Data handled with intent.

WS Tech Venture Studio ("WS Tech", "Company", "we", "our", or "us") provides Harmoniq, a mobile application and related services for creating and sharing digital identity cards with context-aware controls (collectively, the "Services"). WS Tech Venture Studio is registered in the Federal Republic of Nigeria.

We are committed to protecting your privacy and complying with applicable data protection laws, including the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, and the General Data Protection Regulation (GDPR) where applicable.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services. Please read this Privacy Policy carefully. IF YOU DO NOT AGREE WITH THE TERMS OF THIS PRIVACY POLICY, PLEASE DO NOT ACCESS THE SERVICES.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last updated" date of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates.

Information you provide

• Identity Card data: Name, headline, bio, contact details, tags, and custom fields you enter into your cards.
• Account data: If you sign in (for example, with Google), we may collect your display name, email address, and profile photo URL.
• Preferences and settings: Theme mode, session lock configuration, notification preferences, and other in-app settings.
• Support requests: If you contact support, we collect the information you provide along with basic device and app details to help resolve your issue.
• Feedback and submissions: Any questions, comments, suggestions, or feedback you send us about the Services.

Information collected automatically

• Device information: Device type, operating system, unique device identifiers, and app version for compatibility and troubleshooting purposes.
• Session information: Login activity and session details to help you manage active sessions and maintain account security.
• Connectivity state: NFC and location services for enabling sharing features.
• Usage data: Information about how you interact with the Services, including features used, actions taken, and time spent, to improve the Services.
• Log data: Error reports, crash logs, and performance diagnostics collected automatically to maintain Service reliability.

Information collected with your permission

• Location: If you grant location permission, we may collect your location to provide context-aware features such as location labels on shared cards. You can disable this at any time in your device settings.
• Calendar: If you grant calendar permission, we may access your calendar events to display relevant context on your Identity Card. We do not store your full calendar data on our servers.
• Camera: If you grant camera permission, it may be used for QR code scanning functionality. Images are processed locally and not transmitted to our servers.
• Motion sensors: If enabled, motion data may be used for interactive features within the app. This data is processed locally and is not transmitted to our servers.
• Push notifications: If you opt in, we may send push notifications about important updates, reminders, or Service-related communications.

Optional cloud sync

If you enable cloud sync, Harmoniq may store snapshots of your Identity Cards on WS Tech-managed infrastructure. You can disable sync and request deletion of cloud-stored data at any time. We are not responsible for any data loss that occurs when cloud sync is disabled.

We use the information we collect or receive for the following purposes:

• Provide, operate, and maintain the Services, including rendering Identity Cards and managing share links.
• Facilitate optional cloud sync for recovery and multi-device access.
• Enhance security through session management, link revocation, and prevention of unauthorized access.
• Process payments and manage subscriptions if you purchase premium features.
• Provide usage insights and analytics within the app to help you understand how your cards are being used.
• Improve performance, reliability, and user experience through diagnostics and analysis.
• Communicate updates, features, security alerts, and important notices.
• Respond to your inquiries and provide customer support.
• Comply with legal obligations and enforce our Terms of Use.
• Protect against fraudulent, unauthorized, or illegal activity.
• Develop new features, products, and services.

We will not use your personal information for purposes materially different from those described in this Privacy Policy without your consent.

Under NDPR, NDPA, and GDPR, we process your personal data based on the following legal grounds:

• Consent: When you have given explicit consent for specific processing activities, such as cloud sync, location access, or calendar access. You may withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Contract performance: When processing is necessary for the performance of a contract with you (including our Terms of Use) or to take steps at your request before entering into a contract.
• Legal obligation: When we must process your data to comply with legal or regulatory requirements.
• Legitimate interests: When processing is necessary for our legitimate business interests, such as security, fraud prevention, troubleshooting, service improvement, and enforcing our Terms, provided your rights and interests do not override these interests.
• Vital interests: In rare circumstances, when processing is necessary to protect the vital interests of you or another person.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may share information in the following situations:

• With recipients you choose: When you share an Identity Card via link, QR code, NFC, or Nearby presence, the recipient receives the information you have chosen to include. Once shared, we cannot control how recipients use that information.
• Service providers: Trusted third-party service providers who assist us in operating our Services (such as cloud hosting, analytics, and payment processing) process data on our behalf under strict confidentiality agreements and data processing agreements.
• Legal compliance: We may disclose information where required by law, court order, subpoena, or government request, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of all or a portion of our assets, your information may be transferred. We will provide notice before your personal information becomes subject to a different privacy policy.
• Aggregated data: We may share aggregated, de-identified statistical information that cannot reasonably be used to identify you personally.
• With your consent: We may share your personal information for any other purpose with your consent.
• To enforce our rights: We may disclose information to enforce our Terms of Use, this Privacy Policy, or other agreements, and to protect the security and integrity of our Services.

