Selah Privacy Policy.

Y7 Technology LLC ("we," "our," or "us") operates Selah, an AI companion for reading the Bible and reflecting on Scripture. This Privacy Policy explains what information we collect, how we use it, and the controls you have. Selah is designed to be private and offline-first. The app runs fully offline with no account required; the features described below apply only when you use them. This Privacy Policy complies with: • Japan's Act on the Protection of Personal Information (APPI) • European Union General Data Protection Regulation (GDPR) • California Consumer Privacy Act (CCPA) • Other applicable privacy laws worldwide

Y7 Technology LLC Representative: Yudai Sasaki Address: Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan Email: support@y7technology.com For EU users: We are the data controller responsible for your personal data. For California users: We are the business as defined under CCPA.

Selah collects as little as possible. Reading the Bible, saving verses, and tracking your reading progress all happen on your device and are not sent to us. Account Information (only if you sign in) • Selah signs you in anonymously so your history can have an identity — this does not require any personal information. • If you choose Sign in with Apple or Google, we receive the identifier (and, if you allow it, name and email) provided by that service. With Sign in with Apple you may use Apple's "Hide My Email" relay. Questions You Ask (only when you use "Ask") • The text of a question you submit is sent to our backend and to our AI providers to generate a grounded reflection (see "Third-Party Services"). • Your questions and the reflections you receive are saved to your history so you can return to them. Stored On Your Device Only • Saved verses, reading progress, reading position, and app preferences are stored locally on your device and are not transmitted to us. Payment Information • If you purchase a subscription, the transaction is processed by the store you downloaded Selah from — the Apple App Store or Google Play. We receive subscription status, not your card details. Device and Technical Data • Selah contains no crash-reporting, analytics, or attribution SDK. We do not collect device identifiers, and no diagnostic report is sent from your device. • When the app contacts our backend (only for "Ask", sign-in, or account deletion), our hosting provider records a standard server log entry — including the request time, the endpoint, and the originating IP address — as any web service does. We use these logs only to keep the service running and to prevent abuse. We do NOT collect health data, contacts, photos, precise location, or advertising identifiers, and Selah contains no third-party advertising or tracking SDKs.

Service Provision • Signing you in and syncing your Ask history across your sessions • Generating grounded, cited reflections in response to your questions • Providing and stabilizing the app Service Improvement • Investigating backend errors recorded in our server logs to improve reliability Communication • Responding to customer support inquiries Security and Legal • Preventing abuse of our backend (which incurs paid AI costs) • Complying with legal obligations and enforcing our Terms of Service Payment Processing • Managing subscription status (payments are handled by the Apple App Store or Google Play) We do not use your questions or history to target advertising, and we do not sell your personal data.

Selah quotes Bible verses verbatim from a trusted, licensed text database. The AI's reflection is generated separately and is clearly labeled as commentary. Verse text is never generated by the AI — if a reference cannot be grounded in the source text, it is dropped rather than fabricated. This is a core design commitment, not merely a privacy note.

For EU users, we process your data based on: Consent • Sign in with Apple or Google • Optional profile information you choose to provide Contract Performance • Providing the Selah service and syncing your history • Processing subscriptions Legitimate Interests • Reliability, security, and prevention of backend abuse Legal Obligation • Compliance with tax, accounting, and lawful requests

We use a small number of service providers ("sub-processors") strictly to operate Selah. They are contractually obligated to protect your data and use it only for the purposes below. • Supabase — authentication and secure database hosting for your account and Ask history. • OpenAI — the language model that composes reflections. When you use "Ask," your question text and the retrieved Bible passages are sent to OpenAI to generate the reflection. Under OpenAI's API terms, this data is not used to train their models. • Voyage AI — converts your question into a numerical representation ("embedding") to search for relevant passages. • RevenueCat — manages subscription status (only if in-app purchases are enabled). • Apple / Google — identity providers, only if you choose to sign in with them. • Apple App Store / Google Play — processes any purchases, depending on where you downloaded Selah. We do NOT sell your personal data, and we do NOT share it with advertisers. Legal Requirements We may disclose information if required by court order, law, or regulatory request, or to protect the rights, safety, and security of our users and service. Business Transfers In a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to this Privacy Policy.

Technical Safeguards • Encryption in transit (TLS/SSL) • Encryption at rest for data stored on our backend • Access controls and per-user data isolation (row-level security) Organizational Measures • Data minimization by design • Restricted access to production systems • Incident response procedures No system is 100% secure. If you sign in with a third-party account, keep those credentials safe and report suspicious activity to support@y7technology.com.

On-device data (saved verses, reading progress, preferences) remains until you delete it or uninstall the app. Account and Ask history are retained while your account is active. After account deletion, associated data is removed from our active systems within 30 days and may persist in backups for up to 90 days. Some records may be retained longer where required by law. You can request deletion of your account and associated data by contacting support@y7technology.com.

General Rights (All Users) • Access: Request a copy of your personal data • Correction: Update inaccurate information • Deletion: Request deletion ("right to be forgotten") • Data Portability: Receive your data in a machine-readable format • Objection: Object to certain processing To exercise these rights: support@y7technology.com GDPR Rights (EU Users) • Withdraw consent at any time • Restrict processing • Lodge a complaint with your local supervisory authority CCPA Rights (California Users) • Know what personal information is collected and disclosed • Say no to the sale of personal information (we do NOT sell personal data) • Request deletion • Non-discrimination for exercising privacy rights APPI Rights (Japanese Users) • Disclosure, correction, addition, or deletion • Suspension of use or of provision to third parties

Your data may be processed in countries other than your own, including Japan, the United States, and Singapore (our database region). For EU users, we rely on appropriate safeguards such as EU Standard Contractual Clauses (SCCs) and require our service providers to meet EU data protection standards.

Selah is not directed to children under 13 (or the age of majority in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact support@y7technology.com and we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes take effect 30 days after we post notice; non-material changes take effect immediately. We will notify you of significant changes via in-app notice or on our website. Your continued use after changes constitutes acceptance of the updated Privacy Policy.

For privacy-related questions, requests, or complaints: Email: support@y7technology.com Company: Y7 Technology LLC Representative: Yudai Sasaki Address: Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan Response Time • 30 days (GDPR requirement for EU users) • 45 days (CCPA requirement for California users) • Reasonable time frame for other jurisdictions