Privacy Policy

1. Who we are

LifeLong is a relationship-intelligence service operated by Daltonomous Inc., doing business as Adlius ("Adlius," "we," "us," "our"). Adlius is the organization responsible for the personal information described in this policy.

You can reach our Privacy Officer about this policy or how your information is handled at legal@lifelong.network.

2. What this policy covers ("the Services")

This policy applies to all of the following, together "the Services":

• the LifeLong marketing website at lifelong.network;
• the LifeLong web application at app.lifelong.network; and
• the LifeLong iOS application.

It explains what personal information we collect, why, who we share it with, how long we keep it, how we protect it, and your rights.

3. Our privacy commitments

• We do not sell your personal information.
• We do not use your information for advertising. We use Google Analytics on our marketing website to measure usage, configured with advertising features and ad-personalization turned off, and loaded only after you consent (see the Cookie Policy).
• We also use PostHog for privacy-first product analytics (events and funnels), hosted in the European Union, configured so it does not capture the text you type into forms, and loaded only after you consent (see the Cookie Policy).
• We do not collect or process biometric data (LifeLong does not do facial recognition).
• We store and process personal information in Canada and the United States, and may add other regions as the Services grow. Data is encrypted in transit and at rest. See Sections 9 and 13.

4. Personal information we collect

a) Account and billing information. Your name, email address, password (stored hashed), and subscription/plan status. Payments are processed by Stripe; Adlius does not store your full payment-card number.

b) Content you create in the Services ("Your Content"). This is the core of the product. It includes the notes, voice recordings, photos (such as business cards), profile fields, follow-ups, tags, and any files you capture about the people you meet, as well as contact lists you choose to import (for example a LinkedIn or CRM export). Your Content routinely contains personal information about other people — see Section 7.

c) Information collected automatically. When you use the Services we collect limited technical and usage data, which may include IP address, approximate location derived from IP, device and browser type, pages or features used, and event logs used for security, debugging, and reliability.

d) iOS app data. With your permission, the iOS app accesses your microphone (to record voice captures) and camera/photos (to capture business cards and images). Text is extracted from images on your device where possible. Audio recordings are retained for a limited period and then deleted (see Section 10).

We collect only what we need to provide the Services and will not collect materially new categories of data without updating this policy.

5. How we use personal information

We use personal information to:

• create and operate your account and provide the Services;
• structure Your Content into living profiles and generate briefings, suggested follow-ups, and predictive recall (see Section 6 on AI);
• let you export and sync records to tools you choose, such as your CRM;
• process subscriptions, trials, and payments;
• communicate with you about your account, security, and service changes;
• maintain security, prevent abuse and fraud, and debug and improve reliability; and
• comply with legal obligations.

Legal basis. In Canada (PIPEDA / Quebec Law 25) we rely on your consent, given by creating an account and using the Services, and on the performance of our contract with you; where the law requires express consent (for example certain uses under Quebec Law 25), we obtain it. For users in the EU / UK (GDPR / UK GDPR), our legal bases under Article 6 are: (i) performance of our contract with you, to provide the Services; (ii) your consent, where we ask for it (for example non-essential cookies and certain communications); and (iii) our legitimate interests in operating, securing, and improving the Services, where those interests are not overridden by your rights. You can withdraw consent at any time (Section 11); withdrawal does not affect processing already carried out, and may mean we can no longer provide the Services.

6. How we use artificial intelligence

LifeLong uses AI to deliver its core features. Your Content is sent to our AI provider, Anthropic (the Claude models), to:

• structure your captured notes into profile fields and summaries;
• generate relationship briefings and "what to ask next" prompts; and
• power predictive recall (suggesting which contacts may be relevant to an upcoming event).

Anthropic processes this data on our behalf as a service provider. Under Anthropic's commercial terms, Anthropic does not use Adlius's customer data to train its models.

AI output is a suggestion, not a fact. Briefings, profile fields, and predictions are automatically generated and may be incomplete or inaccurate. You can review, correct, and delete them. See Section 12 on automated decision-making.

7. Personal information you record about other people

Because LifeLong helps you remember people you meet, Your Content typically includes personal information about third parties (for example a contact's name, role, company, and personal details you note).

• For information you record about others, you act as the party that decides what to collect, and Adlius processes it on your behalf to provide the Services. You are responsible for having a proper basis to record it and for using it lawfully and respectfully. Our Terms require this.
• We use third-party information only to provide the Services to you and for the purposes in this policy — never to build our own marketing lists or for advertising.
• If you are not a LifeLong user and believe a user has stored information about you, contact us at legal@lifelong.network and we will route your request to the relevant user and assist as required by law.

8. When we share personal information

We share personal information only as described here:

• With our service providers (subprocessors) who help us run the Services, listed in Section 9, under contracts that limit them to our instructions.
• Within our organization, with personnel who need access to operate the Services.
• For legal reasons — where required by law or legal process, to enforce our Terms, or to protect the rights, safety, and property of Adlius, our users, or others.
• In a business transfer — if Adlius is involved in a merger, acquisition, financing, or sale of assets, subject to this policy.

We do not sell personal information and do not share it for advertising.

9. Service providers (subprocessors)

We rely on the following providers, each under contract limiting them to our instructions:

Provider	Purpose	Region
DigitalOcean	Application hosting / database	Canada (Toronto)
Amazon Web Services (S3)	Media file storage	Canada (ca-central-1, Montreal)
Stripe	Payment processing & subscriptions	United States / global
Anthropic	AI processing (structuring, briefings, predictive recall)	United States
Resend	Transactional email	United States
Sentry	Error monitoring	United States
Mailchimp	Marketing / waitlist email	United States
Google Analytics (Google LLC)	Marketing-site usage analytics, with advertising features and Google Signals disabled	United States
PostHog	Product analytics (events, funnels) — consent-gated, does not capture form input values	European Union

10. How long we keep personal information

• Account and Your Content: kept while your account is active. After you cancel or delete your account, your data is deleted no later than 90 days (often sooner), except where we must keep limited records to meet a legal obligation.
• Voice recordings: retained for up to 72 hours after capture, then automatically deleted.
• Media files: kept with the related records and deleted on the same schedule as your account data.
• Logs and security data: kept for a limited period for security and debugging.

You can delete your account and associated records at any time (Section 11).

11. Your rights and how to exercise them

Everyone. Whatever your location, you can:

• access the personal information we hold about you and learn how it is used and shared;
• have inaccurate information corrected;
• withdraw consent and request deletion of your account and records;
• request portability of your data (you can also self-export to CSV, JSON, or vCard in-app); and
• make a complaint (Section 17).

Canada (PIPEDA / Quebec Law 25). You have the rights above, and Quebec residents additionally have rights regarding automated processing and data portability under Law 25.

EU / UK (GDPR / UK GDPR). You also have the rights to restrict or object to processing, to data portability in a structured format, and not to be subject to certain solely-automated decisions (Section 12). Where processing is based on consent, you may withdraw it at any time. You may complain to your local data-protection authority (Section 17).

United States (California and other states). You have the right to know what personal information we collect and how we use and share it, to request access and deletion, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not "sell" or "share" personal information for cross-context behavioural advertising as those terms are defined under California law.

To exercise any right, contact our Privacy Officer at legal@lifelong.network. We will verify your identity and respond within the timelines required by the applicable law. You may use an authorized agent where the law allows.

12. Automated decision-making and profiling

LifeLong uses automated processing in two ways:

• AI relationship features (Section 6) — structuring, briefings, and predictive recall. These produce suggestions for you, not decisions with legal effects, and you remain in control of any action you take.
• Security and abuse monitoring — automated signals may flag or restrict an account suspected of violating our Terms or the law; such actions are subject to human review on request.

You can ask us to explain or manually review an automated outcome by contacting the Privacy Officer.

13. International data transfers

We are based in Canada. Your account, content, and media are stored in Canada (Section 9). Some service providers process personal information in the United States (Stripe, Anthropic, Mailchimp, Google Analytics) and we may add other regions as the Services grow. This means your information may be transferred to, stored in, or accessed from a country other than your own, where data-protection laws differ and where courts and authorities may be able to access it under local law.

Wherever we transfer personal information, we use safeguards appropriate to the destination, including contractual protections (such as data-processing agreements), and we assess transfers as required by Quebec Law 25.

For EU / UK users: Canada benefits from a partial EU adequacy decision for commercial data covered by PIPEDA, so transfers from the EU/UK to us in Canada are generally permitted. For onward transfers to the United States, we rely on the recipient's certification under the EU-US / UK Data Privacy Framework or on Standard Contractual Clauses, together with supplementary measures.

14. Security

We protect personal information with encryption in transit and at rest, tenant data isolation, access controls, and confidentiality obligations for personnel and providers. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information using reasonable safeguards.

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the relevant authorities (including the Office of the Privacy Commissioner of Canada and, for Quebec residents, the Commission d'accès à l'information) as required by law.

15. Cookies

The Services use a minimal set of cookies and similar technologies, with no advertising or cross-site ad tracking. Full details, categories, and your choices are in our separate Cookie Policy.

16. Children

The Services are intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from a minor, we will delete it. A parent or guardian who believes we hold a minor's information can contact our Privacy Officer.

17. Complaints

If you have a concern about how we handle your personal information, please contact our Privacy Officer first so we can try to resolve it. You also have the right to complain to a supervisory authority — the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec (for Quebec residents), or your provincial privacy regulator.

18. Changes to this policy

We may update this policy to reflect changes in the law or our practices. We will update the "Last updated" date and, for material changes, notify you by email or an in-app notice.

19. Contact

Privacy Officer, Adlius — legal@lifelong.network