TrendVentures Holding UG (haftungsbeschränkt)
Effective Date: 03.03.2026

This privacy notice for TrendVentures ("Company," "we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

▪ Visit our website or any website of ours that links to this privacy notice

▪ Download and use our mobile applications such as **AURA AI, Maxed AI**, or any other application of ours that links to this privacy notice

▪ Engage with us in other related ways, including any sales, marketing, or events

SUMMARY OF KEY POINTS

This summary provides key points from our privacy notice, but you can find out more details about any of these topics by reading the full privacy policy.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with TrendVentures and the Services, the choices you make, and the products and features you use. We may share data (image/text) with OpenAI for personalized AI responses.

Do we process any sensitive personal information? We do not process sensitive personal information.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Click here to learn more.

In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties. Click here to learn more.

How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Click here to learn more.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Click here to learn more.

How do you exercise your rights? The easiest way to exercise your rights is by filling out our data subject request form available here, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what TrendVentures does with any information we collect? Read the full privacy policy below.

1 Controller within the Meaning of the GDPR

The controller responsible for the processing of your personal data as defined in Art. 4 No. 7 of the General Data Protection Regulation (GDPR) is:

TrendVentures Holding UG (haftungsbeschränkt)
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany

Email: trendventures@gmail.com

Responsible for data protection matters:
Tim Kußler
You can reach our data protection officer at the email address above with the subject line "Data Protection".

2 Scope of Application

This Privacy Policy applies to all mobile applications operated by TrendVentures Holding UG, including but not limited to:

• AURA AI: Texting Assistant

• Maxed AI

• Comet – Life Advice

• HeightFuel

• SaveMate - Savings Tracker

• Holy AI

These applications are hereinafter referred to collectively as "our Apps". This policy applies regardless of whether the Apps are used on iOS or Android devices.

3 Fundamental Data Protection Principles

We are committed to protecting your privacy and handling your personal data with the utmost care. We process personal data in strict compliance with:

• The General Data Protection Regulation (GDPR)

• The German Federal Data Protection Act (BDSG)

• And any other applicable data protection laws.

Our data processing activities are governed by the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, storage limitation, integrity, confidentiality, and accountability.

4 Categories of Data Processed

We have designed our Apps with a privacy-first approach. TrendVentures Holding UG does not operate user accounts and does not intentionally collect traditional identifiers such as:

• Names

• Email addresses

• Phone numbers

• Postal addresses

• Contact lists

• Precise background location data

• Advertising IDs for profiling purposes

• Social media data

However, to provide the core functionality of our Apps, the following categories of data may be processed:

5 AI-Based Image Processing

This section is essential and describes in detail how image data is processed within our Apps.

5.1 Voluntary Submission of Images

Users may voluntarily upload images within the Apps to receive AI-generated responses, analyses, or advice. These images may contain personal data, including:

• Visual depictions of individuals

• Environmental data visible in the image

• Potentially sensitive content depending on what the user chooses to photograph

• Potential biometric characteristics (e.g., facial features)

We want to be absolutely clear: TrendVentures does not perform biometric identification, facial recognition, or automated identity verification based on these images. Our systems are not designed to recognize who you are, only to analyze the content of the image based on your request.

5.2 Technical Processing Workflow

When a user uploads an image for processing, the following technical steps occur:

1. Transmission: The image is transmitted from your device to our backend infrastructure via an encrypted connection (TLS/HTTPS).

2. Temporary Storage: The image is temporarily stored in our secure backend infrastructure, which is hosted via Supabase. This storage is necessary to facilitate the processing workflow.

3. Forwarding to AI Provider: The image is then forwarded via a secure API connection to OpenAI, our third-party AI service provider, for AI-based processing and analysis.

4. Generation of Response: The AI model generates a response based on the image content and your prompt.

5. Deletion: The image is automatically and permanently deleted from our backend storage immediately after the AI processing is complete and the response is generated.

5.3 Purpose of Processing

The sole and exclusive purpose of processing your images is:

• Generating the AI-based responses or analyses that you have explicitly requested.

• Providing the core functionality of the relevant App.

• Improving and ensuring the technical functionality of the service.

