Privacy Policy

This Privacy Policy explains our practices regarding the collection, use, and disclosure of information that we receive through our Services, and how you can opt-out of a use or correct or change such information. This Privacy Policy does not apply to any third-party websites, services, or applications, even if they are accessible through our Services. Also, please note that unless we define a term in this Privacy Policy, all capitalized terms used in this Privacy Policy have the same meanings as in our Terms of Service (the “Terms”). So, please make sure that you have read and understood our Terms.

This Privacy Policy applies to any information relating to an identified or identifiable natural person (“Personal Information”) that is collected, recorded, organized, structured, stored, adapted or altered, retrieved, consulted, used, disclosed by transmission, dissemination or otherwise made available, aligned or combined, restricted, erased, or destroyed, whether or not by automatic means, or any other operation performed on Personal Information (“Processed”) by Reulay Inc through our Services.

Types of Personal Information We Collect

Reulay Inc, Reulay LLC collects the following categories of information about users of the Services:

Communications with Us: We may collect Personal Information from you such as your name, email address, phone number, and postal address when you request information about our Services, register for Reulay’s newsletter, request to receive customer or technical support, or otherwise communicate with us.

Account Information: If you create an Account, we’ll collect certain information that can be used to identify you, such as your name, age, email address, state of residence, and mobile number. If you create an Account using your login credentials from one of your SNS Accounts (Google, Apple, etc.), we’ll be able to access and collect your full name and email address and other Personal Information that your privacy settings on the SNS Account permit us to access. If you create an Account through the Services or one of your SNS Accounts, we may also collect your gender, date of birth and other information.

Third Party Services: The app does use third-party services that may collect information used to identify you. Link to the privacy policy of third-party service providers used by the app:

Session Data: We may measure, collect, and store your Session Data, including information or data related to your eye and head movement, heart rate and breathing, and your mood and feelings (measured through your responses to surveys and questionnaires in the App), in connection with your use of the Services; if you use the Services through an Account, Session Data may include Personal Information.

How We Use Your Information

We collect, store, use, and Process Personal Information about users for a variety of business purposes, including to:

To Fulfill our Agreement with You and Provide our Services: Reulay will use your Personal Information to provide and improve the Services, including: managing Accounts; undertaking activities to verify or maintain the quality or safety of our Services; processing payments and transactions; communicating with you about your Account, activities on our Services, and policy changes; providing our newsletter; or providing customer or technical support.

Analyze and Improve our Services Pursuant to Our Legitimate Interest: Reulay may use your Personal Information for other purposes pursuant to our legitimate interest, including: detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; measuring interest and engagement in our Services; improving, researching, and developing products and services, and marketing and security procedures; maintaining, repairing, or debugging our Services; verifying your identity and preventing fraud; and complying with our legal obligations, protecting your vital interests, or as may be required for the public good.

Other Uses: Reulay Inc may use your Personal Information for other purposes which are disclosed to you at the time you provide Personal Information or with your consent.

GENERAL

You have the right to opt out of certain uses and disclosures of your Personal Information. Where you have consented to Reulay’s Processing of your Personal Information, you may withdraw that consent at any time and opt-out to further Processing, or Deleting of all person information by contacting solutions@reulay.com

California Privacy Notice

Your Privacy Rights Under the CCPA if You Live in California

If You are a California resident using the Services, You may exercise the following rights (regarding Your personal information) under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”).

Information We May Collect From You

Our Services collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular User or User’s device, whether collected online or offline (“personal information”). In particular, the Services have collected the following categories of personal information from Users within the last twelve (12) months:

Category

Examples

Collected

Identifiers

First and last name, email address, IP address, online identifiers

Yes

Personal information categories listed in the California Customer Records statute (Cal Civ. Code § 1798.80(e))

First and last name, email address

Yes

Internet or other similar network activity

Browsing history or information from a User's interaction with the Services or Our advertisements on third-party platforms

Yes

Category	Examples	Collected
Identifiers	First and last name, email address, IP address, online identifiers	Yes
Personal information categories listed in the California Customer Records statute (Cal Civ. Code § 1798.80(e))	First and last name, email address	Yes
Internet or other similar network activity	Browsing history or information from a User's interaction with the Services or Our advertisements on third-party platforms	Yes

The specific types of personal information We collect are described more fully in Sections 2, 3, and 10 of Our Privacy Policy. Personal information does not include (1) de-identified or aggregated consumer information; (2) publicly available information from government records; or (3) information excluded from the CCPA’s scope.

