LifeLong Network — Privacy Policy

1. Who we are

LifeLong Network is a relationship-intelligence service operated by LifeLong Network Inc. ("LifeLong Network," "we," "us," "our"). LifeLong Network is the organization responsible for the personal information described in this policy.

You can reach our Privacy Officer about this policy or how your information is handled at legal@lifelong.network.

2. What this policy covers ("the Services")

This policy applies to all of the following, together "the Services":

• the LifeLong marketing website at lifelong.network;
• the LifeLong web application at app.lifelong.network; and
• the LifeLong iOS application.

It explains what personal information we collect, why, who we share it with, how long we keep it, how we protect it, and your rights.

3. Our privacy commitments

• We do not sell your personal information, and we do not give or sell it to data brokers, advertisers or other companies so that they can market to you.
• We never use Your Content (the People, notes, recordings and other information you store in LifeLong) for advertising of any kind.
• We do advertise LifeLong itself, and we measure whether our own ads work. That is described in "Advertising and measurement" in Section 8 and only happens with your consent where consent is required.
• We use PostHog for privacy-first product analytics, hosted in the European Union. On our marketing website it loads only after you accept cookies. Inside the app it is part of how we run and improve the Services, and it is off until you turn it on in Settings under "Help improve LifeLong". Either way it never records your screen, never reads the text on the page, and never sends us your notes or the People you store: events carry an opaque user and account identifier and non-identifying metadata only.
• We do not collect or process biometric data (LifeLong does not do facial recognition).
• We store and process personal information in Canada, the United States, and the European Union, and may add other regions as the Services grow. Data is encrypted in transit and at rest. See Sections 9 and 13.

4. Personal information we collect

a) Account and billing information. Your name, email address, password (stored hashed), and subscription/plan status. Payments are processed by Stripe; LifeLong Network does not store your full payment-card number.

b) Content you create in the Services ("Your Content"). This is the core of the product. It includes the notes, voice recordings, photos (such as business cards), profile fields, follow-ups, tags, and any files you capture about the people you meet, as well as contact lists you choose to import (for example a LinkedIn or CRM export). Your Content routinely contains personal information about other people — see Section 7.

c) Information collected automatically. When you use the Services we collect limited technical and usage data, which may include IP address, approximate location derived from IP, device and browser type, pages or features used, and event logs used for security, debugging, and reliability.

d) iOS app data. With your permission, the iOS app accesses your microphone (to record voice captures) and camera/photos (to capture business cards and images). Text is extracted from images on your device where possible. Audio recordings are retained for a limited period and then deleted (see Section 10).

e) Business enquiries. If you contact us about hosting an event or a partnership, we keep your business contact details, our correspondence with you (including email sent to and from our staff mailboxes), and notes about our discussions, for as long as we have a business relationship and for a reasonable period afterwards. If you agree, we also send you occasional email about LifeLong for event hosts and partners. Every such email has an unsubscribe link.

We collect only what we need to provide the Services and will not collect materially new categories of data without updating this policy.

5. How we use personal information

We use personal information to:

• create and operate your account and provide the Services;
• structure Your Content into living profiles and generate briefings, suggested follow-ups, and predictive recall (see Section 6 on AI);
• let you export and sync records to tools you choose, such as your CRM;
• process subscriptions, trials, and payments;
• communicate with you about your account, security, and service changes;
• maintain security, prevent abuse and fraud, and debug and improve reliability; and
• comply with legal obligations.

Legal basis. In Canada (PIPEDA / Quebec Law 25) we rely on your consent, given by creating an account and using the Services, and on the performance of our contract with you; where the law requires express consent (for example certain uses under Quebec Law 25), we obtain it. For users in the EU / UK (GDPR / UK GDPR), our legal bases under Article 6 are: (i) performance of our contract with you, to provide the Services; (ii) your consent, where we ask for it (for example non-essential cookies and certain communications); and (iii) our legitimate interests in operating, securing, and improving the Services, where those interests are not overridden by your rights. You can withdraw consent at any time (Section 11); withdrawal does not affect processing already carried out, and may mean we can no longer provide the Services.

6. How we use artificial intelligence

LifeLong uses AI to deliver its core features. Your Content is sent to our AI provider, Anthropic (the Claude models), to:

• structure your captured notes into profile fields and summaries;
• generate relationship briefings and "what to ask next" prompts; and
• power predictive recall (suggesting which contacts may be relevant to an upcoming event).

Anthropic processes this data on our behalf as a service provider. Under Anthropic's commercial terms, Anthropic does not use LifeLong Network's customer data to train its models.

AI output is a suggestion, not a fact. Briefings, profile fields, and predictions are automatically generated and may be incomplete or inaccurate. You can review, correct, and delete them. See Section 12 on automated decision-making.

7. Personal information you record about other people

Because LifeLong helps you remember people you meet, Your Content typically includes personal information about third parties (for example a contact's name, role, company, and personal details you note).

• For information you record about others, you act as the party that decides what to collect, and LifeLong Network processes it on your behalf to provide the Services. You are responsible for having a proper basis to record it and for using it lawfully and respectfully. Our Terms require this.
• We use third-party information only to provide the Services to you and for the purposes in this policy. We never use the People you store in LifeLong to build marketing lists or to advertise to them.
• If you are not a LifeLong user and believe a user has stored information about you, contact us at legal@lifelong.network and we will route your request to the relevant user and assist as required by law.

8. When we share personal information

We share personal information only as described here:

• With our service providers (subprocessors) who help us run the Services, listed in Section 9, under contracts that limit them to our instructions.
• Within our organization, with personnel who need access to operate the Services.
• For legal reasons — where required by law or legal process, to enforce our Terms, or to protect the rights, safety, and property of LifeLong Network, our users, or others.
• In a business transfer — if LifeLong Network is involved in a merger, acquisition, financing, or sale of assets, subject to this policy.

We do not sell personal information, and we do not disclose it to third parties for their own marketing. The only advertising-related disclosure we make is the consent-based measurement of LifeLong's own advertising described in "Advertising and measurement" below.

Advertising and measurement. LifeLong pays for advertising to find new customers. On our marketing website only, and only if you consent in the cookie banner, we use advertising cookies from Google Ads, Meta and LinkedIn to measure whether our ads lead to sign-ups, and we set a first-party cookie (ll_attr) that remembers which campaign or referral first brought you to us. If you later create an account, we record that campaign or referral against your account so we can see which channels work. We may tell an ad platform that a sign-up or purchase followed one of its ad clicks, using the click identifier that platform gave us. With your marketing consent, we may also send an ad platform a hashed (SHA-256) version of your email address so it can match your sign-up or purchase to an ad you saw and so we can avoid showing you ads for something you already have. We never send your email address in readable form, and we never send Your Content. The ad platforms act on our instructions for measuring and delivering LifeLong's own advertising; we do not allow them to use this information to market other companies' products to you, to the extent their terms let us control that. You can withdraw consent at any time: use "Cookie preferences" or "Your privacy choices" in the website footer, turn off marketing email in Settings → Notifications, or enable Global Privacy Control in your browser, which our website treats as a refusal of advertising cookies.

9. Service providers (subprocessors)

We rely on the following providers, each under contract limiting them to our instructions:

Provider	Purpose	Region
Laravel Cloud (runs on Amazon Web Services)	Application hosting / compute	Canada (ca-central-1)
DigitalOcean	Managed database (PostgreSQL)	Canada (Toronto)
Amazon Web Services (S3)	Media file storage	Canada (ca-central-1, Montreal)
Namecheap	Marketing website hosting (lifelong.network)	United States
Stripe	Payment processing & subscriptions	United States / global
Anthropic	AI processing (structuring, briefings, predictive recall)	United States
Resend	Transactional and campaign email delivery	United States
Sentry	Error monitoring	United States
Mailchimp	Marketing / waitlist email; product email for app users who opt in	United States
Google (Google Analytics, Google Ads)	Marketing-site usage analytics and ad-campaign measurement/personalization — consent-gated	United States
Meta Platforms, Inc. (Meta Pixel)	Marketing-site ad-campaign measurement and personalization — consent-gated	United States
PostHog	Product analytics. Consent-gated on the marketing website; in the app, off unless you turn it on in Settings. No autocapture, no session recording, no personal information in events	European Union (Frankfurt)
Google Workspace	Our staff email and calendar, used for business correspondence with event hosts and partners	United States / global
Google Ads, Meta, LinkedIn	Measurement of LifeLong's own advertising: click identifiers, and hashed email with consent	United States / global

Services you connect, and services on your device. Some recipients are not our service providers. If you connect a calendar, we exchange data with Google or Microsoft under the read-only permission you grant, and you can disconnect at any time. Dictation is handled by your device's speech service and stays on your device unless you turn on Enhanced dictation in the app, in which case the audio and the contact names that make it accurate go to Apple (iOS) or Google (Android); LifeLong never receives or stores the audio. Apple and Google also distribute our mobile apps through their app stores. These companies act as independent controllers of the information they receive, under their own privacy policies.

10. How long we keep personal information

• Account and Your Content: kept while your account is active.
• Voice recordings: retained for up to 72 hours after capture, then automatically deleted.
• Media files: kept with the related records and deleted on the same schedule as your account data.
• Logs and security data: kept for a limited period for security and debugging.

Deleting your account. You can delete your account at any time in Settings. Deletion is immediate and permanent: we erase your account and Your Content from our systems, cancel any subscription, delete your customer record and saved payment method at Stripe, and delete your record from our email marketing provider. Encrypted backups that may still contain your data are overwritten on their normal rotation, within 90 days, and are not used for any other purpose. Our payment processor keeps records of past transactions where the law requires it. We keep a small set of anonymous statistics that cannot identify you (for example the month an account closed, the plan, the country, and how the account originally found us) to understand why people leave.

11. Your rights and how to exercise them

Everyone. Whatever your location, you can:

• access the personal information we hold about you and learn how it is used and shared;
• have inaccurate information corrected;
• withdraw consent and request deletion of your account and records;
• request portability of your data (you can also self-export to CSV, JSON, or vCard in-app); and
• make a complaint (Section 17).

Canada (PIPEDA / Quebec Law 25). You have the rights above, and Quebec residents additionally have rights regarding automated processing and data portability under Law 25.

EU / UK (GDPR / UK GDPR). You also have the rights to restrict or object to processing, to data portability in a structured format, and not to be subject to certain solely-automated decisions (Section 12). Where processing is based on consent, you may withdraw it at any time. You may complain to your local data-protection authority (Section 17).

United States (California and other states). You have the right to know what personal information we collect and how we use and share it, to request access and deletion, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not "sell" personal information. Some US state laws define sending a hashed email or a click identifier to an ad platform as "sharing" for cross-context behavioural advertising. We only do this with your consent, and you can opt out at any time through "Your privacy choices" in the website footer, in Settings → Notifications, or by enabling Global Privacy Control. The footer also carries "Do Not Sell or Share My Personal Information" and "Cookie preferences", which reach the same controls.

To exercise any right, contact our Privacy Officer at legal@lifelong.network. We will verify your identity and respond within the timelines required by the applicable law. You may use an authorized agent where the law allows.

12. Automated decision-making and profiling

LifeLong uses automated processing in two ways:

• AI relationship features (Section 6) — structuring, briefings, and predictive recall. These produce suggestions for you, not decisions with legal effects, and you remain in control of any action you take.
• Security and abuse monitoring — automated signals may flag or restrict an account suspected of violating our Terms or the law; such actions are subject to human review on request.

You can ask us to explain or manually review an automated outcome by contacting the Privacy Officer.

13. International data transfers

We are based in Canada. Your account, content, and media are stored in Canada (Section 9). Our marketing website is hosted in the United States (Namecheap). Some service providers process personal information in the United States (Namecheap, Stripe, Anthropic, Resend, Sentry, Mailchimp, Google, Meta) and the European Union (PostHog), and we may add other regions as the Services grow. This means your information may be transferred to, stored in, or accessed from a country other than your own, where data-protection laws differ and where courts and authorities may be able to access it under local law.

Wherever we transfer personal information, we use safeguards appropriate to the destination, including contractual protections (such as data-processing agreements), and we assess transfers as required by Quebec Law 25.

For EU / UK users: Canada benefits from a partial EU adequacy decision for commercial data covered by PIPEDA, so transfers from the EU/UK to us in Canada are generally permitted. For onward transfers to the United States, we rely on the recipient's certification under the EU-US / UK Data Privacy Framework or on Standard Contractual Clauses, together with supplementary measures.

14. Security

We protect personal information with encryption in transit and at rest, tenant data isolation, access controls, and confidentiality obligations for personnel and providers. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information using reasonable safeguards.

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the relevant authorities (including the Office of the Privacy Commissioner of Canada and, for Quebec residents, the Commission d'accès à l'information) as required by law.

15. Cookies

The Services use a minimal set of cookies and similar technologies. On our marketing website, if you consent, we use advertising cookies (Google Ads, Meta Pixel) to measure LifeLong's own advertising; nothing loads until you consent, and you can decline or withdraw at any time. We also set a cookie that remembers which campaign or referral first brought you to the site, so credit for a later sign-up goes to the right place; it holds no personal data and is set only after you consent. If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising cookies: no advertising cookie and no campaign cookie is set, whatever you choose in the banner. Full details, categories, and your choices are in our separate Cookie Policy.

16. Children

The Services are intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from a minor, we will delete it. A parent or guardian who believes we hold a minor's information can contact our Privacy Officer.

17. Complaints

If you have a concern about how we handle your personal information, please contact our Privacy Officer first so we can try to resolve it. You also have the right to complain to a supervisory authority — the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec (for Quebec residents), or your provincial privacy regulator.

18. Changes to this policy

We may update this policy to reflect changes in the law or our practices. We will update the "Last updated" date and, for material changes, notify you by email or an in-app notice.

19. Contact

Privacy Officer, LifeLong Network Inc. — legal@lifelong.network