Our Services (including our website) may use cookies, web beacons, pixel tags, and similar tracking technologies to collect information automatically. These technologies help us:

• Remember your preferences and settings;
• Understand how you use our Services;
• Improve and optimize the Services; and
• Deliver relevant content.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of certain parts of the Services.

We do not currently respond to "Do Not Track" signals, as there is no consistent industry standard for compliance.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. When personal data is no longer needed, we will securely delete or anonymize it.

• On-device data: Stored locally on your device until you delete it or uninstall the app. We have no access to or control over locally stored data.
• Cloud data: Retained until you delete it, disable cloud sync, or request account deletion.
• Received cards: Cards you receive from others are stored in your account until you choose to delete them.
• Account deletion: Valid requests enter automated processing. Harmoniq removes active account data and authentication access, normally shortly after processing begins and no later than 90 days, except where retention is legally required.
• Diagnostics and logs: Retained for a maximum of 12 months to investigate issues and improve the Services, then automatically deleted.
• Anonymized data: We may retain anonymized, aggregated data that can no longer identify you indefinitely for research and service improvement purposes.
• Legal holds: If we are involved in litigation or a government investigation, we may be required to retain data beyond our normal retention periods.

If you purchase a subscription or premium features, payment processing is handled entirely by the platform provider (such as Google Play or Apple App Store). We receive confirmation of your purchase and subscription status to provide you with the appropriate features.

We do not collect, process, or store your payment card details, bank account information, or other financial data. All payment disputes, refunds, and billing inquiries should be directed to the applicable platform provider. We are not liable for any payment processing errors, unauthorized charges, or disputes that arise through third-party payment systems.

We implement commercially reasonable technical, administrative, and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

• Encryption: We use industry-standard encryption (TLS/SSL) for data transmission and encryption at rest for sensitive stored information.
• Access controls: We implement strict role-based access controls, ensuring that only authorized personnel and systems can access personal data on a need-to-know basis.
• Data minimization: We collect and process only the minimum amount of data necessary for our stated purposes.
• Local protections: You can enable additional protections such as PIN or biometric unlock within the app to secure local data access.
• Regular audits: We periodically review our security practices and update them to address new threats.

WHILE WE STRIVE TO USE COMMERCIALLY ACCEPTABLE MEANS TO PROTECT YOUR PERSONAL INFORMATION, NO METHOD OF TRANSMISSION OVER THE INTERNET OR METHOD OF ELECTRONIC STORAGE IS 100% SECURE. WE CANNOT AND DO NOT GUARANTEE THE ABSOLUTE SECURITY OF YOUR DATA. ANY TRANSMISSION OF PERSONAL INFORMATION IS AT YOUR OWN RISK, AND WE ARE NOT RESPONSIBLE FOR THE CIRCUMVENTION OF ANY PRIVACY SETTINGS OR SECURITY MEASURES CONTAINED ON THE SERVICES.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant data protection authority (including NITDA where applicable) without undue delay, and where feasible, within 72 hours of becoming aware of the breach;
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms; and
• Document all breaches, including the facts, effects, and remedial actions taken.

Notwithstanding the foregoing, we shall not be liable for any breach resulting from circumstances beyond our reasonable control, including but not limited to: your failure to maintain the security of your device or account credentials, unauthorized access by third parties due to your actions or omissions, or force majeure events.

Under NDPR, NDPA, GDPR, and other applicable privacy laws, you may have the following rights regarding your personal data:

• Right to information: Be informed about how your personal data is being collected and used.
• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data in certain circumstances. This right is not absolute and may be subject to legal exceptions.
• Right to restrict processing: Request that we limit how we use your personal data in certain circumstances.
• Right to data portability: Request your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to object: Object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: Withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint: File a complaint with NITDA, the Nigeria Data Protection Commission (NDPC), or other relevant data protection authorities in your jurisdiction.

To exercise these rights, please contact us using the information provided in this policy. We will respond within the timeframes required by applicable law (typically within 30 days). We may need to verify your identity before processing your request. We reserve the right to charge a reasonable fee or refuse requests that are manifestly unfounded, excessive, or repetitive.

You may request deletion of your personal data and account at any time. To request account deletion:

• Use the account deletion feature in the app (Settings → Account → Delete Account);
• Contact us at legal@wstech.studio with the subject line "Account Deletion Request".

Deletion process

• Automated processing: Valid in-app requests are queued for automated processing. Access ends when the account record is removed.
• Data removal: All personal data associated with your account will be permanently and irreversibly deleted from our active systems within 90 days of the request.
• Backup removal: Data in encrypted backups will be deleted according to our backup rotation schedule, typically within 180 days.

