Privacy Policy

1. Who We Are

BIY, LLC is the data controller responsible for the collection and use of your personal information under this Privacy Policy. Our contact details can be found in Section 13 below.

2. Information We Collect

We collect personal data to deliver, maintain, and enhance our Services. The data we collect depends on which Service you use. The categories of personal data we collect include:

Common to account-based Services (Syranto, Sika):

• Account Information: Name, email address, username, password, timezone.
• Usage & Device Data: IP address, device and browser type, operating system, app version, app activity, and pages visited.
• Transactional Data: Purchase history, subscription details, and payment-processor identifiers.
• Cookies & Tracking Technologies: Data collected through cookies, pixels, and similar technologies (see Section 8).

Syranto (pronunciation and accent training):

• Profile Data: Profile photo, biography, learning goals.
• Audio & Speech Data: Recordings submitted for accent training purposes.
• Contact Information: If you opt in to the Contact Sync feature, encrypted hashes of your phone contacts may be collected.

Sika (personal budgeting app):

• Financial Data (via Plaid, Premium only): Read-only access to bank account balances and transaction history. Your bank credentials are entered directly into Plaid and never reach our servers.
• Budget Data: Category limits, manual transaction entries, and spending records you create within the app.
• Goal & Debt Data: Savings goal targets, contribution progress, loan amounts, APRs, and payoff plans you enter.
• Financial Health Score: A calculated score based on your budget adherence; additional factors may be incorporated over time.
• Subscription Data: Subscription status, plan type, and renewal date, as provided by the Apple App Store or Google Play via Adapty. We do not receive or store your payment-card details.
• Advertising Data (free tier only): Device identifiers and usage data processed by Google AdMob to serve ads.

Subfinancing (financial education website):

• Subfinancing.com does not require an account. We collect standard server logs (IP address, browser type, pages visited, referrer URL) and do not collect personal information unless you voluntarily submit a contact form.

EveryTask (browser-based tools):

• EveryTask.io does not require an account and processes all files entirely within your browser. Your files never leave your device and are never uploaded to our servers. We collect standard server logs such as IP address, browser type, pages visited, referrer URL, etc. (see Section 8).

We do not knowingly collect personal data from children under 15. If we become aware of such collection, we will delete the data immediately.

3. How We Use Your Information

We use your personal data for the following purposes:

• To register and manage your account.
• To provide and personalize the Services, including AI-powered pronunciation feedback and lessons (Syranto); budget tracking, Financial Health Score calculation, goal tracking, debt planning, and bank-transaction categorization (Sika); and educational content (Subfinancing).
• To process transactions and manage subscriptions.
• To send service-related and marketing communications (subject to your consent).
• To analyze and improve the functionality and quality of our Services.
• To detect fraud, enforce legal terms, and comply with legal obligations.

Our legal bases for processing personal data include your consent, contractual necessity, compliance with legal obligations, and our legitimate interests.

Where required under the LGPD or other applicable laws, we rely on consent or legitimate interest in accordance with the defined legal bases under those laws.

4. Sharing Your Data

We may share your information with:

• Service Providers: Cloud infrastructure and database/authentication (e.g., Supabase), analytics providers (e.g., Google), email delivery (e.g., Resend), financial-data connectivity (e.g., Plaid, for Sika), subscription management (e.g., Adapty), ad serving (e.g., Google AdMob), and AI service providers.
• Educational Institutions: If you participate in Syranto for Schools, your teacher may access your profile and progress.
• Legal Authorities: Where required to comply with applicable laws, court orders, or lawful government requests.
• Third Parties in a Business Transfer: In the event of a merger, acquisition, or asset sale.

When we transfer personal data to third-party service providers, we ensure they commit to appropriate data protection obligations, including DPF-level protection, Standard Contractual Clauses (SCCs), or appropriate contractual safeguards required under local laws such as the LGPD.

If you choose to make purchases through the Service, payments are processed via third-party platforms, such as the Apple App Store or Google Play. These platforms collect and process your payment information, including credit card details or other financial data, pursuant to their own privacy policies and terms of service. BIY, LLC does not store or directly access your payment credentials. Please refer to the respective privacy policies of Apple (https://www.apple.com/legal/privacy/) and Google (https://policies.google.com/privacy) for more information on their data processing practices.

By making a purchase, you acknowledge and agree that your financial information will be handled exclusively by the Apple App Store or Google Play Store, as applicable, and that BIY, LLC bears no responsibility for payment processing or associated security obligations.

Notwithstanding anything to the contrary, we remain responsible and liable under the EU-U.S. DPF Principles and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF Principles if third-party agents that we engage to process the personal data on our behalf do so in a manner inconsistent with the Principles unless we prove that we are not responsible for the event giving rise to the damage.

4A. Plaid (Bank Connectivity – Sika)

Sika uses Plaid Technologies, Inc. to connect your bank accounts. When you choose to link a bank:

• You authenticate directly with Plaid - your credentials are never transmitted to or stored by BIY, LLC.
• Plaid provides us with read-only access to account balances and transaction data only.
• We use this data solely to power your budgeting, Financial Health Score, and debt-planner features within Sika.
• You may disconnect Plaid at any time from within the Sika app. Disconnecting immediately removes all associated bank data from our systems.

Plaid's use of your information is governed by the Plaid Privacy Policy (plaid.com/legal). Bank sync is a Premium feature; free-tier users who do not connect a bank are not subject to Plaid data collection.

5. International Data Transfers

BIY LLC is based in the United States. We rely on the following mechanisms to lawfully transfer personal data from the EU, UK, Switzerland, or other jurisdictions:

• EU-U.S. Data Privacy Framework and UK Extension to the EU-U.S. DPF, and Swiss-U.S. Data Privacy Framework: BIY, LLC complies with these frameworks as set forth by the U.S. Department of Commerce. BIY, LLC has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with regard to personal data transferred from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. BIY, LLC has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. DPF Principles with regard to personal data transferred from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between this policy and the applicable DPF Principles, the applicable DPF Principles shall govern. To learn more, visit https://www.dataprivacyframework.gov.
• Other Transfer Mechanisms: Where DPF is not applicable, we may use SCCs, binding corporate rules, or obtain your explicit consent. We also comply with local international transfer rules, including those set forth under Brazil's LGPD.

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access to your personal data.
• Correction of inaccurate or incomplete data.
• Deletion of your data ("right to be forgotten").
• Restriction of processing.
• Data portability.
• Objection to certain processing activities.
• Withdrawal of previously granted consent.

For EU Individuals: Your Rights under the GDPR are:

• Right to be informed: You can obtain information about the processing of your personal data.
• Right of access: You can obtain access to the personal data held about you.
• Right to rectification: You can ask for incorrect, inaccurate or incomplete personal data to be corrected.
• Right to erasure: You can request that personal data be erased when it’s no longer needed or if processing it is unlawful.
• Right to restriction of processing: You can request the restriction of the processing of your personal data in specific cases.
• Right to data portability: You can receive your personal data in a machine-readable format and send it to another controller.
• Right to object: You can object to the processing of your personal data for marketing purposes or on grounds relating to your particular situation.
• Rights in relation to automated decision-making and profiling: You can request that decisions based on your personal data and that significantly affect you are made by natural persons, not only by computers.

Under the LGPD, Brazilian data subjects also have the right to: be informed about public and private entities with which your data has been shared; and information about the possibility of denying consent and the consequences of such refusal.

You may exercise these rights via your account settings or by contacting us at privacy@biy.one. We may verify your identity before processing your request.

Pursuant to the DPF Program, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States in reliance on the DPF Program should direct their query to privacy@biy.one. If requested to remove data, we will respond within a reasonable timeframe. We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@biy.one.

For California residents, please refer to Section 15 below for additional disclosures and rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

7. Your Choices

You can manage your preferences in the app settings, including:

• Opting in/out of marketing communications.
• Controlling personalized ad preferences.
• Managing cookies (see Section 8).

