DW DearWith

DearWith Privacy Policy

Version: v1.1
Effective Date: August 17, 2026
Last Updated: October 24, 2026

This Privacy Policy explains how UNIUME PTE. LTD., a Singapore company ("DearWith," "we," "us," or "our"), collects, uses, discloses, transfers, stores, and protects personal data when you use DearWith.

DearWith is a privacy-first product for personal records, shared family spaces, and Letters, with Presence features now retired. We know that Account Presence settings, memory inputs, conversations, Letters, and Moments may be deeply personal. We design our data practices around minimization, user control, limited access, and clear disclosure.

Important Notice and Key Privacy Summary

This summary highlights important privacy terms, but it does not replace the full Privacy Policy. Please read the full Policy carefully. If this summary conflicts with the full Policy, the full Policy controls to the extent permitted by law.

Presence retirement: Registration no longer creates a Presence, and Presence conversations and memory building are no longer available. References below to these features describe historical processing and retained data. Retirement does not itself delete that data or purchase records, and the privacy protections, retention limits, and deletion rights in this Policy still apply. Current Letter delivery does not evaluate conversations or require Presence access.

1. Scope and Relationship to Terms

1.1 This Privacy Policy applies to DearWith apps, including our iOS application and any Android application we make available, web products, websites, APIs, support channels, and related services.

1.2 This Policy should be read together with the DearWith Terms of Service.

1.3 If we publish regional privacy notices, those notices apply to users in the relevant jurisdictions and control where required by law.

1.4 Capitalized terms have the meanings in the Terms of Service. An "Account Holder" is the registered user, an "Account Presence" refers to the retired AI-based profile, and a "Letter Creator" is the Account Holder who creates a Letter.

2. Age and Children Privacy

2.1 DearWith is intended only for users who are at least 18 years old.

2.2 Users under 18 may not create an Account, accept an invitation, access, or use the Service.

2.3 DearWith is not directed to children or teenagers, and we do not knowingly permit anyone under 18 to use the Service.

2.4 We may collect limited adult-eligibility information, including your affirmative 18+ attestation, attestation timestamp and version, Account eligibility status, and related anti-fraud or integrity signals, solely to determine eligibility, prevent circumvention of our adults-only rule, and meet legal obligations. We do not use this information for advertising or model training, and retain it only as long as reasonably necessary for these purposes, security, and legal compliance.

2.5 If we learn that a user is under 18 or otherwise ineligible, we will take appropriate steps to block access and delete or restrict related personal data as required by law and this Policy. A parent or guardian who believes that an under-18 person has provided personal data to DearWith may contact our Data Protection Officer using the details at the end of this Policy.

3. Privacy-First Data Principles

DearWith follows these principles:

3.1 We collect data only where reasonably needed to provide, secure, maintain, improve reliability of, or comply with legal obligations for the Service.

3.2 We do not sell personal information.

3.3 We do not share personal information for cross-context behavioral advertising.

3.4 We do not and will not use user personal data, Presence settings, uploaded materials, memory inputs, Private Conversation Content, or chat content to train any AI models.

3.5 DearWith does not operate its own foundation model or large language model.

3.6 We limit access to Private Conversation Content to authorized situations such as service delivery, user request, technical support, security, abuse prevention, legal compliance, or safety review, as further described in Section 13. This does not mean routine human review of private chats.

3.7 Processing conversation content to provide the Service is not the same as routine human reading of private chats, and our access controls are designed around that distinction.

3.8 We use third-party providers only as needed to operate the Service and subject to appropriate safeguards.

3.9 We aim to provide meaningful user rights, including access, correction, deletion, and portability where required or reasonably available.

4. Categories of Personal Data We Collect

Depending on how you use DearWith, we may collect:

4.1 Account data
Email address, username, account ID, authentication method, password hash or credential metadata, registration time, account status, and language settings.

4.2 Account Presence data
Display name, Account Presence name, Account Presence description, personality settings, relationship context, memory inputs, dialogue examples, permission settings, and other configuration data you choose to provide. This category describes historical Presence configuration data; registration no longer creates a Presence. Depending on what you provide, this category may contain sensitive information and is handled subject to Section 5.

4.3 Private conversation content
Messages you send to Account Presences, AI Outputs generated in response, conversation context needed to provide replies, and relationship-specific memory where enabled. We collect and process this content only as necessary to: (a) generate requested replies; (b) maintain conversation continuity and relationship memory where enabled; (c) synchronize, store, and restore conversation history across supported sessions and devices; (d) run automated safety, abuse-prevention, fraud, and security checks; and (e) support user-requested troubleshooting, legal compliance, safety review, or enforcement in limited authorized cases. Depending on what you include in conversations, this category may contain sensitive information and is handled subject to Section 5. This does not mean routine human review of private chats.

4.4 Uploaded content
Text, images, files, or other materials you choose to upload if supported by the Service. Depending on what you upload, this category may contain sensitive information and is handled subject to Section 5.

4.5 Account Holder, Visitor, and permission data
Invitation links or codes, access grants, access revocations, visitor relationship settings, and authorization records.

4.6 Transaction and entitlement data
Product IDs, order IDs, purchase status, subscription status, entitlement records, renewal status, platform transaction metadata, and purchase-time entitlement snapshots.

4.7 Device, log, and technical data
IP address; approximate country and, where available, state or region derived from network information at registration; device type; operating system; app version; browser type; timezone; locale; crash logs; diagnostic events; security logs; and usage events. We do not collect city, postal code, or precise coordinates for registration-location analytics.

4.8 Support and communication data
Support requests, feedback, survey responses, email communications, and administrative messages.

4.9 Safety and compliance data
Fraud signals, abuse reports, moderation metadata, account integrity signals, legal request records, and enforcement history.

4.10 Adult-eligibility, authority verification, and dispute evidence data
Affirmative 18+ attestations, attestation timestamps and versions, Account eligibility status, anti-fraud or integrity signals, declarations, consent confirmations, rights-holder authorizations, and supporting documents or metadata submitted during adult-eligibility, identity-rights, safety, compliance, or dispute review.

4.11 Letter data
Text, photos, and original audio recordings; title; recording date; audio duration, format, and technical delivery metadata; delivery mode; scheduled delivery time or Open When description; selected recipient and related authorization record; delivery, availability, playback, deletion, and error status; and support, safety, or dispute records relating to a Letter. Audio recordings may contain the Letter Creator's voice and personal or sensitive information in their content. DearWith uses the recording only to provide the Letter feature and does not use it to identify a person or create a voiceprint, except for limited technical processing needed to store, secure, and deliver the recording.

4A. Data Category-to-Handling Cross-Reference

This Section maps each category in Section 4 to the primary downstream handling Sections of this Policy.

4A.1 Account data
Primary handling Sections: `7.1`, `10`, `11`, `16.1`, `17`, `18`.

4A.2 Account Presence data
Primary handling Sections: `5`, `7.2`, `7.4`, `13`, `14`, `16.2`, `17`, `18`.

4A.3 Private conversation content
Primary handling Sections: `7.3`, `7.4`, `7.8`, `7.10`, `9`, `12`, `13`, `16.3`, `17`, `18`.

4A.4 Uploaded content
Primary handling Sections: `5`, `7.4`, `9`, `12`, `13`, `16.10`, `17`, `18`.

4A.5 Account Holder, Visitor, and permission data
Primary handling Sections: `7.5`, `14`, `16`, `17`, `18`.

4A.6 Transaction and entitlement data
Primary handling Sections: `7.6`, `7.11`, `10.3`, `11.3`, `16.5`, `17`, `18`.

4A.7 Device, log, and technical data
Primary handling Sections: `6.2`, `7.8-7.10`, `10.1`, `10.5`, `16.6`, `16.8`, `17.2-17.7`, `28.2-28.5`.

4A.8 Support and communication data
Primary handling Sections: `7.7`, `7.10`, `10.4`, `10.6`, `11.4`, `16.7`, `17.1-17.7`, `18`.

4A.9 Safety and compliance data
Primary handling Sections: `7.8`, `7.10`, `7.12`, `10.5`, `10.7`, `13`, `16.6`, `16.11`, `17`, `28.2`, `28.3`, `28.5`, `28.8`.

4A.10 Adult-eligibility, authority verification, and dispute evidence data
Primary handling Sections: `2`, `7.1`, `7.8`, `10.7`, `13`, `16.1`, `16.11`, `17`, `18`.

4A.11 Letter data
Primary handling Sections: `5`, `6.1`, `7.4`, `7.4A`, `7.5`, `7.8-7.10`, `7.13`, `10`, `11`, `13`, `14`, `16.13`, `17.5`, `18`, `26`, `28.9`.

4B. Moments, Family Spaces, and Optional Location

4B.1 Moments are personal records associated with your account. We collect and store the text, selected photos, recorded audio, tags, optional place names and coordinates, creation and update times, and media metadata you save. Moments set to Only Me are visible only to you through the product. When you choose to share a Moment with a space, its current members can access its content, including attached photos, audio, place names, and coordinates. New members can see published history. Personal tags are not shared. Moments are not public posts, and friendship or Presence access alone does not share them. Our authorized service providers process this data as needed to store, synchronize, protect, and deliver the feature under this Policy.

4B.2 Adding a place is optional. You can enter a name without coordinates, use your current location, or select a point on a map and optionally give it your own name. When you save a place with coordinates, those coordinates are uploaded and stored with the Moment, even if you rename the place. They may be precise or approximate depending on your permissions and selection. This is separate from the coarse registration-location analytics in Section 4.7. Moment location data is used to display and manage the place attached to your record, not for advertising or tracking you across apps or websites.

4B.3 We request camera or microphone access when you choose to take a photo or record audio. The system photo picker lets you select photos to add without granting access to your entire library. Location access is requested when you use a location-based option, including centering the map on your current location. We do not continuously monitor your location or request background location access for Moments. Apple map and geocoding services may process map requests and coordinates to display the map or suggest a place name. You can change these permissions in system settings and still use the record types that do not require them.

4B.4 Supported clients save records locally and synchronize them with our servers. Photos and audio are also stored locally for offline access; available storage and network conditions may affect completion. Local storage is not a guarantee that cloud upload has completed. Removing the app or its local data before synchronization may lose unsynchronized records. Moments are not automatically added to Account Presence memories or used as conversation context. The restrictions on AI model training in Section 9 also apply to Moments.

4B.5 We retain Moments to provide access while you keep them in your account. You can edit or remove an attached place, delete a Moment, or request account deletion. Once a deletion or edit reaches our servers, it changes the record available through the service; associated media cleanup and backup deletion follow the retention and deletion processes in Sections 16 and 17. Offline devices receive changes when they synchronize. This does not mean that every stored copy is physically erased immediately.

4B.6 For Family Moments, we process space names and covers, membership and owner roles, invitations and join requests, sharing settings, publication status, and comments and replies to provide access and moderation. A space owner can manage membership and remove a record from the space without deleting the author’s own content. Authors can withdraw shared records; leaving, removal, or dissolution makes their records in that space private. Comments are kept separately for each space and, after withdrawal, are available only to the record’s author unless shared there again. These access changes do not retrieve copies others saved or guarantee immediate physical deletion from every device or backup. Devices receive changes when they synchronize.

5. Sensitive and AI-Specific Data

DearWith does not require you to submit sensitive personal data. However, because the Service is about memory, relationships, and companionship, you may choose to provide sensitive information in Presence settings, memory fields, uploaded materials, and private conversations. This may include information about grief, family, relationships, health, religion, identity, emotional state, or personal history.

Where you voluntarily provide sensitive information:

5.1 We process it only for the purposes described in this Policy, including Sections 7.1-7.12 (How We Use Personal Data), Section 13 (Private Conversation Access Controls), Section 16 (Data Retention), Section 17 (Account Deletion and Data Deletion), and other legally required obligations described in this Policy, and not for unrelated purposes.

5.2 We do not sell it or use it for cross-context behavioral advertising.

5.3 We do not use it for model training.

5.4 We restrict access according to role, purpose, and operational need.

5.5 You should avoid submitting sensitive information about another person unless you have a lawful basis or appropriate consent.

5.6 If you create a Letter, do not include sensitive information about a recipient or another person unless you have a lawful basis or appropriate consent. If you choose to record sensitive information in a Letter, we process it only to store, secure, schedule, and deliver the recording as you direct, subject to this Policy, the Terms, and applicable safety and legal controls.

6. Sources of Personal Data

We collect personal data:

6.1 Directly from you when you register, complete an adult-eligibility attestation, configure your Account Presence, upload content, build memory, create or manage a Letter, chat, purchase, or contact support.

6.2 Automatically from your device and interactions with the Service.

6.3 From platform providers such as Apple where needed for login, purchases, subscriptions, fraud prevention, or entitlement verification.

6.4 From Service Providers acting on our behalf.

6.5 From other users only where they invite you, configure permissions, report abuse, or provide relationship context involving you. Other users are responsible for having an appropriate legal basis, authority, or consent where required, and must not submit sensitive information about you without lawful authority.

6.6 If we receive personal data about you from another user and you are entitled to rights under applicable law, you may contact us to request access, correction, deletion, restriction, or objection. We may restrict, delete, or de-identify disputed third-party-submitted information where legally required, where consent or authority cannot be reasonably supported, or where needed to protect privacy and safety.

6.7 From rights holders or other parties who submit verification or dispute materials for consent verification or safety/legal review.

7. How We Use Personal Data

We use personal data to:

7.1 Create and manage Accounts and determine adult eligibility.

7.2 Automatically provision each Account's Account Presence and provide its configuration and access-control features.

7.3 Generate AI responses for authorized conversations.

7.4 Structure, store, and retrieve memory or relationship context where enabled.

7.4A Store, technically process, protect, schedule, and automatically deliver or make Letters available to selected authorized recipients when the applicable delivery condition is met; and display Letter status and playback controls.

7.5 Enforce Account Holder and Visitor permissions.

7.6 Process purchases, subscriptions, renewals, refunds, and entitlements.

7.7 Provide customer support and service notices.

7.8 Maintain security, prevent abuse, detect fraud, and protect users.

7.9 Debug, monitor, and improve reliability of the Service, and understand aggregate adoption by country or region.

7.10 Comply with legal obligations, respond to lawful requests, and enforce our Terms.

7.11 Maintain business records, audit records, and accounting records where required.

7.12 Verify adult eligibility and authority or consent claims, review identity-rights disputes, and operate safety safeguards.

7.13 Conversation-context Letter delivery has been retired. Current Letters do not process a recipient’s conversations to choose delivery. Historical trigger processing did not disclose the recipient’s conversation, transcript, or detailed trigger rationale to the Letter Creator.

8. Legal Bases for Processing

Where legal bases are required, we rely on:

8.1 Contract performance, to provide the Service you request.

8.2 Legitimate interests, such as security, fraud prevention, service reliability, user safety, and internal administration.

8.3 Consent, where required for specific optional processing.

8.4 Legal obligations, such as tax, accounting, consumer protection, privacy compliance, and lawful requests.

8.5 Vital interests or public interest, only where legally applicable and necessary for emergency or safety situations.

9. Model Training Policy

DearWith's model-training policy is a permanent privacy commitment for this Service:

9.1 DearWith does not and will not use your personal data, Presence settings, uploaded materials, memory inputs, Private Conversation Content, or chat content to train any AI models.

9.2 DearWith does not operate its own foundation model or large language model.

9.3 Service Providers acting on our behalf are not permitted to use your personal data, Presence settings, uploaded materials, memory inputs, Private Conversation Content, or chat content for their own model training when processing data for DearWith.

9.4 AI model providers may process prompts, context, and related metadata only to provide AI functionality to DearWith, subject to applicable provider settings, contracts, technical controls, retention controls, and no-training restrictions where available.

9.5 We will not ask AI model providers to use DearWith user data for model training, fine-tuning, evaluation datasets, or similar model-improvement purposes.

9.6 Aggregated, de-identified operational metrics may be used only for security, reliability, billing, abuse prevention, capacity planning, and service-quality monitoring, and not to train AI models.

10. Disclosure to Service Providers

We disclose personal data only where reasonably necessary and subject to appropriate safeguards. Categories of Service Providers may include:

10.1 Cloud infrastructure and hosting providers.

10.2 AI model API providers.

10.3 Payment processors and app store platforms.

10.4 Email, SMS, push notification, and communications providers.

10.5 Security, monitoring, diagnostics, and anti-abuse providers.

10.6 Customer support tools.

10.7 Professional advisors, auditors, accountants, and legal counsel where necessary.

Service Providers may only process data for authorized purposes and not for their own independent advertising or model-training purposes where acting on our behalf.

