Privacy Policy

Introduction & Scope

Aika Lab ("we," "us," or "our") is the trading name of AI Player in Gothenburg, a sole proprietorship registered in Sweden (organization number 571121-3230, owned by Yuting Ma). We recognize the importance of your personal information and are committed to protecting your privacy.

This Privacy Policy ("Policy") applies to:

• Our official websites at aikalab.se and aikalab.ai (both operated by Aika Lab)
• Our mobile applications, including Sleep Tuning, Neuro Tuning, and any future applications we release
• Any associated services, APIs, and SDKs we provide

(collectively referred to as the "Services")

Please read this Policy carefully before using our Services. By accessing our Website or downloading and using our Apps, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with any part of this Policy, please discontinue use of our Services.

This Policy applies to users worldwide. For users located in the European Economic Area (EEA), the United Kingdom, and other regions where the GDPR or similar data protection laws apply (such as the UK GDPR, China's PIPL, California's CCPA, and Brazil's LGPD), we provide specific compliance measures clearly marked throughout this Policy.

Information We Collect

To provide our Services, we collect the following categories of personal information:

Data We Do Not Collect

• We do not collect precise location data for any purpose. The Bluetooth permission may technically require location access on certain Android versions; this is explained in Section 13.
• We do not collect contact lists, photo libraries, microphone audio, or camera data.
• We do not collect payment card numbers, bank account details, or any financial credentials. The current App version does not charge for any in-App functionality. For physical accessory purchases via our website store (aikalab.se/market), all payment processing is handled by Stripe.

Special Category Data: EEG and Health Information

This section describes our handling of EEG (electroencephalography) and related biosignal data, which constitute special category personal data under GDPR Article 9 and similarly elevated categories under other applicable laws.

3.1 What EEG Data We Collect

When you use our closed-loop neurostimulation products (such as MindSync Sleep, Deep Relax Sleep, Deep Quick Sleep, Deep Night Owl Sleep, and other future BCI-enabled products), we collect:

• Raw EEG signals: Electrical activity from your brain, captured by your paired BCI device (e.g., Flexolink FLEX-BM05BF), at 250 Hz sampling rate from the FP1-FP2 differential channel
• Derived sleep stage data: Algorithmic estimates of your sleep stages (Wake, N1, N2, N3, REM) computed from your EEG
• Intervention events: Timestamps and characteristics of acoustic stimuli our system delivers during your session
• Session metadata: Session start/end time, total duration, signal quality metrics, environmental noise estimates
• Adaptation Night data: A complete EDF (European Data Format) recording of your first session, used to calibrate the system to your individual EEG characteristics

3.2 How EEG Data is Identified

EEG data is associated with a system-generated User ID only. We do not link EEG data to your name, email, phone number, or any other directly identifying information at the storage level. The mapping between User ID and your account exists only in our access-controlled account database, separate from the EEG data store.

3.3 Legal Basis for EEG Processing (GDPR Article 9)

We process your EEG data on the basis of your explicit consent (GDPR Article 9(2)(a)). You provide this consent when you first pair a BCI device with our App and complete the in-App consent dialog. You may withdraw this consent at any time by:

• Disconnecting your BCI device in the App
• Disabling EEG data upload in the App's privacy settings
• Deleting your account (see Section 11)

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Upon withdrawal, we will cease collecting new EEG data; previously collected data will be handled according to the retention rules in Section 8.

3.4 Purposes of EEG Processing

We do not use your EEG data to: diagnose any medical condition; provide medical advice; make decisions that have legal or similarly significant effects about you; share with insurers, employers, or any third party for profiling purposes; or train machine learning models that could be used to identify individuals.

Purpose & Legal Basis for Processing

We process your personal information only when we have a lawful basis to do so. The legal bases vary by data type and processing purpose:

4.1 Service Delivery & Contractual Performance (GDPR Article 6(1)(b))

• Processing your registration data to create and maintain your account
• Processing payment transactions to fulfill your orders, subscriptions, and pay-per-use requests
• Establishing Bluetooth connections with your BCI devices to deliver core App functionality
• Processing in-App behavior data necessary to operate the products you have purchased or are using

4.2 Explicit Consent (GDPR Article 6(1)(a) and Article 9(2)(a))

• All processing of EEG and biosignal data (see Section 3)
• Sending marketing communications (only when you opt in)
• Using analytics cookies (where required by EU ePrivacy rules; see Section 14)

4.3 Legitimate Interests (GDPR Article 6(1)(f))

• Using technical logs and crash data to investigate bugs, monitor service stability, and improve user experience
• Conducting fraud detection on payment transactions
• Aggregating anonymized data for internal research (after the anonymization period in Section 8)

For each processing activity based on legitimate interest, we have conducted a balancing test to ensure your rights and interests are not overridden. You may object to processing based on legitimate interests at any time (see Section 10).

4.4 Legal Obligations (GDPR Article 6(1)(c))

• Retaining transaction records as required by Swedish accounting law (Bokföringslag)
• Retaining tax-relevant records as required by Skatteverket (Swedish Tax Agency)
• Complying with lawful requests from regulators, courts, or law enforcement

4.5 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal can be done through the App's privacy settings, by deleting your account, or by contacting hello@aikalab.se.

Sharing & Disclosure

We may share your data with third parties only under the following circumstances:

5.1 Service Providers

We engage authorized service providers to operate our Services. See Section 6 for the complete current list. These providers may access your personal information only to the extent necessary to perform their services and are bound by data processing agreements (DPAs) consistent with GDPR Article 28.

5.2 Legal Requirements

We may disclose your information when required by law, or in response to court orders, subpoenas, government requests, or other legal processes. We will challenge any request that we believe is overbroad or improperly issued.

5.3 Business Transactions

In the unlikely event of a merger, acquisition, asset sale, or insolvency, your personal information may be transferred as part of the transaction. We will notify you of any such transfer and ensure the receiving party maintains protections at least equivalent to those in this Policy.

5.4 With Your Specific Consent

Outside the circumstances described above, we will obtain your explicit consent before sharing your personal information with any third party.

Service Providers and Third-Party SDKs

We currently use the following service providers and third-party SDKs:

We will update this list when we add, change, or remove any service providers. The current authoritative list is available at aikalab.se/service-providers.

Physical Accessory Purchases: Physical accessories (such as compatible BCI hardware) are purchased through our website at aikalab.se/market using a separate payment processor. The Aika Lab App does not process these purchases directly; the App may link to our website for these purchases, where applicable Web payment terms apply.

Cross-Border Data Transfers

As a global service operating from Sweden (EU) with users worldwide, your personal information may be transferred to and processed on servers located outside your country or region. Specifically:

• Most service data is hosted in Google Cloud Platform's Frankfurt (EU) region
• Backup and disaster recovery data may be replicated to other GCP regions
• Google Sign-In data is processed by Google LLC in the United States
• The Flexolink SDK is provided by a Chinese entity, but as noted in Section 6, EEG data is not transmitted to Flexolink
• Stripe processes payments via Stripe Payments Europe Limited (Ireland) for EU customers, with backend infrastructure in the United States; transfers from EU to US are protected by Stripe's adherence to the EU-U.S. Data Privacy Framework

For transfers of personal data outside the European Economic Area, we rely on the following safeguards:

• EU Commission Adequacy Decisions where applicable (e.g., for transfers covered by the EU-U.S. Data Privacy Framework)
• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to providers not covered by an adequacy decision
• Supplementary measures including encryption in transit (TLS 1.2+) and at rest (AES-256), strict access controls, and contractual prohibitions on government data requests beyond what is legally required

For users in mainland China, where data is transferred outside China, we will comply with the Personal Information Protection Law (PIPL), including completing necessary security assessments or obtaining appropriate certifications when required.

You may request a copy of the safeguards we use (such as SCC text) by contacting hello@aikalab.se.

Data Retention

We retain your personal information only for as long as necessary for the purposes described in this Policy. Specific retention periods:

About Account Deletion: When you request account deletion, we delete your identifiable data within 30 days. Note that already-anonymized data cannot be deleted because it is no longer linked to you; data we are legally required to retain will be kept for the mandated period; backups will be purged on the next regular rotation cycle (typically within 90 days).

