Privacy Policy

This Privacy Policy explains how Proactive Buddy collects, uses, stores, shares, and protects personal data when you use the service.

Proactive Buddy is an AI-supported reflection service operated by Proactive Health & Retreat ApS as part of the Proactive Being ecosystem.

This Privacy Policy applies when you:

• use Proactive Buddy through Telegram or another supported interface
• purchase, activate, or manage a subscription
• contact us for support or other inquiries
• otherwise interact with the service

The data controller for personal data processed through Proactive Buddy is:

Proactive Health & Retreat ApS CVR: 41372192 Vornæs Skovvej 14 5700 Svendborg Denmark

Contact: hello@proactivebuddy.com

Proactive Buddy is delivered through BuddyPro / Buddy.fm infrastructure. For instance-specific processing — the delivery of your Proactive Buddy conversations, account linkage, and related service operation — BuddyPro / Buddy.fm acts as processor on our behalf under the applicable licence terms and processor structure.

We do not claim that every platform-level processing activity is performed solely as processor. Some platform-wide processing — in particular the shared user profile/memory described in the section “Shared Platform Profile and Memory” below — may involve the platform provider determining purposes and means for its own platform functionality. The allocation of controller and processor roles for that platform-wide processing is not fully resolved, and we have requested written clarification from the platform provider. We describe the position as it currently stands rather than asserting a role that is not yet documented.

We may collect and process the following categories of personal data.

4.1 Information you provide directly

• name
• email address
• account and contact information
• messages, prompts, uploads, and other content you submit through Proactive Buddy
• support requests and related communications
• information you voluntarily choose to share while using the service

4.2 Information collected automatically

• Telegram profile information made available to us, such as username, display name, and language settings
• usage data, such as frequency of use, interaction history, and service activity
• account, subscription, and billing status
• technical and device-related information necessary to provide, maintain, secure, and improve the service

4.3 Payment-related information

Payments are processed by Stripe or another payment provider we designate from time to time. We do not store full payment card details ourselves. We may receive limited payment-related data such as:

• billing email
• payment status
• subscription status
• transaction identifiers
• invoice and tax-related details

We use personal data to:

• provide, operate, and maintain Proactive Buddy
• authenticate users and manage access
• process subscriptions, payments, renewals, and cancellations
• maintain continuity of the user’s conversation experience
• provide support and service communications
• monitor, troubleshoot, and improve service quality, reliability, and safety
• detect misuse, abuse, fraud, and security incidents
• comply with legal, tax, accounting, and regulatory obligations
• establish, exercise, or defend legal claims where necessary

Where GDPR applies, we rely on one or more of the following legal bases:

6.1 Performance of a contract

We process personal data where necessary to provide the service you requested, including account management, delivery of the service, subscription administration, billing, and support.

6.2 Legitimate interests

We may process personal data where necessary for our legitimate interests, including:

• operating and improving the service
• maintaining service continuity and quality
• protecting the service against misuse, abuse, and fraud
• maintaining security, logging, and troubleshooting
• developing and improving the business in a proportionate way

6.3 Legal obligation

We may process personal data where necessary to comply with legal obligations, including accounting, tax, consumer law, and regulatory requirements.

6.4 Consent

Where required by law, we rely on consent for specific processing activities. If we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

Proactive Buddy uses AI-supported systems and third-party infrastructure to deliver the service.

This may involve processing your messages, prompts, uploads, and related conversation content through third-party providers strictly for the purpose of providing, operating, securing, supporting, and improving the service.

We do not sell your personal data.

According to a vendor statement from BuddyPro, conversation data is not used to train AI models, and its contracts with OpenAI, Anthropic, and Google prohibit such use. This is a vendor statement provided to us; we have not independently audited it.

BuddyPro has stated — as a vendor statement, not an independently audited fact — that neither the instance owner nor the BuddyPro team can read conversation content. We do not represent instance owners as having access to conversation content unless current platform documentation supports it. You should not treat any of this as a guarantee of confidentiality.

The underlying platform’s currently published privacy information states that AI services running on the same platform may use a common user profile/memory associated with the same Telegram account.

What this means in practice:

• this is platform-level processing, carried out by the platform provider across services running on the platform — it is not limited to Proactive Buddy
• it can support continuity and personalisation across AI services on the platform linked to the same Telegram account
• the exact fields, scope, retention periods, deletion routines, opt-out options, and isolation controls have been requested in writing from the platform provider and are not yet confirmed to us
• until this is clarified, you should assume that profile or memory information derived from your use may be available to other AI services on the same platform that are linked to the same Telegram account
• we do not represent instance owners as having access to that profile or memory unless current platform documentation supports it

Our written request for clarification does not transfer legal responsibility to the platform provider, and it does not resolve the question on its own. We describe the current, unresolved position so that you can make an informed choice about what you submit. We will update this section when we receive documented answers.

