Privacy Policy · Julija AI

Julija AI is a platform for emotional support and self-understanding. This Privacy Policy explains what data we collect, why we collect it, how we protect it, and what your rights are.

We understand that the topics you may discuss with Julija AI — relationships, anxiety, self-worth, family — fall into the category of sensitive personal data. That is precisely why privacy is not a formality for us, but the foundation on which this product is built.

1. Who we are and how to contact us

The Julija AI platform is operated by Wohl pr, Belgrade, Serbia (PIB: 114425830) — the data controller within the meaning of the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, "Sl. glasnik RS" no. 87/2018 — "ZZPL") and, where applicable to users in the EU/EEA, the General Data Protection Regulation (GDPR).

For all questions, requests, or complaints regarding your personal data: beta@julijaai.com — We respond within 30 days.

2. What data we collect

2.1 Data you provide directly

• Email address (required — for account creation and communication)
• First name (if you provide it at beta sign-up)
• Age group (for age verification purposes)
• Conversation content with Julija AI (messages exchanged during sessions)
• Optional response to the question about topics of interest (at beta sign-up)
• Survey responses (e.g. via Google Forms) — linked to your email address and used solely for product improvement; retention and deletion rights are described in Sections 7 and 8

2.2 Data generated automatically

• Date and time of conversations, and the number of sessions per day (used to apply fair-use limits)
• Session duration
• A conversation-continuity summary ("memory") — to make conversations feel continuous, Julija AI keeps a short, automatically generated summary of the context you have shared (for example, topics and situations you are working through). It is stored with your profile, used only to personalise your own conversations, and is deleted together with your account.
• Technical data about your device and browser (browser type, operating system)
• Message count and processing costs (internal, for platform management)
• Usage and analytics data collected via cookies only if you consent — pages visited, interactions, approximate region (see Section 13)
• Advertising measurement data collected via cookies only if you consent — whether a visit or sign-up came from one of our ads (see Section 13)

2.3 What we do NOT collect

• Full name (only an optional first name at sign-up)
• National identification number, ID card or passport number
• Home address · Phone number · Date of birth · Precise location data
• Payment card details — when paid plans are introduced, payments are handled entirely by our payment provider (see Section 6.4); we never see or store your card details

3. Special categories of personal data

Conversations you have with Julija AI may contain information about mental health, emotional state, relationships, and other sensitive topics. Under GDPR (Article 9) and ZZPL, such data constitutes a special category of personal data requiring a higher level of protection. The conversation-continuity summary described in Section 2.2 is protected in the same way.

We process such data exclusively on the basis of your explicit consent, provided at registration. You may withdraw consent at any time. We will never use sensitive data from conversations for profiling, advertising, or sharing with third parties without your explicit consent.

4. Legal basis for processing

• Consent (GDPR Art. 6(1)(a), Art. 9(2)(a); ZZPL): Processing of conversation content and special categories of data; analytics and advertising cookies.
• Performance of a contract (GDPR Art. 6(1)(b)): Processing of email address and technical data necessary to provide the service.
• Legitimate interests (GDPR Art. 6(1)(f)): Aggregated statistical data for platform improvement and security.

5. Purpose of data processing

• Providing the emotional support service through Julija AI, including conversation continuity (the "memory" described in Section 2.2)
• Creating and managing your user account
• Platform security, fair-use limits, and abuse prevention
• Improving the quality of the platform and user experience, including internal review of conversations by authorised personnel
• Crisis support — identifying situations that may require emergency assistance
• Communication regarding the platform (technical changes, Privacy Policy updates)
• Measuring the effectiveness of our advertising — only with your cookie consent, and never using the content of your conversations

We NEVER use conversations to train AI models without your explicit consent. We do not currently train any model on user data.

6. Who has access to your data

6.1 Internal access

Access to data is limited to the platform founder, solely for the purposes of technical development and product improvement during the beta phase. Conversation content is not read for the purpose of personal monitoring of individual users.

6.2 Categories of recipients (data processors)

To provide the service, we rely on a limited number of carefully selected processors, each bound by a data processing agreement and acting only on our instructions. We share data only within the following categories of recipients:

• Conversational AI providers — process the text of your conversations to generate responses. They are contractually prohibited from using your data to train their models.
• Hosting and infrastructure providers — run the website and the backend functions, and process the technical connection data needed to serve the platform.
• Database and storage providers — store your account, profile, and conversation transcripts. This storage is hosted within the European Union.
• Authentication providers — enable secure sign-in, including third-party sign-in (e.g. Google) if you choose to use it.
• Analytics providers — help us measure and improve how the site is used. Used only if you consent to analytics cookies.
• Advertising measurement providers — help us understand whether our ads work (see Section 13). Used only if you consent to marketing cookies. They never receive the content of your conversations.
• Email delivery providers — send you transactional and platform emails.
• Operational and workflow tools — used to manage beta sign-ups, feedback, and internal processes.

A detailed list of our sub-processors is available on request at beta@julijaai.com.

6.3 Data transfers outside the EU

Your account, profile, and conversation data held by our database and storage providers are hosted within the European Union and are not transferred to the United States by us. Some other categories of recipients (for example AI, hosting, authentication, analytics, advertising measurement, and workflow providers) operate from the United States; analytics and advertising measurement providers are used only with your consent. Where data is transferred to the United States, this is done with appropriate safeguards in accordance with GDPR and ZZPL, including Standard Contractual Clauses. We do not sell or rent your personal data to anyone, and the content of your conversations is never shared with advertisers.

6.4 Payments — Paddle (Merchant of Record)

When we introduce paid plans, purchases will be processed by Paddle (Paddle.com Market Ltd and its affiliates), acting as our Merchant of Record — meaning Paddle is the seller you buy from and handles checkout, payment processing, invoicing, applicable taxes, and refunds. Paddle processes the personal data needed for the purchase (such as your email address, billing country, and payment details) as an independent data controller, under its own privacy policy (see paddle.com/legal/privacy). We receive from Paddle only the information needed to activate and manage your subscription (such as your email address and subscription status) — never your card details. The content of your conversations is never shared with Paddle.

7. How long we retain data

• Account and email address: Until the account is deleted by the user.
• Conversation content (transcripts) and the conversation-continuity summary: Until the account is deleted or consent is withdrawn, whichever comes first.
• After subscription cancellation: the account continues on the Free plan; conversations and memory are retained unchanged until you delete them or the account.
• Inactive accounts: Free-plan accounts inactive for more than 24 months are deleted, with a warning email 30 days before deletion; any activity (login) resets this clock.
• Backups: on deletion, data is removed from active systems within 30 days and expires from encrypted backups within a further 30 days through regular backup rotation; in the meantime, backups are not used for any purpose other than disaster recovery.
• Waitlist / beta applications: email addresses of people who never register are kept for 12 months from signup, or deleted immediately upon opt-out or request — whichever comes first.
• Survey responses: at most 24 months; the same deletion rights apply.
• Technical logs and session records: Maximum 90 days, then deleted or anonymised.
• Consent records (date and document version): For as long as your account exists, as evidence of compliance.
• Aggregated statistical data: May be retained indefinitely in anonymised form only.

8. Right to erasure

You may request deletion of all your data at any time — conversations, email address, and all other personal data. We will delete everything within 30 days and send you confirmation.

Partial deletion: you may request deletion of your conversation history together with the derived summary ("memory") while keeping your account. The memory is deleted along with the conversations — since it is derived from them, deleting one without the other is not possible.

Withdrawal of consent: withdrawing consent for the processing of conversation content is treated as a request to delete that content, since consent is the legal basis for that processing.

Deletion and consent withdrawal are currently exercised by email to the contact address; we send confirmation by email. An in-app deletion control is planned.

Request deletion at: beta@julijaai.com

9. Your rights

• Right of access — request a copy of all data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of all your data
• Right to restriction of processing — request a temporary restriction on processing
• Right to data portability — request your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent for special categories at any time

10. Right to lodge a complaint

• Serbia: Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs)
• Bosnia and Herzegovina: Personal Data Protection Agency of BiH (azlp.ba)
• Montenegro: Agency for Personal Data Protection and Free Access to Information (azlp.me)
• EU/EEA: The data protection supervisory authority in your country of residence (e.g. in Germany the competent Landesdatenschutzbehörde, in Austria the Datenschutzbehörde).
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch)

11. Data security

• Encryption of data in transit (HTTPS/TLS)
• Restricted access to data (principle of least privilege)
• Regular security reviews
• In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours where required, and inform you without undue delay if the breach is likely to result in a high risk to your rights and freedoms

12. Minors

Julija AI is intended for users aged 18 and over. If you indicate that you are under 18, access to the platform will be restricted. If we become aware that we have inadvertently collected data from a minor, we will delete such data without delay.

13. Cookies and similar technologies

We use three categories of cookies and similar technologies:

• Strictly necessary cookies / local storage: Required for login, session management, and security. These are always active and do not require consent, as the platform cannot function without them.
• Analytics cookies (consent-based): Provided by third-party analytics providers that help us understand how the site is used — pages visited, interactions, and aggregated heatmaps. These set third-party cookies and may transfer data to the United States.
• Marketing cookies (consent-based): We use the Meta Pixel (Meta Platforms) to measure whether our ads on Facebook and Instagram lead to visits and sign-ups. If you consent, the Pixel records that you visited the site or submitted the sign-up form, and shares this with Meta for ad measurement and attribution. It never receives the content of your conversations, your messages, or anything you share with Julija AI. Data processed by the Pixel may be transferred to the United States. See Meta's privacy policy at facebook.com/privacy.

On your first visit, a cookie banner lets you Accept or Reject analytics and marketing cookies. No analytics or marketing cookie or script loads before you accept. You can change your choice at any time by clearing the site's cookies/local storage. We do not sell your personal data, and the content of your conversations is never used for advertising.

14. Automated decision-making and profiling

Julija AI generates responses using an AI model, but we do not use your data for automated decisions that produce legal effects or similarly significantly affect you (such as eligibility, credit, or employment decisions). The content of your conversations is never used to profile you for advertising. With your cookie consent, website visit data (not conversation data) is used solely to measure the effectiveness of our ads, as described in Section 13. Identifying potential crisis situations is a safety feature, not an automated decision with legal effect.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email at least 14 days before they take effect. The date of the most recent update is always visible at the top of this document.

16. Contact

For all questions regarding this Privacy Policy: beta@julijaai.com — We respond within 30 days.