Privacy Policy
GrundLayer LTD (“Company”, “we”, “us”, or “our”) operates the Unhooked mobile application (the “App”) and related services. We are committed to protecting your personal information and your right to privacy.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Unhooked. It applies to users worldwide, with specific protections provided under the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and applicable US State Privacy Laws (including the California Consumer Privacy Act / CPRA).
1. Data Controller & Contact Information
GrundLayer LTD is the data controller responsible for your personal data.
- Legal Entity Name: GrundLayer LTD
- Registered Address: [Insert UK Registered Office Address]
- Company Registration Number: [Insert UK Companies House Number]
- Information Commissioner's Office (ICO) Registration: [Insert ICO Registration Number / In Progress]
- Official Privacy & Support Contact: support@unhookedwave.app
*Note on EU Representative:* As a UK-based controller processing data of individuals in the European Economic Area (EEA), we process data under strict adequacy standards. Inquiries from EEA authorities or data subjects may be directed to our support email address above.
2. Important Notice: Special Category (Health & Habit) Data
The App facilitates nicotine cessation (including vaping and nicotine pouches) through habit tracking, trigger identification, and Cognitive Behavioural Therapy (CBT)–informed self-help modules.
Under UK and EU GDPR, information regarding substance use, craving frequencies, and psychological triggers constitutes Special Category Data (data concerning health). We process this data strictly based on your explicit consent (Article 9(2)(a) UK/EU GDPR) obtained during onboarding. You may withdraw this consent at any time by deleting your account or data within the App.
3. Information We Collect
We adhere to strict data minimisation principles. We do not collect your real name in the App.
A. Information You Provide to Us
- Account Credentials (Optional): If you register via email, we store your email address. You may also use the App with anonymous authentication, in which case no direct personal identifiers are stored.
- Habit & Trigger Data: Nicotine product types used (e.g., vape, pouches), usage frequency, trigger contexts (e.g., morning coffee, work stress), motivations, and quit date.
- Craving & Intervention Logs: Real-time craving records, urge-surfing session completions, thought reframes, and self-reported slip/relapse events.
- Support Communications: Any information you choose to include when contacting our support desk.
B. Information Collected Automatically
- Device & Technical Identifiers: Device model, operating system version, anonymous installation UUIDs, and push notification tokens.
- Usage & In-App Activity: Feature engagement, lesson progress, streak metrics, session frequency, and crash reports.
- Payment Identifiers: Transaction receipt tokens and subscription status validated via third-party payment rails (we do not collect or store your credit or debit card numbers).
4. Legal Bases for Processing (UK & EU GDPR)
We rely on the following lawful bases to process your data:
| Purpose / Activity | Data Categories | Lawful Basis (UK/EU GDPR) |
|---|---|---|
| Providing core habit tracking & CBT modules | Account ID, habit logs, quit progress | Performance of a Contract (Art. 6(1)(b)) |
| Processing craving logs & trigger health data | Craving events, trigger profiles, slip logs | Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a)) |
| Managing subscriptions & in-app purchases | Transaction IDs, purchase receipts, plan tier | Performance of a Contract (Art. 6(1)(b)) |
| Sending streak alerts & milestone notifications | Push tokens, streak milestones | Legitimate Interests (Art. 6(1)(f)) / Consent |
| App performance, analytics & bug resolution | De-identified usage funnels, crash logs | Legitimate Interests (Art. 6(1)(f)) |
| B2B Employer Corporate Wellness Reporting | Aggregated, de-identified engagement metrics | Legitimate Interests (Art. 6(1)(f)) |
5. Third-Party Service Providers (Sub-Processors)
We share limited data with trusted infrastructure providers under Data Processing Agreements (DPAs) incorporating standard contractual clauses:
- Database & Hosting: Amazon Web Services (AWS) / Supabase — Hosted in the AWS London (UK) Region (eu-west-2). Data is encrypted in transit (TLS 1.3) and at rest (AES-256).
- Subscription Management: RevenueCat, Inc. (processes subscription state, receipt validation, and purchase events).
- App Distribution & Billing: Apple App Store (Apple Inc.) manages all in-app transaction payments and billing data.
- Product Analytics: PostHog EU (hosted on European infrastructure for aggregated behavioral tracking, event metrics, and funnel conversion analysis).
- Push Notifications: Apple Push Notification service (APNs) (transmits streak alerts and local check-in reminders using secure device tokens).
- AI Model Processing: None. No artificial intelligence APIs or external language models are utilised to process your personal data.
6. B2B Employer Wellness Programs
If you access Unhooked via an employer benefit code:
- Your employer never receives your individual health data, trigger reports, slip logs, or personal identity.
- Employers receive only aggregated, anonymised reporting (e.g., aggregate participant counts, anonymised group milestone completion rates) for billing and wellness validation.
7. Data Storage, Retention, and Account Deletion
- Data Location: Primary application databases are maintained in the United Kingdom (AWS London).
- Retention Schedule: We retain your personal data as long as your account remains active.
- Account Deletion (Right to Erasure): You may initiate account deletion directly in the App settings. Upon request, your account is marked for soft-deletion and permanently purged from active and backup databases within 30 days.
- Anonymised Data: Fully anonymised, aggregated metrics that cannot be linked back to an individual may be retained for longitudinal cessation research and platform improvement.
8. Your Legal Rights
Depending on your jurisdiction (including the UK, EEA, and various US states), you hold specific rights regarding your personal data:
Non-Discrimination: We will never discriminate against you for exercising your privacy rights.
9. International Data Transfers
When data is transferred outside of your home country (including outside the UK or EEA), we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements (IDTAs), EU Standard Contractual Clauses (SCCs), or adequacy regulations.
10. Protection of Minors
Unhooked is designed and intended for users aged 18 and older. We do not knowingly collect personal data from individuals under 18. If we become aware that personal information of a minor has been collected without verifiable parental consent, we will promptly delete the data from our servers.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect product updates or legal adjustments. When material updates occur, we will notify you through an in-app banner or via notification before the changes take effect.
12. Contact
For questions, subject access requests, or privacy concerns: