscription includes, and any reprint or replacement copy |
We and our third-party partners, including analytics providers, advertising networks, and affiliated service providers, use standard tracking technologies to collect certain information automatically when you use the Service. These technologies may include cookies, software development kits (SDKs), application programming interfaces (APIs), web beacons, scripts, and tracking pixels.
Tracking technologies help us to:
Information collected through these tools may include identifiers (such as your device ID, advertising ID, or IP address), browser type, operating system, referral URLs, interactions with the App, and session duration. This information may be linked to your Account or other personal information we hold about you, consistent with applicable law.
Some portions of our Service employ advertising technologies that use tracking tools to deliver interest-based advertising (“cross-context behavioural advertising”). These technologies, used by our advertising partners such as Meta (Facebook), Google, TikTok, Pinterest, X, Snapchat, and others, help us and them display ads that are more relevant to your interests. When you interact with our Service, these partners may collect information such as:
We may also advertise our Service on third-party websites and platforms (for example, showing an ad on Facebook or TikTok). When you click on one of these ads and install or access our App, that third party may inform us that you were referred through their ad, helping us evaluate the performance of our campaigns. To manage your preferences or opt out of personalized advertising, you can:
Please note: opting out does not eliminate advertising altogether, it only means the ads you see will be less relevant to your interests. Your advertising ID may still be used for frequency capping, reporting, or aggregated analytics.
You can also manage your preferences regarding cookies and other tracking technologies via our cookie consent banner or by adjusting your device or browser settings. Guidance on managing cookies and advertising IDs is available from your device manufacturer or browser provider.
| Recipient’s name | Recipient’s privacy policy | Purpose |
|---|---|---|
|
Meta Pixel |
https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0 |
Tracks conversions from Facebook and Instagram ads, builds audience groups, and optimizes ad delivery. |
|
Google Ads and Tag Manager: |
Measures advertising reach and enables remarketing to users who have interacted with our Service. |
|
|
TikTok Pixel |
Enables ad targeting and performance measurement for TikTok users |
|
|
Pinterest Tag |
Tracks engagement with our promotions on Pinterest and supports audience analytics. |
|
|
X Pixel |
Measures advertising effectiveness and allows retargeting of relevant user groups |
|
|
Snapchat Pixel |
Links user actions in the App with Snapchat ad performance to improve audience matching. |
We are dedicated to respecting your privacy and safeguarding your personal data. In line with this commitment, we adhere to principles regarding the handling of your information, as detailed below:
No Sale, License, or Rental of Personal Data. We do not sell your personal data for money. However, some of the advertising activity described in this Privacy Policy meets the definition of a “sale” or a “share” under United States state privacy laws, because those laws cover disclosures made for other valuable consideration and disclosures for cross-context behavioural advertising. You can opt out of that activity at any time using the link on our website and the methods set out in the United States section below. Your personal data is otherwise only disclosed as described in this Privacy Policy.
Limited Sharing with Service Providers. We share your personal data exclusively with service providers who assist in delivering and supporting our Service, as described herein. We ensure that no data is shared with external providers or partners without appropriate data protection agreements or contractual terms in place to safeguard your information.
Protection of Children’s Data. Our Service is for adults aged 18 and over and we do not knowingly collect personal data from anyone younger. There is a separate point about children here: a memoir often includes photographs of children and passages about them. That information reaches us because our adult customer chose to include it, and our customer is responsible for having the right to do so, as set out in our Terms. We do not use it for any purpose other than producing the book
We store your personal data only for as long as it is necessary and relevant to achieve the purposes for which it was originally collected. This includes providing our Service, maintaining security, resolving disputes, and complying with legal and regulatory obligations.
Retention Periods. When your personal data is no longer required for its original purpose, we will either securely delete or anonymize it so that it can no longer be linked to you. If you deactivate or delete your account, we will retain your personal data for no longer than six (6) months, unless retention is required for legal, regulatory, or contractual obligations. In cases where legal or regulatory requirements necessitate longer retention, we will store only the minimum personal data necessary and ensure it is appropriately protected.
