Privacy Notice

Who we are

Linarion is a service operated by KLB Solutions FZCO, a free zone company registered in Dubai, United Arab Emirates (the "company", "we", "us").

For the purposes of data protection law, KLB Solutions FZCO is the data controller for the personal information of everyone who uses Linarion. Our servers are in the European Union (Frankfurt, Germany) and we serve users in the EU, EEA, and UK. We are therefore subject to the EU GDPR and the UK GDPR as a non-EU/non-UK controller.

We can be reached at:

KLB Solutions FZCO (operating as Linarion) Email: privacy@linarion.com

If you have a question or concern about how we handle your information, this is the right place to start.

What this notice covers

This notice explains what information Linarion holds, why we hold it, how long we keep it, and what rights you have over it. It applies to:

• Brain owners — people who create a Linarion brain for themselves or in memory of someone who has died
• Family members and contributors — people invited into a brain
• Trusted contacts — people designated by a brain owner to act after the brain owner's death
• Visitors to the Linarion website who have not yet created an account

We serve people in the European Union, the European Economic Area, and the United Kingdom. Our servers are located in Frankfurt, Germany (EU region). We do not offer the service outside these territories at launch.

You must be 18 or older to use Linarion.

The information we hold and why

Account information

When you create an account, we hold your email address and the authentication credentials linked to it. We use your email address only to let you sign in. We do not use it to send you marketing, and we do not share it with advertisers. The legal basis for this is contract (Article 6(1)(b) of the UK and EU General Data Protection Regulation — the GDPR): we need a sign-in identity to provide the service.

What you record into your brain

The core of Linarion is what you choose to record: memories, values, beliefs, how you make decisions, your relationships, your history. This includes written notes, photographs, and documents you upload about yourself or about a person who has died.

We hold this because you asked us to hold it, and because the whole point of the service is to preserve it. The legal basis is consent (Article 6(1)(a) GDPR). You can withdraw your consent and delete everything at any time — see "Your rights" below.

Sensitive information

Some of what people record touches areas that data protection law treats with extra care. These include:

• health information, including information about Alzheimer's disease, dementia, cancer, or other conditions
• religious or philosophical beliefs
• political views
• information about sexual orientation or relationships
• information about ethnic or racial background

The law calls these "special categories" of personal data (Article 9 GDPR). We process this information on the basis of your explicit consent (Article 9(2)(a) GDPR). We ask for that consent separately — it is not buried in the general terms of service.

If you are using Linarion's Continuity Mode (a feature for people who are documenting their identity while living with cognitive decline), we will ask for explicit consent before that mode is activated, because its use may itself reveal health information.

You can withdraw your consent to any category of sensitive information at any time. When you do, we will stop processing that category and delete any records that fall within it, unless you separately instruct us to retain them.

Voice notes

If you record voice notes, the audio files are held by us and processed to produce a written transcript. The audio and the transcript are personal data. If you choose to enable voice synthesis, the trained voice model derived from your recordings is biometric data under Article 9 GDPR. It is strictly optional and stays off unless you turn it on: we ask for your explicit, separate consent before any voice model is created, and you can withdraw that consent and have the model deleted at any time.

Photographs and documents

Photographs and documents you upload are held and displayed within your brain in accordance with your privacy circle settings (see "Who can see what" below). Photographs are personal data; we do not run facial recognition or identification processing on them.

Contributions from family members

People you invite into your brain as family members or contributors may add their own memories, notes, or reflections. Each contributor's submissions are their own personal data as well as yours. We hold them on the basis of the contributor's own consent, given when they accept an invitation.

Technical data

When you use the website, our servers collect standard technical records: your IP address, browser type, the pages you visit, and the time of each request. We keep these for up to 90 days to detect and address technical problems. We do not use this data to build a profile of you.

Who can see what

Linarion uses a three-circle privacy model. You set this for each part of your brain.

• Private circle — only you can see it
• Family circle — you and the family members or contributors you have named
• Trusted contact circle — your designated trusted contacts (relevant mainly after your death)

The brain's responses respect your circle settings at the point of every query. We enforce this in the system, not just in the terms.

Who we share your information with

We do not sell your personal information. We do not share it with advertisers. We share it only with the companies we use to run Linarion, and only to the extent necessary for each of them to do their job.

The categories of companies we work with are:

We name providers by role rather than by company name because we are provider-agnostic — we may change which company fills each role, and this notice will be updated when we do. We enter into a data processing agreement with each sub-processor that requires them to protect your information to at least the same standard we have committed to here.

We do not use your content to train AI models. Every sub-processor that handles brain content is contractually prohibited from using it for training, fine-tuning, or any purpose beyond delivering the service to you.

Legal disclosures

We may be required to disclose information by law, court order, or regulation. If we receive such a request, we will tell you before we comply unless we are legally prevented from doing so.

International transfers

Our servers are in the European Union (Frankfurt, Germany). KLB Solutions FZCO is established in the UAE, which does not currently have an EU or UK adequacy decision. Where personal data is transferred from the EU or UK to KLB Solutions FZCO in its UAE operating capacity, we rely on Standard Contractual Clauses approved by the European Commission (Implementing Decision 2021/914), supplemented by a Transfer Impact Assessment, and the UK International Data Transfer Addendum where applicable for UK residents.