We want to assure you that images are not used for any other purposes, including:

• Marketing or advertising

• Profiling or creating behavioral user profiles

• Selling or renting data to third parties

• Training our own internal AI models (see Section 6 for OpenAI's data usage)

5.4 Legal Basis for Image Processing

The legal basis for processing these images is multifaceted:

• Performance of a Contract (Art. 6(1)(b) GDPR): The processing is necessary to fulfill our contractual obligation to provide you with the AI analysis features you request when using our App.

• Explicit User Consent (Art. 6(1)(a) GDPR): By actively uploading an image and initiating the process, you are providing clear and explicit consent for this specific processing activity.

• Legitimate Interest (Art. 6(1)(f) GDPR): We have a legitimate interest in processing your request to deliver the technical service you expect from us.

If an uploaded image contains special categories of data (e.g., health data, biometric data, political opinions) as defined in Art. 9 GDPR, processing is only carried out based on your explicit consent, which you provide by voluntarily uploading such an image.

5.5 Summary of key Processing Principles

What data is sent
When you use the AI image processing features, the images you upload, your prompts, and necessary contextual input data are transmitted for processing.

To whom data is sent
Data is shared with our AI service provider solely for the purpose of generating the requested AI response. The data is shared with OpenAI to generate personalized AI-Responses.

User permission
Image upload and initiation of processing are voluntary actions and serve as explicit consent for the described processing activities.

Data collection, use, and third-party protection
Data is collected only to provide the requested AI functionality and is not used for marketing, profiling, or unrelated purposes. Any third-party service used for processing is contractually required to maintain a level of data protection that is at least equivalent to the standards described in this Privacy Policy.

If you use the mentioned apps you accept our data processing and you accept the privacy policy.

6. Processing by OPENAI

To power our AI features, we use artificial intelligence models provided by OpenAI via their API.

Nature of Data Shared with OpenAI:
Depending on your specific interaction with the App, the data shared with OpenAI may include:

• The images you upload

• The text prompts or questions you enter

• Contextual instructions necessary to generate the correct response

Purpose of Data Sharing:
The data is shared with OpenAI for the sole purpose of generating the AI-based responses you have requested. This includes the content analysis and automated interpretation of your inputs.

Data Storage and Usage by OpenAI:
Please be aware that data submitted via the API may be processed on OpenAI's servers, which are located in the United States. OpenAI's use of this data is governed by their own data processing terms and policies. According to their terms, they may process data for the following purposes:

• To provide the AI service to us (our controller)

• For security, abuse, and fraud monitoring of their platform

TrendVentures does not control OpenAI's internal technical infrastructure or their detailed data handling practices. For more information, we encourage you to review OpenAI's Privacy Policy.

6.1 International Data Transfers

As noted, OpenAI's servers may be located outside the European Union, including in the United States. When your personal data is transferred outside the EU, we take steps to ensure that your data is treated securely and in accordance with this Privacy Policy. These transfers rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs), to ensure an adequate level of data protection. By using our Apps and its AI features, you acknowledge this international transfer. TrendVentures ensures that any third-party service provider with whom data is shared provides an adequate level of data protection that is at least equivalent to the protection standards described in this Privacy Policy. In particular, we require our AI service provider to process data in accordance with applicable data protection laws and contractual safeguards.

7. Backend & Infrastructure Providers

We rely on specialized third-party providers to ensure our Apps run smoothly and securely.

7.1 Supabase

We use Supabase as our primary backend platform. Supabase is used for:

• The temporary storage of images (as described in Section 5.2)

• Processing backend logic and data necessary for app functionality.

Data is stored on Supabase's infrastructure only for as long as is technically necessary to fulfill your request and is then deleted.

7.2 Firebase

We use Firebase, a platform provided by Google, for a variety of purposes, including:

• Core infrastructure services

• Crash reporting (to help us fix bugs and improve stability)

• Performance diagnostics (to understand how our app performs on different devices)

Firebase may process technical information such as:

• Device type and model

• Operating system version

• App version number

• Technical logs related to app performance and crashes

This data is pseudonymized and used only to maintain and improve our services. No personal user accounts are created or managed through Firebase.

