Fyl App Privacy Policy

DisrupSTAR Limited (“DisrupSTAR”, “we”, “us” or “our”) is an Irish company founded to help people tell their story clearly and confidently.

This privacy policy explains, in simple language, how we collect, use, and protect your information when you explore our website (the “Site”) or sign-up to or use the Fyl app or related services (the “Services”) on our website.

Our goal is to keep your information safe, private, and firmly under your control.

Who we are

If you have questions about how we use your information, you can contact us anytime at:

We are not currently required to appoint a Data Protection Officer, but we take your privacy seriously, and we will respond to any questions or concerns promptly.

What information we collect

When you use Fyl, we collect only the information we need to provide the service and improve your experience.

Product Analytics (PostHog) We use PostHog, a product analytics platform provided by PostHog Inc., to understand how our app is used.

PostHog acts as a data processor on our behalf; we remain the data controller.

What we collect: Screen/page views, a small number of custom events (e.g., button taps), and basic technical information (device type, OS, app version, language, time zone).

Safety: We do not use PostHog to capture form inputs, passwords, or sensitive personal information.

IP address capture is disabled by default on PostHog Cloud EU.

Data Residency: Our PostHog instance is hosted on PostHog Cloud EU, running on AWS infrastructure in the Frankfurt (eu-central-1) region, Germany.

Retention: We retain raw event-level analytics data for 24 months, after which it is deleted or anonymised.

Transcription and AI Services (Deepgram & Mistral) To provide our recording and summary features, we use specialized processors:

• Deepgram: Acts as a data processor for voice transcription. For EEA users, we utilize the EU-specific endpoint (api.eu.deepgram.com) to keep processing within Europe. Where data is transferred to the US, Deepgram relies on the 2021 EU Commission Standard Contractual Clauses (SCCs) embedded in their Data Processing Agreement (DPA).
• Mistral AI: We use Mistral as a processor to generate your project summaries. Mistral is an EU-based provider, ensuring your content is processed in alignment with European data standards.

Information Category	Description of Information Collected
Information You Provide	We process certain information that you provide directly to us.
Account Information	We collect certain information from you when you set up an account on our Services. Your name, Any nickname you prefer, Address, Date of birth, Email address
Inputs and Outputs	You can use our Services in lots of different ways, including through chat, voice and file/image uploads (“Inputs”) which generate responses and actions, including summaries (“Outputs”). We collect any Personal Data referred to by you in your Inputs, and this may be generated in our Outputs. We request that you do not include any financial information, passwords or other sensitive information in your Inputs. Information you include through chat, Voice recordings you submit to the Services, Files and image uploads, Outputs
Information About Your Support Network	When you choose to share a summary with a family member, friend, or caregiver, we store the email address of the person you send it to so we can deliver your summary securely. Email address of your family member, friend or caregiver
Payment Information	If you subscribe, we use your information to manage your subscription. Payments are handled securely by trusted third-party payment providers. Your card details
Communications Information	We collect certain information when you engage with our support teams. Your communications with our support team, Any additional information you provide for troubleshooting purposes
Information We Collect Automatically	We automatically receive and record information from your browser or your mobile device when you visit the Site or use certain features of the Services.
Browser and/or Device Information	We automatically receive and record information from your browser or your mobile device when you visit the Site or our Services. IP address, Browser information, Device type, Operating system information
Service Usage Information	Usage Information: Information about how you use the Services, such as when you access the Services, records of your browsing history and searches performed. Diagnostic and Troubleshooting Information: Information about how our Services are performing, including timestamps, crash data, website performance logs and error messages
Identifiers and Cookie Information	We do not use cookies! Mobile apps do not use browser cookies, but PostHog uses similar technologies—specifically a randomly generated, app-installation-level identifier (sometimes called a "distinct ID" or "anonymous ID") stored locally on your device. This identifier allows us to recognise repeat sessions from the same installation without identifying you personally. If you reinstall the app or reset your device's advertising identifiers, a new ID is generated.
Information We Receive from Third Parties	We receive certain information about you from third parties
Information from Analytics Providers	We receive information about your usage of our Sites and Services, interactions, age group, and survey responses (including prior to account creation, in some cases). Your usage of our Site and Services, Screen / page views (which screens you open and the order in which you navigate them). A small number of custom events that we have defined to measure how specific features are used (for example, taps on certain buttons or completion of specific in-app actions). Basic technical information needed to make this data meaningful, such as device type, operating system and version, app version, language, time zone, and approximate session timing.

Why we use your information

We use your information so we can deliver our Services.

This includes creating your account, saving your recorded sessions, generating your summaries, managing your free trial, and supporting any subscription you choose to activate.

We also use some information to keep the app safe, improve our design and features, and understand how people interact with Fyl so we can make it more helpful for patients.

Learn more about how we use your personal information and our legal basis for each data use:

Why and How We Use Your Information	Information Categories Used
Where necessary to perform our contract with you We use certain information that is necessary for us to provide you with the Services or to enter into a relevant contract (including an employment contract) with you.
To provide our Services We use certain personal information, in order to provide you with our Services. This includes creating your account, managing your free trial, and supporting any subscription you choose to activate.	Account Information, Payment Information, Inputs and Outputs
To provide customer support We need to process certain information in order to address your request for support.	Account Information, Inputs and Outputs, Communications Information, Diagnostic and Troubleshooting Information
To promote the safety, security and integrity of our Services We use certain information to investigate suspicious activity, detect, prevent and combat fraudulent behaviour and to maintain the integrity of our Services.	Account Information, Inputs and Outputs, Communications Information, Service Usage Information, Cookie Information
To send Services communications We sometimes send important service messages, such as updates, changes to the Services or security alerts.	Account Information
Where necessary to comply with our legal obligations Our Services are subject to laws and regulations that require us to collect, use, and store your personal information in certain ways.
To comply with legal and regulatory obligations We may also use, preserve, or release your personal information to a third party to comply with our legal and regulatory obligations, including in response to lawful requests by public authorities (including tax authorities) and to meet legitimate national security or law enforcement requirements. Examples of laws that may require us to collect, use or disclose your information: Civil, commercial, criminal, or consumer protection matters: where we are in receipt of a court order to disclose information for the purposes of court proceedings or regulatory inquiries (e.g. orders or mandatory requests under the Irish Competition and Consumer Protection Act 2014, the Consumer Rights Act 2022). Corporate and taxation matters: to comply with our corporation and taxation obligations, such as those under the Irish Companies Act 2014 and the Taxes Consolidation Act 1997. Regulatory matters: to comply with our regulatory obligations, including engaging with our regulators, such as (but not limited to) the Data Protection Commission and the Revenue Commissioners.	Account Information, Inputs and Outputs, Communications Information, Browser and/or Device Information, Service Usage Information

Where necessary for our legitimate interests We rely on our legitimate interests or those of third parties where they are not outweighed by your rights and freedoms.
Why and How We Use Your Information	Legitimate Interest Relied On	Information Categories Used
To understand how you use our Site and Services and improve your experience We use certain information to improve our Services, understand how you interact with our Site and Services and enable accurate and reliable reporting.	It is in our legitimate interests to understand how our Services are being used, and to explore and unlock ways to develop and grow our business. It is in our legitimate interests, and those of our users, to improve the efficiency of our Services, troubleshoot errors with our Services and obtain insights into usage patterns of our Services.	Service Usage Information, Browser and/or Device Information, Cookie Information
To protect our legal rights We may also retain, preserve, or review your personal information to protect, establish, or exercise our legal rights or defend against impending or asserted legal claims.	It is in our interest to protect and defend ourselves from legal claims.	Account Information, Inputs and Outputs, Payment Information, Communications Information, Browser and/or Device Information
To research and innovate We carry out surveys of your experience using the Services.	It is in our interest and our users’ interests to improve our Services through information obtained from these research surveys.	Account Information, Communications Information
In the event of a business reorganisation In some cases, DisrupSTAR may choose to reorganise its business. In these types of transactions (such as a sale, merger, liquidation, receivership, reorganisation, or transfer of all or substantially all of DisrupSTARs assets), we may share or transfer your personal information with the acquiring entity.	Such transactions may be necessary and in our legitimate interests, particularly our interest in making decisions that enable our business to develop over the long term.	Account Information

Where you provide your consent When we use your information based on your consent, you have the right to withdraw your consent at any time. Any processing carried out before you withdraw your consent will remain lawful.	Information Categories Used
Where you ask us to share your information Where you direct us to share your personal data with a third party, we will do so. For example, you can share your Outputs, including your Summaries, via email with your nominated Support Network.	Account Information, Outputs, Information about your Support Network
To enable device-based settings Collecting information that you allow us to receive through the device-based settings you enable (such as access to your GPS location, camera or photos) which we use to provide the features or services described when you enable the setting.	Browser and/or Device Information
To send you marketing communications To send you targeted marketing communications through email, mobile, in app, and push notifications or by SMS.	Account Information, Service Usage Information, Information from our Analytics Providers

Who we share your information with

We never sell your information, and we never share your recorded session content unless you choose to share it.

We do, however, share your data with third parties where necessary to perform our Services, comply with our legal obligations, or for purposes set out in this Privacy Policy, including:

Linked Third-Party Websites: When you use third-party services or websites that are linked through our Services, the providers of those services or products may receive information about you that we, you, or others share with them.