If a sub-processor we use is based in the United States, we ensure that any transfer of your information to them is protected by Standard Contractual Clauses and, where current and applicable, the EU-US Data Privacy Framework.

The UK currently has an adequacy decision from the European Commission. If that adequacy decision ceases to apply, we will put Standard Contractual Clauses in place for any processing in or transferred to the UK.

How long we keep your information

If you die and have not left instructions about what should happen to your brain, the brain enters a protected state. It is not deleted automatically. Heirs and family members may come forward and request closure — see "After you die" below.

We do not delete your brain because it appears inactive. Absence of recent use is not a signal we act on.

After you die

This section explains how Linarion works after a brain owner dies. It is an unusual part of a privacy notice, because most services do not think about this. For Linarion it is central.

What you can set while you are alive

While you are alive, you can use Linarion's settings to record your wishes for what should happen to your brain after you die. You can:

• name one or more trusted contacts who will be notified and who can facilitate access for family members
• decide which parts of your brain should remain accessible to which people, using the same three-circle privacy model
• set an instruction to delete everything on your death, if that is what you prefer

These settings are your post-mortem directives. For users in France, these settings constitute directives under Articles 84–86 of the French Data Protection Act. For users in Spain, explicitly restricting a person's access in your settings constitutes the prohibition under Article 3 of Organic Law 3/2018 (LOPDGDD). For users in Italy, they constitute the prohibition under Article 2-terdecies of the Italian Personal Data Protection Code.

You should review your settings and update them if your wishes change.

What happens when we are notified of your death

When Linarion is notified that a brain owner has died — by a trusted contact, a family member, or an heir — we will:

• Verify the notification (we will ask for reasonable evidence)
• Apply the access and retention settings you configured during your life
• Notify your trusted contacts
• If you set an instruction to delete, carry out that deletion within 30 days

If you did not leave any settings, the brain enters a stewardship-locked state. It is not deleted. Family members, trusted contacts, and heirs may contact us to discuss what they would like to happen. We will not grant access to content beyond the three-circle settings you set during your life without appropriate evidence of family relationship or succession.

Heirs

Heirs who were not named as trusted contacts or family contributors during the brain owner's life have a right in several EU member states to come forward and request access or deletion. We honour this. If you believe you are an heir of a deceased Linarion user and wish to exercise rights over their account, contact us at privacy@linarion.com with evidence of your relationship.

We cannot grant access to private-circle content to anyone other than the brain owner themselves. That content was set private by the brain owner's deliberate choice and we treat that choice as binding.

Contributor content after a brain owner's death

If you contributed content to another person's brain and that person has died, your contributions remain under your control. You can ask us to remove them at any time.

Cookies

Your rights

Under the GDPR and equivalent UK law, you have the following rights. You can exercise most of them directly in your account settings. For anything not available there, contact us at privacy@linarion.com and we will respond within 30 days.

Access — You can ask us to confirm what information we hold about you and receive a copy of it.

Correction — You can ask us to correct information that is wrong.

Deletion — You can delete your account and everything in it directly from your account settings. This removes your brain, all recorded content, voice and photo files, and access for connected family members immediately. We will also remove your content from our backups within 30 days. The only information we retain after deletion is the minimum necessary to comply with a legal obligation (for example, a record of your billing history for tax purposes).

Export — You can download your entire brain at any time in open formats (JSON and Markdown). There is no charge for this. We do not make it difficult.

Restriction — You can ask us to pause the processing of your information while a dispute is being resolved.

Objection — You can object to any processing we carry out on the basis of legitimate interests. We have not relied on legitimate interests as a basis for processing your brain content.

Withdrawal of consent — Where we hold information on the basis of your consent, you can withdraw that consent at any time. Withdrawal does not affect anything we did before you withdrew consent.

Portability — You can ask us to send your information to another service in a machine-readable format.

If you are in the UK

The above rights apply equally under the UK GDPR and the Data Protection Act 2018. The supervisory authority in the UK is the Information Commissioner's Office (ico.org.uk).

How to complain

If you are unhappy with how we have handled your information, please contact us first at privacy@linarion.com. We take these concerns seriously and will try to resolve them.

If you are not satisfied with our response, you have the right to complain to a supervisory authority for data protection.

As KLB Solutions FZCO is established outside the EU and UK, we do not have a single designated "lead" supervisory authority under the GDPR's one-stop-shop mechanism until we appoint an EU representative (see "Who we are" above). This means EU residents may complain to their own national data protection authority. A list of all EU/EEA supervisory authorities is at: edpb.europa.eu/about-edpb/about-edpb/members_en

If you are in the UK, the supervisory authority is the Information Commissioner's Office: ico.org.uk

Children

Linarion is not available to anyone under 18. We do not knowingly hold information about children. If you believe we have inadvertently collected information about a person under 18, please contact us and we will delete it.

Changes to this notice

If we make significant changes to this notice, we will tell you by email or by a notice when you next sign in. The date at the top of this page shows when it was last updated. We keep previous versions of this notice, and you can ask us to send you a previous version.

Contact us

KLB Solutions FZCO (operating as Linarion) Privacy and data rights: privacy@linarion.com General enquiries: hello@linarion.com Legal notices: legal@linarion.com Security concerns: security@linarion.com

We aim to respond within 5 working days for general questions, and within 30 days for formal rights requests.