8. Subscription and Payment processing

For Apps that offer premium subscriptions, we have designed the payment process to minimize data access.

• Subscription Management: We use a service called RevenueCat to manage and verify subscription statuses across different platforms (Apple and Google). RevenueCat confirms whether a user has an active subscription but does not have access to your actual payment details.

• Payment Processing: All financial transactions are handled directly by the platform you made the purchase on:

  • Apple App Store

  • Google Play Store

TrendVentures does not access, view, or store your credit card details, bank account information, or full billing addresses. These payment providers act as independent controllers responsible for your payment data under their own privacy policies and terms.

9. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you as defined in Art. 22 GDPR.

• AI Responses are Informational: While our Apps use AI to generate automated responses, these outputs are for informational, entertainment, or general guidance purposes only. They do not constitute legally binding advice (e.g., medical, legal, or financial advice).

• No Profiling: We do not use the content of your images or prompts to build a profile of your personality, behavior, or interests.

10. Data Retention

Our retention policy is designed to minimize data storage.

• Uploaded Images: Deleted immediately after processing is complete.

• AI-Generated Responses: We do not permanently store the text or results of your AI interactions.

• Crash Logs: Retained only as long as necessary for debugging and improving app stability, typically for a few months.

• Subscription Records: As we do not manage payments, we do not retain any financial records. RevenueCat retains a record of your subscription status (e.g., active/expired) as long as you use the service. Payment providers retain your transaction data according to their own policies and legal obligations.

11. Data Security measures

Protecting your data is a top priority. We implement a comprehensive set of technical and organizational security measures, including:

• Encrypted Transmission: All data transmitted between your device and our servers is encrypted using HTTPS/TLS protocols.

• Secure API Authentication: All connections to third-party providers like OpenAI and Supabase are secured with strong authentication methods.

• Strict Access Controls: Access to our internal systems and any temporary data is strictly limited to authorized personnel who require it for technical maintenance and support.

• Minimal Data Architecture: Our systems are designed to process data and delete it immediately, minimizing the risk associated with long-term data storage.

• Secure Hosting: We use reputable cloud hosting providers (Supabase, Firebase) who adhere to high industry security standards.

12. No Data Selling / No Advertising Profiling

We want to be unequivocal about our business model:

• We do not sell your personal data to anyone.

• We do not share your personal data with advertisers or data brokers.

• We do not perform cross-app tracking to build advertising profiles.

• We do not use your images, prompts, or any other personal data for behavioral marketing or targeted advertising.

13. User Rights Under GDPR

As a user in the European Union, you have specific rights regarding your personal data. Because we do not store your data in a traditional user account, exercising some rights (like access or erasure) will typically involve confirming that you were the user who submitted a specific request within a specific timeframe.

You have the right to:

• Right of Access (Art. 15 GDPR): Request confirmation of whether we process personal data concerning you and, if so, access to that data.

• Right to Rectification (Art. 16 GDPR): Request the correction of inaccurate personal data.

• Right to Erasure ('Right to be Forgotten') (Art. 17 GDPR): Request the deletion of your personal data.

• Right to Restriction of Processing (Art. 18 GDPR): Request that we restrict the processing of your data.

• Right to Data Portability (Art. 20 GDPR): Request to receive your data in a structured, commonly used, and machine-readable format.

• Right to Object (Art. 21 GDPR): Object to the processing of your data, based on your particular situation.

• Right to Withdraw Consent: If processing is based on consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at: trendventures@gmail.com (with the subject line "Data Protection").

You also have the right to lodge a complaint with a supervisory authority. The responsible authority for us is the State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg, Germany.

14 Children & Minors

Our Apps and their features are intended for users who are at least 16 years old. They are not directed at children under 16. We do not knowingly collect or process personal data from children under 16. If we become aware that we have inadvertently processed data from a child under 16, we will take steps to delete that information as soon as possible.

15 Changes to this Privacy policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or technical developments. We will notify you of any material changes by posting the new Privacy Policy within the Apps and updating the "Effective Date" at the top of this document. We encourage you to review this Privacy Policy periodically for any changes.