Data Security

We implement the following technical and organizational measures to protect your data:

• Encryption in transit: All data transmissions use TLS 1.2 or higher
• Encryption at rest: All stored data is encrypted using AES-256 or equivalent
• Access controls: Strict role-based access; only authorized personnel can access user data
• Audit logging: Access to personal data is logged and reviewed
• Secret management: Cryptographic keys and credentials stored in Google Cloud Secret Manager
• Pseudonymization: EEG data stored under system-generated User IDs, not directly linked to identifying account information
• Data minimization: We collect only the data necessary for stated purposes
• Regular security assessments: Ongoing security reviews and prompt vulnerability response

9.1 Incident Response

In the event of a personal data breach, we will: promptly investigate and contain the breach; notify the Swedish Data Protection Authority (Integritetsskyddsmyndigheten, IMY) within 72 hours of becoming aware of the breach, where required by GDPR Article 33; notify affected users without undue delay where the breach is likely to result in high risk to their rights, as required by GDPR Article 34; and take remedial action to prevent recurrence.

Your Rights

Under applicable data protection laws, you have the following rights:

10.1 GDPR Rights (EU/EEA Users)

10.2 Other Jurisdictions

• California (CCPA/CPRA): Right to know, delete, correct, opt out of sale/sharing (we do not sell or share for cross-context behavioral advertising), limit use of sensitive personal information, and non-discrimination for exercising rights
• United Kingdom (UK GDPR): Substantially the same rights as EU GDPR, with complaints to the ICO
• China (PIPL): Right to access, copy, correct, delete, withdraw consent, transfer, and explanation of processing rules
• Brazil (LGPD): Substantially similar rights including portability and information about sharing

Account Deletion

You can delete your account at any time through any of the following methods:

• In-App: Open the App, navigate to Settings → Account → Delete Account, and follow the confirmation prompts
• Web: Visit aikalab.se/account/delete. The page provides options to (a) log in and delete your account directly, (b) review the deletion process before logging in, or (c) submit a deletion request even if you do not have an account
• Email: Send an email to hello@aikalab.se with the subject "DELETE ACCOUNT" from your registered email address

11.1 What Happens After Deletion

11.2 Effect on Pending Physical Accessory Orders

Payments and Physical Accessory Sales

12.1 Current App Version Is Free

The current version of Sleep Tuning and our other Apps are completely free to use. There are no subscriptions, no pay-per-use charges, no in-App purchases, and no advertisements. All product features, sessions, and associated reports are available to you at no cost.

If we introduce paid features or subscriptions in future versions, we will update this Privacy Policy in advance, clearly communicate the changes, and obtain your renewed consent for any new data processing activities related to payments.

12.2 Physical Accessory Sales via Our Website

Physical accessories (such as compatible BCI hardware) are sold separately through our website store at aikalab.se/market. These sales are governed by our Terms of Sale displayed on the website.

When you purchase a physical accessory:

• Payment is processed by Stripe, our website payment provider
• Stripe processes your payment card and billing information directly; we never see or store your card numbers, bank account details, or other financial credentials
• We receive only transaction confirmation data (transaction ID, product purchased, amount, timestamp, and your shipping address)
• Stripe's own privacy policy applies to your payment transaction; see stripe.com/privacy

12.3 Data We Process for Physical Accessory Sales

For each physical accessory order, we process: shipping address, email address (for order confirmation and shipping updates), transaction confirmation from Stripe, order status and fulfillment records, and refund records (if applicable). This data is retained per Section 8 (7 years for transaction records, per Swedish accounting law).

12.4 Refunds for Physical Accessories

Refund policy for physical accessory purchases is governed by our Terms of Sale on the website. Under EU consumer protection law, you typically have a 14-day right of withdrawal for physical goods purchased at distance, subject to the product being in original condition.

Bluetooth and Location Permissions

To connect to compatible BCI devices (such as Flexolink FLEX-BM05BF), our Apps require Bluetooth permissions. On certain Android versions (particularly Android 11 and below), Android's permission system technically requires location permission to perform Bluetooth scanning, even when location data is not actually used.

On Android 12 and above, where the operating system provides separate BLUETOOTH_SCAN and BLUETOOTH_CONNECT permissions, our Apps use these dedicated permissions and do not request location access.

You may revoke any permission at any time through your device's settings. Revoking Bluetooth permission will disable BCI-dependent features but will not affect open-loop products that do not require a BCI device.

Cookies & Tracking Technologies

Our Website uses cookies and similar tracking technologies (e.g., pixel tags, web beacons, local storage) to enhance user experience and analyze service usage. Our mobile Apps use device identifiers and local storage in a similar manner.

14.1 Cookie Categories

Essential Cookies: Required for basic functionality (authentication, security). These cannot be disabled.

Functional Cookies: Remember your preferences for a personalized experience.

Analytics Cookies: Help us understand how users interact with our Services. These are loaded only with your consent (where required by EU ePrivacy rules).

Marketing Cookies: We currently do not use marketing cookies. If we add any in the future, they will be loaded only with your consent.

14.2 Cookie Management

You can manage or delete cookies through your browser settings. For users in the EU/EEA, we provide a cookie consent management tool on first visit, allowing you to accept or reject non-essential cookies.

14.3 In-App Tracking

Our mobile Apps do not use advertising identifiers for cross-app tracking. The Android Advertising ID may be collected as part of device information but is used solely for crash analytics and not for advertising purposes.

Children's Privacy

Our Services are intended for users aged 18 and above. The Sleep Tuning App and other BCI-enabled products involve acoustic neuromodulation that has not been validated for use by minors and may interact with developing nervous systems in ways we have not characterized. For this reason:

• We do not direct our Services to children under 18
• We require users to confirm they are 18 or older during account registration
• We do not knowingly collect personal information from children under 13 (COPPA compliance)
• We do not knowingly collect personal information from children under 16 in the EU/EEA without verifiable parental consent (GDPR Article 8)
• Our age threshold of 18 applies regardless of jurisdictional minimums; this is a product safety decision, not just a legal one

If we discover that we have collected information from a child below our age threshold, we will delete such information promptly. Parents or guardians who believe their child has provided information to us should contact hello@aikalab.se for immediate removal.

Automated Decision-Making

We do not engage in automated decision-making within the meaning of GDPR Article 22 — that is, decisions made solely by automated means that produce legal effects or similarly significant effects about you.

Our Services use algorithmic processing (such as real-time sleep stage detection by the Sleep Tuning Stage Detector) to deliver core functionality. These algorithmic determinations are used solely for service delivery (selecting which acoustic stimulation to deliver at a given moment) and do not produce legal effects, employment decisions, financial decisions, or similarly significant decisions about you.

If we ever introduce features that constitute automated decision-making under Article 22, we will update this Policy and provide the meaningful information about the logic involved, the significance, and the consequences as required by Article 13(2)(f).

Policy Updates

We may update this Policy from time to time to reflect changes in our Services, our data processing practices, or applicable law.

For material changes (such as new categories of data collected, new processing purposes, or new third-party recipients), we will notify you in advance via:

• Website announcement
• In-App notification or banner
• Email to your registered address (where we have one)

For changes that affect consent-based processing (including processing of EEG data under Article 9), we will seek your renewed consent. Continued use of our Services after a non-material update constitutes acceptance of the revised Policy.

We maintain a version history of this Policy. The "Effective Date" at the top of this Policy reflects the current version's effective date.

Contact Us

For all privacy-related questions, requests, or concerns:

Email: hello@aikalab.se
Subject Line: Please use "Privacy Request — [topic]" for privacy-specific inquiries

Postal Address:
Aika Lab (AI Player in Gothenburg)
Legendgatan 13
422 55 Hisings Backa
Sweden

We will respond to your request as soon as possible, and no later than 30 calendar days from receipt as required by GDPR Article 12.

18.1 Supervisory Authority

If you are in the EU/EEA and believe we have not addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority. For Swedish residents, this is:

Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm, Sweden
Phone: +46 8 657 61 00
Web: www.imy.se