We apply safeguards for Service Provider disclosures, including data processing agreements, confidentiality requirements, purpose limitation, least-privilege access controls, encryption in transit and at rest where appropriate, role-based access review, logging and audit controls, incident response obligations, transfer safeguards where required, and deletion/return commitments at the end of services where required. Where a provider cannot meet these safeguards for the data category involved, we will avoid using that provider for that category or apply additional controls.

11. Current Third-Party Provider Categories

DearWith currently uses the following third-party service providers:

11.1 Amazon Web Services (AWS): cloud infrastructure, hosting, data storage, logging, security, diagnostics, and communications infrastructure used to operate and support the Service. Our primary production infrastructure is located in the United States, in or around the Oregon region.

11.2 OpenAI: AI model API services used to generate requested AI responses and related Service functionality.

11.3 Apple: Sign in with Apple, App Store distribution, in-app purchases, subscriptions, refunds, payment verification, and related platform services.

11.4 We may add or change third-party service providers, including AI model providers such as Anthropic (Claude), Google (Gemini), xAI (Grok), or other providers, in the future. We will provide advance notice to users before a material change to our Service Providers takes effect.

12. No Sale and No Cross-Context Behavioral Advertising

12.1 DearWith does not sell personal information.

12.2 DearWith does not share personal information for cross-context behavioral advertising or cross-site targeted advertising.

12.3 DearWith does not use private chat content, Account Presence settings, memory inputs, or uploaded materials for ad targeting.

13. Private Conversation Access Controls

Private Conversation Content Rules

13.1 Private Conversation Content is treated as confidential user content.

13.2 DearWith personnel do not routinely read Private Conversation Content.

13.3 Access may occur only for limited reasons, such as user support, debugging, security, abuse investigation, legal compliance, enforcement, user-requested export/deletion, safety review, consent or rights disputes, or lawful requests from competent authorities.

13.4 Access should be limited to authorized personnel or Service Providers with a legitimate need and follow a least-necessary scope.

13.5 System processing of Private Conversation Content for storage, routing, and response generation is necessary to provide the Service and is different from routine manual reading by personnel.

13.5A Current Letter delivery does not evaluate private conversations. Historical conversation-context matching did not give the Letter Creator access to the recipient’s conversation or transcript and did not involve routine human review.

General User Content Rules

13.6 User Content outside Private Conversation Content (including profile, memory, relationship, and uploaded materials) is also handled under need-based access controls.

13.7 We do not conduct unnecessary routine manual review of such User Content. Access may occur for limited reasons including user support, technical troubleshooting, security, abuse investigation, legal compliance, rights disputes, or enforcement.

13.8 We may use technical logs and metadata to troubleshoot issues without reviewing full content where feasible.

13.9 We may apply automated safety systems to detect prohibited content, abuse, or security risks.

13.10 For uploaded materials, user inputs, and AI interactions, we may run risk-based automated safety screening and use resulting risk signals to trigger temporary content-level restrictions and, where necessary, limited human-assisted review under least-necessary access controls.

14. Account Holder and Visitor Privacy

14.1 An Account Holder controls access to the Account Holder's Account Presence through available permission settings.

14.2 A Visitor's private conversation with an Account Presence is not automatically shown to the Account Holder unless the product expressly provides that feature with notice and appropriate consent.

14.3 Relationship-specific memory may be used to provide the Visitor's future conversations with that Account Presence where enabled.

14.4 When an Account Holder revokes access, future access may be restricted, subject to product rules, legal retention, safety, and dispute needs.

14.5 Users must not submit private information about others without appropriate authority.

14.6 A Letter Creator selects themselves or one eligible friend through available product controls. A Letter is private to its selected recipient; friendship or family-space membership does not make it visible to other people.

14.7 The Letter Creator may receive Letter operational status, such as pending, delivered, deleted, or unavailable, but not the recipient's private conversation, transcript, or detailed trigger rationale.

