We take your privacy very seriously and this Privacy Notice explains how Nothing Technology Limited and its affiliated companies (collectively, "we", "us", or "our") collect, use, share and process your Personal Data when you are using the Nothing X app (the "App"). We are the "data controller" in respect of processing your Personal Data. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

1. What Personal Data we collect
"Personal Data"means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). To provide our services, we may collect, use, store and process the following types of data:
Identity and Contact Data:Email address, password, region, language, avatar/profile photo, birthday, gender.
Health and fitness data:heart rate, blood oxygen, sleep data, stress level, vitality score, training load, VO₂max, menstrual cycle information, body height, step count, calories burned, exercise type and duration. Audio Data:audio from calls, meetings, conversations, voice or speech recordings, and other audio content that is played through, captured by, or recorded using your earbuds, headphones, or the App.
Multimedia data:screenshots, screen recordings, customer service messages.
Device information:device ID, device model, OS version, serial number, MAC address, firmware version, app version, region, device language.
Network and usage data:IP address, public IP, crash logs, diagnostic logs, usage behavior, app interactions.
Location data:GPS location (if authorized), time zone, device region.
Third-party login data:Apple ID, Google login profile (email, username, profile picture).
News preferences:your chosen news categories or topics of interest.

We use different methods to collect data from and about you including through:
Your interactions with us.
You may give us your personal data when:
you register an account via our App;
when you participate in the activities on the App;
you correspond with us by post, phone, email or otherwise.
Automated technologies or interactions.As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies.

Please note that audio recordings, transcripts, summaries, and related outputs generated through call recording, meeting recording, Snapshot, AI transcription, or AI summary features may contain special categories of personal data if such information is included in the audio you record, capture, upload, or otherwise provide. This may include information about your race or ethnicity, religious or philosophical beliefs, sex life or sexual orientation, political opinions, trade union membership, health information, or genetic or biometric data.

Where you actively enable AI transcription or AI summary features, such data may be uploaded to our servers and transmitted to authorized third-party AI service providers solely for the purpose of generating the transcript, summary, or other AI output requested by you. Unless otherwise stated or required by applicable law, once processing is complete, the uploaded audio containing such special category data will be permanently deleted.

2. How We Use Your Data
We will only use your personal data when the law allows us to. Most commonly, we will use your data in the following circumstances:
set up and connect your headphones, and smartwatches with the App;
download a software update;
provide, personalize and improve your experience with the App, headphones, and smartwatches;
allow device pairing and personalized sound experience;
track and present fitness and health data to you (e.g. heart rate trends, sleep history, step count, calories burned);
troubleshoot issues and improve product performance through diagnostic logs and crash reports;
provide localized services, content, and customer support based on your region, language, and device usage;
provide call recording, meeting recording, Snapshot, AI transcription and summary features when you choose to use them;
process recorded or captured audio to generate transcripts, summaries, keywords, action items, titles, or other AI-generated outputs requested by you;
process requests and orders and provide customer support;
conduct surveys, hearing tests, and improvement programs you voluntarily participate in;
comply with applicable legal obligations (e.g., tax, consumer rights, cybersecurity, or health data protection laws).

Your data will not be used for advertising purposes or shared with third parties beyond what is necessary to provide the services. This may include our service providers who help provide some of the functionality that is part of the services. We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

We require all third parties to respect the security of your data and to treat it in accordance with the law. We do not allow our third-party service providers to use your data for their own purposes and only permit them to process your data for specified purposes and in accordance with our instructions.

To provide you with a full range of functions and services, we may cooperate with third-party service providers (SDKs or APIs) that collect and process Personal Data either directly or through us.

