NBSDIGITAL

Privacy Policy

Effective Date: September 28, 2026

This Privacy Policy explains how NBSDIGITAL LLC, a Delaware limited liability company (“NBSDIGITAL LLC,” “we,” “us,” or “our”), collects, receives, uses, stores, discloses, and protects information when you use our website, Android application, software, subscriptions, and related services (collectively, the “Services”).

This Privacy Policy should be read together with our Terms and Conditions, which govern your use of the Services, subscriptions, account responsibilities, intellectual property, disclaimers, limitations of liability, and termination. If applicable law gives you privacy rights that cannot be waived or limited by contract, nothing in these documents is intended to remove or restrict those rights.

By using the Services, you acknowledge the privacy practices described in this Privacy Policy. Where applicable law requires your consent or another legal basis for particular processing activities, we will obtain or rely on the legally required basis.

1. Information We Collect or Receive

We seek to collect and process only information that is reasonably necessary to provide, secure, maintain, support, and improve the Services and to comply with applicable legal obligations.

The information we process may vary depending on how you use the Services, which features you use, whether you create an account, and whether you purchase a subscription through Google Play.

1.1 Account Information

When you create or use an account, we may collect or receive:

• your account user name or other account identifier (this is a name you choose for the account or workstation, such as “User1” or “Counter1” — we do not require your legal name);
• a display name you choose for an account, which is shown in the application and on documents it produces. You may use a personal name here if you wish, but you are not required to;
• your email address;
• authentication credentials or authentication-related information;
• information you provide when contacting customer support; and
• other information reasonably necessary to create, authenticate, maintain, or secure your account.

Your email address may be used for account recovery, authentication, important service communications, subscription-related communications, and customer support.

We do not require information that is not reasonably necessary for the relevant account or Service functionality.

1.2 Information You Enter into the Services

Depending on the functionality of the Services, you may enter information, records, documents, or other content into the application.

We process this information primarily to:

• provide the requested Service;
• store and synchronize your information;
• make the information available to you;
• provide customer support;
• maintain and secure the Services;
• prevent unauthorized access or misuse; and
• comply with applicable legal obligations.

You remain responsible for the accuracy and appropriateness of information that you enter into the Services and for maintaining appropriate copies of information that you are required to retain.

1.3 IP Address and Technical Information

When you access our website or Services, our hosting, application, security, and server infrastructure may automatically receive and record technical information, which may include:

• IP address;
• date and time of access;
• request information;
• application or website activity necessary to operate the Services;
• browser or application information;
• operating-system information;
• device-related technical information;
• error and diagnostic information; and
• security-related information.

We may use this information for security and authentication, fraud and abuse prevention, detecting unauthorized access, maintaining and troubleshooting the Services, diagnosing technical failures, monitoring system reliability, protecting our systems and users, and complying with applicable legal obligations.

Our servers and supporting infrastructure are operated by third-party hosting, network, and security providers. Section 9 describes where information may be processed, and Section 4 describes the categories of provider we use.

1.4 Device-Related Information

Our Android application may process certain device-related information or identifiers that are reasonably necessary for:

• authentication and account security;
• fraud and abuse prevention and protection against unauthorized use;
• maintaining application functionality;
• diagnosing technical problems; and
• maintaining the security and reliability of the Services.

The exact information processed depends on the technical implementation of the application and the Android services or libraries used by the application. We do not intentionally collect unnecessary device information.

Where a particular Android identifier is resettable, limited, or subject to platform restrictions, we will use it consistently with applicable Android and Google Play requirements.

1.5 Biometric Unlock

Our Android application may offer the option to unlock it with a fingerprint or other biometric method registered on your device. This is an optional convenience and an alternative to entering your password; it is not required in order to use the Services.

Where you enable it, the biometric check is performed entirely by Android on your own device, using the biometric system built into the device. Your fingerprint or other biometric data is held by the device and is never transmitted to us, and we neither receive, process, nor store it. The application is told only whether a check succeeded or failed.

You can turn biometric unlock off in the application at any time, and you can remove the registered biometric itself in your device settings.

2. How We Use Information

We may process information for the following purposes:

• creating and maintaining accounts and authenticating users;
• providing the Services and storing and synchronizing user-provided information;
• managing subscriptions: verifying Google Play purchases, determining subscription entitlement, processing subscription lifecycle events, restoring subscription access, and preventing unauthorized use of subscriptions;
• detecting and preventing fraud and abuse;
• responding to customer support requests and recovering accounts;
• communicating important information about the Services;
• diagnosing technical problems and monitoring and maintaining infrastructure;
• protecting the security and integrity of the Services and improving reliability and functionality;
• enforcing our Terms and Conditions;
• complying with legal obligations and responding to lawful requests;
• establishing, exercising, or defending legal claims; and
• protecting our rights, property, users, and Services.

We do not sell your personal information, and we do not use personal information — including information you enter into the Services, device identifiers, or cookies — for targeted advertising, behavioral profiling, or cross-context behavioral advertising. If our practices ever change, we will update this Privacy Policy and obtain any consent required by applicable law before doing so.

3. Legal Bases for Processing

Where applicable law, including the European Union General Data Protection Regulation (“GDPR”) and the UK GDPR, requires a legal basis for processing personal information, we rely on one or more of the following.

3.1 Performance of a Contract

We process information where necessary to perform our contract with you: creating and maintaining your account, authenticating you, providing the Services and features you request, managing your subscription and verifying purchases, and providing customer support.

3.2 Legitimate Interests

Where permitted by applicable law, we process information where reasonably necessary for our legitimate interests: securing the Services and protecting accounts, preventing fraud and abuse, maintaining and improving infrastructure and reliability, keeping accurate subscription records, and establishing, exercising, or defending legal claims.

Where we rely on legitimate interests, we consider applicable legal requirements and the rights and interests of affected individuals.

3.3 Legal Obligations

We process information where necessary to comply with applicable laws, regulations, court orders, governmental requests, tax requirements, accounting requirements, or other legal obligations.

3.4 Consent

Where applicable law requires consent for a particular processing activity, we will request consent. Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that was lawfully carried out before withdrawal.

4. How We Share Information

We may disclose or make available limited information to third parties where reasonably necessary to provide, secure, maintain, or support the Services. These parties may include:

Hosting and infrastructure providers — providers of hosting, databases, server and network infrastructure, backups, security, monitoring, email or communications services, analytics (if implemented), and other technical operations.

Google and Google Play — to distribute the application, process and verify subscriptions, manage Google Play purchases, receive subscription lifecycle notifications, determine subscription status, and provide subscription-based Services. Google may independently process information under Google’s own privacy policies and terms (see Section 5).

Authentication and security providers — where used, providers that help us authenticate users, secure accounts, detect fraud, or protect our infrastructure.

Professional advisers — lawyers, accountants, auditors, insurers, or other professional advisers where reasonably necessary.

Government authorities and legal recipients — where required by applicable law, lawful legal process, court order, or governmental request, or where reasonably necessary to establish, exercise, or defend legal rights.

Business transfers — if NBSDIGITAL LLC is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, information may be transferred as part of that transaction, subject to applicable law and any required notice.

We limit the information provided to service providers to what is reasonably necessary for the services they provide, and we require them to handle information in accordance with appropriate contractual, legal, and security requirements.

5. Google Play’s Independent Processing

Google Play is a separate service operated by Google.

Google may independently collect, use, store, and process information in connection with your Google account, your device, Google Play, payment methods, subscriptions, purchases, application installations, application usage, and other Google services.

NBSDIGITAL LLC does not control Google’s independent processing activities. Google’s processing is governed by Google’s own privacy policies, terms, and applicable legal obligations. You should review Google’s current privacy documentation for information about how Google handles information within its services.

6. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention periods may depend on the type of information, the purpose for which it was collected, whether your account remains active, whether you maintain a subscription, security and fraud-prevention requirements, customer support, dispute resolution, legal obligations, accounting or tax requirements, enforcement of agreements, backup systems, and other legitimate business requirements.

After a subscription ends, we keep your account data for at least 90 days, so that you may resubscribe or export it, as described in our Terms and Conditions. We then delete it in our next scheduled deletion run, which we carry out at least once a month. In practice this means your data is deleted between three and four months after the subscription ends. If you delete your account yourself, we do not wait 90 days: we keep your data for at least three weeks and then delete it in our next scheduled deletion run, as described in Section 7.

Subscription and transaction records may need to be retained for longer than ordinary account information because they may be necessary to verify past purchases, resolve billing disputes, investigate fraud, maintain accounting records, respond to legal claims, comply with legal obligations, and establish the history of subscription entitlements.

When information is no longer reasonably required, we will delete, anonymize, or otherwise dispose of it in accordance with applicable law and our operational requirements. Information may remain temporarily in backups or security systems after deletion from active systems.

7. Account Deletion

You may request deletion of your NBSDIGITAL LLC account and associated personal information.

Account deletion request: https://www.nbsdigital.com/privacy-request

You can also delete your account from inside our Android application, under Settings > Delete account. The account owner confirms with their password, and the company's records are then closed to sign-in at once. We keep them for at least three weeks, so that an account deleted by mistake can be reopened if you ask us within that time, and then delete them in our next scheduled deletion run.

Upon receiving a valid deletion request, we will delete or anonymize associated personal information within a reasonable period, except where information may or must be retained under applicable law or is reasonably necessary for legal obligations, accounting or tax requirements, fraud prevention, security, dispute resolution, enforcement of agreements, or the establishment, exercise, or defense of legal claims.

Deleting an NBSDIGITAL LLC account does not delete your Google account, Google Play account, Google Play purchase history, or information independently maintained by Google. Google manages information held within Google’s own systems according to Google’s applicable policies and procedures.

8. Security

We use reasonable technical and organizational measures designed to protect information against unauthorized access, alteration, account takeover, disclosure, loss, misuse, or destruction.

No internet transmission, application, server, database, or electronic storage system can be guaranteed to be completely secure; while we take reasonable measures to protect information, we cannot guarantee absolute security.

9. International Data Processing

NBSDIGITAL LLC is a Delaware company in the United States. Our servers, hosting providers, infrastructure providers, and other service providers may be located in the United States or other countries.

If you access or use the Services from outside the United States, information about you may therefore be transferred to, stored in, or processed in the United States or another country.

Where applicable law requires safeguards for international transfers of personal information, we will use legally recognized transfer mechanisms or other appropriate safeguards. Depending on the circumstances and applicable law, such safeguards may include adequacy decisions, standard contractual clauses, contractual safeguards, other legally recognized transfer mechanisms, or applicable exceptions permitted by law.

10. European Economic Area and United Kingdom

If you are located in the European Economic Area (“EEA”) or the United Kingdom (“UK”), NBSDIGITAL LLC is the controller of your personal information, and you have the following rights under the GDPR or UK GDPR, subject to the conditions and exceptions set out in those laws:

• Access — to obtain confirmation of whether we process your personal information and a copy of it;
• Rectification — to have inaccurate or incomplete personal information corrected;
• Erasure — to have your personal information deleted in the circumstances provided by law;
• Restriction — to require us to limit the processing of your personal information in certain circumstances;
• Data portability — to receive the personal information you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible;
• Objection — to object to processing based on our legitimate interests, and at any time to processing for direct marketing;
• Withdrawal of consent — where processing is based on consent, to withdraw it at any time without affecting the lawfulness of processing before withdrawal;
• Automated decisions — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not make such decisions); and
• Complaint — to lodge a complaint with the supervisory authority in your EEA member state, or with the Information Commissioner’s Office (ICO) in the UK.

To exercise these rights, contact us using the details in Section 18. We may need to verify your identity before acting on a request. We will respond within one month of receipt; where a request is complex or we receive several requests, this period may be extended by two further months, in which case we will inform you.

11. California Privacy Rights

The California Consumer Privacy Act, as amended (“CCPA”), may provide certain privacy rights to California residents when the CCPA applies to NBSDIGITAL LLC.

Where applicable, California residents may have rights concerning their personal information, including rights to:

• know or access certain personal information;
• request correction of inaccurate personal information;
• request deletion of personal information, subject to statutory exceptions;
• obtain information about categories of personal information collected or disclosed and the purposes for collecting and using it;
• opt out of certain sales or sharing of personal information, where applicable; and
• exercise other rights provided by applicable California law.

NBSDIGITAL LLC does not sell personal information and does not share personal information for cross-context behavioral advertising.

To submit a privacy request, use the contact details in Section 18. We may need to verify your identity before processing a request, and we will respond to valid requests within the time required by applicable law. Certain rights are subject to statutory exceptions, limitations, and verification requirements.

12. Children’s Privacy

The Services are not intended for children under the minimum age applicable to the Services and jurisdiction without appropriate parental or guardian involvement.

We do not knowingly collect personal information from children in circumstances where such collection is prohibited by applicable law. If you believe that a child has provided personal information to us in violation of applicable requirements, please contact us; we will investigate and, where appropriate, take reasonable steps to delete the information.

13. Cookies and Similar Technologies

Our website may use cookies or similar technologies where reasonably necessary to operate the website, maintain security, remember preferences (such as your language choice), authenticate users, analyze technical performance, or provide functionality requested by the user.

Where applicable law requires consent for particular cookies or similar technologies, we will request the required consent.

If our website uses third-party analytics or similar technologies, the applicable third parties and purposes will be identified in the relevant version of this Privacy Policy or an applicable cookie notice.

14. Third-Party Links

Our website and Services may link to third-party websites or services that we do not operate. Those third parties process information under their own privacy policies and terms, which we recommend you review.

15. Your Responsibility Regarding Information You Provide

You should avoid entering unnecessary sensitive personal information into the Services unless the relevant feature specifically requires it.

You are responsible for ensuring that information you provide to the Services is lawful and that you have the necessary rights or permissions to provide it. If you use the Services to store information concerning other individuals, you should do so only where you have an appropriate legal basis and authorization to do so.

16. Data Breaches and Security Incidents

If we become aware of a security incident involving personal information, we will assess the incident and take reasonable steps to contain, investigate, remediate, and document it.

Where applicable law requires notification to affected individuals, regulators, or other authorities, we will provide such notification within the period and in the manner required by applicable law.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will post the updated Privacy Policy on our website with a revised Effective Date.

If changes are material or applicable law requires additional notice or consent, we will provide additional notice through the Services, by email, through our website, or by other legally appropriate means.

Your continued use of the Services after the Effective Date of an updated Privacy Policy constitutes acknowledgment of the updated policy to the extent permitted by applicable law.

18. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or your personal information, contact us at:

NBSDIGITAL LLC Delaware, United States

Privacy contact: privacy@nbsdigital.com

Privacy requests: https://www.nbsdigital.com/privacy-request

Website: www.nbsdigital.com