Privacy Notice
In this document
- 1. Scope and responsible organisation
- 2. The local and online boundary
- 3. Information kept on your device
- 4. Personalisation and assistant memory
- 5. Online models, web search and research
- 6. Microphone, dictation and realtime voice
- 7. Images, video, files and Photos
- 8. Device permissions and iPhone actions
- 9. HealthKit and sensitive information
- 10. Connectors, authorisation and external actions
- 11. Google account data, where available
- 12. Authorisation service and security records
- 13. Downloads, websites, support and store services
- 14. Purposes and lawful bases
- 15. Recipients and permitted disclosures
- 16. International processing
- 17. Retention and deletion
- 18. Your controls and security
- 19. Requests, verification and complaints
- 20. Regional rights
- 21. Children, automated decisions and tracking
- 22. Changes and how to contact us
1. Scope and responsible organisation
This Privacy Notice explains how ESOTECH LTD handles personal information in the Pumli app, its related websites and its optional authorisation service. Contact [email protected] for privacy questions or requests. We determine the purposes and means of processing under our control. Independent AI providers, model hosts, app stores and services you connect have their own responsibilities and privacy notices; we do not control their separate processing. There is no general Pumli cloud account or cloud conversation-sync service in the current app. Availability differs by release: Google-account, Outlook, Facebook and WhatsApp Business connectors are hidden in Pumli 3.0 production. The connected-account sections below also describe separately available development and authorisation flows.
2. The local and online boundary
When you use a downloaded local model without an online feature, inference takes place on your device and Pumli does not send that conversation to our server for generation. “Local” does not mean that every optional feature is offline. Selecting an online model, remote MCP tool, connected search, realtime voice or cloud media generation transmits information needed for that task to the chosen destination. A locally running model can initiate such a request through a connector you enabled. Consider the selected tool and provider before submitting confidential or sensitive information.
3. Information kept on your device
App storage can contain conversations and titles, assistant names and instructions, saved memories, downloaded models and download state, tool preferences and approvals, generated or imported files and temporary recordings. API keys entered for online model or media providers are currently saved in app storage; remote MCP credentials and supported account tokens use iOS SecureStore. Device protection applies, but general app storage is not a separate encrypted credential vault. Operating-system backups may include eligible app data according to your device and backup settings. Keychain entries or backups may survive app removal; remove credentials in Pumli and revoke them with the provider if you want to end access.
4. Personalisation and assistant memory
If enabled, memory stores information you ask the assistant to remember and supported preferences extracted through the app’s memory feature. It is held locally and can influence later responses. You can review, correct or delete memories and turn the feature off in settings. Memory and custom instructions can be included in the context of an online request when relevant to the feature you choose. They are not a separate Pumli advertising profile. Avoid storing passwords, financial credentials or sensitive information about others as assistant memory.
5. Online models, web search and research
For an online request, the selected provider may receive your prompt, relevant conversation context, instructions, selected files or images, search query, tool arguments and necessary tool results. Research can make several successive requests and use results from earlier steps; it therefore may contact more than one service. Google Search grounding uses Gemini where selected and is separate from Google-account connectors. Remote services also receive ordinary network information, such as your IP address and request time. Their own retention, safety monitoring, model-improvement options and international processing rules may apply. We do not represent that every provider offers zero retention or excludes training.
6. Microphone, dictation and realtime voice
Microphone access is requested for voice features. Local dictation uses a downloaded speech model on your device. Optional realtime voice currently sends live microphone audio and conversation context directly to OpenAI while the session is active and receives generated audio and text. Stop or close the session to end Pumli’s active capture; requests already transmitted remain subject to the provider’s handling. Recordings or transcription files may remain in app caches or conversation storage. Pumli does not use voice recordings to identify you through a voiceprint or for advertising. Your provider’s audio-processing policy applies separately.
7. Images, video, files and Photos
Camera, file and photo-selection features use content you deliberately capture or choose. Image generation sends prompts and selected references to the chosen image provider, including Gemini where selected. Video generation sends prompts and selected reference media to Seedance through your chosen Volcano Ark or BytePlus endpoint. Providers may retain inputs and outputs or review them under their policies. Generated files may be downloaded into app storage. Saving an image or video to Photos or sharing it requires your action and applicable system permission. Do not submit another person’s image, voice or private document without appropriate authority.
