Privacy Policy (GDPR) – Nativus

1. Data Controller

SC Nativus Calm SRL

VAT / Company ID: 53095982

Registered address: Șos. Mihai Bravu, No. 37A, bl. P30A, Floor 5, Apt. 24, Sector 2, Bucharest, Romania

Support email: contact@nativus.ro

2. Data Collected

Nativus may collect the following personal data:

Account data

• Email address and name
• Subscription-related data

Usage data

• Content listened and feedback provided
• Onboarding preferences
• In-app searches, pages visited
• Notification preferences
• Technical data: device type, app version
• In-app usage events (pages viewed, actions), linked to a pseudonymous identifier

Mental health data

• GAD-7 anxiety assessment results (answers, score, severity)
• Personal journal text entries
• Emotion selections

Account, usage, and mental health data are stored on our servers. Mental health data and journal content are not shared with advertising networks. Certain technical usage data is processed by the providers listed in Section 3.1.

✘ GPS location data is not collected.

3. Purpose of Processing

Personal data is processed for the following purposes:

• Application functionality
• Personalizing the user experience
• Self-assessment of anxiety (GAD-7)
• Managing premium subscriptions
• Sending notifications (if enabled)
• Internal analytics and product improvement
• Technical error monitoring
• User support

We do not use your data for advertising purposes and do not sell it to third parties.

Processing for internal analytics and technical monitoring (Section 3.1) is based on your consent (GDPR Art. 6(1)(a)), given when you create your account.

3.1. Analytics and technical monitoring

Nativus uses the following providers acting on our behalf:

• PostHog — product analytics
• Sentry — technical error monitoring

These services receive a pseudonymous identifier (account ID) and technical usage data. They do not receive: email address, name, GAD-7 results, journal content, emotion selections, or other mental health data.

You may withdraw consent or object to this processing by contacting contact@nativus.ro.

4. Data Deletion and Archiving

Upon account deletion:

• Data becomes immediately inaccessible
• Full deletion occurs within a maximum of 30 days

Archived data is retained solely for legal and security purposes.

5. User Rights

Under GDPR, users have the right to:

• Access
• Rectification
• Erasure
• Restriction
• Objection
• Data portability (where technically feasible)

Requests: contact@nativus.ro

7. Security

Nativus implements appropriate technical and organizational measures to protect personal data.

8. Updates

This Privacy Policy may be updated periodically. Continued use of the application constitutes acceptance of such updates.