Legal · App

Terms

The short version: We collect only the data needed to run Terms, we never sell it, there are no ads, you can delete everything by e-mailing us. The full details are below.

Privacy Policy

Terms — Privacy Policy

Effective 14 April 2021

Introduction #

This Privacy Policy explains how Exevio d.o.o. (“Exevio”, “we”, “us” or “our”) collects, uses, shares and protects information when you use the Terms app — a free Terms app, available on iOS / iPadOS and Android (together, the “Service”).

It also describes the choices you have and the rights you may exercise. By using the Service you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not use the Service.

Capitalised terms not defined here have the meaning given in our Terms of Service.

Summary of key points #

This summary is for convenience; the full sections below control.

  • What we collect: account & activity data and device & technical data — only what is needed to run the Service.
  • Why: provide, operate and maintain the service, analytics & product improvement, security, fraud prevention & abuse detection, comply with legal obligations and customer support.
  • Sharing: we do not sell your personal data; we work with 1 third-party service listed in this policy.
  • Your rights: access, correct, delete or export your data, object to processing and withdraw consent — write to apps@exevio.com.
  • Deletion: you can delete your data by e-mailing apps@exevio.com.
  • Age: the Service is not intended for anyone under 13.

Who we are (data controller) #

The data controller responsible for your personal data is:

Exevio d.o.o.
Vukovarska 6, 51000 Rijeka, Croatia
apps@exevio.com
+385 95 222 1110
Registration / VAT: HR53022148424
exevio.com

Information we collect #

We collect only the information necessary for the purposes described in this policy. Depending on how you use the Service, this may include:

  • Account & activity: usage & interaction data.
  • Device & technical: device identifiers, ip address, os / browser & version and crash logs & diagnostics.

How we obtain it:

  • Information you give us. When you fill in a form, contact support or otherwise interact with us, we collect what you provide.
  • Information collected automatically. When you use the Service we and our service providers automatically record technical and usage data such as your IP address, device and browser characteristics, operating system, language, time zone, app version, crash reports and how you interact with the Service.

How we use your information #

We use the information we collect for the following purposes and, where the GDPR or UK GDPR applies, on the legal bases indicated:

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Third-party services and SDKs #

We rely on carefully selected third-party providers to run the Service. They process data on our behalf as processors or, where indicated, as independent controllers under their own privacy policies. We list them here so you know exactly who may receive your data:

Other

Each provider is bound by a data processing agreement or equivalent contractual terms, receives only the data needed for its purpose, and may not use it for anything else. Their policies may change; the links above lead to the current version.

How we share information #

We do not sell your personal data and we do not rent it to marketers. We share it only in these situations:

  • Service providers that host, secure, analyse, support or otherwise help us operate the Service (see the list above), under contracts that restrict their use of your data.
  • Authorities and other parties when legally required — to comply with law, court orders or lawful requests, to enforce our terms, or to protect the rights, property or safety of Exevio, our users or the public.
  • A successor in a business transaction — if we are involved in a merger, acquisition, financing or sale of assets, your data may be transferred as part of that transaction; this policy will continue to apply until you are notified otherwise.
  • Anyone else only with your consent or at your direction.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

International data transfers #

Exevio is established in Croatia.

Some of our service providers are located outside the European Economic Area, the United Kingdom and Switzerland, including in the United States. When we transfer personal data to such countries we rely on adequacy decisions of the European Commission (and UK/Swiss equivalents), the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) for certified recipients and the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), supplemented by transfer impact assessments. You may request a copy of the relevant safeguards by contacting us.

How long we keep your data #

We keep your personal data for as long as we need it to provide the Service to you. When you ask us to delete your data, we delete or anonymise it within 30 days, except for copies in encrypted backups that are overwritten on their regular rotation cycle.

We may retain some data for longer where we must (for example invoices and tax records for statutory periods), to resolve disputes, enforce our agreements or protect legal rights — always limited to what is necessary for that purpose. Aggregated statistics that cannot identify you may be kept indefinitely.

How we protect your data #

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS/HTTPS), role-based access controls and the principle of least privilege, regular, encrypted backups and logging and monitoring for suspicious activity.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to result in a high risk to your rights, we will notify you and the competent supervisory authority as required by law.

Your rights and choices #

Wherever you live, you can ask us to:

  • Access the personal data we hold about you and receive a copy;
  • Correct inaccurate or incomplete data;
  • Delete your data (“right to be forgotten”), subject to legal retention duties;
  • Export your data in a structured, machine-readable format (data portability);
  • Restrict or object to processing, including processing for direct marketing at any time;
  • Withdraw consent where processing is based on consent, without affecting processing already carried out;
  • Not be discriminated against for exercising any of these rights.

To exercise a right, e-mail apps@exevio.com. We may need to verify your identity before acting on a request. We respond within 30 days (extendable where the law allows for complex requests) and free of charge unless requests are manifestly unfounded or excessive. You may also authorise an agent to act on your behalf.

Deleting your account and data

You can request deletion of your data at any time by e-mailing apps@exevio.com. Deletion is permanent and completed within 30 days; we keep only what the law requires us to retain (such as invoices) and de-identified statistics. You can also request a copy of your data before deleting.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with a supervisory authority — in our case Croatian Personal Data Protection Agency (AZOP), https://azop.hr — or with the authority in the country where you live or work. We would appreciate the chance to address your concern first.

Additional information for the EEA, UK and Switzerland #

If you are in the European Economic Area, the United Kingdom or Switzerland, we process your personal data under the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018 and the Swiss Federal Act on Data Protection (FADP). Our legal bases are set out in “How we use your information”. Where we rely on legitimate interests, we have balanced them against your rights and you may object at any time. Where we rely on consent, you can withdraw it at any time.

You have all the rights listed above, including the right to lodge a complaint with your local supervisory authority or with our lead authority, Croatian Personal Data Protection Agency (AZOP), https://azop.hr; in the UK this is the Information Commissioner’s Office (ico.org.uk) — under the Data (Use and Access) Act 2025 you may also complain to us directly and we will acknowledge within 30 days and respond without undue delay; in Switzerland the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

Providing personal data is generally voluntary; however, without certain data (for example an e-mail address for an account) we may be unable to provide parts of the Service.

Your California and US state privacy rights #

This section applies to residents of California and other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Nebraska) and supplements the rest of this policy.

Categories of personal information

In the last 12 months we have collected the categories listed under “Information we collect”, which correspond to the following categories under the California Consumer Privacy Act (CCPA/CPRA): identifiers and internet or other network activity. We collect them from the sources and for the purposes described above and disclose them for business purposes to the service providers and third parties listed in this policy.

Sale and sharing

We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.

Your rights

You have the right to know what personal information we collect, use, disclose, sell or share; to access, correct and delete it; to opt out of sale/sharing and of certain profiling; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. Submit requests to apps@exevio.com. We will verify your request (usually by confirming control of the e-mail address associated with your data) and respond within 45 days, extendable once by a further 45 days with notice. Authorised agents may submit requests with proof of authority. Appeals. If we decline a request you may appeal by replying to our decision; we will respond within 45 days, and if the appeal is denied you may contact your state Attorney General.

Notice at collection and financial incentives. We do not offer financial incentives in exchange for personal information. Retention: see “How long we keep your data”. Shine the Light: California residents may request a list of third parties to whom we have disclosed personal information for their direct marketing — we do not do so.

Additional information for Brazil (LGPD) #

If you are in Brazil, we process your personal data under the Lei Geral de Proteção de Dados (Law 13.709/2018). Exevio d.o.o. is the controller. In addition to the rights above, you may request confirmation of processing, anonymisation or blocking of unnecessary data, information about the entities we share data with, and information about the consequences of refusing consent. Requests go to apps@exevio.com. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Additional information for Canada #

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws (including Québec’s Law 25). We collect, use and disclose personal information only with your knowledge and consent, except where permitted or required by law. You may withdraw consent, access and correct your information, and complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner. Your data may be processed outside Canada and be subject to the laws of those jurisdictions.

Additional information for Australia #

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may access and correct your personal information and complain to us; if you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). We may disclose personal information to recipients overseas (including the EU and USA) and take reasonable steps to ensure they handle it in line with the APPs.

Children’s privacy #

Terms is not directed at children under 13 and we do not knowingly collect personal data from them (or from anyone under 16 in the EEA without parental consent where required). If you are a parent or guardian and believe your child has provided us with personal data, contact apps@exevio.com and we will delete it promptly.

Changes to this policy #

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last revised. For material changes we will give you reasonable advance notice — for example by e-mail, an in-app notice or a prominent notice on this page — and, where the law requires, ask for your consent. Continued use of the Service after the effective date means the updated policy applies. Previous versions are available on request.

Contact us #

Questions, requests or complaints about this policy or your personal data:

Exevio d.o.o.
Vukovarska 6, 51000 Rijeka, Croatia
apps@exevio.com
+385 95 222 1110

Questions about this Privacy Policy? Write to apps@exevio.com.

This document was generated by the Exevio Legal generator from a structured questionnaire. It is designed to meet GDPR, UK GDPR, CCPA/CPRA and app-store requirements but is not legal advice.