If personal data covered by this Privacy Policy is to be used for a new purpose that is materially different from that for which the personal data was originally collected or subsequently authorized, or is to be disclosed to a non-agent third party in a manner not specified in this Policy, BIY LLC will provide you with an opportunity to choose whether to have your personal data so used or disclosed. Requests to opt out of such uses or disclosures of Personal Data should be sent to us as specified in the "Contact Information" section below.

Certain personal data, such as information about medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, is considered "Sensitive Information."

BIY LLC remains responsible and liable under the EU-U.S. DPF Principles, the UK extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles, if third-party agents that it engages to process the personal data on its behalf do so in a manner inconsistent with the Principles unless BIY LLC proves that it is not responsible for the event giving rise to the damage.

BIY LLC will not use Sensitive Personal for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual unless BIY LLC has received your affirmative and explicit consent (opt-in).

For EU/UK/Swiss/Brazilian users, we do not process data for behavioral advertising without opt-in consent.

If personal data covered by this Privacy Policy is to be used for a new purpose that is materially different from that for which the personal data was originally collected or subsequently authorized, or is to be disclosed to a non-agent third party in a manner not specified in this Policy, you have an opportunity to choose whether to have your personal data so used or disclosed. Requests to opt out of such uses or disclosures of personal data will be sent to us automatically if you change your preferences in the app settings.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Authenticate users.
• Maintain sessions.
• Personalize content.
• Analyze usage.

You can manage cookie preferences in your browser settings. Some features of the Services may not function properly if cookies are disabled.

9. Retention of Data

We retain your personal data only as long as necessary for the purposes for which it was collected, including to:

• Provide the Services.
• Comply with legal obligations.
• Resolve disputes.
• Enforce agreements.

When data is no longer necessary, we securely delete or anonymize it in accordance with applicable data protection regulations, including the LGPD.

10. Security

We implement technical and organizational safeguards to protect your data, including encryption, access controls, and secure hosting environments. However, no system is completely secure; we encourage you to use strong passwords and safeguard your login credentials.

11. Data Privacy Framework Rights & Independent Recourse Mechanism (IRM)

In compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), BIY, LLC commits to resolve complaints about our collection or use of your personal information transferred to the U.S. pursuant to the EU-U.S. DPF or the UK Extension to the EU-U.S. DPF or the Swiss-U.S. DPF. EU, UK, and Swiss individuals with inquiries or complaints should first contact privacy@biy.one.

BIY, LLC has further committed to refer unresolved DPF Principles-related complaints to a U.S.-based independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided free of charge to you.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

BIY, LLC is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC). We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

12. Children's Privacy

Our Services are not directed to children under the age of 15, and we do not knowingly collect their data. If you believe a child under 15 has provided personal data to us, please contact us at privacy@biy.one, and we will take appropriate action.

13. Contact Information

BIY, LLC5900 Balcones Drive #28242Austin, TX, 78731, USAUnited States of AmericaEmail: privacy@biy.onePhone: +1(281) 473-1886

For GDPR-related inquiries, you may also contact our Data Protection Officer at dpo@biy.one.

For LGPD purposes, our designated data protection contact is reachable at privacy@biy.one.

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, technology, or business practices. When we do, we will revise the "Last Revised" date above and, if material changes are made, we will provide notice as required by applicable law.

15. California Privacy Rights (CCPA/CPRA Notice)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the purposes for collecting or selling it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request the deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request that inaccurate personal information we maintain about you be corrected.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information. We do not sell your personal information in the conventional sense but may share it for cross-context behavioral advertising purposes, subject to your opt-out rights.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit the use and disclosure of your sensitive personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California privacy rights, you may: email us at privacy@biy.one with "California Privacy Request" in the subject line, or access your account settings (if applicable).

We will verify your identity before processing your request and respond within the timeframes required by law. Authorized agents may submit requests on your behalf with written permission.

Thank you for trusting BIY, LLC with your data. We are committed to protecting your privacy and providing a transparent user experience.