Privacy Policy

1. Introduction

Gynergy is the name of our app, and it is operated by GYNERGY.AI, Inc. ("Company," "we," "us," or "our"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Gynergy on our websites gynergy.ai, app.gynergy.ai, lvl5life.com, and app.lvl5life.com, and when you use our services (collectively, the "Services").

LVL 5 LIFE is our Mastermind program. It runs on the Gynergy platform at lvl5life.com and app.lvl5life.com, so this Privacy Policy covers it too.

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

2. Information We Collect

2.1 Personal Information You Provide

We collect personal information that you voluntarily provide when you:

• Register for an account
• Subscribe to our Mastermind program
• Fill out forms or applications
• Contact us for support
• Participate in surveys or promotions
• Interact with our AI coaching assistant (ARIA)

This information may include:

• Identity Data: Name, username, title, date of birth, gender
• Contact Data: Email address, phone number, mailing address
• Financial Data: Payment card details, billing address (processed by Stripe); and, if you connect a bank account, financial-account information via Plaid (see Section 2.5)
• Profile Data: Goals, preferences, interests, feedback, survey responses
• Communication Data: Messages with our team and AI systems
• Transformation Data: Self-reported health metrics, financial check-ins, relationship assessments, mindset evaluations, and legacy/purpose reflections collected through our five-pillar coaching framework

2.2 Calendar Data (Optional Integration)

When you choose to connect your Google Calendar, we request access to read the calendars you have chosen to show in Google and, only when you explicitly ask ARIA to, create events on your primary calendar. Both are granted through Google's OAuth consent flow. We do this so ARIA, your AI coach, can give you contextual guidance about your day and, at your request, place a focus block or commitment on your calendar.

The same connection powers your scheduling link, if you publish one. To show someone your real availability we read the times you are already busy, and when they book a slot we add that booking to your primary calendar and invite them to it. That event is created by their booking, not by you asking for it, which is the one case where something lands on your calendar without you starting it.

Calendar connection is opt-in. You can connect, disconnect, or revoke access at any time from your Settings page or directly in your Google Account permissions. Disconnecting deletes our copy of your access tokens immediately.

How we secure it: Your Google OAuth access and refresh tokens are encrypted at rest using AES-256-GCM. Calendar event data is fetched on demand to power ARIA's response and is not retained beyond the request, except as briefly cached (under 15 minutes) to limit redundant calls to Google's API.

How ARIA uses it: ARIA references your upcoming events to suggest preparation, recovery, or focus blocks. ARIA creates an event only when you explicitly ask it to in that conversation. ARIA never schedules on its own, and nothing we do modifies or deletes events that are already on your calendar. The one exception to "only when you ask" is a booking someone else makes through your scheduling link, described above. You can review ARIA's reasoning in any conversation and disconnect calendar access if ARIA's behavior ever feels off.

Retention: Encrypted tokens are retained for as long as you keep the integration connected. On disconnect, tokens are deleted within 24 hours and Google is notified to revoke our access. Cached event data expires within 15 minutes regardless of connection state.

Google API Services User Data Policy: Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell calendar data, do not use it for advertising, and do not allow humans to read it except (a) you, (b) with your explicit consent, (c) for security or legal purposes, or (d) in aggregated, de-identified form for product improvement.

2.3 Email Data (Optional Integration)

Separately from calendar, you can choose to connect your Gmail inbox. This is opt-in, requested through its own Google consent step, and grants us read-only access — we cannot send, modify, delete, or compose email on your behalf. We use this access solely to let ARIA surface and summarize what needs your attention; suggestions only, and nothing touches your mailbox.

You can disconnect at any time from Settings or from your Google Account permissions page; disconnecting deletes our copy of your tokens. Email content is processed on demand and not retained as a copy of your mailbox. Our use of Gmail data adheres to the Google API Services User Data Policy, including its Limited Use requirements: we do not sell email data, do not use it for advertising, and do not allow humans to read it except (a) you, (b) with your explicit consent, (c) for security or legal purposes, or (d) in aggregated, de-identified form for product improvement.

2.4 Wearable & Health Device Data (Optional Integration)

When you choose to connect a wearable or health device — currently Oura, WHOOP, or Withings — we request read-only access to your data via that provider's OAuth consent flow. We do this so ARIA — your AI coach, including the Dr. Kai vitality persona — can ground your coaching in your real recovery, sleep, and body-composition data instead of generic advice.

