Privacy Policy

1. Scope & Eligibility

This Policy applies to all Services operated by Immortal that link to it.

• U.S. only. Data is processed in the United States.
• Age 18+. We do not knowingly collect data from individuals under 18.

2. Notice at Collection (U.S. State Privacy Laws)

We collect the following categories of personal information:

Sale and sharing for advertising: We do not sell personal information for money. We may disclose identifiers and internet or technical data to advertising and attribution partners to measure, attribute, deliver, and improve our campaigns. Some state privacy laws may define this activity as “selling,” “sharing,” or targeted advertising even when no money is exchanged. A-LIST's website code does not attach wellness or health inputs, medical-intake responses, prescription details, Apple Health data, image data, or patient-account information as custom Meta web-event parameters. Page context collected on public website pages where Meta measurement is enabled is described in Section 10. You may opt out through Your Privacy Choices or a Global Privacy Control signal as described in Section 9.

3. Information We Collect

We collect information directly from you, from your device, and from integrations you authorize.

Includes:

• Account information
• User content and media (including DMs)
• Wellness and health inputs
• Camera and image data
• AI interaction data
• Voice and real-time session data
• Screen context data
• Subscription and entitlement data
• Technical diagnostics

4. Sources of Information

• You
• Your device and OS
• Integrations (e.g., HealthKit)
• Service providers
• Public content

5. How We Use Information

We use information to:

• Operate and authenticate accounts
• Provide AI-powered features (including real-time voice and Guardian navigation/actions)
• Process images and media for requested features
• Provide subscriptions and entitlement access
• Enable messaging and social features
• Improve performance, reliability, and product quality
• Conduct analytics and research
• Communicate with users, including marketing and promotional messages (via email, SMS, push, and in-app), and deliver, attribute, measure, and improve advertising and those communications with third-party marketing and attribution partners
• Ensure safety, integrity, and abuse prevention
• Comply with legal obligations

Automated systems: We do not use automated decision-making with legal or similarly significant effects.

6. Public Content & Messaging

• Content may be public depending on settings
• Direct messages (DMs) are intended to be private but may be processed for safety, moderation, and feature functionality
• We do not guarantee absolute confidentiality of content

7. How We Disclose Information

Service Providers / Sub-processors

We use providers including:

• Infrastructure: Google Cloud Platform (Cloud Run), AWS
• Analytics: Mixpanel, BigQuery
• AI: OpenAI, Anthropic, OpenRouter models
• Speech processing: Whisper or equivalent
• Diagnostics: Sentry, Shake
• Messaging: Twilio, Firebase
• Marketing & attribution: AppsFlyer (mobile attribution, deep linking, audience targeting, and campaign measurement) and Meta (website advertising measurement and conversion attribution)
• Authentication: Supabase, Google Sign-In
• Payments: Apple (StoreKit), Stripe
• Experimentation: Statsig

Marketing partners. Depending on the service, we disclose identifiers, contact details, and internet or technical data to marketing, advertising, and attribution providers (including AppsFlyer and Meta) so they can deliver, attribute, measure, and improve marketing communications and ad campaigns. For the Meta website measurement described in Section 10, A-LIST's website code does not supply names, email addresses, or phone numbers as browser advanced-matching fields and does not attach medical-intake responses, prescription details, or patient-profile information as custom event fields. Partners process information under their applicable terms and privacy policies and may use permitted event data for advertising measurement, delivery, and improvement.

AI Processing

Data may be processed by AI providers to fulfill requests. We instruct providers to use data only to provide functionality and restrict training where supported.

Legal / Compliance

To comply with law or protect rights and safety

Business Transfers

In mergers, acquisitions, or financing events

Public Content

Visible to others as shared

8. Health Integrations (Apple HealthKit)

• Access only with permission
• Used only for requested features
• Not used for advertising or sold

9. Your Choices & Controls

• Location, contacts, and health data permissions (manage in your device settings)
• Content deletion
• Account deletion

Web advertising data sharing

You may opt out through Your Privacy Choices. When the opt-out is active, we stop Meta browser Pixel measurement and do not send Meta the server-side InitiateCheckout or Purchase events for activity from that browser. We also honor Global Privacy Control signals automatically. Opting out does not affect the Service or prevent you from seeing advertisements unrelated to your A-LIST website activity.

