Section 1Introduction
Metacognitive Therapy AS ("we," "us," "our") respects your privacy. This Privacy Policy is incorporated into and forms part of our Terms of Service. It explains how we collect, use, and protect your personal data when you use the No Worries App and website (the "Services"). We are the data controller under the General Data Protection Regulation (GDPR). By using the Services, you acknowledge that you have read and understood this Privacy Policy and agree to our Terms of Service.
Section 2Data We Collect and Why
| Data Category | What it Includes | Purpose & Legal Basis |
|---|---|---|
| Account Data | Name, email address, third-party login ID. | To create and manage your account. Legal basis: Contract. |
| Usage Data | App interactions, video progress, crash reports. | To improve app performance and user experience. Legal basis: Legitimate Interest. |
| Subscription Data | Subscription status, renewal dates, AI credit balance. | To grant access to premium features. Legal basis: Contract. |
| Support Data | Emails or messages sent to our support team. | To resolve your issues. Legal basis: Contract / Legitimate Interest. |
| Live Event Data | Questions submitted during live streams. | To facilitate interactive educational sessions. Legal basis: Contract. |
Section 3How We Handle AI Interactions (Emma)
Emma operates as a conversational AI assistant designed for educational purposes regarding Metacognitive Therapy.
- AI and Voice Data Processing: When you use the voice feature, your voice audio and transcriptions are transmitted securely to our third-party infrastructure partner, ElevenLabs, solely for the purpose of real-time speech recognition, voice synthesis, and generating conversational responses.
- Data Retention and Training: Voice recordings and conversation logs are not stored permanently on our servers or third-party servers after the session is processed. User data, audio, and transcripts are strictly never used to train, retrain, or improve artificial intelligence models.
- No Sensitive Data: You should not share sensitive health data (Special Category Data under GDPR) with Emma.
Section 4Data Sharing and International Transfers
We do not sell your personal data. We only share your data with trusted third-party service providers when necessary to operate the Services. These include the following categories of recipients:
- Authentication and Payment Providers: To manage secure login and process app-store subscriptions.
- Cloud Hosting and Infrastructure Providers: To securely store data and host our servers.
- Analytics and Diagnostics Providers: To collect crash reports and monitor in-app interactions so we can improve app stability and user experience (data is hosted within the EU/EEA).
- AI Infrastructure Partners: To process real-time voice, transcription, and conversational data (e.g., ElevenLabs).
- IT and Support Service Providers: To provide customer service and resolve technical issues.
We require all third parties to respect the security of your personal data and treat it in accordance with the law.
International Transfers: Some of our service providers may process your data outside of the European Economic Area (EEA). Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following legal safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
- Where we use certain service providers, we may use specific contracts approved by the European Commission, known as Standard Contractual Clauses (SCCs), which give personal data the same protection it has in Europe.
You can request a copy of the specific safeguards applied to your data by contacting our Data Protection Officer.
Section 5Data Retention and Account Deletion
We retain your account data for as long as your account is active.
Inactive Accounts: To comply with data minimization principles, if your account remains inactive (meaning you have not logged in) for a period of twenty-four (24) months, and you do not have an active subscription, we reserve the right to automatically delete your account and associated personal data. We will attempt to notify you via email before this deletion occurs.
How to Delete Your Account: You can delete your account at any time directly within the App by navigating to Settings > Account > Delete Account, or by contacting us at privacy@metacognitivetherapy.com.
If you delete your account, we will erase your personal data within 30 days, except where we are legally required to retain certain records (e.g., for tax and accounting laws).
Section 6Your Rights under GDPR
If you are located in the EU/EEA, you have the following rights regarding your personal data:
- Right to Access: Request a copy of your data.
- Right to Rectification: Correct inaccurate data.
- Right to Erasure: Request deletion of your data.
- Right to Restrict or Object: Limit how we process your data.
- Right to Data Portability: Receive your data in a structured, machine-readable format.
- Right to Revoke Consent: You can revoke device-level permissions (such as push notifications) at any time through your mobile device settings.
To exercise these rights, please contact us at privacy@metacognitivetherapy.com. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
Section 7Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or alteration.
Section 8Changes to this Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via an in-app notice or email.
Section 9Contact Us
For any privacy-related questions, please contact our Data Protection Officer at:
Email: privacy@metacognitivetherapy.com