BEMELLOU PRIVACY POLICY

This section constitutes the full Privacy Policy of Bemellou and is a continuation of the Terms of Service.

Last updated: 10 September 2026

Effective date: 10 September 2026

9.1 — Data Controller
Bemellou ("we," "us," or "our") is the data controller responsible for your personal data. For any data-related inquiries,
Contact us at support@bemellou.com.

9.2 — Information We Collect

We collect the following categories of personal data:

Account Data: Name or nickname, email address, password (cryptographically hashed; we never store or access plain-text passwords), avatar image, bio, and referral codes.

Profile & Activity Data: Sparks earned, streak data, subscription tier, community rank, journal entries, weekly intentions, quiz results, messages posted, likes given, and participation history.

Device & Usage Data: Browser type, operating system, device type, screen resolution, IP address (anonymised after collection within our own systems), pages visited, timestamps, session duration, and interaction patterns.

Advertising & Attribution Data: Conversion and browsing events used to measure and target advertising. On the Bemellou website this includes page views, product views, add to cart, checkout, and purchase events, your IP address, browser and device information, and cookie or advertising identifiers set by our advertising and analytics partners. In the Bemellou mobile app this includes your device advertising identifier and the four events listed in section 9.17. This category never includes journal entries, mood data, or any other account content or wellness data.

Plushie Registration Data: Plushie verification codes entered and associated plushie types.

Payment Data: We do not directly store credit card numbers or full payment credentials. Payment processing is handled by Stripe, Inc. (PCI DSS Level 1). We store only customer identifiers, subscription status, plan type, and transaction timestamps.

Moderation Data: Flagged content, matched moderation terms, moderation review history, and administrative actions for community safety enforcement.

Voice Data: If you use voice-to-text journaling, audio recordings are temporarily processed for transcription and are not permanently stored. Transcribed text is stored as part of your journal entry.

9.3 — Legal Basis for Processing (GDPR)

Consent: You consent to general data processing when you accept these Terms and create your account. The advertising and attribution technologies described in sections 9.12 and 9.17 rely on separate, specific consent, which we request through our cookie banner on the website and through your device settings in the mobile app. You may withdraw either form of consent at any time by changing your cookie preferences, resetting your device advertising identifier, or deleting your account.

Contractual Necessity: Processing necessary to provide you with Platform features you have subscribed to.

Legitimate Interest: Platform security, fraud prevention, content moderation, rate limiting, abuse detection, and service improvement.

Legal Obligation: Compliance with applicable laws, regulations, court orders, or valid legal processes.

9.4 — How We Use Your Data
We use your personal data to: (a) provide, maintain, and improve the Platform; (b) personalise your experience; (c) moderate content and enforce Community Guidelines; (d) process payments and manage subscriptions; (e) communicate with you about your account, service updates, or security alerts; (f) analyse usage patterns in aggregate to improve the Platform; (g) measure the performance of our advertising, limited to the attribution data described in sections 9.12 and 9.17; (h) prevent fraud, abuse, and security threats; (i) comply with legal obligations; (j) enforce these Terms.

9.5 — Data Storage & Security

Your data is stored securely on cloud infrastructure with encryption at rest (AES-256) and in transit (TLS 1.2+). We implement comprehensive security measures including Row-Level Security (RLS) database policies, server-side rate limiting, strict input validation and sanitisation, comprehensive audit logging, role-based access control, and automated content moderation. Passwords are cryptographically hashed and never stored in plain text. Despite these measures, no system is 100% secure, and you acknowledge this inherent risk.

9.6 — Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will: (a) notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33); (b) notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34); (c) document all breaches, their effects, and remedial actions taken.

9.7 — Data Retention

We retain your personal data for as long as your account is active. Upon account deletion:

• Profile data, journal entries, and personal settings are permanently deleted within 30 days.
• Community messages may be anonymised rather than deleted to preserve conversation context.
• Moderation logs, flagged content records, and audit trails may be retained for up to 3 years for legal compliance and safety.
• Anonymised and aggregated analytics data may be retained indefinitely, as it cannot be used to identify you.
• Payment records may be retained as required by tax and financial regulations (typically 7 years).
• Advertising and attribution data is retained in our systems for no longer than 14 months, after which it is deleted or anonymised. Data already transmitted to TikTok is retained under TikTok's own retention policy.

9.8 — Data Sharing & Third-Party Processors

We do NOT sell, rent, or trade your personal data. We do share a limited set of shopping and conversion data with the advertising, analytics, and service providers listed below. We never share journal entries, mood data, or any other wellness information with any of them.

