Privacy Policy — E=CVⁿ: Your Exponential Self

Controller: Carprix, LLC, a Florida limited liability company, 251 Valencia Avenue, #143167, Coral Gables, FL 33134, United States of America.

• Privacy requests and questions: privacy@ecvn.ai
• Support: support@ecvn.ai
• Data Protection Officer / Encarregado (Brazil): Rodrigo Nunes Füchter, privacy@ecvn.ai
• Representative in the European Union (GDPR Art. 27): [EU-REP]
• Representative in the United Kingdom (UK GDPR Art. 27): [UK-REP]

• We use your data to run the App, to guide you along your career plan and to keep your account and subscription working.
• The App's assistant is an automated digital assistant that uses artificial intelligence models supplied by contracted providers (Anthropic and OpenAI). You are always talking to an automated system, not to a person. We ask for your explicit permission before any of your content is sent to these providers.
• Sensitive information (for example, racial or ethnic origin, religion, culture or health) is processed only if you raise the topic yourself and give explicit consent. It is never used for metrics, rankings, comparisons, profiling for advertising or marketing.
• We do not sell your personal data, do not share it for cross-context behavioral advertising, show no advertising and do not track you across other companies' apps or websites.
• You can see, correct, export and delete what the App knows about you, and you can delete your account inside the App, either immediately or on a scheduled date no later than 30 days after your request.

Category	Examples	Purpose	Legal basis (GDPR / UK GDPR · LGPD)
Account data	Name, e-mail address, password hash, Apple or Google account identifier, language, time zone	Create and secure your account; sign-in; communications about the service	Performance of contract (Art. 6(1)(b) · Art. 7, V)
Basic profile	Date of birth (entered at sign-up and kept in your profile), sex, place of birth, education, current occupation	Verify that you are 18 or older; personalize your career plan	Performance of contract (Art. 6(1)(b) · Art. 7, V)
Career content	Your CV (uploaded file or narrated history), answers to interview blocks, goals, achievements, setbacks, notes, your "rule book", self-assessments	Build and improve your CV, your 30-day plan, your feedback and your progress through the "saddles" of the method	Performance of contract; explicit consent for the processing by model providers (Section 5)
Voice, photos, videos and files	Voice recordings sent to the assistant; photos, videos, audio and documents of your work	Transcribe, describe and organize your work into a work map and rule-book suggestions	Performance of contract; consent for access to microphone, camera and files (requested at the moment of use)
Conversations with the assistant	Messages you write or say, replies, the context sheet and notes the App keeps about you	Provide the assistant's guidance with continuity	Performance of contract; explicit consent for processing by model providers
Special categories of data	Racial or ethnic origin, religion or beliefs, culture, health, emotional life — only when you bring them up	Take them into account in the guidance you asked for, as you decide	Explicit consent (Art. 9(2)(a) · Art. 11, I); revocable at any time
Subscription data	Subscription plan, status, trial, renewal and cancellation dates, store transaction identifiers, country of the store	Grant access to paid features; prevent fraud; meet accounting duties	Performance of contract; legal obligation (Art. 6(1)(c) · Art. 7, II)
Calendar (device)	Free and busy time windows on the calendar of your device, and events you ask the App to create	Suggest 30-minute blocks for your plan and add them only after your confirmation	Consent (permission requested at the moment of use)
Notifications	Push token, preferred time for reminders, text of each reminder	Send one daily reminder at your active time	Consent (system permission), revocable in the App and in the device settings
Product analytics	Screens used, features activated and funnel events, which are pseudonymous: linked to your internal account ID, without your name or e-mail address; no content of your conversations or files	Understand which features help, improve the App	Consent (Art. 6(1)(a) · Art. 7, I), revocable in You › Privacy
Diagnostics	Crash reports, performance data, device model, operating system and app version, without content or contact data	Fix errors; keep the service secure and available	Legitimate interest in security and reliability (Art. 6(1)(f) · Art. 7, IX); you may object at privacy@ecvn.ai
Security data	Sign-in events, IP address, rate-limit and abuse signals	Protect accounts, prevent fraud and misuse	Legitimate interest (Art. 6(1)(f) · Art. 7, IX); legal obligation where applicable
Support	Messages you send to support@ecvn.ai	Answer you	Performance of contract; legitimate interest

Biometrics. Face ID, Touch ID and Android biometric unlock are handled entirely by your device's operating system. We never receive or store your biometric data; the App only receives a yes/no answer from the device.

