Privacy Policy

Privacy Policy

Welcome to Biko AI

We take your privacy very seriously. Please read this Privacy Policy carefully as it contains important information on who we are and our information practices, meaning how and why we collect, use, disclose, share, store, and retain your personal information (where applicable). It also explains your rights in relation to your personal information and how to contact us or supervisory authorities in the event you have a complaint or request.

We collect, use, and are responsible for certain personal information about you in connection with your access to and use of our website, applications, and platform (collectively, the “Site” and “Services”). Biko AI operates an artificial intelligence-powered emotional self-reflection and life coaching support platform that allows users to engage in AI-assisted conversations, journal entries, emotional self-reflection exercises, and related experiences designed to promote personal insight and emotional awareness. This Privacy Policy explains how we collect, use, disclose, store, protect, and otherwise process personal information in connection with your use of the Site and Services, including information you voluntarily provide through AI conversations, prompts, responses, journal entries, coaching notes, emotional and wellness-related information, and other interactions with the Services.

When we offer Services to individuals in the European Union (“EU”), the European Economic Area (“EEA”), the United Kingdom (“UK”), or other jurisdictions where applicable data protection laws apply, we are subject to applicable privacy and data protection laws, including the EU General Data Protection Regulation (“EU GDPR”) and, where applicable, the UK General Data Protection Regulation (“UK GDPR”). We are responsible as a “controller” of that personal information for the purposes of such applicable data protection laws.

1. Key Terms. It would be helpful to start by explaining some key terms used in this Privacy Policy:

For the avoidance of doubt, User Content may include emotional, wellness-related, or otherwise sensitive information that you voluntarily choose to provide through AI conversations or other interactions with the Services. Although such information may be processed to provide, maintain, protect, personalize, and improve the Services as described in this Privacy Policy, the Services are intended solely for informational, educational, emotional self-reflection, and coaching-support purposes. Biko AI does not provide medical, mental health, psychiatric, psychological, therapeutic, or other licensed professional services, and User Content is not processed for the purpose of providing medical diagnosis, treatment, or healthcare services.

2. Personal Information We Collect About You. We may collect and use the following personal information that identifies, relates to, describes, or could be reasonably linked, directly or indirectly, to an individual or household, in connection with your use of the Site and Services:

Certain personal information that you voluntarily submit through AI conversations or other interactions with the Services may constitute Special Category Personal Information under the GDPR (including information relating to health, emotional well-being, religious beliefs, or other sensitive topics). You are not required to provide such information; however, if you voluntarily choose to do so, you acknowledge that we may process such information as described in this Privacy Policy and, where required by applicable law, based upon your consent or another lawful basis for processing.

If you do not provide personal information required to use the Services, certain features or functionality of the Services may be unavailable or may not function as needed.

The Services are not intended for individuals under fourteen (14) years of age. Individuals under eighteen (18) years of age may use the Services only with verified parental or legal guardian consent, as described in our Terms of Use. We reserve the right to request age verification, identity verification, or documentation of parental or guardian authorization, and we may suspend or terminate access to the Services if we are unable to verify such information.

3. How Your Personal Information is Collected. We may collect personal information from one or more of the following categories of sources:

• You, directly through your use of the Site and Services, including account registration, profile creation, subscription enrollment, AI conversations, journal entries, coaching notes, prompts, responses, audio submissions, and submission of information through our website and applications

• Third-party service providers and vendors that help us operate the Site and Services, including payment processors, customer relationship management platforms, analytics providers, hosting providers, authentication providers, and other technology service providers

• Data analytics providers

• Operating systems and platforms

• Cookies and similar technologies used on the Site and Services

• Information you voluntarily provide while communicating with us, including customer support requests, feedback, surveys, emails, and other correspondence

• Third parties that you authorize to interact with the Services, if and when such integrations are made available

• Our IT and security systems, including:

• Automated monitoring of our Site, Services, and technical systems, such as our computer networks and connections, communications systems, email, and instant messaging systems

• Other systems used to operate, maintain, and secure the Services -and-

• Security, fraud detection, and abuse-prevention systems that help us protect the Site, Services, our users, and our business operations

4. How and Why We Use Your Personal Information. Under data protection laws, we can only use your personal information if we have a proper reason for doing so, for example:

• To comply with our legal and regulatory obligations

• For the performance of our contract with you or to take steps at your request before entering into a contract

• For our legitimate interests or those of a third party –or–

• Where you have given consent

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.

The table below explains what we use (process) your personal information for and our reasons for doing so:

For EU, UK, and EEA Data Subjects: To the extent we process any special category personal information, we will do so only where permitted by applicable law, including where you have provided explicit consent or where another lawful basis applies. Where you voluntarily choose to disclose health, wellness, emotional, or other sensitive information through AI conversations, journal entries, coaching notes, or other interactions with the Services, you acknowledge that such information may be processed as described in this Privacy Policy to provide, maintain, personalize, protect, and improve the Services, subject to applicable law.

5. EU, UK, and EEA Data Subjects: Marketing and Promotional Communications. We may use your personal information to send you updates (by email, text message, telephone, or post) about our Services, including product updates, feature releases, service announcements, subscription-related offers, and, where applicable, promotional communications.

We have a legitimate interest in processing your personal information for promotional purposes (see above “How and why we use your personal information”). This means we do not usually need your consent to send you promotional communications. However, where consent is needed, we will ask for this consent separately and clearly.

We will always treat your personal information with the utmost respect and never sell your personal information or share it with third parties for their own marketing purposes.

You have the right to opt-out of receiving promotional communications at any time by:

• Contacting us at [email protected]

• Using the “unsubscribe” link in emails or replying “STOP” to text messages

• Updating your communication preferences within your account (where available) or

• Following any other opt-out instructions included in the applicable communication

We may ask you to confirm or update your marketing preferences if you instruct us to provide further Services in the future, or if there are changes in the law, regulation, or the structure of our business.

Please note that even if you opt out of marketing communications, we may still send you non-promotional communications relating to your account, subscription, your use of the Services, billing, customer support requests, security notifications, emergency or safety-related communications, changes to our Terms of Use or Privacy Policy, or other administrative matters relating to your use of the Services.

6. Who We Share Your Personal Information With. We routinely share personal information with:

• Our affiliates, subsidiaries, and entities under common ownership or control (if applicable)

• Service providers we use to help deliver, operate, maintain, secure, and improve the Services, including hosting and cloud infrastructure providers (such as Vercel), analytics providers, payment processors (such as Stripe), customer relationship management platforms (such as Course Creator 360 and Go High Level), authentication providers, customer support providers, and other technology providers

• Analytics providers, cookie providers, advertising and marketing service providers (to the extent permitted by applicable law), fraud prevention providers, security providers, and other vendors that assist in operating our business

• Artificial intelligence service providers used to facilitate the functionality of the Services, including Anthropic (conversational artificial intelligence) and ElevenLabs (speech-to-text transcription and text-to-speech voice). For the avoidance of doubt, we do not permit Anthropic, ElevenLabs, or other third-party artificial intelligence providers to use your personal information or User Content to train or improve their own general artificial intelligence models, except as otherwise disclosed in this Privacy Policy, required by applicable law, or authorized by you

• Other third parties where you direct us to share your information or where such disclosure is necessary to provide the Services you request

We do not publicly disclose your personal information or make your User Content available to other users of the Services. Except where you expressly choose to share information, there is no general user-to-user visibility of personal information, AI conversations, journal entries, coaching notes, or other User Content through the Services.

We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers to ensure they can only use your personal information to provide services to us and to you.

We may disclose and exchange information with law enforcement agencies, regulatory bodies, emergency responders, governmental authorities, or other appropriate third parties to comply with our legal and regulatory obligations or where we reasonably believe such disclosure is necessary to protect the vital interests, safety, or rights of any person, consistent with our Terms of Use and applicable law.

We may also need to share some personal information with other parties, such as potential buyers of some or all of our business or during a re-structuring. We will typically anonymize information, but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.

Except as described above, we do not share your personal information with third parties for their own independent marketing or commercial purposes. We also do not sell your personal information or share your personal information for cross-context behavioral advertising.

7. Categories of Personal Information We Disclose. In connection with providing, operating, maintaining, securing, and improving the Site and Services, we may disclose one or more of the following categories of personal information to the recipients described in Section 6 above, to the extent reasonably necessary for the purposes described in this Privacy Policy:

• Identifiers (e.g., a real name, alias, Internet Protocol address, email address, account name, or other similar identifiers)

• Information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, account profile information, date of birth, phone number, billing information, and other information you voluntarily provide in connection with your account or use of the Services

• Commercial information (e.g., products or services purchased, obtained, or considered, subscription information, billing records, or transaction history)

• Internet or other electronic network activity information (e.g., browsing history, search history, cookies, device information, analytics information, and information regarding your interaction with the Site or Services)

• Geolocation data (limited to approximate location data derived from IP address or device settings)

• Communications you send to us (such as support inquiries, feedback, emails, chat messages, or other correspondence)

• Professional or employment-related information (if voluntarily provided)

• Health, wellness, mood, emotional, and self-reflection information voluntarily submitted by you through AI conversations, prompts, responses, journal entries, coaching notes, uploaded audio, or other User Content –and–

• Inferences, AI-generated summaries, personalization, emotional self-reflection observations, conversation summaries, coaching-support content, and other outputs generated through your interaction with the Services

These disclosures are made only to the categories of recipients identified in Section 6 above and are limited to what is reasonably necessary to operate, provide, secure, maintain, personalize, and improve the Site and Services, comply with applicable law, protect users, and otherwise conduct our legitimate business operations. We do not disclose your personal information to third parties for their own independent marketing purposes or for cross-context behavioral advertising.

8. How Long Your Personal Information Will Be Kept. We will keep your personal information for as long as necessary to provide the Services, operate our business, fulfill the purposes described in this Privacy Policy, and comply with applicable legal, regulatory, contractual, and operational requirements. Subject to your applicable rights to request deletion under this Privacy Policy and applicable law, certain personal information may be retained for as long as reasonably necessary in connection with Biko AI’s continued operation of its business and maintenance of the Services. Examples of the purposes for which we may retain your personal information include:

• To respond to any questions, complaints, or claims made by you or on your behalf

• To show that we treated you fairly

• To keep records required by law

• To maintain, secure, personalize, improve, troubleshoot, and develop the Site and Services, including maintaining conversation history, journal entries, coaching notes, AI interactions, and related User Content where reasonably necessary for the operation and improvement of the Services

• To investigate suspected fraud, misuse, security incidents, or violations of our Terms of Use

• To comply with contractual, legal, regulatory, tax, accounting, audit, and law enforcement obligations -or-

• To establish, exercise, or defend legal claims or protect the rights, safety, property, or security of Biko AI, our users, or others

Different categories of personal information may be retained for different periods depending on the nature of the information, the purpose for which it was collected, applicable legal requirements, and our legitimate business needs.

Where you exercise your right to delete your account or request deletion of your personal information, we will process such requests in accordance with applicable law, subject to any legal, contractual, security, fraud prevention, dispute resolution, backup, archival, or other legitimate business purposes that require continued retention of certain information.

When personal information is no longer reasonably necessary for the purposes described in this Privacy Policy or applicable law, we will delete, anonymize, or de-identify such information in accordance with applicable laws and our data retention practices.

9. EU, UK, and EEA Data Subjects: Your Rights Under Applicable GDPR Laws.

For further information on each of those rights, including the circumstances in which they apply, see the guidance from the European Data Protection Board (“EDPB”), the UK Information Commissioner's Office (“ICO”), or your applicable supervisory authority regarding your rights under applicable data protection laws.

10. How to Exercise Your Rights. If you would like to exercise any of your rights as described in this Privacy Policy, you can do so through the self-service tools available within your account (where applicable), by contacting us at [email protected] or through the contact functionality available within the Services.

• When submitting a request, you may be asked to provide:

• Information reasonably necessary to identify and verify your identity (such as your name, email address, account information, and/or other identifying details associated with your use of the Services) –and–

• A description of the right you wish to exercise and the information to which your request relates

• If we are unable to verify your identity or your authority to make a request on behalf of another individual, we may deny or limit the request to the extent permitted by applicable law

• Any personal information we collect in connection with verifying your identity will be used solely for that purpose and for responding to your request. We will respond to verified requests within the timeframe required by applicable law

11. EU, UK, and EEA Data Subjects: Where Your Personal Information is Held. Information may be held on servers and systems operated by us and our service providers, including cloud infrastructure providers, payment processors, customer relationship management providers, analytics providers, and other third-party service providers described in this Privacy Policy (see above: “Who We Share Your Personal Information With”). Our primary business operations, servers, databases, and service providers are located in Arizona, United States, although certain service providers may process information in other jurisdictions as necessary to provide the Services.

Some of these third parties may be based outside the EU, EEA, or UK, as applicable. In particular, our Services are operated primarily from the United States, and your personal information may be processed, stored, or accessed in the United States or other jurisdictions in which our service providers maintain facilities. For more information, including on how we safeguard your personal information when this occurs, see below: “International Transfers of Personal Information.”

12. EU, UK, and EEA Data Subjects: International Transfers of Personal Information. To deliver the Services to you, it is sometimes necessary for us to share your personal information outside the EU, EEA, or UK, including in the following circumstances:

• With our service providers located outside the EU, EEA, or UK

• If you are based outside the United States –or–

• Where our infrastructure, systems, service providers, payment processors, customer relationship management providers, analytics providers, or other third-party vendors operate in jurisdictions outside the country in which you reside, including the United States

These transfers are subject to special rules under applicable European and UK data protection laws.

Many of the countries to which we transfer personal information, including the United States, do not have the same data protection laws as the EU, EEA, or UK. We will, however, ensure that such transfers comply with applicable data protection laws and that appropriate safeguards are in place to protect your personal information. Where required by applicable law, we use appropriate safeguards to protect your personal information, including entering into the standard contractual clauses approved by the European Commission (and, where applicable, the UK Information Commissioner’s Office), or relying upon other lawful transfer mechanisms recognized under applicable data protection laws.

If you would like further information about international data transfers, please contact us (see “How To Contact Us” below).

13. Keeping Your Personal Information Secure. We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorized way. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality. We implement technical, administrative, and organizational safeguards designed to protect personal information processed through the Site and Services, including measures such as access controls, encryption, secure data storage practices, authentication procedures, system monitoring, and other commercially reasonable security measures appropriate to the nature of the personal information we process, including emotional, wellness, self-reflection, and other sensitive information voluntarily submitted through the Services. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

    Although we use commercially reasonable efforts to protect personal information, no method of transmitting information over the Internet or storing information electronically is completely secure. Accordingly, we cannot guarantee the absolute security of your personal information, and you acknowledge that you provide personal information to us at your own risk.

14. EU, UK, and EEA Data Subjects: How to File a GDPR Complaint. We hope that we can resolve any query or concern you raise about our use of your personal information. Accordingly, we encourage you to contact us first using the contact information provided in this Privacy Policy so that we may attempt to resolve your concerns directly.

    The GDPR also gives you the right to lodge a complaint with a supervisory authority in the EU, EEA, or UK jurisdiction where you work, normally live, or where any alleged infringement of applicable data protection laws occurred. You may contact your local supervisory authority for further information about your rights. A list of supervisory authorities is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

15. Changes to This Privacy Policy. This Privacy Policy was published on July 24, 2026 and last updated on July 24, 2026.

We may change this Privacy Policy from time to time to reflect changes in our business, the Site, the Services, applicable law, or our information handling practices. When we do, we will post the updated version on our website or make it available through the Services and update the “Last Updated” date above. Where required by applicable law, we may also notify you of material changes via email or through the Services. Your continued access to or use of the Site or Services following the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised Privacy Policy, to the extent permitted by applicable law.

16. How to Contact Us. Please contact us by post, email, or telephone if you have any questions about this Privacy Policy or the information we hold about you.

Our contact details are shown below:

17. Do You Need Extra Help? If you would like this Privacy Policy in another format (for example: audio, large print, braille, accessible digital formats, or other formats) please contact us (see “How to contact us” above).