14.8 Where a Letter Creator deletes a Letter, we will prevent future access and playback through the Service, subject to reasonable technical processing time, backups, legal retention, safety, and dispute requirements. This cannot retrieve a copy a recipient lawfully made before deletion.

15. International Transfers and Storage Location

DearWith is operated by a Singapore company and may serve users globally. Your personal data may be transferred to, processed in, or stored in jurisdictions other than your country of residence.

15.1 We use cloud infrastructure in the United States, including in or around the Oregon region.

15.2 AI model providers and other Service Providers may process data in the United States or other countries depending on their infrastructure.

15.3 For Singapore users, we take steps intended to provide a comparable standard of protection for transferred personal data as required by the Singapore PDPA.

15.4 For users in the EEA, UK, or Switzerland, we may rely on appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, or equivalent transfer mechanisms where required.

15.5 We also use operational safeguards such as data minimization, access controls, encryption where appropriate, provider due diligence, contractual purpose limits, and retention/deletion controls.

15.6 For users in other jurisdictions, we apply transfer safeguards required by applicable law where relevant.

15.7 Cross-border processing may expose data to lawful requests by courts, regulators, or law enforcement in the relevant jurisdictions.

15.8 Unless otherwise required by law or expressly stated in product-specific terms, DearWith does not guarantee data localization in a specific country or region.

16. Data Retention

We retain personal data only as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Typical retention principles (unless a longer period is required by law, dispute hold, or security need):

16.1 Account data: retained while your Account is active. After account deletion, we generally retain only limited account-level records (such as account ID, registration/deletion timestamps, adult-eligibility and consent logs, and essential fraud/dispute audit records) for up to 24 months for security, legal, accounting, or dispute purposes. This does not extend the retention of Account Presence settings, memory data, Private Conversation Content, or uploaded content, which are handled under their respective retention rules below.

16.2 Account Presence settings and memory data: retained while the relevant Account Presence or Account remains active, and generally deleted from active systems within 30 days after eligible deletion requests, subject to product-specific retention commitments.

16.3 Private Conversation Content: retained to provide conversation history and memory features; when deleted by the user or after account deletion, deletion from active systems generally occurs within 30 days, with residual backup deletion aligned with backup cycles.

16.4 Uploaded content: retained while the relevant Account Presence or Account remains active and generally deleted from active systems within 30 days after an eligible deletion request, subject to backup cycles, legal retention requirements, safety controls, and dispute-handling needs.

16.5 Payment and transaction records: retained for up to 7 years where required for accounting, tax, platform, fraud prevention, chargeback, and legal compliance.

16.6 Security logs and diagnostic logs: generally retained between 180 days and 24 months, depending on security, debugging, fraud prevention, and system integrity needs.

16.7 Support records: generally retained up to 24 months after ticket closure unless longer retention is required by law or dispute handling.

16.8 Backups: deleted or overwritten on scheduled backup cycles, generally within 90 days, unless preserved for legal, security, or disaster recovery reasons.

16.9 Account Presence availability: this feature has been retired and is no longer automatically provided. Historical content remains subject to the retention and deletion rules in this Policy. A plan or entitlement does not restore access.

16.10 Adult-eligibility information: retained only for as long as reasonably necessary to determine eligibility, prevent circumvention, meet legal obligations, and maintain security and fraud controls. We generally retain the affirmative attestation and associated eligibility status rather than a date of birth.

16.11 Authority verification and dispute evidence data: generally retained only for as long as needed to review and resolve the relevant case, and typically deleted or de-identified within 180 days after closure unless legal hold, security, anti-fraud, or mandatory compliance requirements require longer retention.

16.12 Retention handling may differ across Private Conversation Content, other User Content, and adult-eligibility data based on product functionality, safety controls, and legal requirements.

16.13 Letter data: retained while the relevant Letter remains active, pending delivery, or available to the selected recipient. When a Letter Creator deletes a Letter or when the related Account is deleted, Letter Content is generally deleted from active systems within 30 days and from backups within 90 days, subject to legal retention, security, fraud, safety, rights-dispute, and technical recovery requirements. Limited delivery, deletion, and audit records may be retained under Sections 16.1, 16.6, and 16.11.

We may anonymize or aggregate data so it no longer identifies you, using de-identification measures and periodic review intended to prevent re-identification. Such data may be retained for analytics, security, product reliability, and business purposes.

17. Account Deletion and Data Deletion

17.1 You may request account deletion through in-app controls or by contacting us.

17.2 After verifying the request, we will start deletion or anonymization workflows for personal data associated with your Account, subject to legal exceptions.

17.3 Some data may be retained where necessary for legal compliance, fraud prevention, security, accounting, dispute resolution, enforcement, or platform requirements.

17.4 Deletion from active systems may occur before deletion from backups.

17.5 A Letter Creator may delete a Letter through available product controls. Subject to the exceptions in this Policy, we will remove the Letter from future delivery and playback and process deletion of the associated Letter Content under Section 16.13. Deleting a Letter does not delete the recipient's separate Private Conversation Content, and does not retrieve copies lawfully made before deletion.

17.6 We generally complete deletion from active systems within 30 days after successful verification, unless technical complexity or legal requirements justify a longer period.

17.7 Backup deletion generally follows scheduled cycles and is typically completed within 90 days.

17.10 If DearWith suspends or terminates an account for violations, abuse, fraud, safety risk, or legal requirements, we may immediately restrict access, preserve relevant records for investigation and compliance, and then delete or anonymize remaining data according to this Policy and applicable law.

17.11 If a user does not provide reasonably requested authority or consent evidence in a dispute workflow, we may remove or restrict specific content and related features while retaining only the minimum records needed for safety, legal compliance, and review rights.

17.12 Deletion workflows may be implemented differently across Private Conversation Content, other User Content, and adult-eligibility data to reflect operational dependencies, safety controls, and legal retention obligations.

18. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

18.1 Access personal data associated with your account and use of the Service that we process.

18.2 Request correction of inaccurate or incomplete data.

18.3 Request deletion of personal data.

18.4 Request portability or export of certain data.

18.5 Object to or restrict certain processing.

18.6 Withdraw consent where processing is based on consent.

18.7 Appeal or challenge certain decisions where applicable.

18.8 Lodge a complaint with a competent privacy regulator.

We may verify your identity before responding. We respond within the time required by applicable law; for Canadian access requests, this is generally 30 calendar days unless a permitted extension applies.

19. United States Privacy Notice

For users in the United States:

19.1 DearWith does not sell personal information.

19.2 DearWith does not share personal information for cross-context behavioral advertising.

19.3 Depending on your state, you may have rights to access, delete, correct, port, or opt out of certain processing.

19.4 We do not knowingly permit users under 18 to use the Service. If we learn that an under-18 user has provided personal information, we take appropriate action under Section 2.

19.5 We do not use sensitive personal information for purposes that require a "limit use" choice under California law unless disclosed in a regional notice.

19.6 We may provide additional state-specific notices if required.

19.7 Where applicable U.S. state AI laws require AI interaction disclosure, we provide clear and conspicuous notices when users are interacting with AI systems, including additional notices for legally defined high-risk or regulated scenarios.

19.8 If DearWith deploys covered automated decision-making technology in legally defined consequential-decision scenarios in a specific U.S. state, we may provide additional pre-use notices, post-decision disclosures, correction channels, and meaningful human review rights required by law.

20. California Notice

If California privacy law applies, California residents may have rights to:

20.1 Know categories of personal information collected, sources, purposes, and disclosures.

20.2 Access specific pieces of personal information.

20.3 Delete personal information.

20.4 Correct inaccurate personal information.

20.5 Opt out of sale or sharing. DearWith does not sell or share personal information for cross-context behavioral advertising.

20.6 Limit use of sensitive personal information where applicable.

20.7 Non-discrimination for exercising privacy rights.

Categories of personal information may include identifiers, account data, internet or device activity, transaction data, user-generated content, sensitive information voluntarily provided, and inferences used only for service functionality and safety.

21. Singapore PDPA Notice

For Singapore users:

21.1 We collect, use, and disclose personal data for the purposes described in this Policy.

21.2 We may transfer personal data outside Singapore, including to the United States, only with safeguards that provide a standard of protection comparable to that required by the PDPA, unless an applicable exception applies.