We obtain the categories of personal information listed above from the following categories of sources:

Directly from You, such as when you set up an account to use the Reulay Oasis app.
Indirectly from You, such as electronically observing Your actions on Our Services

Use of Personal Information

We may use or disclose the personal information We collect for the purposes described in Sections 2, 3, and 10 of Our Privacy Policy.

Sharing Personal Information

We may disclose Your personal information to third parties for a business purpose. In such cases, We enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not to use it for any purpose except performing the contract.

In the preceding twelve (12) months, We have disclosed the following categories of personal information for a business purpose:
1. Category 1: Identifiers
2. Category 2: Personal Information
3. Category 3: Internet activity
Specific examples of such sharing activities can be found in Sections 4 and 11 of Our Privacy Policy. We do not sell Your personal information to third parties. We do share a limited set of data that is gathered when You visit Our Website, such as cookies and pixels, with third parties in order to allow You to see tailored digital advertisements, as further detailed in Sections 7 and 8 of Our Privacy Policy. To the extent this online advertising activity is interpreted as included in California’s broad definition of “data sale,” You may use the opt-out tools described below in Subsection 4 of this CALIFORNIA PRIVACY NOTICE Section.

Your Rights and Choices
1. Right to Know and Access: You have the right to request that We disclose certain information to You about Our collection and use of Your personal information over the past 12 months.
2. Right to Delete: You have the right to request that We delete any of Your personal information that We collected from You and retained, subject to certain exceptions.
3. Right to Opt-Out: In some circumstances, You may submit a verifiable request to opt out of Our sharing of Your Personal Information.
4. Right to Equal Service and Price (No Discrimination): You have the right not to receive discriminatory treatment for exercising Your CCPA privacy rights.

Submitting a Verifiable Consumer Request

Please send Your verifiable consumer request to Us at hi@reulay.com.

California’s Shine the Light Law

California Civil Code Section 1798.83 permits Our Users who are California residents to request and obtain from Us a list of what Personal Information (if any) We disclosed to third parties for direct marketing purposes in the preceding calendar year.

Changes to Our California Privacy Notice Section

We reserve the right to amend any part of this CALIFORNIA PRIVACY NOTICE Section at Our sole discretion and at any time.

Colorado Privacy Notice

Your Privacy Rights If You Live in Colorado (Effective July 31, 2023)

If You are a Colorado resident using the Services (“Colorado Consumer”), You may exercise the following rights under the Colorado Privacy Act (“CPA”). The CPA does not apply to individuals acting in a commercial or employment context.

We set forth above in our Privacy Policy the categories of “Personal Data” (referred by Us as “Personal Information”) that We process, the purpose for processing such Personal Data, the categories of personal data shared, and the categories of third parties with whom Personal Data is shared.

Colorado Consumers have the following rights, all subject to the meanings and exceptions set forth in the CPA:

To confirm whether We are processing Your Personal Data and request to access such data ("Right to Know” and “Right to Access").
That We correct inaccurate Personal Data We hold about You (“Right to Correct”).
That We delete the Personal Data provided by You or obtained about You ("Right to Delete").
To obtain a copy of the Personal Data previously provided by You to Us and, to the extent feasible, in a readily usable format to allow data portability (“Right to Data Portability”).
To opt-out out, either at or before the time, of the processing of Your Personal Data for the purposes of targeted advertising or sale of Your Personal Data, or profiling in furtherance of decisions resulting in denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, healthcare services, or access to essential goods or services that pertain to You (“Right to Opt-Out of Targeted Advertising”).
To give Us express consent prior to the processing of Your Sensitive Data (“Right to Protect Sensitive Data”).

CPA Requests

If you are a Colorado Consumer and would like to exercise Your rights pursuant to the CPA, please contact Us with such requests as indicated in Section 20 (“How to Contact Us”) of this Privacy Policy.

Reulay Inc. engages in online advertising practices (and certain analytics or similar activities) that may be considered “targeted advertising” under the CPA. To disable sharing through cookies set by third parties that may be considered targeted advertising under the CPA, please contact Us in accordance with Section 20 (“How to Contact Us”) of this Privacy Policy.

Authentication, Time to Respond, Charges: We will respond to and address Your requests (or any questions), so long as We can authenticate and/or confirm the accuracy of Your request or its content, and confirm or authenticate Your identity. (See Section 20 (“How to Contact Us” section) of Our Privacy Policy for details on how We will verify Your requests.) We will respond to Your request within 45 days of receiving Your request, or within an additional 45 days if additional time is reasonably necessary. We will not charge You to respond to Your requests (including provide information requested by You through such request) for a maximum of two times per calendar year. If, however, any request will cause undue burden on Us to respond and provide information, We may charge You a reasonable fee.

CPA Appeals

If You would like to appeal Our decision relating to Your request, You have the right to submit an appeal pursuant to the CPA, and can do so by contacting Us. In Your email submission, please include Your full name, the basis for Your appeal, and any additional information to consider. We will respond to Your appeal within 60 days of receiving Your appeal. If Your appeal is denied, then We will give You information on how to contact the Attorney General if You wish to file a complaint.

Opt-Out Requests

You may submit an opt-out request in accordance with Section 15 (“Your Opt-Out Rights”) of Our Privacy Policy. If You submit multiple requests in one email communication, We will handle all opt-out requests first.

Connecticut Privacy Notice

Your Privacy Rights If You Live in Connecticut (Effective July 31, 2023)

If You are an individual Connecticut resident using the Services (“Connecticut Consumer”), You may exercise the following rights under the Connecticut Data Privacy Act (“CTDPA”). The CTDPA does not apply to individuals acting in a commercial or employment context.

We set forth above in our Privacy Policy the categories of “Personal Data” (referred by Us as “Personal Information”) that We process, the purpose for processing such Personal Data, the categories of Personal Data shared, and the categories of third parties with whom Personal Data is shared.

Connecticut Consumers have the following rights, all subject to the meanings and exceptions set forth in the CTDPA:

To confirm whether We are processing Your Personal Data and request to access such data ("Right to Know” and “Right to Access").
That We correct inaccurate Personal Data We hold about You (“Right to Correct”).
That We delete the Personal Data provided by You or obtained about You ("Right to Delete").
To obtain a copy of the Personal Data previously provided by You to Us and, to the extent feasible, in a readily usable format to allow data portability (“Right to Data Portability”).
To opt-out out, either at or before the time, of the processing of Your Personal Data for the purposes of targeted advertising or sale of Your Personal Data, or profiling in furtherance of decisions resulting in legal or similarly significant effects on You (“Right to Opt-Out of Targeted Advertising”).
To give Us express consent prior to the processing of Your Sensitive Data (“Right to Protect Sensitive Data”).

CTDPA Requests

If you are a Connecticut Consumer and would like to exercise Your rights pursuant to the CTDPA, please contact Us with such requests as indicated in Section 20 (“How to Contact Us”) of this Privacy Policy.

Reulay Inc. engages in online advertising practices (and certain analytics or similar activities) that may be considered “targeted advertising” under the CTDPA. To disable sharing through cookies set by third parties that may be considered targeted advertising under the CTDPA, please contact Us in accordance with Section 20 (“How to Contact Us”) of Our Privacy Policy.

Authentication, Time to Respond, Charges: We will respond to and address Your requests (or any questions), so long as We can authenticate and/or confirm the accuracy of Your request or its content, and confirm or authenticate Your identity. We will respond to Your request within 45 days of receiving Your request, or within an additional 45 days if additional time is reasonably necessary. We will not charge You to respond to Your requests (including provide information requested by You through such request) for a maximum of one time per calendar year. If, however, any request will cause undue burden on Us to respond and provide information, We may charge You a reasonable fee.

CTDPA Appeals

If You would like to appeal Our decision relating to Your request, You have the right to submit an appeal pursuant to the CTDPA, and can do so by contacting Us. In Your email submission, please include Your full name, the basis for your appeal, and any additional information to consider. We will respond to Your appeal within 60 days of receiving Your appeal. If Your appeal is denied, then We will give You information on how to contact the Attorney General if You wish to file a complaint.

Utah Privacy Notice

Your Privacy Rights If You Live in Utah (Effective July 31, 2023)

If You are an individual Utah resident using the Services (“Utah Consumer”), You may exercise the following rights under the Utah Consumer Privacy Act (“UCPA”). The UCPA does not apply to individuals acting in a commercial or employment context.

We set forth above in our Privacy Policy the categories of Personal Data (referred by Us as “Personal Information”) that We process, the purpose for processing such Personal Data, the categories of Personal Data shared, and the categories of third parties with whom Personal Data is shared.

Utah Consumers have the following rights, all subject to the meanings and exceptions set forth in the UCPA:

To confirm whether We are processing Your Personal Data and request to access such data ("Right to Know” and “Right to Access").
That We correct inaccurate Personal Data We hold about You (“Right to Correct”).
That We delete the Personal Data provided by You or obtained about You ("Right to Delete").
To obtain a copy of the Personal Data previously provided by You to Us and, to the extent feasible, in a readily usable format to allow data portability (“Right to Data Portability”).
To opt-out out of the processing of Your Personal Data for the purposes of targeted advertising or sale of Your Personal Data (“Right to Opt-Out of Targeted Advertising”).
To opt-out of the processing of Your Sensitive Data (“Right to Protect Sensitive Data”).

UCPA Requests

If you are a Utah Consumer and would like to exercise Your rights pursuant to the UCPA, please contact Us with such requests as indicated in Section 20 (“How to Contact Us”) of this Privacy Policy.

Reulay Inc. engages in online advertising practices (and certain analytics or similar activities) that may be considered “targeted advertising” under the UCPA. To disable sharing through cookies set by third parties that may be considered targeted advertising under the UCPA, please contact Us in accordance with Section 20 (“How to Contact Us”) of Our Privacy Policy.

Authentication, Time to Respond, Charges: We will respond to and address Your requests (or any questions), so long as We can authenticate Your request and confirm or authenticate Your identity. We will respond to Your request within 45 days of receiving Your request, or within an additional 45 days if additional time is reasonably necessary. We will not charge You to respond to Your requests (including provide information requested by You through such request) for a maximum of one time per calendar year, but may charge you a reasonable fee for two or more requests within one calendar year. If, however, any request that is excessive or will cause undue burden on Us to respond and provide information, We may charge You a reasonable fee.

Virginia Privacy Notice

Your Privacy Rights If You Live in Virginia (Effective July 31, 2023)

If You are an individual Virginia resident using the Services (“Virginia Consumer”), You may exercise the following rights under the Virginia Consumer Data Protection Act (“VCDPA”). The VCPA does not apply to individuals acting in a commercial or employment context.

Virginia Consumers have the following rights, all subject to the meanings and exceptions set forth in the VCDPA:

To confirm whether We are processing Your Personal Data and request to access such data (“Right to Know” and “Right to Access”).
That We correct inaccurate Personal Data We hold about You (“Right to Correct”).
That We delete the Personal Data provided by You or obtained about You (“Right to Delete”).
To obtain a copy of the Personal Data previously provided by You to Us and, to the extent feasible, in a readily usable format to allow data portability (“Right to Data Portability”).
To opt-out out of the processing of Your Personal Data for the purposes of targeted advertising, sale of Your Personal Data, or profiling in furtherance of decisions resulting in legal or similarly significant effects regarding You (“Right to Opt-Out of Targeted Advertising”).
To give Us express consent prior to the processing of Your Sensitive Data (“Right to Protect Sensitive Data”).

VCDPA Requests

If you are a Virginia Consumer and would like to exercise Your rights pursuant to the VCDPA, please contact Us with such requests as indicated in Section 20 (“How to Contact Us”) of this Privacy Policy.

Reulay Inc. engages in online advertising practices (and certain analytics or similar activities) that may be considered “targeted advertising” under the VCDPA. To disable sharing through cookies set by third parties that may be considered targeted advertising under the VCDPA, please contact Us in accordance with Section 20 (“How to Contact Us”) of Our Privacy Policy.

Authentication, Time to Respond, Charges: We will respond to and address Your requests (or any questions), so long as We can authenticate Your request and confirm or authenticate Your identity. We will respond to Your request within 45 days of receiving Your request, or within an additional 45 days if additional time is reasonably necessary. We will not charge You to respond to Your requests (including provide information requested by You through such request) for a maximum of two times per calendar year. If, however, any request will cause undue burden on Us to respond and provide information, We may charge You a reasonable fee.

VCDPA Appeals

If You would like to appeal Our decision relating to Your request, You have the right to submit an appeal pursuant to the VCDPA, and can do so by contacting Us. In Your email submission, please include Your full name, the basis for your appeal, and any additional information to consider. We will respond to Your appeal within 60 days of receiving Your appeal. If Your appeal is denied, then We will give You information on how to contact the Attorney General if You wish to file a complaint.

GDPR Privacy Notice

Your Privacy Rights If You Live in the EEA, UK, or Switzerland

If You live in the European Economic Area (“EEA”), United Kingdom (“UK”), or Switzerland (each a “GDPR Country” and collectively, “GDPR Countries”), please review these additional privacy disclosures under the European Union’s General Data Protection Regulation (“GDPR”). Please note that for any of the key GDPR principles not specifically covered in this GDPR section, We believe in good faith that such principles are reasonably and appropriately addressed in other areas of Our Privacy Policy.

Your Data Rights

As a resident of one of the GDPR Countries, You have, under the GDPR, certain rights with respect to Our processing of Your Personal Information (referred to in the GDPR and below as “personal data”) and such rights include the following:
1. Right to Access: You have the right to know if We are processing personal data about You and, if so, to access and obtain a copy of personal data about You, as well as information relating to the processing of that data.
2. Right to Rectification: You have the right to have Us correct or update any personal data about You that is inaccurate or incomplete. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
3. Right to Erasure: Under certain circumstances, You have the right to request deletion or erasure of Your personal data, such as when required by law, when We no longer need such personal data for the purposes for which it was collected, You have withdrawn written consent, or when We are relying on legitimate interests as a legal basis, and Your rights override Our legitimate interests. Upon Your request, We will permanently and irrevocably anonymize your data such that it can never be reconstructed to identify you as an individual. This, however, is not an absolute right, and We may have legal or legitimate grounds for keeping such data.
4. Right to Portability: You have the right to obtain a copy of the personal data We hold about You in a structured machine-readable format and to have it transmitted to another controller without hindrance to Us. This right only applies when the processing of Your personal data is based on Your consent or on a contract, and such processing is carried out by automated means.
5. Right to Restriction of Processing: You have the right to restrict or limit the ways in which We process Your personal data when You contest the accuracy of the personal data, when Your personal data has been obtained by Us unlawfully, when You have objected to Our processing of such data and We are considering whether to cease processing, or when We no longer reasonably need to process the personal data.
6. Right to Object to Processing: You have the right to object, on grounds relating to Your particular situation, to Our processing of Your personal data when We are relying on legitimate interests as Our legal basis and Your rights override Our legitimate interests in processing such personal data. We may invoke compelling legitimate grounds for continued processing. You also have the right to object to Our processing of Your personal data for direct marketing purposes.
7. Right to Withdraw Consent: When We rely on consent as the basis for processing personal data, You have the right to withdraw (in writing) Your consent.
8. Right to Lodge Complaint: You have the right to lodge a complaint with Your local supervisory authority about Our handling (transfer, storage, and processing) practices of Your personal data.
9. Right to Give Posthumous Instructions: You have the right to give instructions concerning the use of Your personal data after Your death, as required by applicable law.
Contact

To exercise one or more of these rights, or if You have any questions or comments about this GDPR PRIVACY NOTICE Section or anything else about Your personal data when using Our Services, please do not hesitate to contact Us in accordance with Section 20 (“How to Contact Us”) of Our Privacy Policy.

Limitations to Your Rights and Requests

As described above, You have certain rights to Your personal data under the GDPR; however, these rights might result in Reulay possibly not being able to provide You with Our Services or some of the features and functionality of our Services.

In addition, We may reject any of Your above-described requests for certain reasons, including (without limitation) if the request is unlawful or if it may infringe on the rights and freedoms of another person or third party.

Further, for Your protection, We may require proof of identity and verification before We can answer the above-described requests.

Legal Bases for Processing Data

In this subsection, We identify the legal grounds on which We rely to process Your personal data.

In accordance with GDPR, We identify the following legal bases on which We rely to process Your personal data:
1. The performance of the contract between You and Reulay for the data processing related to Your use of Reulay’s Services (including Your purchases and payments). (See Our “Terms of Use.”)
2. Reulay’s legitimate interests more specifically include:
  - Our business interest in processing the personal data We collect, such as to develop, administer, and support Our Services; to operate, evaluate, and improve Our business; to facilitate and manage Our Services; promote research; support Our recruitment activities; or facilitate a corporate transaction (e.g., sale of assets, merger, or acquisition).
  - Our business interest in processing personal data to fulfill Our contracts with business partners, such as third parties that distribute or support Our Services or business operations.
  - Our business interest in processing personal data to establish, exercise or defend against fraud, illegal activity, and claims and other liabilities, including by enforcing the terms and conditions that govern the Services We provide.
  - Our business interest in providing You with emails and push notifications for timely introductory materials and information about Your Reulay account, and features and updates to Our Services.
  - Our financial interest in providing You with promotional offers and/or discounts with respect to paid subscriptions and special offerings.
  - Our business interest in offering You particularized or adapted content based on Your use of the Services
  - Our business interest in collecting data regarding Your general usage activities for the purpose of improving Our Reulay user experience.
  - Our business interest in requesting that You participate in Reulay surveys in order to better understand Your needs and expectations.
  - Our financial interest in providing You the opportunity to purchase Reulay subscriptions for the benefit of a third party through the Reulay “gifting” program when We have launched this program.
  - Our business interest in providing You with customer service communications regarding Your account, questions about Our Services, or any other matters directed to customer service staff, in order to have clear and easy communication with You and to respond to Your requests.
  - Our business interest in collecting data related to unplanned downtime or errors in Our Services.
  - Our business interest in complying with Our legal obligations, such as maintaining accurate financial records, and for reasons of public interest, such as with respect to adverse events and product safety reporting.
  - Our business interest in verifying your eligibility in a Community and providing limited reporting to Partners associated with such Community when We have created and launched this Community.

Disclosure of Your Data

We may disclose your personal data to certain third parties as described in Sections 4 and 11 of Our Privacy Policy.

Cross-Border Data Transfer

If We transfer Your Personal Information out of the GDPR Country in which You reside and to a country not deemed to provide an adequate level of personal data protection pursuant to the GDPR, then the transfer will be performed:

Pursuant to the recipient’s compliance with the “Standard Contractual Clauses” of the GDPR,
Pursuant to Your consent (if given) regarding Your personal data, or
As otherwise permitted by the applicable GDPR Country’s requirements.

You may contact Us (in accordance with Section 20 (“How to Contact Us”) of Our Privacy Policy) if You would like further information on what procedures or mechanisms We use to transfer Your personal data out of the applicable GDPR Country.

Reulay, Inc. 2024