Exceptions to Deletion Requests. Even if you request the erasure of your personal data, certain circumstances may require us to retain minimal personal data, including:
Once retention is no longer required for these purposes, we will ensure the final deletion or anonymization of your personal data securely.
We take data security seriously and have implemented both organizational and technical safeguards to protect your personal information against unauthorized access, loss, alteration, or misuse.
Organizational Security Measures. We enforce strict internal policies and procedures to maintain the security and confidentiality of personal data, including:
Technical Security Measures. We deploy reasonable cybersecurity protections to safeguard your personal data, including:
Acknowledgment of Security Limitations. We take commercially reasonable measures to protect your personal data, utilizing security technologies and best practices to guard against unauthorized access, data breaches, and cyber threats. However, no security system is entirely impervious to risks. Ensuring the safety of your information is an ongoing effort that involves continuous monitoring, risk evaluation, and enhancement of security protocols. The presence of a security incident does not automatically imply non-compliance with legal requirements or industry standards.
Immediate Assessment and Containment. In the unlikely event of a personal data breach, we will promptly assess the incident, contain its impact, and evaluate the risks to individuals’ rights and freedoms. Our breach response may involve actions such as logging affected users out, resetting passwords, and enhancing security protocols to mitigate potential harm. By maintaining strong personal security practices and promptly reporting any concerns, you can help us protect your information effectively.
Regulatory Reporting Obligations. Where the breach is likely to result in a risk to your rights and freedoms, we will report it within 72 hours of becoming aware to our lead supervisory authority, the Office of the Commissioner for Personal Data Protection of Cyprus.
To report a personal data breach or seek assistance, please contact us via support@oncely.app or dpo@extramile-cy.com. We will address your concerns accordingly.
As a resident of the European Union (EU), European Economic Area (EEA), you are entitled to certain rights regarding your personal data under the General Data Protection Regulation (GDPR). Below is a summary of your key rights and how you can exercise them:
Right to Access Your Data. You have the right to request access to the personal data we hold about you. Upon request, we will provide a copy of your personal data along with details about how it is processed, shared, and stored.
Right to Rectification. If your personal data is inaccurate, incomplete, or outdated, you have the right to request corrections or updates to ensure it is accurate and complete.
Right to Erasure (‘Right to be Forgotten’). You can request the deletion of your personal data where:
Your right to erasure may not apply where processing is necessary for legal compliance, public interest, or the establishment, exercise, or defense of legal claims.
Right to Restrict Processing. You may request that we restrict the processing of your personal data if:
Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, and machine-readable format and, where feasible, request the direct transfer of this personal data to another service provider.
Right to Object to Processing. You have the right to object to the processing of your personal data where:
Right to Withdraw Consent. If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing conducted before consent was withdrawn.
Right to Lodge a Complaint. If you believe your privacy rights have been violated, you have the right to file a complaint with your local data protection authority (DPA).
To exercise your rights, please contact us via support@oncely.app or write to us at the address set forth above.
If you reside outside the European Union (EU), European Economic Area (EEA), you may have specific privacy rights under your country’s applicable data protection laws. Below is a summary of key rights based on various jurisdictions:
If you are a resident of California, Virginia, Colorado, Connecticut, or other U.S. states with privacy laws, you may have certain rights under laws such as the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), and others.
If applicable, you have the right to:
If you are a California resident, you may also use an authorized agent to submit requests on your behalf.
If you are a resident of Canada, you have the following rights under PIPEDA:
Brazil – Lei Geral de Proteção de Dados (LGPD)
If you are a resident of Brazil, you are entitled to rights under the LGPD, including:
For privacy concerns, you may contact the Brazilian Data Protection Authority (ANPD) at ANPD website.
If you are a resident of Australia, you have rights under the Privacy Act 1988, including:
If you are located in Japan, your rights under the APPI include:
We will respond to requests within a reasonable timeframe, as required by Japanese law.
