Wildial Privacy Policy

1. Who we are

Wildial Ltd (“Wildial”, “we”, “us”, “our”) operates the Wildial application and related services (the “Service”).

We are the data controller for the personal data processed through the Service. This means we decide why and how your personal data is used.

Wildial is designed to help people build closer emotional connections with nature by recording and reflecting on everyday nature encounters.

2. Scope of this policy

This policy explains what data we collect, how we use it, who we share it with, and the choices and rights available to you.

It applies to the Wildial app, related websites, support communications, and any associated features or services that link to or refer to this policy.

3. Age restriction

The Service is intended for individuals aged 18 and over.

We do not knowingly collect personal data from children under 18. Because the Service is self-directed and may not include formal age verification at all times, you must not use the Service or submit personal data if you are under 18.

If we become aware that we have collected personal data from a child under 18, we will take steps to delete it.

4. The types of data we process

We process different types of data depending on how you use the Service. For clarity, we distinguish between personal data, user content, and derived or technical data.

Personal data that can identify you

• Email address
• Account and authentication identifiers
• Contact details you provide when contacting support
• Billing or transaction-related data where relevant to paid features

User content you choose to provide

• Photos and other images
• Free-text notes and reflections
• Voice notes or recordings
• Emotional response information, tags, or scores
• Information about nature encounters, observations, and associated context
• Location information where you choose to enable or provide it

Derived and system-generated data

• Timestamps and usage history linked to entries or interactions
• AI-generated insights, classifications, summaries, and suggested labels
• Emotion mapping outputs, visualisation data, and composite indicators
• Pseudonymous identifiers such as entry IDs, row IDs, and internal references
• Technical, device, session, and security information required to operate, protect, and improve the Service

Important note

Some user content may contain personal data because of what a user chooses to upload or describe. The Service is not intended for the collection of health or medical information or other special category data. Please do not include sensitive health, medical, or similarly intimate information unless you are comfortable doing so. If you choose to include such material, we will process it only as part of providing the Service and protecting the platform, subject to applicable law.

5. What we mean by “personal data” and other data you may share

“Personal data” means information that relates to an identified or identifiable person. For example, your email address or account identifier is personal data because it can be linked to you.

Other information you share in Wildial may not directly identify you on its own, but can still be personal data depending on the context. For example:

• a photo may contain identifiable details;
• a voice note may reveal your identity;
• a note or reflection may mention other people or personal circumstances; and
• a location may become identifying when combined with time or other context.

When this policy refers to “user content”, we mean the material you choose to upload, record, write, or generate within the Service. Some user content will be personal data and some may not be. We treat user content carefully because even reflective or nature-related content can become personal depending on what you include.

6. How we use your data

We use data processed through the Service to:

• create and manage user accounts;
• store, organise, and display nature encounters, reflections, and related content;
• generate insights, emotional mappings, classifications, and other outputs within the Service;
• allow users to review and refine selected AI-generated outputs and incorporate those refinements into subsequent user experiences within the Service;
• support nature identification and contextual understanding;
• personalise the user experience and help users notice patterns in their own encounters;
• operate, maintain, troubleshoot, secure, and improve the Service;
• communicate with users about service-related matters, updates, or support requests;
• measure the delivery of service communications and understand engagement with emails, including whether emails are opened and links are clicked, in order to improve communications and the Service;
• analyse service performance, engagement, and feature usage and reliability, to improve and develop the Service;
• create aggregated and de-identified datasets for product development, research, reporting, and communication; and
• develop partner-facing insights about the emotional value of nature in spaces, products, or services, using aggregated and de-identified outputs rather than identifiable individual-level data.

7. AI-native service and AI-powered processing

Wildial is an AI-native service. AI is part of how the Service works, rather than an optional add-on.

We use AI and machine-learning-supported services to help analyse and interpret user content and contextual information. This may include:

• generating reflections, summaries, and prompts;
• producing emotional mappings, labels, or other interpretive outputs;
• identifying plants or related natural elements from images or contextual signals; and
• supporting visualisations, pattern detection, and user feedback.

When using AI services, we aim to minimise the data shared externally. Where possible, we avoid sending direct identifiers such as email addresses and instead use pseudonymous or minimised request data. However, the content you ask the Service to analyse may itself contain personal data depending on what you provide.

We do not use AI for solely automated decision-making that produces legal effects or similarly significant effects on you.

AI-generated outputs are intended to support reflection, learning and exploration of nature experiences. They are interpretive in nature and should not be regarded as psychological assessments, medical advice, diagnoses, or statements of objective fact.

7.1 User refinement of AI-generated outputs

Some AI-generated outputs within the Service can be reviewed and refined by users. Where you choose to modify available AI-generated outputs, we may retain both the original AI-generated output and your refined version as part of your experience record.

In most user-facing features and subsequent analyses within the Service, user-provided refinements generally take precedence over the original AI-generated output. This reflects our intention that your own interpretation and experience remain central to how Wildial represents your encounters.

8. Data analytics, aggregated insights, research, and partner reporting

Wildial analyses data at different levels to support both the individual user experience and our wider mission of evidencing the emotional value of nature.

Individual user insights

We process user content and related data to generate personal reflections, emotional mappings, summaries, visualisations, and other in-app insights for that user.

Aggregated and de-identified analysis

We may combine data across many users to understand broader patterns, such as how people respond to certain types of places, species, landscapes, products, or experiences. These analyses are used to improve the Service, inform product development, and support feature design.

Research, reports, and publications

We may use aggregated and de-identified data for research and development, public reports, thought leadership, funding materials, or academic and non-academic publications that communicate the emotional value of nature or related behavioural patterns.

Partner and B2B insights

We may provide aggregated and de-identified insights to organisations such as hospitality providers, land managers, real estate stakeholders, travel businesses, cultural organisations, or other partners seeking to understand and improve the emotional value associated with their spaces, products, or services.

Our intention is that partner-facing outputs do not include directly identifiable personal data or raw user content in identifiable form. We also take steps designed to reduce the risk that individuals could be re-identified from aggregated or place-based outputs. We do not sell identifiable personal data, uploaded user content, AI-generated experience records or identifiable emotional records to third parties. Partner-facing outputs are intended to be based on aggregated and de-identified information rather than information that identifies individual users.

9. Lawful bases

We rely on the following lawful bases under UK data protection law:

Contract

We process data where necessary to provide the Service you request, including account management, storage of entries and reflections, core AI-native functionality, user-facing insights, customer support, and related operational processing.

Legitimate interests

We process data where necessary for our legitimate interests in securing and improving the Service, preventing misuse, understanding how the Service is used, developing new features, carrying out aggregated and de-identified analytics, supporting partner insight products, and conducting research and communications about the emotional value of nature, provided those interests are not overridden by your rights and interests.

Consent

We rely on consent where required by law, for example for certain optional device permissions such as precise location access, microphone access, or similar permissions on your device. Where consent is the basis, you can withdraw it through your device or app settings, although this may affect feature availability.

Legal obligation

We may process data where necessary to comply with legal or regulatory obligations.

10. Data minimisation and separation of identity from experience data

We aim to minimise the use of direct identifiers and to separate identity data from reflective or experiential content wherever reasonably possible.

This may include:

• using internal identifiers rather than direct identifiers in operational workflows;
• limiting the data sent to external providers;
• separating account-level data from analytical datasets where practicable; and
• preferring aggregated or de-identified reporting for research and partner use.

These measures are intended to reduce privacy risk, but no de-identification method can guarantee zero re-identification risk in every context.

11. Data processors and third parties

We use third-party service providers to help operate the Service, for example for cloud hosting, authentication, AI-powered analysis, plant identification and email delivery. These currently include providers such as Supabase, OpenAI, Anthropic, Pl@ntNet and Resend.

These providers process data under contractual and operational arrangements intended to support data protection compliance. Depending on the service, the provider may act as our processor or, in some cases, as an independent controller for limited purposes. Further detail may be provided in supplementary notices or updated versions of this policy.

12. International transfers

Some of our service providers may process data outside the UK. Where this happens, we seek to use appropriate safeguards required by law, such as adequacy regulations, standard contractual clauses, or the UK International Data Transfer Addendum, as applicable.

13. Cookies and similar technologies

When you use the Wildial website, we may use essential cookies or similar technologies that are necessary for the operation, security and functionality of the Service, such as maintaining your session or protecting against misuse.

If we introduce optional analytics, performance or similar technologies that require consent under applicable law, we will provide appropriate information and, where required, ask for your consent before they are used.

14. Data retention

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including providing the Service, maintaining security, meeting legal obligations, resolving disputes, and enforcing agreements.

In practice, retention periods may vary depending on the type of data:

• account and profile information is generally retained while your account is active;
• user content is retained until you delete it, request deletion, or your account is deleted, subject to backup and system lag;
• Backups are retained only for operational resilience and are overwritten or expire in accordance with our backup practices;
• support and operational records may be retained for a reasonable period to manage issues and maintain continuity;
• aggregated and de-identified datasets may be retained for longer where they no longer identify individuals and remain useful for research, reporting, or product development.

If you request deletion of your account, we will take steps to delete or anonymise associated personal data within a reasonable period, except where retention is required for legal, regulatory, fraud-prevention, dispute-resolution, or security reasons.

15. Security measures

We implement technical and organisational measures designed to protect personal data, including measures such as:

• access controls and permissions management;
• row-level or role-based controls where relevant;
• secure authentication and credential practices;
• encrypted transmission of data over HTTPS;
• logging, monitoring, and protective measures intended to detect or prevent misuse;
• separation or minimisation of identifiers where feasible; and
• administrative safeguards such as restricted access and security practices for internal accounts.

No system can be guaranteed to be completely secure, but we work to apply safeguards proportionate to the nature of the Service and the data processed.

16. Your rights

Subject to applicable law, you may have the right to:

• access your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive a copy of certain data in a portable format; and
• withdraw consent where processing relies on consent.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) if you believe your data protection rights have been infringed.

To exercise your rights, contact us at hello@wildial.com. We may need to verify your identity before acting on a request.

17. Third-party content and data about other people

You should only upload or submit content that you have the right to share. If your content includes information about another person, it is your responsibility to ensure you are permitted to share it.

Please avoid uploading material that is unnecessarily intrusive, confidential, or sensitive, especially where it relates to another person.

18. Changes to this policy

We may update this policy from time to time to reflect changes in the Service, our providers, legal requirements, or our data practices.

Where changes are material, we will take reasonable steps to notify users within the Service, by email, or through another appropriate channel.

19. Contact

If you have any questions about this policy or about how Wildial uses personal data, please contact:

Wildial Ltd

Montana Cottage, Blairlogie, Scotland

hello@wildial.com