How to opt out of marketing

You can opt out of marketing and promotional communications, and of sharing your contact details with marketing partners (including AppsFlyer), at any time:

• Email: click the "unsubscribe" link in any marketing email.
• SMS: reply STOP to any marketing text.
• Push notifications: disable in your device's notification settings or in the A-LIST app settings.
• In-app: turn off marketing communications in Settings → Notifications / Communications.
• Mobile ad tracking: on iOS, deny App Tracking Transparency for A-LIST (Settings → Privacy & Security → Tracking) and/or reset your device advertising identifier.
• By email: send a request to privacy@a-list.com and we will remove you from marketing audiences shared with third-party marketing partners.

Opting out of marketing will not stop service or transactional messages (e.g., security alerts, billing, account notices) that are needed to operate the Service.

10. Cookies, SDKs & Tracking

We use cookies, SDKs, and similar technology for:

• Analytics (Mixpanel, BigQuery)
• Diagnostics (Sentry, Shake)
• Communications (Twilio, Firebase)
• Advertising measurement and attribution (Meta and AppsFlyer)

Meta website measurement

On public website pages where Meta measurement is enabled, we use the Meta Pixel to send a PageView event. Meta's Conversions API reports InitiateCheckout when an initial online visit begins and Purchase after successful payment authorization. PageView may include the page URL and title, referrer, IP address, browser or device information, and Meta ad-click or browser identifiers. InitiateCheckout is limited to the event time, an anonymous session-derived event identifier, IP address, user agent, and available Meta ad-click or browser identifiers. Purchase is limited to the event time, an order-derived event identifier, value and currency, IP address, user agent, and available Meta ad-click or browser identifiers. We use these events to measure and improve advertising. A-LIST's website code does not supply contact information for browser advanced matching or include the purchased treatment, medical-intake responses, prescription details, or patient-account information in these events.

11. Data Retention

• Account data: retained while active
• Logs: retained for limited operational periods
• Audio: not retained beyond processing unless disclosed
• AI data: retained as needed for functionality, safety, and debugging
• Legal retention as required

Order, prescription & compliance records

If you have placed an order (including prescription/telehealth orders), we retain records associated with that order after you delete your account — including order and billing history, prescription and consent records, identity-verification records, and a limited snapshot of the identifying information needed to keep those records attributable to you (such as name, date of birth, email, and phone number). We retain these records as required by law and for tax, accounting, and regulatory recordkeeping purposes, and for the establishment or defense of legal claims. We retain them only for as long as those obligations require, after which they are deleted or de-identified. If you have not placed an order, deleting your account removes your personal information as described above without a compliance snapshot.

12. Security

We use:

• Encryption in transit and at rest
• Access controls and least-privilege access
• Monitoring and logging

No system is completely secure.

13. U.S. Privacy Rights

You may request:

• Access
• Deletion
• Correction
• Portability
• Opt out of sale, sharing, or targeted advertising where applicable through Your Privacy Choices or Global Privacy Control

Deletion. Your right to deletion is subject to exceptions permitted by law. We may retain certain information where necessary to comply with a legal obligation, meet tax and recordkeeping requirements, complete a transaction you requested, maintain prescription/medical and consent records, prevent fraud, or establish or defend legal claims. See "Data Retention" for what we retain after account deletion and why.

We will not discriminate against you for exercising an applicable privacy right.

Contact: privacy@a-list.com

14. International Transfers

Data is processed in the United States.

15. Children

We do not knowingly collect data from users under 18.

16. Third-Party Links

We are not responsible for third-party services.

17. Changes

We may update this Policy and provide notice where required.

18. Contact

Immortal Company Inc.

11273 COLINWARD AVE

Las Vegas, NV 89135

privacy@a-list.com