Exceptions to deletion

We may retain certain information after an account deletion request where required or permitted by law, including:

• Records necessary for legal compliance, tax, audit, or regulatory purposes;
• Data required to resolve disputes, enforce agreements, or protect legal rights;
• Anonymized or aggregated data that cannot reasonably identify you;
• Transaction records required by financial regulations.

Important limitations

PLEASE NOTE THE FOLLOWING REGARDING DATA DELETION:

• Data you have shared with others (such as Identity Cards shared via links, QR codes, NFC, or Nearby presence) may have been saved, copied, or further distributed by recipients. We have no control over and are not responsible for data in the possession of third parties.
• Deletion of on-device data is your responsibility. Uninstalling the app or clearing app data will remove locally stored information. We are not responsible for data remaining on your device after account deletion.
• We are not liable for any failure to delete data that results from circumstances beyond our reasonable control, including but not limited to technical failures, force majeure events, or your failure to provide accurate account identification.

You are responsible for:

• Maintaining the confidentiality and security of your account credentials and device;
• All activities that occur under your account, whether or not authorized by you;
• Ensuring that the information you share via Identity Cards is accurate and does not violate any third-party rights;
• Reviewing the information included on your Identity Cards before sharing, as shared information may be saved or further distributed by recipients;
• Promptly notifying us of any unauthorized use of your account or any other breach of security;
• Maintaining adequate backups of any data stored locally on your device; and
• Complying with all applicable laws when using the Services.

WE ARE NOT RESPONSIBLE OR LIABLE FOR ANY LOSS, DAMAGE, OR HARM ARISING FROM YOUR FAILURE TO COMPLY WITH THE ABOVE RESPONSIBILITIES, INCLUDING BUT NOT LIMITED TO UNAUTHORIZED ACCESS TO YOUR ACCOUNT DUE TO YOUR FAILURE TO SAFEGUARD YOUR CREDENTIALS.

The Services may contain links to third-party websites, services, or applications (such as Google Sign-In, cloud infrastructure providers, app store platforms, and device operating system APIs) that are not operated by us.

These third parties have their own privacy policies, terms of service, and data practices. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party services. We strongly advise you to review the privacy policies of every third-party service you interact with.

YOUR INTERACTION WITH ANY THIRD-PARTY SERVICE IS AT YOUR OWN RISK. WE SHALL NOT BE LIABLE FOR ANY LOSS OR DAMAGE ARISING FROM YOUR USE OF OR RELIANCE ON ANY THIRD-PARTY SERVICE, CONTENT, OR PRACTICES.

The Services are not directed to children under 13 years of age (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children under this age.

If we learn that we have collected personal information from a child without verification of parental consent, we will take steps to delete that information as quickly as possible. If you believe that a child under the applicable age has provided us with personal data, please contact us immediately.

Parents and guardians who permit minors (between 13 and the age of majority) to use the Services are responsible for monitoring their use and ensuring compliance with these terms.

Your information may be transferred to, stored, and processed in countries other than Nigeria where we or our service providers maintain facilities. These countries may have data protection laws that are different from the laws of your country.

We ensure appropriate safeguards for international transfers consistent with applicable law, including:

• Standard contractual clauses approved by relevant authorities;
• Data processing agreements with our service providers; and
• Ensuring that recipient countries provide adequate levels of data protection.

By using the Services, you consent to the transfer of your information to countries outside your country of residence, including Nigeria, which may have different data protection rules.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

• THE SERVICES AND ALL INFORMATION, CONTENT, AND MATERIALS MADE AVAILABLE THROUGH THE SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS WITHOUT ANY WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY.
• WE DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ACCURACY OF INFORMATION.
• WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, OR THAT DEFECTS WILL BE CORRECTED.
• WE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES, RESULTING FROM YOUR ACCESS TO OR USE OF (OR INABILITY TO ACCESS OR USE) THE SERVICES.
• OUR TOTAL LIABILITY ARISING OUT OF OR IN CONNECTION WITH THIS PRIVACY POLICY OR THE SERVICES SHALL NOT EXCEED THE GREATER OF: (A) THE AMOUNTS PAID BY YOU TO US IN THE 6 MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY, OR (B) ONE HUNDRED US DOLLARS ($100).
• WE SHALL NOT BE LIABLE FOR ANY UNAUTHORIZED ACCESS TO OR ALTERATION OF YOUR TRANSMISSIONS OR DATA, ANY MATERIAL OR DATA SENT OR RECEIVED OR NOT SENT OR RECEIVED, OR ANY TRANSACTIONS ENTERED INTO THROUGH THE SERVICES.
• WE SHALL NOT BE LIABLE FOR ANY LOSS OR DAMAGE CAUSED BY A DISTRIBUTED DENIAL-OF-SERVICE ATTACK, VIRUSES, OR OTHER TECHNOLOGICALLY HARMFUL MATERIAL THAT MAY INFECT YOUR DEVICE, DATA, OR OTHER PROPRIETARY MATERIAL DUE TO YOUR USE OF THE SERVICES.