Third-party SDK	Purpose	Data Collected Directly by the SDK
Google Maps SDK	Location-based services	GPS location, IP address, app info
Google Sign-In SDK	Account login	Email, user ID, profile image
Firebase Crashlytics	Crash monitoring	Device model, OS version, crash logs, IP address
Firebase RemoteConfig	Dynamic app configuration	Device info, user region, usage pattern
Firebase Messaging	Push notifications	Device ID, push token, IP address
Mimi SDK	Hearing test / sound personalization	Headphone ID, IP, timestamp, logs, hearing test results
Audiodo SDK	Personalized sound experience	Audio profiles, device info
Gomore SDK	Fitness tracking (heart rate, steps, etc.)	Health data: heart rate, step count, calories, exercise info

In some cases, we collect and share Personal Data with the following third parties based on your consent:

Third-party SDK / API	Purpose	Data Shared
Apple Health SDK	Syncing wearable health data	Heart rate, sleep, blood oxygen, menstrual cycle, calories (iOS version)
Health Connect SDK	Android health data integration	Same as above (Android version)
Strava API	Workout sync and activity sharing	Step count, distance, calories, GPS path, timestamps
Apple Sign-In	Login	Email address, Apple ID (anonymized if chosen), profile photo (iOS version)
Gemini API	AI transcription	Audio data

3. Data Storage and Transfer
- Retention period
We will only retain your data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

- Regional Processing:
For users in the United Kingdom (UK), all data is processed on servers located in Franklin, Germany.
For users in the European Union (EU), all data is processed on servers located in Franklin, Germany, in compliance with GDPR.
For users in India, all data is processed on servers located in Mumbai, India.
For users outside the EU, data is processed on servers located in Franklin, Germany.

We may transfer your personal data to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside of the UK to countries which have laws that do not provide the same level of data protection as UK law.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring that adequate safeguards are in place as required under UK data protection law.

4. Legal Basis for Processing
We will only use your personal data when we have a lawful basis to do so. Our lawful basis for which we use your personal data is specified as follows:

Consent:You have freely consented before the processing in a specific informed and unambiguous indication of what you want. If you consent, you should select the appropriate consent option at the pop up.

Performance of a contract:we need to process your personal data or any data that you input into the App to provide the services and therefore perform a contract with you.

Compliance with law:We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

Legitimate interests:we may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to help us improve our products and services. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by law).

5. Your Data Rights
You have the following rights under data protection laws in relation to your personal data. These include:

Right to access your data:request access to and / or a copy of the personal data we process about you (commonly known as a data subject access request).

Right to correct your data:request correction of any incomplete or inaccurate data we hold about you.

Right to request to delete your data:request us to delete or remove your personal data where there is no good reason for us continuing to process it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Right to object:object to us processing your personal data where: (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms; or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.

Right to request restriction:ask us to suspend the processing of your personal data in the following scenarios:
- if you want us to establish the data's accuracy.
- where our use of the data is unlawful, but you do not want us to erase it.
- where you need us to hold the data even if we no longer require it as you need to establish, exercise or defend legal claims; or
- you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Data portability:request we transfer certain of personal data to you or your chosen third party in a commonly used, machine readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent:Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may be unable to provide the services to you. We will advise you of this at the time you withdraw your consent.

Complaint:If you are unhappy with how we process your personal data, we ask that you contact us first using the details below so that we have the chance to put it right. However, you also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).

We will handle any request to exercise your rights in accordance with applicable law and any relevant legal exemptions. If you wish to exercise any of these rights at any time by contacting us using the contact details provided below in this Privacy Policy.

6. Data Security
All information you provide to us is stored on our secure servers. We also implement robust measures to protect your personal data, including:
Encryption during data transmission.
Immediate deletion of data after processing.
Access controls to prevent unauthorized access.

We use appropriate technical and organizational measures to protect your data that we collect and process. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. The measures we use are designed to provide a level of security appropriate to the risk of processing your data.

7. Children's Privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children without parental consent.

8. Changes to This Privacy Policy
We keep this Privacy Policy under regular review and we may update this policy to reflect changes in our practices or regulatory requirements. Updates will be communicated via the App. You may be required to read and acknowledge the changes to continue your use of Nothing X.

9. Contact Us
If you have any questions regarding this Privacy Policy or its implementation, here is how you can reach us:
Email Address: privacy@nothing.tech