 

We may share data with:

• Shopify, Inc., our ecommerce platform, which hosts the store and uses store and customer data across its merchant network to improve fraud prevention, product recommendations, ad targeting, and personalisation, as described in Shopify's Additional Services Terms.
• Stripe, Inc., for payment processing, subject to Stripe's privacy policy and PCI DSS compliance.
• Cloud infrastructure providers for hosting and data storage, subject to data processing agreements with appropriate safeguards.
• Advertising platforms, for measuring and targeting our advertising: TikTok, Meta (Facebook and Instagram), Google (including YouTube), and Pinterest. Each receives shopping events such as page views, add to cart, and purchases, together with technical identifiers, as described in section 9.12.
• Triple Whale, for analytics and campaign attribution.
• Klaviyo, for email and SMS marketing, including your contact details and shopping activity where you have subscribed.
• Service providers supporting store operations: Judge.me for product reviews, Parcel Panel for shipment tracking, and UpPromote for our affiliate and referral programme.
• Law enforcement only when required by a valid legal process (court order, subpoena, or warrant) and only the minimum data necessary.
• In connection with a merger, acquisition, or sale of assets, there will be at least 30 days' prior notice to users and the option to delete accounts before transfer.

Anonymous posting hides your identity from other community members, but remains visible to Platform administrators for moderation and safety purposes.

9.9 — Your Rights Under GDPR & Applicable Law

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data via your Profile settings or by contacting us.
• Right to Erasure (Art. 17): Request deletion of your personal data. We will comply unless retention is required for legal obligations or defence of legal claims.
• Right to Restrict Processing (Art. 18): Request that we limit how we use your data while a complaint or request is being resolved.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format (JSON or CSV).
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time. For general processing, delete your account or contact us. For advertising and attribution specifically, change your cookie preferences on the website or reset or delete your device advertising identifier in your device settings, as described in sections 9.3, 9.12, and 9.17. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right re: Automated Decision-Making (Art. 22): We do not make any decisions based solely on automated processing that produce legal effects concerning you.

To exercise any of these rights, contact us at support@bemellou.com. We will verify your identity and respond within 30 days (up to 60 days with notification if additional time is needed).

9.10 — California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights:

Right to Know: Request disclosure of categories and specific pieces of personal information collected, sources, business purposes, and third parties with whom we share it.

Right to Delete: Request deletion of your personal information, subject to certain exceptions permitted by law.

Right to Correct: Request correction of inaccurate personal information.

Right to Opt-Out of Sale/Sharing: We do not sell your personal information for money. We do disclose shopping and conversion data, together with advertising identifiers, to advertising and analytics partners including TikTok, Meta, Google, Pinterest, Klaviyo, and Triple Whale, and to Shopify for platform-level ad targeting and personalisation, as described in sections 9.8 and 9.12. Under the CPRA this is treated as "sharing" for cross-context behavioural advertising. You may opt out at any time by using the "Do Not Sell or Share My Personal Information" control on our website, by blocking advertising cookies in your browser, by resetting or deleting your device advertising identifier, or by emailing support@bemellou.com. We will not discriminate against you for opting out.

Right to Limit Use of Sensitive Personal Information: We only use sensitive personal information for purposes authorised under CCPA/CPRA. We do not disclose journal entries, mood data, or any other sensitive personal information to advertisers.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise these rights, contact support@bemellou.com. We will verify your identity using reasonable means before fulfilling any request.

9.11 — Children's Privacy
The Bemellou app and platform are strictly for users aged 18 and older. We do not knowingly collect, use, or disclose personal data from users under the age of 18. If we become aware that a user under 18 has accessed the app or platform, we will promptly terminate their account and permanently delete all associated personal data. Physical plush toy purchases on the Bemellou website are open to all ages; parental guidance is encouraged for purchasers under 18. If you believe a minor has created an account, contact us immediately at support@bemellou.com.

9.12 — Cookies & Tracking Technologies

We use essential first-party cookies strictly necessary for authentication, session management, and security (for example, CSRF protection). These cannot be disabled without breaking core functionality.

We also use third-party advertising and analytics technologies on the Bemellou website, provided by TikTok, Meta (Facebook and Instagram), Google (including YouTube), Pinterest, Klaviyo, and Triple Whale. These record shopping activity such as page views, product views, add to cart, checkout, and purchase events, together with your IP address, browser and device information, and cookie or advertising identifiers. We use them to measure whether our advertising works and to show relevant ads to people who have visited the store. Some of these events are also sent server-side by our ecommerce platform rather than from your browser.

In the Bemellou mobile app we use the TikTok Business SDK only, which transmits the four events listed in section 9.17.

None of these partners ever receives journal entries, mood check-ins, session notes, messages to psychologists, community or peer circle activity, quiz results, or any other wellness or mental health information. That data never leaves Bemellou and is never used to target advertising.

We do not sell your browsing history.

Where required by law we ask for your consent before any non-essential cookie or advertising technology is used, through the cookie banner shown on the website. You can change your choice at any time through the banner or your browser's cookie settings, and you can limit app measurement by resetting or deleting your device advertising identifier in your device settings. Declining does not restrict any part of the Platform.

Each partner's own handling of the data it receives is governed by its own privacy policy. TikTok's is available at https://www.tiktok.com/legal/privacy-policy.

9.13 — International Data Transfers
Your data may be transferred to and processed in countries outside your own, including the United States. Such transfers are protected by appropriate safeguards, including: (a) Standard Contractual Clauses (SCCs) as approved by the European Commission; (b) adequacy decisions where applicable; (c) supplementary measures as required by the Schrems II ruling. This includes the attribution data described in sections 9.12 and 9.17, which is transferred to TikTok and processed under TikTok's own international transfer safeguards and privacy policy. By using the Platform, you consent to these transfers subject to the safeguards described.

9.14 — Do Not Track Signals
The Bemellou website responds to "Do Not Track" (DNT) browser signals. When a DNT signal is detected, we limit data collection to what is strictly necessary for the operation of the service. DNT is a browser-based signal and does not apply to the Bemellou mobile app. To limit advertising measurement in the app, reset or delete your device advertising identifier in your device settings, as described in section 9.17.

9.15 — Changes to Privacy Policy
We may update this Privacy Policy from time to time. For material changes that affect how we process your personal data, we will: (a) provide at least 30 days advance notice via email and Platform notification; (b) clearly identify what has changed; (c) provide an opportunity to review the changes before they take effect. Your continued use after the effective date constitutes acceptance. If you do not agree to the changes, you must stop using the Platform and delete your account.

9.16 — Data Protection Officer
For privacy-related inquiries, data access requests, complaints, or to report a potential data breach, contact our Data Protection Officer at support@bemellou.com. If you are dissatisfied with our response, you have the right to lodge a complaint with your local supervisory authority. For EU residents, a list of authorities is available at edpb.europa.eu.

9.17 — Advertising and attribution

This section describes advertising measurement in the Bemellou mobile app. For the Bemellou website, see section 9.12.

We use the TikTok Business SDK inside the Bemellou mobile app to measure the performance of our advertising. Its only purpose is attribution: telling us whether someone who saw a Bemellou ad on TikTok went on to install the app or complete a purchase. We do not use it to profile you, and we do not use it to build advertising audiences from your activity inside the app beyond the events listed below.

The SDK transmits four events to TikTok:

1. App install
2. Registration (creating a Bemellou account)
3. Start trial
4. Purchase, including order value and currency

Alongside these events, the SDK sends standard technical information: your device advertising identifier, IP address, device type and operating system version, and the time the event occurred.

That is the complete list. No journal entries, mood check-ins, session notes, messages to psychologists, community or peer circle activity, survey answers, or any other wellness or mental health information you enter in the Bemellou app is ever transmitted to TikTok or to any other advertising or analytics partner. That information stays within Bemellou and is handled under the sections above.

You can reset or delete the advertising identifier used for this measurement at any time in your device settings. Doing so does not restrict any part of the app.

TikTok's own handling of the data it receives is governed by its privacy policy at https://www.tiktok.com/legal/privacy-policy.

CONTACT & PLAIN LANGUAGE SUMMARY

Contact Information 
All inquiries — general support, legal matters, privacy & data requests, DMCA notices: support@bemellou.com

In Plain Language
Bemellou is a community, not therapy, not a medical service, not a crisis line. We built this because we care deeply about emotional well-being and believe nobody should have to feel alone. We can't promise outcomes, but we can promise a space designed with heart.

The Bemellou app is for adults 18 and older — strictly. Our website and plushies are for everyone; all ages are welcome to shop, with parental guidance encouraged for younger customers.

Our 30-day return policy means you can return any unused plushie within 30 days of delivery, for any reason, with free return shipping on us. If something arrives damaged, let us know within 7 days, and we will make it right.

We protect your data seriously — we never sell it, and you can request deletion at any time. Be kind to each other, remember that fellow members aren't trained professionals, and please reach out to qualified help for serious concerns. We're really glad you're here.

© 2026 Bemellou Inc. · Miami, Florida, United States · bemellou.com · support@bemellou.com