If you reside in Mexico, you are granted rights under the LFPDPPP, commonly known as ARCO rights:
You also have the right to revoke consent for the use of your personal data, subject to certain exceptions.
To exercise your rights, you may contact our privacy team using the details in the “Contact Us” section.
If you submit a request to exercise your data protection rights, we will process it as follows:
Response Timeframe. We respond within the period required by the law that applies to you: one month under the EU GDPR, extendable by a further two months for complex requests; forty-five days under the California and other United States state privacy laws, extendable by a further forty-five days.
Right to Decline Requests. We reserve the right to decline requests that are manifestly unfounded, excessive, or repetitive under applicable privacy laws. If your request falls into this category, we will notify you of our decision and provide reasons where required by law.
Identity Verification. To protect your privacy and prevent unauthorized access, we may request additional information to verify your identity before processing your request. This step is necessary to ensure:
If we are unable to reasonably verify your identity, we may be unable to fulfil your request. We will inform you of this and provide guidance on any alternative steps you may take.
General Details. Residents of certain U.S. states, such as California, may have additional rights regarding their personal information under applicable state laws. These include the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), among other state privacy laws. Where specific legal provisions in this notice do not apply, the Privacy Policy shall govern the processing and handling of personal information.
Exercising Your Rights. Only you or an authorized representative legally permitted to act on your behalf may submit a request related to your personal information. Please refer to the previous section for details on the rights available to you and how to exercise them. In addition to those rights, this section provides further information about the processing, collection, and disclosure of personal information under U.S. State Privacy Laws.
Definition of Personal Information. Personal Information refers to any information that identifies, relates to, describes, or can reasonably be linked to you as an individual.
Pursuant to the CCPA, the term “personal information” excludes:
Where we rely on that exclusion, we commit, as California law requires, to take reasonable measures to ensure the data cannot be associated with you, to use and hold it only in de-identified form, to make no attempt to re-identify it, and to bind by contract any recipient of it to the same three obligations.
Data Controller Responsibilities. Extramile Limited is responsible for determining how your personal information is collected, used, disclosed, and shared in accordance with applicable US privacy laws, including the CCPA and other state-level privacy regulations.
Sale and sharing. We do not sell your personal information for money. We do, however, work with advertising and analytics partners to deliver relevant advertising, and that activity meets the definition of a “sale” or a “share” under California law. You can opt out of it at any time, as set out below.
How This May Be Considered “Selling” or “Sharing” Under the CCPA? Under the CCPA, the sharing of personal information for targeted advertising or cross-context behavioral advertising may be classified as “selling” or “sharing”, even if no money is exchanged. This means that certain activities, such as allowing advertising networks to collect identifiers or browsing behavior to show you personalized ads, could be considered data sharing under California law.
Your Right to Opt-Out of Targeted Advertising and Data Sharing. Even though we do not sell your personal information for direct monetary gain, you still have the right to opt out of any sharing of your personal information with our advertising and analytics partners. This includes targeted advertising, personalized marketing, behavioral tracking and analytics-based audience insights.
You can exercise this right by:
Please note that under California’s "Shine the Light" law (California Civil Code § 1798.83), residents of California may request information about the disclosure of their personal information to third parties for direct marketing purposes. If applicable, you may submit such a request by contacting us.
Do Not Track. The "Do Not Track" (DNT) feature is a privacy preference that some web browsers offer, allowing users to indicate their preference not to be tracked by websites or online services. However, at this time, there is no universally accepted standard for implementing DNT signals, and not all browsers support this feature. Consequently, we do not currently respond to DNT signals.
Global Privacy Control. Global Privacy Control is different from Do Not Track, and we do treat it as a valid instruction. Where your browser or extension sends a Global Privacy Control signal, we treat it as a request to opt out of the sale and sharing of your personal information for that browser, and we apply it without asking you to take any further step.
Request for Access: you have the right to ask for access to (i) the personal and sensitive information we have about you and how we use it; and (ii) the categories, sources, and third parties that have received your personal information or to whom it has been "sold" or disclosed in the past 12 months. You can make this request once a year at no cost. Please ensure the subject line reads "California Privacy Rights Request," and include relevant details such as your name, street address, city, state, and zip code. Once we validate your request, we will provide the requested disclosure within 30 days of receipt, unless an extension is necessary. If we require additional time due to the complexity of the request or the high volume of requests, we may extend the response period by an additional 30 days. In such cases, we will notify you within the initial 30-day period, explaining the reason for the extension and the expected response timeline.
Under the CCPA, privacy rights extend beyond users to all individuals, including job applicants, employees, independent contractors, and business partners who are California residents. These individuals may request information about our information collection practices regarding their personal information and may also exercise rights to access, delete, correct, or opt out of certain information sharing as permitted under California law. To make a request, please follow the instructions outlined in this Privacy Policy.
Categories of Personal Information Collected & Disclosed. We collect the following categories of personal information in connection with the Service. The table below outlines:
| CATEGORY | EXAMPLE | CATEGORIES OF SOURCES | BUSINESS PURPOSE | WHO WE SHARE IT WITH | RETENTION PERIOD OR CRITERIA |
|---|---|---|---|---|---|
|
Identifiers |
Name, email address, phone number, account username, IP address etc. |
Directly from you, when you create an account, subscribe, or contact support. Automatically, from your device and browser when you use the Service. From our payment processors and from the app stores, where you buy through them. |
Facilitating business operations and service delivery. Engaging in lawful advertising, marketing, and promotional efforts. Managing account registration, authentication, and support functions. Maintaining, enhancing, and safeguarding the functionality, reliability, and security of the Service. |
Advertising platforms, technology and service providers, analytics and research firms, cloud storage providers, social media companies, business partners, affiliated companies, and payment processors. |
For as long as your account is open, then deleted. Records we must keep for tax, accounting, or the defence of legal claims are kept for the period the relevant law requires. |
|
Personal characteristics |
Age or age range, interests, goals, preferred topics, language and content preferences, quiz or assessment responses, self-reported digital habits, Content viewed or saved, completed lessons or activities, progress indicators, and interactions with recommendations. |
Directly from you, through the onboarding questionnaire, your profile, and the choices you make in the Service. |
Facilitating business operations and service delivery. Maintaining, enhancing, and safeguarding the functionality, reliability, and security of the Service. |
Technology, hosting, and cloud service providers that support the relevant functionality and process such information as necessary to provide the Service. |
For as long as your account is open, then deleted, or earlier if you ask us to delete it. |
|
Service interaction and activity information |
Details contained within your memoir, course and task progress, completed activities, quiz responses and results, interactions with recommendations, and other activity within the Service. |
Automatically, from your use of the Service. |
Providing Service functionality. Tracking progress and completion of activities. Personalizing Content and recommendations. Maintaining and improving the functionality and performance of the Service. |
Technology and service providers, analytics providers, hosting and cloud service providers. |
For as long as your account is open, then deleted. Statistics that no longer identify you may be kept after that. |
|
Payment information |
Purchase history, transaction details, subscription data etc. |
From our payment processors and the app stores, and directly from you where you give us billing details. |
Facilitating business operations and service delivery. Processing transactions, fraud detection, maintaining financial records |
Payment processors |
For the period tax and accounting law requires, and for as long as a chargeback or refund remains possible. We do not store full payment card numbers. |
|
Internet or network activity |
Browsing history, usage logs, App interactions, cookies etc. |
Automatically, from your device and browser. From our analytics, attribution, and advertising partners, and from cookies and similar technologies on our website and in the App. |
Facilitating business operations and service delivery. Maintaining, enhancing, and safeguarding the functionality, reliability, and security of the Service. |
Advertising platforms, technology and service providers, analytics and research firms, cloud storage providers. |
Server and security logs: 12 months. Analytics and advertising identifiers: for the lifetime of the cookie or identifier as stated in the Cookie Policy, or until you opt out, whichever comes first. |
|
Geolocation data |
Approximate location based on IP address etc. |
Automatically, derived by us from your IP address. We do not collect precise geolocation. |
Facilitating business operations and service delivery. Maintaining, enhancing, and safeguarding the functionality, reliability, and security of the Service. |
Advertising platforms, technology and service providers, analytics and research firms, cloud storage providers. |
Not stored as a separate record. It is kept only for as long as the log or record it was derived from. |
|
Inferences drawn from personal information |
User preferences, behavioral trends, if applicable, etc. |
Derived by us from the other categories in this table. We do not buy inferences from data brokers. |
Facilitating business operations and service delivery. Engaging in lawful advertising, marketing, and promotional efforts. Maintaining, enhancing, and safeguarding the functionality, reliability, and security of the Service. |
Advertising platforms, technology and service providers, analytics and research firms, cloud storage providers, social media companies, business partners, and affiliated companies. |
For as long as your account is open, then deleted. Deleted sooner if you opt out of profiling or withdraw your consent. |
We include this section for residents of other US states with privacy laws that may impact them. This section applies wherever you live in the United States. Rather than list each state law separately, we apply the highest standard required by any of them to every United States resident. Approximately twenty states now have comprehensive privacy laws in force, and more take effect each year; applying a single standard means your rights do not depend on which list we have remembered to update. These privacy laws include the Virginia Consumer Data Privacy Act (“VCDPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Colorado Privacy Act (“CPA”), and the Nevada Privacy Law (“NPL”), the Montana Consumer Data Privacy Act (“MCDPA”), the Oregon Consumer Privacy Act (“OCPA”), and the Texas Data Privacy and Security Act (“TDPSA”). This section is intended to comply with these laws by supplementing the information provided elsewhere in the Privacy Policy.
Collection of Personal Information. We may collect personal information as described and categorized elsewhere in this Privacy Policy. The specific definitions of sensitive information vary by state law.
Use of Personal Information. We may collect, use, and disclose personal information for the purposes outlined in this Privacy Policy. This includes providing services, improving our products, and complying with legal obligations.
Disclosure of Personal Information. We may disclose personal information to third parties and service providers as described in this Privacy Policy. We ensure such disclosures comply with applicable laws to protect your privacy and rights.
Residents of Colorado, Connecticut, Virginia, Utah, Montana, Oregon, and Texas are entitled to the following rights concerning their personal information:
State-Specific Rights. Each state has unique provisions under its privacy laws. Below are additional details for residents of Montana, Oregon, Texas, and Nevada.
*Some of our advertising activity meets the definition of a sale or share under state law, and we do build profiles to personalise the Service and our advertising. You can opt out of both as set out above.
*Some of our advertising activity meets the definition of a sale or share under state law, and we do build profiles to personalise the Service and our advertising. You can opt out of both as set out above.
How to Exercise Your Rights. To exercise any of the rights outlined above:
Appealing a refusal. If we refuse to act on your request, we will tell you why, and we will tell you how to appeal. If you live in Virginia, Colorado, Connecticut, Montana, Oregon, or Texas you have a statutory right to appeal that refusal.
How to appeal. Reply to the message in which we refused your request, or write to us at dpo@extramile-cy.com with the word “APPEAL” in the subject line, or use the same online form you used to make the original request and choose “Appeal”. Appealing is free, it is no harder than making the original request, and you do not need to give a reason.
When we will reply. We will tell you in writing whether we have changed our decision, and we will give you our reasons. We will do so within forty-five (45) calendar days of receiving your appeal if you live in Colorado or Oregon, and within sixty (60) calendar days if you live in Virginia, Connecticut, Montana, or Texas. Where Colorado law allows and the appeal is genuinely complex, we may take a further sixty (60) calendar days; if we do, we will tell you within the first forty-five (45) calendar days and explain why.