Please note that when you use third-party services which are not governed by this Privacy Policy, their own terms and privacy policies will govern your use of those services and products.

Professional Advisors, Industry Partners, Authorities and Regulators: We share your information described above under section ‘Why We Use Your Information’ with our advisors and consultants, regulators and tax authorities, law enforcement, government agencies, civil litigants, and industry partners to:

• comply with applicable law or regulations, court orders, subpoenas, legal process or government requests;
• detect, investigate, prevent, or address actual or suspected fraud, and other illegal activity or security and technical issues; and/or
• protect the rights, property and safety of our customers, DisrupSTAR or others, including to prevent death or imminent bodily harm.

Business Reorganisation: In some cases, DisrupSTAR may choose to reorganise its business. In these types of transactions (such as a sale, merger, liquidation, receivership, or transfer of all or substantially all of DisrupSTAR’s assets), customer information is typically one of the business assets that is transferred. If DisrupSTAR intends to transfer information about you, DisrupSTAR will notify you by email or by putting a notice on our Site.

Service Providers: DisrupSTAR also engages third-party companies and individuals (such as recruiters and security providers) to help us operate, provide, and advertise the Services. These third parties have limited access to your information, may use your information only to perform these tasks on our behalf, and are prohibited from disclosing or using your information for other purposes.

The types of third-party service providers that we work with include:

Third-Party Service Providers	What Information We Share
Cloud hosting providers	All categories of information listed above
Email delivery services and push notification providers	Browser and/or Device Information, Account Information
Payment processors	Payment Information, Account Information
App analytics tools	Account Information, Browser and/or Device Information, Service Usage Information

We share data only with trusted service providers:

• Cloud Hosting: Scaleway (Infrastructure hosted in the EEA - France).
• Transcription: Deepgram (EU/US via SCCs).
• AI Summarisation: Mistral (EEA).
• Analytics: PostHog (Hosted in EEA - Germany).

International transfers

Some of the services we use may store or process data outside the EU or EEA. When this happens, we comply with the GDPR and use legal safeguards such as EU Standard Contractual Clauses (“SCCs”) to ensure your information remains protected. You can contact us to request a copy of these SCCs.

How long we keep your information

We will retain your information only for as long as is necessary for the purposes set out in this Policy, or as needed to comply with our legal obligations under national applicable law. We decide how long we need information on a case-by-case basis and depending on the retention laws applicable.

The following factors typically affect the retention period:

• Necessity for the provision of our Services: We keep your information as long as is necessary to provide the Services to you. This includes things like maintaining and improving the performance of our Services, keeping our Services secure, and maintaining appropriate business and financial records. Most of our retention periods are determined on the basis of this general rule.
• Consent-based processing of personal data: If we process personal data on the basis of consent (including consent to the extended storage), we store the data for as long as necessary in order to process it according to your consent or until you withdraw your consent.
• Statutory, contractual or other similar obligations: DisrupSTAR will retain and use your information to the extent necessary to comply with our legal obligations, for example, if we are required to retain your information to comply with applicable tax/revenue laws.

For example, we keep your Account Information for as long as you have an active account. Your session recordings stay in your account until you delete them yourself. If your account is inactive for 24 months, we will contact you to ask whether you want to keep it. If you do not respond within 30 days, we will delete your account and associated information securely.

Your rights

If you are located in the EEA, Switzerland or the UK, you have rights under the GDPR that give you control over your information, such as the:

• Right to access and portability: You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
• Right to rectification: You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
• Right to erasure: You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten. This right does not apply to certain data that we are required to retain by law.
• Right to object to or restrict processing: You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.
• Right to withdraw consent: You have the right to withdraw your consent to our processing at any time. The lawfulness of our processing before you withdraw your consent will not be affected by such withdrawal.

In order to exercise any of the rights set out above including for data held via PostHog or Deepgram, please contact us at [email protected].

Links to other websites

The Site or Services may contain links to other websites. Our privacy policy applies only to our Site and Services. If you provide your information to such third parties in connection with your use of the Services, different practices may apply to the use or disclosure of the information that you provide to them. While DisrupSTAR requires these third parties to follow DisrupSTAR’s privacy and security requirements, DisrupSTAR does not control the privacy or security policies of such third parties. To the full extent applicable in your jurisdiction, DisrupSTAR is not responsible for the privacy or security practices of these third parties. If you click on another site, please check their privacy policy.

Changes to this policy

We review this policy regularly. When we make changes, we will update the date above, and if the changes are significant, we may notify you through the Services or by email.

Your right to contact the Data Protection Commission

If you are unhappy with how we manage your information and feel we have not resolved your concern, you can contact the Data Protection Commission in Ireland: