Privacy Policy

LifeOS AI ("we", "us", "our") is a company registered in the Republic of South Africa and is the "responsible party" for the personal information we process. We are committed to protecting your privacy and complying with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Constitution of the Republic of South Africa, and applicable data protection laws. This Privacy Policy explains what personal information we collect, how we use it, and the rights you have over it.

1. Information we collect

We collect personal information that you provide directly and information generated through your use of the Service:

• Account information: name, email address, and authentication details when you register or log in.
• Profile and assessment data: the answers and preferences you provide during onboarding and life assessment, including demographics, goals, and life-area priorities.
• Life data: the goals, habits, tasks, journal entries, finance records, health logs, and other content you enter into the Service.
• Usage data: device, browser, interaction, and analytics data collected when you use the Service.
• Payment data: billing-related information processed by our payment partner iKhokha; we do not store full card details on our servers.

Data we collect — summary table

2. How we use your information

We process your personal information for the following purposes:

• To provide, maintain, and improve the Service, including personalising your dashboard and AI Coach outputs.
• To create and administer your account and authenticate your identity.
• To process subscription payments and manage your entitlements.
• To communicate with you about your account, updates, and support.
• To analyse usage and improve the safety, security, and performance of the Service.
• To comply with legal obligations and protect our legitimate business interests.

3. Legal basis for processing

We process personal information only where we have a lawful basis under POPIA, including: your consent; the need to perform a contract (providing the Service you requested); compliance with a legal obligation; and our legitimate interests, balanced against your rights. You may withdraw consent at any time, though this may affect features that depend on the relevant data.

4. Sharing with third parties

We do not sell your personal information. We share it only with service providers and processors who act on our behalf and under our instructions (for example, hosting, analytics, email, and payment processing partners), and where required by law. These parties are bound by confidentiality and POPIA-compliant processing terms. If you use the Service with a coach or professional, you may choose to share specific data with them via the Service's sharing controls; such sharing is governed by your settings and the professional's relationship with you.

5. Cross-border transfers

Some of our processors may operate outside South Africa. Where personal information is transferred across borders, we ensure it receives a level of protection consistent with POPIA, using appropriate safeguards such as standard contractual clauses or processing only in jurisdictions assessed as providing adequate protection.

6. Data security

We use reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse, including encryption in transit, controlled access, and regular review. No system is completely secure; in the event of a security breach we will notify affected users and the Information Regulator as required by POPIA.

7. Data retention

We retain your personal information only for as long as necessary to fulfil the purposes set out in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and data at any time, subject to records we are legally required to retain.

8. Your rights under POPIA

You have the following rights regarding your personal information:

• Access — to request a copy of the personal information we hold about you.
• Correction — to have inaccurate or incomplete information corrected.
• Deletion — to request deletion of your personal information, subject to legal retention requirements.
• Objection — to object to processing based on legitimate interests or for direct marketing.
• Withdrawal of consent — to withdraw consent you have given at any time.
• Complaint — to lodge a complaint with the Information Regulator (see below).

To exercise any of these rights, contact our Information Officer using the details below.

9. Cookies and tracking

We use cookies and similar technologies to operate and improve the Service. You can control cookies through your browser settings; disabling them may affect some features of the Service.

10. Children

The Service is not intended for individuals under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Information Officer and contact

Our Information Officer can be contacted at privacy@lifeos.ai or via our Contact page for any privacy-related request or complaint. You may also lodge a complaint with the Information Regulator (South Africa) at complaints@inforegulator.org.za or www.inforegulator.org.za.

12. How we use AI

The LifeOS AI Coach generates recommendations and insights based on your own entered data — goals, habits, journal entries, health logs, finance records, and tasks. Here is exactly how AI is used and the guardrails that protect you:

• Suggestions only: every AI recommendation is a suggestion. Nothing is ever auto-applied to your data without your explicit confirmation. You review and approve every action before it takes effect.
• No AI writes to Journal or Health: the Coach can propose tasks, habits, and goal-deadline changes, but it never creates, edits, or deletes your Journal entries or Health logs. Those are always your own input.
• Grounded in your data: recommendations cite the specific data point that prompted them (e.g. "3-day habit streak broken"). Generic advice that would be true without your data is not acceptable.
• Confidence labelling: when the data behind a recommendation is thin, the Coach says so explicitly and marks it "limited confidence" — it never overstates certainty.
• Escalation, not diagnosis: for financial, legal, or clinical matters, the Coach declines to give authoritative advice and recommends a qualified human professional. It names the signal that triggered escalation.
• Crisis protocol: if your input suggests self-harm or crisis, the Coach surfaces crisis resources immediately — it never gives a dismissive or generic reply in that situation.
• Review anytime: you can review what is AI-generated versus your own input at any time. AI-proposed actions are logged as CoachRecommendations with their outcome (accepted, dismissed, snoozed, completed), visible in your Coach history.
• Off by default for training: your data is not used to train AI models unless you explicitly opt in under Privacy preferences.

13. Third-party processors

We rely on the following third parties to operate the Service. Each is bound by POPIA-compliant processing terms and limited to the purpose stated:

We do not sell your personal information to any third party. Cross-border transfers use appropriate safeguards consistent with POPIA (see section 5).

14. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the Service or by email. Continued use after the effective date constitutes acceptance of the updated policy.