If cross-service continuity is not acceptable for your use case, limit what you submit accordingly, or contact us at hello@proactivebuddy.com before using the service.

Proactive Buddy is intended for reflection on professional and personal decisions. It is not an approved environment for classified, regulated, or highly confidential material.

Do not submit classified information, critical-infrastructure vulnerabilities, credentials or access keys, trade secrets, highly confidential customer material, regulated secrets, health or psychological details, or other special-category personal data unless a specific approved use case and lawful basis have been established with us in advance.

Proactive Buddy is an AI system and a reflection partner. It is not a human coach or adviser, and it does not provide legal, financial, medical, or psychological advice. If you are in crisis or facing an emergency, contact local emergency services or a qualified professional.

We may share personal data with trusted service providers and partners who help us operate Proactive Buddy, including providers for:

• payment processing
• hosting and infrastructure
• messaging and delivery
• AI model and inference services
• analytics, monitoring, logging, and support
• storage and security

These parties process personal data either:

• on our behalf under data processing agreements where required, or
• as independent controllers where their own role requires that under applicable law

We may also disclose personal data:

• where required by law
• to respond to lawful requests from authorities
• to protect rights, safety, and property
• in connection with a merger, acquisition, financing, restructuring, or sale of all or part of our business, subject to applicable safeguards

Primary data is stored in AWS Frankfurt (Germany). Vector database infrastructure is hosted in Pinecone Ireland.

Some service providers may process personal data outside your country of residence, including outside the EU/EEA. In particular, we do not represent that all AI model and inference processing takes place inside the EEA: AI providers and platform infrastructure may process content outside the EEA. Storage locations stated above are vendor-stated locations for the components named and do not describe every processing step.

Where relevant, we seek to use appropriate safeguards under applicable law, such as:

• adequacy decisions
• Standard Contractual Clauses
• other lawful transfer mechanisms

You may contact us if you want more information about the safeguards used for relevant transfers.

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including to:

• provide the service
• maintain your account and subscription
• verify prior commitments and continuity where relevant to the service
• comply with legal, accounting, tax, and regulatory obligations
• resolve disputes
• enforce our rights and agreements

Retention categories:

• account and subscription data: retained while your account is active and for a reasonable period afterward as needed for support, disputes, compliance, and fraud prevention
• payment and invoicing data: retained for as long as legally required for accounting and tax purposes
• support communications: retained for as long as reasonably necessary to handle support, disputes, and follow-up
• conversation data and uploaded content: retained for as long as needed to provide the service, maintain continuity, and support legitimate service operations, unless deleted earlier, anonymized, or no longer needed

We may delete, aggregate, or anonymize data when it is no longer needed.

Retention details for platform-level shared profile/memory, vector embeddings, backups, and system logs are stated by the platform vendor. Confirmation of exact retention and deletion behaviour for those components has been requested in writing and is not yet confirmed to us.

If you request deletion of your Proactive Buddy conversation history and AI memory, Proactive Buddy will forward the request to BuddyPro support together with the affected user ID.

BuddyPro will then enable a one-time /clear command for that specific user. Once run, the user’s full conversation history and AI memory are permanently deleted.

Deleting a message inside Telegram removes it from the Telegram chat view. It does not, by itself, delete data held in backend systems. Full deletion may require the documented support request plus the one-time /clear workflow described above.

We have requested written confirmation from the platform provider on whether the /clear workflow also removes shared platform profile/memory, vector embeddings, backups, and system logs. Until that is confirmed, we cannot state that every derived copy is deleted, and we will not promise a result the platform has not documented.

To request deletion, contact: hello@proactivebuddy.com

We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include:

• encrypted transmission
• access controls
• secure hosting environments
• limited administrative access
• vendor due diligence
• logging and monitoring
• role-based access restrictions where appropriate

No system can be guaranteed perfectly secure. However, we take data protection and service security seriously and aim to apply proportionate safeguards.

If GDPR applies to you, you may have the right to:

• access your personal data
• request correction of inaccurate personal data
• request deletion of personal data
• object to certain processing
• request restriction of processing
• request data portability
• withdraw consent where processing is based on consent
• lodge a complaint with a supervisory authority

To exercise your rights, contact: hello@proactivebuddy.com

If you are in Denmark, you may also complain to Datatilsynet, the Danish Data Protection Agency.

Proactive Buddy is not intended for children and is not directed to individuals under 18.

We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate legal basis, we will take steps to delete it.

We may update this Privacy Policy from time to time.

The updated version will be posted with a revised “Last updated” date. Where required by law or where changes are material, we may also notify users through appropriate channels.

If you have questions about this Privacy Policy or our data practices, contact:

hello@proactivebuddy.com