8. Device permissions and iPhone actions
Optional phone actions are off until enabled. Depending on the feature, iOS may request microphone, camera, Photos, speech recognition, local-network, location, calendar, reminder, contact or HealthKit permissions. Location is requested while using the feature, not for continuous background tracking. Contact lookup returns matching records; calendar and reminder actions use the access and supported operations you authorise. Phone, Messages, Mail, Maps and external-app actions hand selected details to the relevant app. iOS may present a further confirmation. You can disable a connector in Pumli and review or revoke system permissions in iOS Settings; these are separate controls.
9. HealthKit and sensitive information
The iPhone Health and Apple Fitness actions request read access to step counts or recent workout records for the requested on-device feature. They do not write HealthKit data, run background health collection or use health data for advertising, data brokerage or marketing profiles. The released health tools are designed to present their results locally rather than send HealthKit records to an online model or remote connector. If you manually copy health or other sensitive information into an online prompt or share it outside Pumli, that separate action sends it to your chosen destination. Location, contacts, mail and calendar data can also be sensitive; enable only the features you need and review information before sharing.
10. Connectors, authorisation and external actions
You choose which services to connect and which permissions to grant. A connector can receive the tool request and data necessary for its operation and return records or generated results to the app. Depending on its capabilities, it may read, create, change or delete data. Results can enter the assistant’s conversation context and, for a later online request, be sent to the selected provider. Approval settings, including Always allow, control repeated in-app confirmations but do not replace operating-system or provider authorisation. Removing a connection stops future use through that saved connection; it does not erase actions or provider copies already created.
11. Google account data, where available
Personal Google-account connections request the scopes relevant to the Gmail, Calendar, Drive, Docs, Sheets, Slides or Contacts feature you choose. A paid Workspace account is not required. Account API calls travel directly from your phone to Google; our authorisation broker does not proxy your emails, documents, events or contacts. Editing requires the corresponding granted scope. Drive editing is limited to files created by or separately authorised to Pumli, rather than Drive-wide write access. The available Calendar editing actions concern events on calendars you own and do not provide calendar deletion, sharing or guest-invitation tools. Gmail sending requires the editable review screen and your explicit Send action; Cancel does not send. The review identifies the connected sending account. Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including Limited Use requirements. We do not sell Google user data, use it for advertising or use it to train general AI models. Access is preceded by the applicable disclosure and consent and can be revoked in Pumli or your Google Account.
12. Authorisation service and security records
When Pumli-managed Google sign-in is used, our AWS service in the United States briefly processes authorisation codes and access or refresh tokens to complete, renew or revoke the connection. These credentials are not persisted in its database or application logs. Supported tokens saved by Pumli remain in SecureStore on your phone. Pumli’s own OAuth application secret is kept separately in AWS Secrets Manager. To resist forged or replayed sign-ins, the service temporarily stores random transaction identifiers, state and code hashes, a PKCE challenge, an app nonce, requested scopes, status and expiry. These technical records are not anonymous merely because they lack a name. They expire after five minutes and are deleted on a valid exchange; unused records enter automatic database deletion, which may take several days. Minimal security-event logs contain a request identifier, fixed endpoint name, response status, duration and time, with configured retention up to 365 days; routine diagnostics have a 14-day retention. They exclude passwords, tokens, codes, query strings, bodies, email addresses, conversation content and precise location. Expired log deletion normally takes up to 72 hours and can occasionally take longer. These records are used for security and investigation, not advertising or model training, and are reviewed for continued necessity.
13. Downloads, websites, support and store services
Model downloads contact hosts such as Hugging Face or ModelScope, which receive your network address and requested file. Opening a link contacts its destination. Our public website and authorisation endpoint are delivered through hosting, DNS and security providers, which process connection information needed to serve and protect them. We do not add advertising pixels or cross-site behavioural tracking to these public pages. If you email support, we receive your email address, message and attachments; send only information needed for the issue and redact credentials or unrelated private content. Apple independently handles App Store transactions, store analytics and system diagnostics according to its policies and your device choices.
14. Purposes and lawful bases
Where a legal basis is required, processing necessary to provide requested app features and respond to service enquiries relies on performance of our contract with you or steps you request before a contract. Optional permissions, connected-account access and optional online processing rely on consent where required; a system permission alone does not replace any additional legal consent required for sensitive data. Where applicable, explicit consent is required before processing special-category health information. Minimal fraud-prevention, authorisation-security and incident records rely on our legitimate interests in protecting the service, subject to necessity, proportionality and balancing against your rights. Legal recordkeeping or responding to binding lawful requests may rely on legal obligations. We do not treat agreeing to the Terms as consent to unrelated processing.
15. Recipients and permitted disclosures
Information is disclosed to the provider or app you select for a task and, where necessary, processors supporting our hosting, security and support operations. Our authorisation service uses AWS; the public domain uses Cloudflare services. Providers may act as independent controllers for their own account, billing or safety purposes. We may disclose information we actually hold where lawfully required, to protect legal rights or investigate security incidents, subject to applicable safeguards. We do not maintain a central copy of your local conversation history to disclose. We do not sell personal information, rent mailing lists or share information for cross-context behavioural advertising. A business transfer, if one occurs, would require appropriate notice and applicable legal protections.
16. International processing
A service you choose may process data outside your country. The selected endpoint, account region and provider policy affect that location; online generation may use United States or other international infrastructure, and the selected Seedance service can involve mainland China or international endpoints. Our authorisation service is hosted on AWS in the United States. Where we are responsible for a restricted international transfer, we must use the mechanism required by applicable law, such as an applicable adequacy decision or approved contractual safeguards and supplementary measures where necessary. AWS processing is subject to its applicable data-processing terms; a public policy is not by itself proof that every transfer mechanism applies to every circumstance. Contact us for information about the safeguards relevant to processing under our control. Independent providers explain their own transfers in their notices.
17. Retention and deletion
Local conversations, memories, models and generated files generally remain until you delete them or applicable device cleanup occurs. Caches and incomplete downloads may have different lifetimes. Backups and Keychain data follow device settings and may persist separately. The authorisation and log retention periods are in section 12; a one-year maximum for minimal security logs does not mean user tokens or conversations are stored for one year on our server. Support correspondence is retained only as reasonably needed to resolve the request, handle follow-up, establish legal claims or meet a legal duty, and reviewed for deletion when no longer needed. A necessary legal hold can extend retention for the specific records concerned. Independent providers’ copies follow their own retention rules and deletion processes.
18. Your controls and security
You can delete chats, models and memories; change custom instructions; remove saved keys; disconnect supported services; disable tools; and revoke iOS or provider permissions. Deleting a local chat does not delete an email, Notion page or other external item created by a tool. Revoking access does not necessarily delete copies already held by a provider. Use provider controls where appropriate. We apply proportionate access controls, protected transport and data-minimisation measures to processing under our control. General app storage, account compromise, device backups and independent services still create risks. No security method is absolute. If a personal-data breach under our responsibility meets a notification threshold, we will notify the relevant authority and affected people as required by law.
19. Requests, verification and complaints
Depending on the applicable law, you may request access, correction, deletion, portability, restriction, withdrawal of consent or objection to relevant processing. Contact [email protected] and describe the information and right involved; do not send passwords or full identity documents unless a proportionate, secure verification step is specifically necessary. We may need limited information to verify identity or authority, respond within the applicable statutory period and explain lawful exceptions or extensions. We cannot retrieve data held only on your device or promise deletion from an independent provider; we will explain the appropriate controls or destination. You may complain to your competent data-protection authority without first obtaining our permission.
20. Regional rights
Where EEA or UK data-protection law applies, rights include access, rectification, erasure, restriction, portability, withdrawal of consent and objection, including objection to processing based on legitimate interests; you may complain to your local supervisory authority or the UK ICO. Where California law applies to us and your information, rights can include knowing/accessing, correcting and deleting covered information, limiting certain sensitive-information uses, opting out of sale or sharing and requesting review through an authorised agent. We do not sell information or share it for cross-context behavioural advertising and do not penalise a lawful privacy request. Other US state laws may provide an appeal right. Where Australian privacy law applies, you may seek access and correction and complain to us or the OAIC. Other jurisdictions may provide comparable or additional rights, including rules for sensitive data and overseas transfers. These descriptions do not reduce any mandatory protection or assert that every regional statute applies in every case.
21. Children, automated decisions and tracking
Pumli is not directed to children under 13, and independent use requires the eligibility described in the Terms. We do not knowingly seek children’s personal information for our server services; contact us if you believe it was improperly provided. Pumli generates responses and may execute tools under your instructions; we do not use it to make solely automated decisions on our own behalf about your eligibility for credit, employment, insurance or comparable legal benefits. We do not use app data for targeted advertising or cross-app tracking. Provider cookies and processing on external authorisation pages are governed by their separate notices and choices.
22. Changes and how to contact us
The current notice is available in the app and at https://www.pumilai.com/privacy; Terms of Use are at https://www.pumilai.com/terms. We will update the date when this notice changes, explain material changes and obtain a new consent where required before introducing materially different processing. A new feature does not automatically authorise access to an unconnected account. For privacy enquiries, requests or complaints contact ESOTECH LTD at [email protected]. Please identify Pumli in the subject so the request can be routed correctly.