Emotion recognition. The App does not infer emotions from your voice or face. The assistant only takes into account what you say or write.

Data you must provide. Account data, date of birth (to verify that you are 18 or older) and acceptance of the Terms of Use are required to open an account. Everything else is optional; if you choose not to provide it, the guidance will be less personalized.

The App's guidance is generated automatically from your content and from the content of the book. The assistant may make mistakes; review important information before you rely on it. The assistant does not make decisions that produce legal effects on you or similarly significantly affect you; any decision about your career remains yours.

We share personal data only with service providers that process it on our behalf, under written contracts that oblige them to protect it at least to the standard described in this Policy and to use it only to provide their service to us:

Provider	Service	Location of processing
Amazon Web Services, Inc.	Hosting, database, file storage, e-mail delivery, encryption keys	United States (us-east-1)
Anthropic, PBC	AI models for the assistant's conversations, CV extraction, description of photos and videos, nightly summaries	United States
OpenAI, L.L.C.	Speech-to-text transcription, text embeddings; backup model for the assistant	United States
RevenueCat, Inc.	Subscription status management for App Store and Google Play	United States
650 Industries, Inc. (Expo)	Delivery of push notifications to Apple and Google notification services: push token, device platform and the text of the reminder	United States
PostHog, Inc.	Product analytics (only with your consent), pseudonymous and linked to your internal account ID, without conversation or file content	European Union
Functional Software, Inc. (Sentry)	Crash and error reporting, without content or contact data	United States
Apple Inc. and Google LLC	Sign-in (if you choose them), app distribution, payments and delivery of push notifications to your device	According to their own policies

The model providers process your content only to return the answer to the App and are contractually prohibited from using it to train their models. Before the first time your content is sent to them, the App shows a consent screen that names Anthropic and OpenAI and asks for your explicit permission; you can withdraw it in You › Privacy, in which case the assistant's features stop working and the rest of the App (book content, your saved data) remains available.

We may also disclose data when required by law or by a valid order of a competent authority, to protect the rights, safety and property of users or of Carprix, or in connection with a merger, acquisition or sale of assets, in which case this Policy will continue to apply to your data.

Carprix is located in the United States, and your data is stored in the United States. When the law of your country requires a transfer mechanism, we use: for the European Economic Area, the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) or the EU-U.S. Data Privacy Framework where the recipient is certified; for the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner; for Brazil, the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024) or another mechanism of Article 33 of the LGPD; and, for Switzerland and other countries, the equivalent mechanisms. You may request a copy of the relevant safeguards at privacy@ecvn.ai.

Data	Retention
Account, profile, career content, conversations, notes	While your account is active
Original voice, photo, video and file uploads	While your account is active; you may delete originals after they are processed
After you delete your account	Removed from our active systems immediately ("Delete now") or on the scheduled date, no later than 30 days after the request; encrypted backups are overwritten within a further 35 days
Inactive accounts (no sign-in for 24 months)	Deleted after 30 days' notice by e-mail
Records of subscription transactions	For the period required by tax and accounting law
Security logs	Up to 12 months
Product analytics events	Up to 24 months, pseudonymous and linked to your internal account ID
Special categories of data	Until you delete them or withdraw consent, and in any case with your account

We keep data for longer only when the law requires it or to establish, exercise or defend legal claims, and only for as long as needed.

Data is encrypted in transit (TLS 1.2 or higher) and at rest (AWS KMS). Your personal narratives and notes receive an additional layer of encryption per user. Access is restricted per user in every query, administrative access requires single sign-on and multi-factor authentication and is logged, and logs do not contain the content of your conversations. On the device, the App stores only an encrypted index and cache. No system is completely secure; if a personal data breach is likely to affect you, we will notify you and the competent authorities as required by law.

Depending on where you live, you have the right to:

• access your data and receive a copy;
• rectify inaccurate data;
• erase your data;
• restrict or object to processing, including processing based on legitimate interest;
• data portability (export in JSON and PDF in You › Privacy › Download my data);
• withdraw consent at any time, without affecting processing carried out before the withdrawal;
• not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (the App does not make such decisions);
• lodge a complaint with a supervisory authority: in the EU, the authority of your country of residence; in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in Brazil, the Autoridade Nacional de Proteção de Dados (gov.br/anpd).

Brazil (LGPD, Art. 18): confirmation of processing; access; correction; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with consent; information about the entities with which we share data; information about the possibility of not providing consent and its consequences; and revocation of consent.

United States residents: where a state privacy law applies to us (for example, California, Colorado, Connecticut, Virginia, Texas or Oregon), you may request to know, access, correct, delete and port your personal information, and to opt out of sale, targeted advertising and profiling. We do not sell personal information, do not share it for cross-context behavioral advertising and do not use it for targeted advertising or profiling with legal or similarly significant effects. Sensitive personal information is used only to provide the service you asked for. We will not discriminate against you for exercising your rights. You may use an authorized agent, and you may appeal our decision by replying to our response.

How to exercise your rights. In the App, under You › Privacy and You › Privacy › Delete account, or by writing to privacy@ecvn.ai. We may ask you to confirm your identity. We reply within one month (GDPR / UK GDPR), within 15 days (LGPD, full statement) or within 45 days (U.S. state laws), with extensions only where the law allows.

If you choose to tell the assistant about your health, that information may be "consumer health data" under laws such as the Washington My Health My Data Act. We collect it only with your consent, use it only to provide the guidance you requested, do not sell it and do not share it with third parties other than the service providers listed in Section 5, which process it on our behalf. You may access it, delete it and withdraw your consent at any time through You › Privacy or privacy@ecvn.ai.

In the App. Go to You › Privacy › Delete account. After you confirm with your device's biometrics or by typing the confirmation word, choose one of two options:

• Delete now: your account is closed and your data is deleted from our active systems immediately.
• Schedule deletion: your account is deleted on the date shown on the screen, 30 days after your request.

In both cases we confirm the request by e-mail to the address of your account.

Without the App. Write to privacy@ecvn.ai from the e-mail address of your account, or follow the steps at https://ecvn.ai/app/delete-account; you do not need to reinstall the App. We may ask you to confirm your identity. Your account is deleted within 30 days of the confirmed request, and we confirm it by e-mail.

Encrypted backups are overwritten within a further 35 days. Records that the law requires us to keep (Section 7) are retained only for the required period.

Deleting your account does not cancel a subscription purchased in the App Store or Google Play; cancel it in your store account settings to stop future charges (see the Terms of Use).

The App is intended only for people aged 18 or over. When you create an account, the App asks for your date of birth to verify that you are 18 or over and does not let you continue if you are not. Your date of birth is kept in your profile, where you can correct it. We do not knowingly collect data from minors. If we learn that an account belongs to a person under 18, we will delete it.

If what you write or say indicates that you may be in acute distress or at risk, the App interrupts the current activity and shows you the contact details of support and emergency services in your country. This is done only to protect your vital interests (GDPR Art. 6(1)(d) and 9(2)(c); LGPD Art. 7, VII and 11, II, "e"). The App does not contact anyone on your behalf, and the episode is not used for analytics or any other purpose.

We will notify you in the App before material changes take effect and, where required, ask for your consent again. The effective date at the top shows the current version.

Carprix, LLC · 251 Valencia Avenue, #143167, Coral Gables, FL 33134, USA · privacy@ecvn.ai