No liability for negligence or user actions

WE SHALL NOT BE LIABLE FOR ANY LOSS, DAMAGE, OR HARM ARISING FROM:

• YOUR FAILURE TO MAINTAIN THE CONFIDENTIALITY OF YOUR ACCOUNT CREDENTIALS, DEVICE ACCESS, OR SECURITY SETTINGS;
• YOUR DECISION TO SHARE PERSONAL INFORMATION WITH THIRD PARTIES THROUGH THE SERVICES;
• ANY ACTIONS TAKEN BY RECIPIENTS OF INFORMATION YOU HAVE SHARED;
• YOUR FAILURE TO MAINTAIN ADEQUATE BACKUPS OF DATA STORED ON YOUR DEVICE;
• INACCURATE, INCOMPLETE, OR MISLEADING INFORMATION PROVIDED BY YOU;
• YOUR VIOLATION OF THESE TERMS, OUR PRIVACY POLICY, OR ANY APPLICABLE LAW;
• THIRD-PARTY SERVICES, PLATFORMS, OR INTEGRATIONS OVER WHICH WE HAVE NO CONTROL.

Force majeure

WE SHALL NOT BE LIABLE FOR ANY FAILURE OR DELAY IN PERFORMING OUR OBLIGATIONS UNDER THIS PRIVACY POLICY OR PROVIDING THE SERVICES WHERE SUCH FAILURE OR DELAY RESULTS FROM CIRCUMSTANCES BEYOND OUR REASONABLE CONTROL, INCLUDING BUT NOT LIMITED TO: ACTS OF GOD, NATURAL DISASTERS, WAR, TERRORISM, RIOTS, EMBARGOES, ACTS OF CIVIL OR MILITARY AUTHORITIES, FIRE, FLOODS, EPIDEMICS OR PANDEMICS, POWER OUTAGES, TELECOMMUNICATIONS FAILURES, INTERNET SERVICE PROVIDER FAILURES, CYBERATTACKS, GOVERNMENT ACTIONS, OR ANY OTHER EVENTS BEYOND OUR REASONABLE CONTROL. IN SUCH EVENTS, OUR OBLIGATIONS UNDER THIS PRIVACY POLICY SHALL BE SUSPENDED FOR THE DURATION OF THE FORCE MAJEURE EVENT.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES OR THE LIMITATION OF LIABILITY FOR CERTAIN DAMAGES. IF THESE LAWS APPLY TO YOU, SOME OR ALL OF THE ABOVE DISCLAIMERS OR LIMITATIONS MAY NOT APPLY, AND YOU MAY HAVE ADDITIONAL RIGHTS.

You agree to defend, indemnify, and hold harmless WS Tech Venture Studio, its affiliates, officers, directors, employees, agents, and licensors from and against any claims, damages, obligations, losses, liabilities, costs, or expenses (including reasonable attorneys' fees) arising from or related to:

• Your use of or access to the Services;
• Your violation of this Privacy Policy or our Terms of Use;
• Your violation of any applicable law or regulation;
• Your violation of any third-party rights, including intellectual property or privacy rights;
• Any content or data you submit, post, or transmit through the Services; or
• Your negligence or willful misconduct.

This indemnification obligation survives termination of your account and this Privacy Policy.

This Privacy Policy shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria, without regard to its conflict of law principles.

Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Nigeria, subject to the dispute resolution provisions in our Terms of Use.

We reserve the right to update or modify this Privacy Policy at any time. Material changes will be communicated via the app, website, or email notification where appropriate. The "Last updated" date at the top of this policy indicates when the latest revisions were made.

Your continued use of the Services after the posting of changes constitutes your binding acceptance of such changes. If you do not agree with any changes to this Privacy Policy, you must discontinue use of the Services immediately.

We recommend that you review this Privacy Policy periodically and print a copy for your records.

For privacy-related inquiries, data protection requests, or to exercise your rights under applicable law, please contact us:

• Via the in-app Settings (Settings → Support)
• By email at legal@wstech.studio

We will acknowledge receipt of your request and respond within the timeframes required by applicable law (typically within 30 days). Complex requests may take longer, in which case we will inform you of the expected timeline.