21.3 You may request access to and correction of your personal data.

21.4 You may withdraw consent where processing is based on consent, but withdrawal may affect service availability.

21.5 We will assess and notify relevant parties of notifiable data breaches as required by Singapore law.

21.6 We have designated a Data Protection Officer. You may contact the Data Protection Officer / Privacy Officer through the business contact details set out in Section 30.

22. EEA, UK, and Switzerland Notice

Where GDPR, UK GDPR, or similar law applies:

22.1 The controller is UNIUME PTE. LTD., unless otherwise stated.

22.2 Processing bases may include contract performance, legitimate interests, consent, and legal obligations.

22.3 You may have rights of access, rectification, erasure, restriction, objection, portability, and complaint to a supervisory authority.

22.4 Cross-border transfers may rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

22.5 You may object to processing based on legitimate interests where applicable.

22.6 DearWith has not appointed an EU representative at this time. If DearWith makes the Service available in the EEA in a manner that triggers GDPR Article 27, DearWith will appoint and publish details for an EU representative before or when legally required, unless an exemption applies.

22.7 Where EU AI transparency obligations apply to specific DearWith features, we may provide additional AI-interaction disclosures, synthetic-content labels, or detectability controls consistent with applicable law.

23. Canada Notice

For Canadian users:

23.1 You may request access to and correction of personal information.

23.2 You may withdraw consent, subject to legal or contractual restrictions and reasonable notice.

23.3 Personal information may be processed outside Canada and may be subject to foreign laws.

23.4 You may use the privacy contact details in Section 30 for privacy questions or complaints. We generally respond to access requests within 30 calendar days, subject to a permitted extension and notice where applicable.

24. Australia, New Zealand, Japan, and Korea Notice

For users in Australia, New Zealand, Japan, or Korea:

24.1 You may request access to and correction of your personal information.

24.2 We may process personal information outside your country of residence.

24.3 You may contact us to make a privacy complaint.

24.4 Nothing in this Policy limits non-waivable consumer or privacy rights.

24.5 For Japan users, additional disclosures under APPI may be provided where required.

24.6 For Korea users, additional disclosures under PIPA or related regulations may be provided where required.

25. Cookies and Similar Technologies

We may use cookies, local storage, device identifiers, and similar technologies to:

25.1 Keep you signed in.

25.2 Remember settings and preferences.

25.3 Maintain security.

25.4 Measure service reliability.

25.5 Diagnose errors.

Where required, we will provide consent controls or additional notices.

26. Security

We use technical, organizational, and administrative safeguards designed to protect personal data, including:

26.1 Access controls.

26.2 Authentication and authorization.

26.3 Logging and monitoring.

26.4 Encryption where appropriate.

26.5 Vendor review and contractual controls.

26.6 Incident response processes.

26.7 Internal confidentiality controls.

No system can be guaranteed to be absolutely secure. We work to reduce risk and respond appropriately to security incidents.

27. Data Breach Notification

If a notifiable data breach occurs, we will assess the incident and notify affected users, regulators, platforms, or other parties as required by applicable law and legal timelines.

28. Automated Processing and Safety Systems

DearWith may use automated systems to support:

28.1 AI response generation.

28.2 Abuse detection.

28.3 Fraud prevention.

28.4 Security monitoring.

28.5 Content safety and policy enforcement.

28.6 AI transparency notices and labeling workflows where required by applicable law.

28.7 Deepfake and synthetic-content disclosure workflows where required by applicable law.

28.8 Risk-based automated safety screening of uploaded materials, user inputs, and AI interactions, with limited human-assisted review where needed.

28.9 Letter delivery uses the selected recipient and delivery settings. Scheduled delivery runs at the selected time subject to applicable conditions; Open When letters are made available in the recipient’s inbox for them to open when appropriate. Current delivery does not evaluate private conversations or provide the creator with conversation content.

We do not use automated processing to make legal or similarly significant decisions about you without appropriate safeguards where required by law.

29. Changes to This Privacy Policy

We may update this Policy from time to time. Material changes may be communicated through app notice, website posting, email, or similar reasonable means. Updated versions become effective on the stated date.

30. Contact

For privacy, legal, data-protection, and user-rights requests: