Privacy Policy

Last updated: 07 July 2026

This Privacy Policy explains how Alef Global Consulting FZ-LLC ("JOSEF," "we," "us," or "our") collects, uses, discloses, and protects personal data in connection with the JOSEF mobile application and related services (together, the "Service"). JOSEF offers dream readings generated from a corpus of dream-interpretation traditions: you describe a dream, and the Service returns an interpretation for personal reflection and entertainment purposes.

We are ALEF GLOBAL CONSULTING FZ-LLC, a Free Zone Limited Liability Company registered in Ras Al Khaimah, United Arab Emirates (Services Licence No. 47029993), with its registered address at VUET2814, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.

This Policy is written to address the requirements of the EU/EEA and UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), other applicable U.S. state privacy laws, the Brazilian General Data Protection Law ("LGPD"), and comparable data protection frameworks in other Latin American jurisdictions, as well as other data protection laws that may apply depending on where you live. Section 11 sets out your rights by region.

1. Scope of this Policy

This Policy applies to individuals who download, install, or use the JOSEF app, whether on a free basis or under a paid subscription, and to visitors of any JOSEF website that links to this Policy. It does not apply to information processed by Apple, Google, or other third parties acting as independent controllers/businesses in their own right (for example, your App Store account and payment details), which is governed by their own privacy notices.

2. Who we are

Alef Global Consulting FZ-LLC is the data controller (GDPR) / "business" (CCPA/CPRA) / "controller" (LGPD) responsible for personal data processed through the Service, except where stated otherwise in this Policy.

• General privacy inquiries: contact@myjosef.com
• Postal address: VUET2814, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
• EU representative (Article 27 GDPR): Ms. Laura Lopez, 17 rue de Ponthieu, 75008 Paris, France — email: CONTACT@ALEF-GLOBAL.COM — phone: +33 6 26 17 18 11

3. Personal data we collect

3.1 Information you provide to us

• First name or nickname – so the app can address you personally. This is chosen by you and stored locally on your device.
• Dream content – the text you type or dictate describing your dream and, if you use voice dictation, the associated audio recording (see Section 4, which addresses this content specifically).
• Preferences and settings – such as language preference and whether voice features are enabled.
• Support communications – your email address and the content of any message you send to our support team.
• Age confirmation – the date of birth or age range you confirm at sign-up, collected solely to verify that you meet the minimum age requirement to use the Service (see Section 12).
• Subscription and payment status – confirmation of your subscription tier and store-issued identifiers (see Section 3.2).

3.2 Information collected automatically

• Device and technical data – device type, operating system, app version, and language settings, required for the app to function correctly.
• Subscription/store identifiers – provided by the Apple App Store, Google Play, and our subscription-management provider, used to verify and administer your access.
• Anonymous device identifier (pseudonymous) – a random number generated by the app on your device, unrelated to your name, email address, or any advertising identifier. It is transmitted to our servers, where it is stored in hashed form and, solely to reconcile your purchases, in clear text. Its purpose is strictly functional: to enforce the quota of three free interpretations per device and to attach your purchases to that device. It is never used for advertising or tracking. It is stored in the system keychain (iOS) or derived from a system identifier (Android), so it persists if you delete your account or reinstall the app.
• Limited diagnostic data – crash logs and basic usage signals used to maintain stability and security of the Service. These logs never contain the text of your dreams or of the interpretations.

4. Your dreams: special category (sensitive) data

A dream that you describe to JOSEF may reveal highly personal information about your state of mind, beliefs, relationships, or intimate life. We treat this content with particular care:

• Purpose limitation: the text of your dream, and any voice recording, is sent to our AI service provider (OpenAI) solely to transcribe your voice (if used) and generate your interpretation. This content is not used to build an advertising profile and is never shown to any other user.
• Local-first storage: your dreams and their interpretations are stored locally, in a journal on your own device, not on our servers. You can disable this journal in Settings and delete any entry at any time. Uninstalling the app or clearing its data removes this content.
• Explicit consent required: because this content may qualify as special category data, we only transmit it to our AI provider for processing on the basis of your explicit, freely given consent, collected through an affirmative action before any such processing takes place (see Section 6).

5. How we use your information

We use personal data to:

• provide the dream-interpretation Service and respond to your requests;
• create, administer and secure your account and subscription;
• respond to support inquiries;
• maintain the security, integrity and proper functioning of the Service, and prevent fraud or abuse;
• verify that you meet the minimum age requirement to use the Service, and identify signals in dream content — for users of any age — that may indicate an imminent risk of self-harm, in order to direct you to crisis or emergency resources (see Section 12; this is not a clinical or diagnostic function and does not replace professional help);
• understand aggregate usage of the Service in order to maintain and improve it; and
• comply with our legal obligations.

We do not use your information to serve third-party advertising, and we do not sell your personal data.

6. Legal bases for processing (GDPR/UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

You may withdraw your consent to the processing described above at any time, with effect for the future, by disabling voice/journal features in Settings or by writing to contact@myjosef.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and if you withdraw consent to the transmission of dream content, the interpretation feature may no longer be available to you.

7. Automated processing and AI-generated interpretations

Interpretations are generated with the assistance of a third-party large language model. This process does not produce a decision that has a legal effect on you or similarly significantly affects you, and no interpretation should be treated as professional advice (see the Terms of Use). We do not use your dream content to make automated decisions about your eligibility for any service, benefit, or opportunity.

8. Service providers and recipients of your data

We share the minimum data necessary with a limited number of service providers who process data on our behalf, under contractual instructions and confidentiality and security obligations:

If you use a web version of the Service, voice dictation may rely on the speech-recognition functionality built into your browser, which processes audio under its own provider's policy.

We do not sell personal data to third parties, and we have not sold or shared (as "share" is defined under the CCPA/CPRA) personal data in the preceding twelve months.

9. International data transfers

We are established in the United Arab Emirates, and certain service providers, notably OpenAI, process data in the United States. Neither jurisdiction is currently subject to an adequacy decision of the European Commission.

Where we transfer personal data out of the EEA, the UK, or Switzerland to a third country, we rely on the European Commission's Standard Contractual Clauses (2021 version, with the UK International Data Transfer Addendum where applicable), supplemented, where our transfer risk assessment indicates it is necessary, by additional technical and organizational measures. A copy of the relevant safeguards is available on request at contact@myjosef.com.

For users in Brazil and other Latin American jurisdictions with cross-border transfer requirements (for example, the LGPD), we apply contractual and technical safeguards designed to provide a comparable level of protection, and we will provide further information about such transfers on request.

10. Data retention

Dream content and settings stored locally on your device remain there until you delete them or uninstall the app. Data processed by our service providers is retained only for as long as necessary for the purposes described in this Policy, and is then deleted or anonymized, unless a longer retention period is required by law (for example, accounting or tax records).

On our servers, specifically:

• The text of your dream is never stored. Only an irreversible cryptographic fingerprint (SHA-256) is kept, so that the same request can be recognized without the dream ever being reconstructed.
• The text of the interpretation returned to you is kept for a maximum of thirty (30) days, for the sole purpose of serving it again if your app requests it (for example after a network interruption) and of preventing the same credit from being charged twice. After that period, this content is automatically erased.
• Once erased, we retain only non-readable items: the dream fingerprint, counters of interpretations used, your subscription status, and the corresponding credit movements, which we must keep to meet our accounting obligations.

11. Your privacy rights by region

11.1 European Economic Area, United Kingdom and Switzerland

If the GDPR, UK GDPR, or Swiss FADP applies to you, you have the right to: access your personal data; request rectification or erasure; restrict or object to certain processing; request data portability; and withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement (for example, the CNIL in France or the ICO in the United Kingdom). We aim to respond to verified requests within one month, extendable where necessary under applicable law.

11.2 California (CCPA/CPRA)

If you are a California resident, you have the right to: know what personal information we collect, use, and disclose; request deletion; request correction of inaccurate information; limit the use and disclosure of sensitive personal information; and not be discriminated against for exercising these rights. We do not sell or "share" personal information as those terms are defined under California law. Verified requests are processed within 45 days (extendable by an additional 45 days where permitted). You may designate an authorized agent to submit a request on your behalf.

11.3 Other U.S. States

Residents of other U.S. states with comprehensive privacy laws (including, as applicable, Virginia, Colorado, Connecticut, Utah, and others) have similar rights to access, correct, delete, and obtain a copy of their personal data, and to appeal a denied request. To exercise these rights, contact us at contact@myjosef.com; we will identify and apply the framework relevant to your state of residence.

11.4 Brazil and other Latin American jurisdictions

If the Brazilian LGPD or a comparable Latin American data protection law applies to you (for example, in Mexico, Colombia, Chile, or Argentina), you generally have the right to: confirm the existence of processing; access your data; correct incomplete, inaccurate, or outdated data; request anonymization, blocking, or deletion of unnecessary or excessive data; request portability; obtain information about entities with which we have shared your data; revoke consent; and, where applicable, lodge a complaint with the competent supervisory authority (for example, the ANPD in Brazil).

11.5 Other jurisdictions

If you are located elsewhere, we will endeavor to honor requests consistent with the principles described in this Policy and any locally applicable law. Contact us at contact@myjosef.com.

Because most of your content (your dreams) is stored only on your device, you can already access, edit, and delete it directly within the app at any time.

12. Children's privacy

The Service is intended for adults and is not directed to children. We do not knowingly collect personal data from individuals under 18 years of age, nor, with respect to users in the United States, from children under 13 within the meaning of COPPA. If you believe a minor has provided us with personal data, please contact contact@myjosef.com and we will delete it.

• Age screening: at sign-up, we ask you to confirm your date of birth or age range through a neutral screening step before you can access the Service. This is not an identity check (we do not request government-issued identification), but a reasonable, proportionate measure to identify and exclude users who do not meet the minimum age requirement. If, despite this screening, content you submit suggests you may be a minor, we may limit or suspend your access and, where appropriate, delete the associated data.
• Crisis-signal detection: because dream content may occasionally reflect distress, we apply limited, automated screening for signals that may indicate an imminent risk of self-harm, in order to display crisis-line information within the app. This measure applies to all users regardless of age — it is a general safety feature of the Service, not a protection limited to minors (see also Section 5). This screening is not a clinical or diagnostic tool, may not detect every instance of distress, and does not replace professional help or emergency services (see the Terms of Use).
• AI companion chatbot laws: a growing number of jurisdictions (for example, New York and California) regulate "AI companion" chatbots designed to simulate an ongoing personal, emotional, or therapeutic relationship, with particular restrictions where minors are concerned. JOSEF is a dream-interpretation tool for personal reflection and entertainment, not a companion chatbot, and is not designed to encourage an ongoing simulated relationship. Nonetheless, in light of this evolving regulatory landscape and out of an abundance of caution, we apply comparable minor-protection safeguards described in this Section, including the 18+ age requirement, age screening, and crisis-signal detection described above.

13. Security

We implement appropriate technical and organizational measures to protect personal data and restrict access to personnel and service providers who need it to perform their functions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authorities and affected individuals in accordance with applicable law, including, where applicable, the 72-hour notification requirement under Article 33 GDPR.

15. Changes to this policy

We may update this Policy from time to time. A revised version will bear a new "Last updated" date and will take effect upon posting. Where changes are material, we will provide additional notice (for example, through the app) before they take effect. Continuing to use the Service after a revised Policy takes effect constitutes acceptance of the changes to the extent permitted by applicable law.

16. Contact us

Alef Global Consulting FZ-LLC

VUET2814, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates

Email: contact@myjosef.com