Privacy Policy

Punch — AI Companion Application · GDPR + CCPA/CPRA

Effective 5 August 2026 · Version 1.0 · info@model-group.si

Controller: MODEL 5 podjetje za organizacijo, izvedbo, posredovanje d.o.o., Poljanski nasip 12, 1000 Ljubljana, Slovenia — reg. no. 2264994000, VAT SI 72347422.

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use the Punch AI companion application. Because Punch is offered globally, this Policy addresses the EU/UK GDPR, the California CCPA/CPRA and other U.S. state privacy laws, and other applicable regimes.

1. Controller and contact

The Company is the data controller. For privacy requests: info@model-group.si. If we are required to appoint a DPO or an EU/UK representative, their details will be published here.

2. Data we collect

Data you provide:

• Account data: email, username, authentication data, age attestation (18+).
• Subscription/billing data: plan and transaction records. Card details are processed by our payment processor / the app store, not stored by us.
• Conversation content: the messages, prompts, and content you exchange with the companion (may incidentally include sensitive information you choose to share).
• Support and correspondence.

Data collected automatically:

• Device and usage data: device identifiers, app version, interaction logs, diagnostics, approximate (coarse) location derived from IP.
• Cookies/SDKs on any web components (Section 11).

Data from third parties:

• App stores and login providers (sign-in identity) and fraud/safety signals.

3. Purposes and legal bases (GDPR)

• Provide the Service (generate responses, maintain your companion). Basis: performance of contract.
• Safety and crisis-response, content moderation, preventing abuse and illegal content. Basis: legitimate interests and legal obligation; for sensitive data, substantial public interest / vital interests where applicable.
• Billing and fraud prevention. Basis: contract; legal obligation; legitimate interests.
• Service improvement and model quality. Basis: legitimate interests, subject to Section 6; consent where required.
• Security, legal compliance, and defence of claims. Basis: legal obligation; legitimate interests.
• Communications about the Service. Basis: contract; legitimate interests; consent for marketing where required.

4. Sensitive / special-category data

The App does not require special-category data (GDPR Art. 9) or "sensitive personal information" (CPRA). We instruct you not to share it. If you include it in your messages, then to the extent a legal basis of consent is required, you consent to our processing it solely to provide the conversational Service and to keep you and others safe. We do not use it for marketing/advertising, do not sell it, and apply heightened safeguards. You may withdraw consent by deleting the content or your account.

CPRA — LIMIT USE OF SENSITIVE PERSONAL INFORMATION: California residents may limit our use of sensitive personal information to what is necessary to provide the Service. We already restrict such use to service delivery and safety and do not use it to infer characteristics for advertising.

5. AI model providers

To generate responses, conversation content may be processed by third-party AI model providers acting as our processors under data-protection terms. They are contractually restricted from using your content to train their own models except as necessary to provide the service to us, and from using it for their own purposes, unless you separately consent. We select providers offering appropriate security and, where relevant, limited-retention options.

6. Use of conversations to improve the Service

Where permitted, we may use de-identified or aggregated conversation data to evaluate and improve safety and quality. Human review, if any, is limited, access-controlled, and performed on de-identified data wherever feasible, primarily for safety and abuse investigation. Where consent is the basis for using identifiable conversation content to improve models, we ask separately and you can withdraw it. Where we offer an opt-out for improvement uses, we honour it.

7. Disclosure of data

We share personal data with: processors/service providers (hosting, AI model providers, analytics, support, payment); app stores (for purchases); authorities and third parties where required by law or to protect rights and safety, and to report unlawful content (e.g. CSAM to competent bodies/NCMEC as applicable); and successors in a corporate transaction, subject to this Policy. We do not sell your personal data and do not share it for cross-context behavioural advertising.

8. International transfers

We may transfer personal data outside your country, including to the U.S. For transfers from the EEA/UK/Switzerland we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) and assess supplementary measures. Copies are available on request.

9. Retention

We keep personal data only as long as necessary for the stated purposes and to meet legal, accounting, safety, and dispute-resolution needs. Conversation content is retained for the period stated in-app, then deleted or de-identified. On account deletion we delete or de-identify personal data within a defined period, subject to backups (purged on a rolling cycle) and legal holds.

10. Your rights

GDPR / UK GDPR: You have rights to access, rectification, erasure, restriction, portability, and objection (including to processing based on legitimate interests), and to withdraw consent. You may complain to your supervisory authority (in Slovenia, the Information Commissioner — Informacijski pooblaščenec).

California (CCPA/CPRA) and other U.S. state laws: Depending on your state, you may have rights to know/access, delete, correct, opt out of "sale"/"sharing" and certain targeted advertising and profiling, and to limit use of sensitive personal information, plus non-discrimination. We do not sell or share personal data as defined. Exercise rights via info@model-group.si or in-app; authorised agents may submit with proof of authority. We verify requests and respond within statutory timelines.

How to exercise: Submit requests at info@model-group.si or in-app. We will not discriminate against you for exercising your rights.

11. Cookies and similar technologies

On web components we use strictly necessary cookies and, only with consent where required, analytics/functional technologies. Manage preferences via the in-app/website consent tool. The App is designed to minimise tracking; we do not use your conversations for advertising. See the Cookie Policy.

12. Security

We implement technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, and monitoring. No system is perfectly secure. In the event of a breach affecting your data, we will notify you and authorities where required (e.g. GDPR 72-hour authority notification and applicable U.S. state breach-notification laws).

13. Children

The Service is for adults (18+). We do not knowingly collect data from anyone under 18. If we learn we have, we delete it and close the account. Contact info@model-group.si if you believe a minor provided us data.

14. Automated processing

The core Service generates automated responses. We do not use your data for solely automated decisions producing legal or similarly significant effects within GDPR Art. 22. Safety classifiers assist human oversight and do not make final adverse decisions without the possibility of human review.

15. Changes

We may update this Policy. Material changes are notified in-app or by email. The "Effective" date shows the latest version.

Contact

MODEL 5 podjetje za organizacijo, izvedbo, posredovanje d.o.o., Poljanski nasip 12, 1000 Ljubljana, Slovenia — reg. no. 2264994000, VAT SI 72347422. info@model-group.si