Privacy Policy

1. What This Policy Covers

This policy applies to the GoodThought website, mobile applications, digital services, content library, Journal/Lumi experience, ORI AI assistant, expert marketplace and related services (collectively, the “Services”). It is intended to operate globally, subject to applicable law. If mandatory local law provides a stronger or more specific right, protection, or requirement, that law controls to the extent required.

2. Information We Collect

• Account and identity information such as name, email, username, profile information, country/region and account status.
• Authentication and security information associated with supported sign-in methods.
• Age confirmation, preferences, settings, consent records and communication choices.
• Journal/Lumi entries, notes, reflections, tags, attachments and other content a user chooses to store.
• ORI information voluntarily provided by a user and, only where enabled, specified Journal/Lumi entries.
• Expert marketplace information including bookings, session details, expert communications, ratings and session-related information.
• Payment and transaction information including purchase, subscription, refund, transaction, currency and payment status. Payment-card details are generally handled by payment providers rather than stored directly by GoodThought.
• Technical and usage information such as device type, operating system, app/browser version, IP address, approximate location derived from technical information where applicable, identifiers, logs, crash information and interactions.
• Support communications, feedback, reports and survey responses.
• Email addresses, email communication preferences, marketing consent records, and email delivery, bounce, complaint, unsubscribe and suppression information.
• Mobile telephone numbers and SMS communication preferences where SMS communications are offered and users choose to provide them.

3. Minimum Data Collection

GoodThought does not require a full date of birth for ordinary account creation. Users may be asked to confirm that they meet the minimum age requirement, and additional age verification may be used when reasonably necessary to protect users, comply with law or verify eligibility.

4. How We Use Information

• Provide, personalize, secure and administer the Services.
• Operate ORI as a content and experience discovery assistant.
• Process subscriptions, payments, refunds, payouts, chargebacks and related financial operations.
• Schedule and administer expert sessions.
• Provide support and respond to requests.
• Prevent fraud, abuse, account compromise and security incidents.
• Improve Services using permitted analytics, aggregated/de-identified information, evaluations, testing, synthetic data and explicit feedback.
• Send transactional and essential service communications.
• Send optional marketing communications where the recipient has provided the required affirmative consent or where otherwise permitted by applicable law.
• Deliver authorized email and SMS communications.
• Maintain communication preferences, consent, unsubscribe, bounce, complaint and suppression records.
• Comply with legal obligations and establish, exercise or defend legal claims.

5. ORI and Personalization

ORI is a content and experience discovery assistant, not a therapist, psychologist, medical provider, diagnostic system, legal adviser or substitute for professional advice. Journal/Lumi entries are private by default; ORI has no Journal/Lumi access by default, and a user may explicitly authorize access to an individual entry. Private Journal/Lumi content is not used by GoodThought for general AI model training. GoodThought may use permitted aggregated or de-identified information, evaluations, synthetic data and explicit feedback to improve the Services.

6. Sharing and Service Providers

GoodThought may disclose information to service providers that process information on its behalf, payment providers, hosting and infrastructure providers, security providers, analytics providers, communications providers, expert-related parties where necessary to provide a requested service, professional advisers, regulators or authorities where legally required, and parties involved in a corporate transaction where permitted by law.

Communications providers may include Amazon Simple Email Service (Amazon SES) and Twilio SendGrid for email delivery, and Twilio for SMS and messaging services. These providers may process information necessary to deliver communications, maintain security and deliverability, manage unsubscribes and suppression, process bounces and complaints, and support compliance.

GoodThought does not sell personal information for cross-context behavioral advertising unless its actual practices and applicable law permit and disclose such activity.

7. Communications

GoodThought distinguishes between transactional/service communications and optional marketing communications.

Transactional and service communications may include account verification, authentication and security notifications, password or account recovery, booking confirmations, session reminders, subscription and billing notices, payment or refund notices, customer support communications, important service updates, changes affecting the Services, and other communications relating to actions or transactions initiated or requested by the user. These communications may be sent by email or, where offered and permitted, SMS. A separate marketing opt-in is not required for communications that are necessary to provide or administer the Services, subject to applicable law.

GoodThought may also send optional marketing, promotional, educational, product, content or engagement communications where permitted by applicable law and where the recipient has provided the required affirmative consent. Marketing consent is optional and is not a condition of creating an account, purchasing a subscription or using GoodThought.

For email, GoodThought may use Amazon Simple Email Service (Amazon SES) and Twilio SendGrid. GoodThought does not knowingly purchase, rent, scrape or use third-party email lists for marketing communications. Marketing emails will provide an appropriate and functioning mechanism to unsubscribe or manage communication preferences. GoodThought may maintain records of marketing consent, withdrawal of consent, unsubscribe requests, bounces, complaints and suppression status.

Where GoodThought offers SMS communications, users may provide a mobile telephone number and, where required, separately consent to receive SMS messages for the specific communications described at the time of consent. SMS marketing consent is optional and is not a condition of creating an account, purchasing a subscription or using GoodThought.

Where GoodThought sends marketing or promotional SMS messages, those messages will be sent only where the required consent has been obtained. Message frequency varies. Message and data rates may apply. Users may opt out of recurring SMS communications at any time by replying STOP. Users may request assistance by replying HELP or by contacting support@goodthought.app.

After a user opts out of recurring SMS communications, GoodThought will stop sending further recurring messages for that messaging program unless the user subsequently provides consent again, except for communications permitted or required by applicable law.

GoodThought does not share, sell, or provide users’ mobile phone numbers or SMS/messaging consent data to any third parties or affiliates for their own marketing or promotional purposes. GoodThought may provide mobile telephone numbers and related information to service providers, including Twilio, that process such information solely on GoodThought’s behalf to provide authorized messaging, customer support, security, compliance, and related services.

Users may manage optional communication preferences through available GoodThought settings or preference-management tools.

8. Cookies and Similar Technologies

GoodThought may use cookies and similar technologies for essential operation, security, preferences, analytics and other permitted purposes. Where consent is legally required for non-essential technologies, GoodThought will request it and provide mechanisms to change or withdraw choices. See the Cookie Policy.

9. Legal Bases and Jurisdictional Rights

Where laws such as the GDPR apply, GoodThought will identify an appropriate legal basis, which may include contract, legal obligation, legitimate interests, consent or another permitted basis. Depending on location, users may have rights of access, correction, deletion, restriction, objection, portability, withdrawal of consent and rights concerning marketing or certain automated processing. California residents may have rights under the CCPA/CPRA, and other jurisdictions may provide additional rights. GoodThought will honor mandatory local rights to the extent required.

10. Retention and Deletion

GoodThought uses a category-based retention approach. Active personal information and user content are deleted or anonymized when appropriate after account deletion, while limited information may be retained where reasonably necessary for accounting, payment records, refunds/chargebacks, fraud and security investigations, legal claims, audit requirements, communication-consent records, unsubscribe and suppression records, or unavoidable backups. Retention periods vary by data category and applicable law.

11. Security

GoodThought uses reasonable administrative, technical and organizational measures designed to protect personal information, including access controls, authentication, encryption in transit and at rest where appropriate, secrets management, logging, monitoring, backups, incident response and vendor controls. No transmission or storage method is completely secure. Third-party service providers are expected to apply appropriate security and privacy controls to information processed on GoodThought's behalf.

12. International Transfers

GoodThought may process information in countries other than the user's country of residence. Where required, GoodThought will use appropriate legal and technical safeguards recognized by applicable law.

13. Children

GoodThought is not intended for children under 13. The Children's Privacy Policy provides additional requirements and protections.

14. Changes and Contact

GoodThought may update this policy from time to time. Material changes will be communicated through appropriate channels where required.

Privacy requests may be submitted through available in-product controls or to privacy@goodthought.app.