Privacy explained in full.

1. Scope, controller and roles

This Policy applies where GalaWise determines why and how personal information is processed for the Services. If an organization administers a ReelEaze workspace, that organization may separately be a controller or business for content its members place in the workspace; contact that organization about its independent practices. Apple, Google, Meta, Facebook, Instagram, Threads, LinkedIn, TikTok, Pinterest, YouTube and any other service you connect or visit are independent providers governed by their own terms and policies.

This Policy does not cover information processed solely on your device and never sent to us, or third-party sites and services we do not control. It also does not turn optional permissions into consent: camera, microphone, contacts, photos, location, notifications, cloud backup and connected-account access are requested separately through the app or operating system when needed.

2. At a glance

• We collect information needed to create accounts, deliver communications, operate calls, synchronize workspaces, publish at your direction, secure the Services, provide support and satisfy law.
• We do not sell personal information and do not share it for cross-context behavioral advertising. The website does not load advertising pixels or behavioral-advertising cookies.
• Supported personal messages and calls are designed to be end-to-end encrypted. Encryption protects content in transit between participants, but it does not hide all account, device, routing, delivery or call metadata.
• Connected social-account data is used only to provide the connected features you authorize, maintain the connection, secure it and meet provider rules.
• You can control permissions, privacy settings, connected channels and account deletion. Additional rights depend on where you live.

3. Information we collect and process

We ask you not to send passwords, one-time codes, private encryption keys, social access tokens, government identifiers, financial information, health information or other sensitive data through support unless we explicitly request a secure method and the information is necessary.

4. Where information comes from

• From you: when you register, complete a profile, grant a permission, communicate, upload, publish, contact support or submit a report.
• From your devices: app, operating-system, network, push, security, crash and performance signals.
• From other users: when they save you as a contact, invite you, communicate with you, add you to a group or workspace, or report content involving you.
• From connected platforms: only within the authorization and features you approve.
• From service providers and public sources: delivery confirmations, security intelligence, approximate IP country, public social-profile information and lawful requests.

If you provide information about someone else, you are responsible for having a lawful reason and any permission required to do so.

5. How we use information and our legal bases

We do not use solely automated decision-making that produces legal or similarly significant effects on you. Automated systems may rate-limit, detect suspicious activity or flag content or accounts for review; where required, you may request human review.

6. Messages, calls, encryption and backups

What end-to-end encryption covers

Supported personal message payloads and call media are designed so only participating devices hold the keys needed to read or hear the content. Our relay may temporarily hold encrypted payloads and related delivery information. End-to-end encryption does not conceal the fact that an account communicated, the participants, time, delivery state, size/type, IP/network routing or other operational metadata.

Important limits

• A recipient can screenshot, record, export, forward, copy or report content after receiving it. We cannot control recipients' devices or conduct.
• Notification previews, device backups, photo libraries, exported files and operating-system logs are controlled by you and the relevant device or cloud provider. A backup is protected according to the backup option and provider you select; do not assume every backup is end-to-end encrypted.
• If you intentionally report a message, attach content to support, or ask us to process content through a feature that requires server or third-party access, that submitted copy can be reviewed for the stated purpose.
• Group calls may use our self-hosted routing infrastructure. Routing servers can handle encrypted media packets and operational metadata; the encryption design does not eliminate network metadata.

Calls are not emergency services

VISHU calling depends on devices, power, internet access, push delivery and third-party networks. It does not replace a mobile or landline telephone, cannot guarantee location delivery, and must not be relied on to contact police, fire, ambulance or other emergency services.

7. ReelEaze and connected services

ReelEaze connects only after an authorized person completes the provider's official authorization flow. We do not ask for or store your social-network password. Access credentials are encrypted and restricted to approved capabilities. Workspace owners control roles and channel grants; members should connect only accounts they are authorized to manage.

Depending on provider support and approved permissions, ReelEaze may create, schedule, publish, edit or delete content; retrieve managed content, comments, replies, status and insights; and refresh or revoke authorization. Some destinations support automatic publishing, some require a notification and final action in the provider app, some use a draft transfer, and others are unsupported. Provider APIs, review status, limits and permissions may change without our control.

We do not sell connected-service data, use it for behavioral advertising, or combine it with unrelated data to build advertising profiles. We use it to provide, secure, maintain and support the integration, comply with provider rules and honor deletion or revocation. Disconnecting stops future access through our authorization but does not automatically remove content already published or copies retained by the provider.

If an optional AI assistance feature is later made available, it will require a user-initiated action and a clear notice before selected text or media is sent to the identified model provider. AI assistance is not currently part of the public Services described by this Policy.

8. When and with whom we disclose information

We disclose only what is reasonably necessary for the relevant purpose:

• People and workspaces you choose: recipients, call participants, group members, workspace members and invited collaborators receive the information and content needed for the interaction.
• Connected platforms: the provider receives content, settings and identifiers when you direct ReelEaze to connect, publish, retrieve or manage activity.
• Infrastructure processors: hosting, databases, content delivery, email, SMS/phone authentication, push notification, map/place, crash/performance, security and customer-support providers process limited data under contractual or provider terms. Current technology may include self-hosted infrastructure, Firebase/Google services, Apple Push Notification service, Google Maps/Places, Google Drive when you choose backup, and official connected-platform APIs.
• Administrators: authorized GalaWise staff and, for ReelEaze, authorized workspace administrators access data only as needed for their role, support, safety, security and audit.
• Legal and safety recipients: courts, regulators, law enforcement, emergency responders or affected parties when we reasonably believe disclosure is legally required or necessary to protect rights, safety and service integrity. We review requests for authority, jurisdiction, scope and validity, and notify users unless prohibited or unsafe.
• Business transactions: advisers and a successor in a merger, financing, reorganization, sale or insolvency, subject to confidentiality and continued protection required by law.

We may publish or share aggregated or de-identified information that cannot reasonably be linked back to a person. We require recipients not to re-identify it where appropriate.

9. No sale or behavioral-advertising sharing

We do not sell personal information for money and do not share personal information for cross-context behavioral advertising as those terms are defined by applicable U.S. state privacy laws. We do not use sensitive personal information to infer characteristics about you. If these practices change, we will provide legally required notice and choices before the change applies.

10. Retention and deletion

We retain each category only for as long as reasonably necessary for the stated purpose, taking account of delivery, account status, workspace instructions, security, disputes, legal obligations, backup cycles and provider rules. Current engineering defaults include:

• Encrypted message payloads: removed from the relay after all intended recipients confirm local storage where that acknowledgement is available; otherwise undelivered ciphertext is scheduled to expire after up to 30 days.
• Temporary chat media: server-uploaded media is scheduled for removal after approximately 7 days by default. Current profile media is excluded while needed for the profile. Recipients' local copies are controlled by those recipients.
• First-party raw analytics: scheduled to expire after approximately 90 days; longer-lived rollups should be aggregated.
• Account and profile: while the account is active, then deleted or de-identified subject to the exceptions below.
• Login/security, support, safety and audit records: for the period reasonably needed to secure the Services, investigate incidents, handle a request and meet legal or claim requirements. A precise production schedule must be approved before launch and kept in our internal retention register.
• ReelEaze workspace and connected-service data: while the workspace or connection is active, until an authorized deletion, and for a limited period needed for synchronization, backup expiry, security, disputes or law.

Account deletion erases or de-identifies profile identity and credentials, removes active sessions, push routes, uploaded contacts, encryption pre-key records and live-location sessions owned by the account, and replaces the account record with a minimal tombstone needed to preserve other users' conversation integrity. Messages already delivered to other people remain in their local conversations; content published to a third party remains subject to that platform's controls. See Data Deletion.

Deletion from active systems may not immediately remove encrypted backup copies. Backups are isolated, not used for ordinary operations, and expire or are overwritten on a controlled cycle. We may retain narrowly scoped records where law, fraud prevention, security, dispute resolution or another person's rights require it; we will not use retained data for an unrelated purpose.

11. International transfers

We and our providers may process information in countries other than yours. Privacy protections and government-access rules differ by country. Where required, we use an adequacy decision, contractual protections, transfer assessments or another recognized legal mechanism, and apply supplementary technical and organizational safeguards. Contact us to request available information about the relevant safeguard.

12. Your controls and privacy rights

In-product controls let you edit profile information, manage visibility and receipts, block users, change device permissions, control notifications, disconnect channels, manage workspace membership and delete your account. Depending on law, you may also request:

• confirmation and access to personal information we hold about you;
• correction of inaccurate or incomplete information;
• deletion, de-identification or restriction of processing;
• a portable copy of information you provided;
• objection to processing based on legitimate interests or direct marketing;
• withdrawal of consent at any time, without affecting prior lawful processing;
• human review of a qualifying automated decision;
• non-discrimination for exercising a privacy right; and
• an appeal and a complaint to your local data-protection or consumer regulator.

Submit a request through Contact Us or privacy@vishu.galawise.com. Tell us the account and right involved, but do not send passwords, OTPs or tokens. We may verify identity and authority, use an authorized-agent process where required, and decline or limit a request only where law permits. We will explain any denial and appeal route.

13. Regional notices

European Economic Area and United Kingdom

You have the rights described above subject to GDPR/UK GDPR conditions. You may complain to the supervisory authority where you live, work or believe an infringement occurred. If GalaWise offers the Services to people in these regions while established elsewhere, it must appoint and identify any legally required representative or data protection officer before launch.

California and other U.S. states

Residents may have rights to know categories and specific pieces of information, correct, delete and obtain a copy, and opt out of sale, targeted advertising or qualifying profiling. We do not currently sell or share personal information for cross-context behavioral advertising. We collect the categories described in section 3 from the sources in section 4, use them for section 5, disclose them to section 8 recipients, and retain them under section 10. We do not knowingly sell or share personal information of people under 16.

India

Where India's Digital Personal Data Protection framework applies, you may request access to a summary of processing and sharing, correction, completion, updating or erasure, grievance redressal and nomination as provided by law. Consent may be withdrawn as easily as it is given, subject to prior lawful processing and necessary consequences. The legally required Data Protection Officer, consent manager and grievance contact details, if applicable to GalaWise's final classification, must be published before launch.

Other regions

Brazil, Canada, Australia and other jurisdictions may provide additional rights and complaint routes. We honor applicable mandatory rights even if this Policy does not list every local term.

14. Children and teenagers

The Services are not directed to children under 13. A higher minimum age, parental authorization, age-assurance or child-specific rule applies where required by local law. ReelEaze workspace administration and connected publishing are intended only for people able to enter a binding agreement. We do not knowingly collect a child's information in violation of law. A parent or guardian who believes a child provided information unlawfully should contact us for review and deletion.

15. Security and incidents

We use safeguards designed for the nature and risk of the information, including transport encryption, end-to-end encryption for supported communications, encrypted connected credentials, access controls, environment separation, audit records, rate limits, least privilege, secure development practices, monitoring, backups and incident response. No system, device, transmission or storage method is completely secure, and we cannot promise that unauthorized access, loss or misuse will never occur.

A security disclaimer does not remove our duties under applicable law. If we discover an incident involving personal information, we will investigate, contain and remediate it; preserve appropriate evidence; assess risk; notify regulators, affected people and connected providers when required; and communicate practical protective steps. You should keep devices and apps updated, protect device access, use available account security, review linked devices and notify us promptly of suspected compromise.

16. Legal requests and preservation

We respond only to requests we reasonably believe are valid, binding and properly scoped. We may challenge overbroad or unlawful requests, disclose only responsive data we possess and are legally required to provide, and notify the affected person unless prohibited or likely to create harm. Encryption may mean we do not possess readable message or call content. A lawful preservation order can preserve data still in our custody; it cannot create data we do not have or give us a user's private encryption keys.

17. Changes to this Policy

We may update this Policy when the Services, providers or law change. We will post the new effective date and give additional in-product, email or other prominent notice before a material change takes effect when required. We will ask for new consent if a new purpose legally requires it; silence or continued use will not substitute for consent where law requires an affirmative choice. Prior versions will be retained as required by provider rules or law.

18. Contact, complaints and unresolved launch details

Send privacy questions, requests and complaints to privacy@vishu.galawise.com or use Contact Us. Security reports should use the security route.

Required before public launch: GalaWise must publish its complete registered legal name, physical notice address, country of establishment, any registration number required by law, and the contact details of any required Data Protection Officer, EU/UK representative or India grievance official. This draft deliberately does not invent those facts.