Each connection is opt-in. You can connect, disconnect, or revoke access at any time from your Wearables settings, or directly in your account with the provider. Disconnecting deletes our copy of your access tokens and notifies the provider to revoke our access.

How we secure it: Your wearable OAuth access and refresh tokens are encrypted at rest using AES-256-GCM. Health measurements are stored in your account to power your coaching and to show you your own trends over time.

How we use it — and what we never do: We use this data solely to personalize your coaching, prescriptions, and recovery guidance, and to show you your own progress. We do not sell it, do not use it for advertising, and do not use it to train AI models. We do not allow humans to read it except (a) you, (b) with your explicit consent, (c) for security or legal purposes, or (d) in aggregated, de-identified form for product improvement.

Retention & deletion: Encrypted tokens are retained for as long as you keep the integration connected and are deleted on disconnect. You may request deletion of all wearable-derived health data at any time from your settings or by contacting us, and we will delete it across our systems.

Provider terms: Our use and transfer of data received from these providers adheres to each provider's API terms, including their limited-use and no-resale requirements — the Oura API Agreement, the WHOOP API Terms of Use, and the Withings API Terms of Use.

2.5 Bank & Financial Account Data (Optional Integration — Plaid)

When you choose to connect a bank or financial account, we use Plaid Inc. ("Plaid") to securely link it. You enter your bank credentials directly into Plaid's interface (or your bank's own OAuth login) — your banking credentials are never seen, received, or stored by us. We do this so our LEDGER financial tools can ground your budgeting, runway, and transaction insights in your real account activity instead of manual entry.

Connecting a financial account is opt-in. You can disconnect at any time, which revokes our access with Plaid and stops further syncing.

How we secure it: The access token Plaid issues for your connection is encrypted at rest using AES-256-GCM, and every use of it is recorded in a tamper-evident audit log. We do not sell your financial data, do not use it for advertising, and do not use it to train AI models.

Retention & deletion: Encrypted tokens are retained while the connection is active and are revoked with Plaid on disconnect. You may request deletion of synced financial data at any time by contacting privacy@gynergy.com.

Plaid's role & your consent: By connecting a financial account, you also agree to Plaid's handling of your information as described in the Plaid End User Privacy Policy. Plaid acts as a service provider that connects your accounts on your behalf; its use of your data is governed by its own Privacy Policy.

2.6 Information Collected Automatically

When you access our Services, we automatically collect certain information:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages viewed, time spent, click patterns, features used
• Location Data: General geographic location based on IP address
• Cookies and Tracking: Session cookies, persistent cookies, and pixel tags, including Meta's pixel (see Sections 5.2 and 8)

2.7 Information from Third Parties

We may receive information about you from third parties including:

• Authentication providers (Clerk)
• Payment processors (Stripe)
• Analytics providers (Google Analytics and PostHog)
• Wearable & health-device providers (Oura, WHOOP, Withings) — with your consent; see Section 2.4
• Financial-account connectivity (Plaid) — with your consent; see Section 2.5
• Marketing partners

3. How We Use Your Information

We use your personal information for the following purposes:

• Service Delivery: To provide and manage your account, process transactions, deliver the Mastermind program, and operate ARIA AI coaching
• Personalization: To customize your experience, provide tailored recommendations, and track your transformation journey
• Communication: To send administrative information, respond to inquiries, and provide customer support
• Marketing: To send promotional communications (with your consent)
• Analytics: To analyze usage patterns, improve our Services, and develop new features
• Advertising Measurement: To measure and optimize our own ads on Meta (Facebook and Instagram); see Section 5.2. We don't show ads on the platform, and we don't sell attention
• Security: To protect against fraud, abuse, and unauthorized access
• Legal Compliance: To comply with legal obligations and enforce our terms

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your personal data based on:

• Contract Performance: Processing necessary to fulfill our contractual obligations to you
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our Services and preventing fraud
• Consent: Processing based on your explicit consent (e.g., marketing communications, and analytics and advertising cookies)
• Legal Obligation: Processing necessary to comply with applicable laws

5. Information Sharing and Disclosure

We may share your information with:

5.1 Service Providers

• Clerk: Authentication and identity management
• Stripe: Payment processing and subscription management
• Supabase: Database hosting and real-time features
• Render: Website and application hosting
• Cloudflare: DNS and edge network
• Vercel: Object storage for a small set of legacy marketing media
• OpenAI/Anthropic: AI services for ARIA coaching
• Resend: Email delivery services
• Sentry: Error monitoring and performance tracking
• GoHighLevel: CRM, marketing automation, and SMS communications
• HeyGen: AI avatar video generation for Avatar Advisors
• ElevenLabs: AI voice synthesis for Avatar Advisors
• Calendly: Event scheduling and calendar management
• Plaid: Secure bank-account connectivity for LEDGER financial tools (see Section 2.5)
• Google Analytics: Website analytics
• PostHog: Product analytics

5.2 Advertising Measurement Partner: Meta

We use Meta Platforms, Inc. (Facebook and Instagram) as an advertising measurement partner. With your consent, or unless you opt out, depending on where you are (see Section 8), we send Meta:

• From your browser, through the Meta pixel: the pages you visit on our websites and the actions you take on them, such as starting or submitting an application. The pixel does not run inside the member portal, and it stops once you sign in as a member: it never receives your account, your email or what you do as a member.
• From our servers, through Meta's Conversions API: our application events, which are Lead (you entered your details), SubmitApplication (you submitted your answers) and Schedule (you booked a call). Each one carries a SHA-256 hashed copy of your email address and phone number, your IP address, your browser's user agent, and Meta's _fbp and _fbc cookies.

We do this for one purpose: to measure and optimize our own ads. That means learning which of our ads led to real applications and booked calls, and helping Meta show our ads to people likely to be interested. We don't show ads on the platform, and we don't sell attention. Meta's own use of this information is governed by the Meta Privacy Policy. You can turn this off at any time; see Section 7.2.

5.3 Other Disclosures

We may also disclose your information:

• To comply with legal process or government requests
• To protect our rights, privacy, safety, or property
• In connection with a merger, acquisition, or sale of assets
• With your consent or at your direction

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. The retention period depends on the context of our relationship with you and legal requirements.

• Account Data: Retained while your account is active and for 3 years after closure
• Transaction Records: Retained for 7 years for tax and legal compliance
• Communication Logs: Retained for 2 years
• AI Conversation History: Retained for 1 year or until you request deletion

7. Your Privacy Rights

7.1 General Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Request transfer of your data to another service
• Objection: Object to certain processing of your data
• Restriction: Request limitation of data processing
• Withdraw Consent: Withdraw previously given consent

7.2 California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold, shared, or disclosed
• Right to opt out of the sale or sharing of personal information
• Right to non-discrimination for exercising privacy rights

Sale and sharing. We do not sell your personal information for money. Sending Meta the pixel and Conversions API events described in Section 5.2 is “sharing” for cross-context behavioral advertising under the CCPA. The personal information shared this way is identifiers (a hashed email address and phone number, your IP address, and cookie IDs), internet activity (pages visited and application events), and device information (your browser's user agent). It is shared with one category of third party: an advertising platform (Meta). We do not knowingly sell or share the personal information of anyone under 16.

How to opt out. Use the Do Not Sell or Share My Personal Information link, here or in the footer of our websites. It works without an account, and it saves your choice in the browser you use it in. We also honor Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as your opt-out of sale and sharing and keep advertising sharing off in that browser. We do not respond to Do Not Track signals; GPC is the signal we honor.

7.3 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@gynergy.com. We will respond to your request within 30 days.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

• Essential Cookies: Required for basic site functionality
• Authentication Cookies: Keep you logged in securely
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Understand how you use our Services
• Advertising Measurement Cookies: Meta's pixel cookies (_fbp, _fbc), used to measure and optimize our own ads (see Section 5.2)

Where you are sets the default. If you are in the European Economic Area, the United Kingdom or Switzerland, analytics and advertising cookies stay off until you choose them in our cookie banner. We estimate this from your device's time zone, and we treat any time zone we can't place the same way. Everywhere else, they are on by default. A notice tells you so, and you can opt out at any time with the Do Not Sell or Share My Personal Information link or with Global Privacy Control (see Section 7.2). A choice you make always takes priority over the default.

You can control cookies through your browser settings. Note that disabling certain cookies may limit your ability to use some features of our Services.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication and access controls
• Regular security assessments and monitoring
• Employee training on data protection
• Incident response procedures

While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws. When we transfer data internationally, we implement appropriate safeguards such as Standard Contractual Clauses to protect your information.

11. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us: