Insula LLC
a California limited liability company doing business as Imcy
California Secretary of State file no. B20260266445
4653 Carmel Mountain Rd, Ste 308 PMB 1106, San Diego, California 92130-6650, USA
support@imcy.world

PRIVACY POLICY

Privacy notice for parents and guardians who use the Imcy website and platform

Version. Draft 4 · November 7, 2026 (replaces Draft 3 of November 6, 2026; the Intro is now Imcy's Matching Service plus the Coach's free Intro Call)

Effective date. 10 November 2026. Last updated. 10 November 2026.

Related documents. 1.6 Notice at Collection; 1.10 Cookie Policy; 1.15 Data Request Form; 1.1 Client Platform Terms; each Coach's own privacy notice

CONTENTS

Article 1 Who we are

Article 2 Information we collect

Article 3 Information we do not collect

Article 4 Our roles

Article 5 Why we use your information and our legal bases

Article 6 Who we share your information with

Article 7 International transfers

Article 8 How long we keep information

Article 9 Children

Article 10 Your rights

Article 11 Security, breaches and changes

Article 12 Coaches' own privacy notices

Annex: California notice at collection: categories

Key points. Imcy holds only what it needs to run the platform: your contact details, bookings, payments and messages. Imcy holds no information about your child; your coach handles everything shared in the intro call or in or about sessions under the coach's own privacy notice. We do not sell your information or make automated decisions about you. You can ask to see, correct, delete or download your information at any time.

1. WHO WE ARE

1.1 Controller. Insula LLC, a California limited liability company (California Secretary of State file no. B20260266445), doing business as Imcy, 4653 Carmel Mountain Rd, Ste 308 PMB 1106, San Diego, California 92130-6650, USA ("Imcy", "we", "us"), is responsible for the personal information described in this Policy.

1.2 Contact. For privacy questions and requests: support@imcy.world (a business Google Workspace mailbox, monitored on business days), the Data Request Form at https://imcy.world/privacy-request, or by post to the address above.

1.3 Representatives. EU representative (GDPR article 27): none appointed. UK representative (UK GDPR article 27): none appointed.

1.4 Responsible person. We have not appointed a data protection officer, because the law does not require one. Ekaterina Shutenko, founder, is responsible for privacy at Imcy.

2. INFORMATION WE COLLECT

2.1 What we collect. We collect the following information about you, the parent or guardian:

2.2 What is required. Your name, email address and payment are needed to provide the Matching Service and to book and pay for Sessions. Everything else, including your phone number and marketing preferences, is optional.

3. INFORMATION WE DO NOT COLLECT

3.1 Nothing about your child. We do not ask for or keep your child's name, age, date of birth, school, photo, health or any other information about your child. Coaches' profiles show the age groups they work with, so you can choose without telling us.

3.2 No session content or health information. We do not receive session content, recordings, session notes, intake answers, consent forms or health information. Your coach holds these, outside every Imcy system.

3.3 Why our team never asks. Imcy's administrators and sales staff are instructed never to ask about your child, and our forms have no field for it, so that information about children stays only with the coach, who is responsible for protecting it. If you send it to us anyway, we do not use it, ask you to give it to your coach, and delete it from all our systems within 7 days.

4. OUR ROLES

4.1 Imcy as controller. Imcy is the controller of information it uses for its own purposes: the website, enquiries and leads, marketing, the Matching Service, complaints handling, and its own accounts and records.

4.2 Imcy as the Coach's processor. When Imcy books Sessions, sends reminders and takes payments for your Coach, it acts on the Coach's behalf as the Coach's processor (or "service provider"), under a data processing agreement with the Coach.

4.3 Your Coach. Your Coach is an independent controller of everything shared in or about the Intro Call and Sessions, including any information about your Child (article 12).

4.4 The Supervisor. Complaints about the professional quality or safety of Sessions are reviewed by the Supervisor, an independent qualified coach engaged by Imcy as a contractor. The Supervisor handles any information received from you or your Coach under the Supervisor's own privacy notice, as an independent controller. Imcy receives only the Supervisor's conclusion, without details about your Child.

5. WHY WE USE YOUR INFORMATION AND OUR LEGAL BASES

5.1 Purposes and legal bases. Under the GDPR and UK GDPR we rely on these legal bases:

5.2 Legitimate interests. Our legitimate interests are keeping children and families safe, running a reliable and fair Platform, resolving complaints, preventing fraud and misuse, and defending legal claims. You may object to this use (article 10.2).

5.3 Matching and automated decisions. A member of Imcy's team proposes a Coach within the rank you choose, using the parameters in the 1.7 Coach Directory disclosure. We do not make decisions with legal or similarly significant effects on you based solely on automated processing.

6. WHO WE SHARE YOUR INFORMATION WITH

6.1 Your Coach. The Coach proposed to you or chosen by you receives your name, contact details, matching preferences and booking details. The Intro Call and all Sessions run on the Coach's own video-conferencing account, which Imcy cannot access.

6.2 Service providers. These providers process information for Imcy under written contracts:

6.3 Others. The Supervisor (for a complaint about a Session); authorities where the law requires it or a child's safety demands it; professional advisers, auditors and insurers under a duty of confidentiality; and a buyer or successor of our business, which must keep using your information as this Policy describes.

6.4 No sale; no sharing unless you opt in. We do not sell your personal information. We use advertising cookies, which California law may treat as "sharing" for cross-context behavioral advertising, only if you agree in our cookie banner, and you can opt out at any time through "Cookie settings", the "Do Not Sell or Share My Personal Information" link, or a Global Privacy Control signal. We do not disclose information to third parties for their own direct marketing.

7. INTERNATIONAL TRANSFERS

7.1 Where information goes. Imcy is in the United States, and most of our service providers process information there. Coaches may be in other countries.

7.2 Safeguards. Where the GDPR, UK GDPR or Swiss law applies, transfers are covered by the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified. You may ask for a copy of the safeguards.

7.3 Transfers to your Coach. When you choose a Coach in another country, we send your details under the data protection terms in our agreement with the Coach, which include the Standard Contractual Clauses and UK Addendum, or where none applies, because the transfer is necessary for the contract you asked for (GDPR and UK GDPR article 49(1)(b)).

8. HOW LONG WE KEEP INFORMATION

8.1 Records linked to children. Some laws require longer retention of records about minors. Imcy keeps no records about any child, so no longer period applies to Imcy. Your Coach keeps any such records under the Coach's own privacy notice and the law that applies to the Coach.

8.2 Legal holds. We may keep information longer only while a legal claim, investigation or legal duty requires it. When a period ends, we delete or anonymize the information.

9. CHILDREN

9.1 A service bought by adults. Parents and guardians buy coaching for children, including children under 13 and children aged 13 to 15. Our website, forms and Platform are for adults aged 18 or over, and children may not create accounts or send us information.

9.2 COPPA statement. Imcy does not knowingly collect personal information from or about children, including children under 13 under the US Children's Online Privacy Protection Act and children under 16 under the GDPR and California law.

9.3 The Coach's records. The Intro Call and every coaching call are the Coach's own services. They take place on the Coach's own account, and everything shared in them belongs to the Coach's records, not Imcy's. The Coach tells Imcy only whether the Intro Call took place and whether you wish to book Sessions. Before any call with a child, the Coach obtains your consent on the Coach's Parent Consent and Child Assent form and, for a child under 13 or under the age of digital consent in your country, verifies it as the law requires.

9.4 Emocoach Studio. Your Coach may appear to your Child as an animated character with an altered voice. The software does not record, store or send any image, video or voice of your Child to Imcy.

9.5 Under-16 information is never sold or shared. We do not sell or share the personal information of anyone we know to be under 16.

9.6 If we learn we hold a child's information. We stop using it, tell the sender to give it to the Coach, pass it to the authorities only where a child may be at risk, and delete it from all our systems within 7 days.

10. YOUR RIGHTS

10.1 Everyone. Depending on where you live, you may ask to access your information and receive a copy, correct it, delete it, receive it in a portable format, restrict or object to its use, and withdraw consent at any time without affecting earlier use.

10.2 Your right to object. You may object at any time to our use of your information based on legitimate interests, and to direct marketing without giving a reason. Every marketing email has an unsubscribe link, and you can reply STOP on WhatsApp.

10.3 California. If the California Consumer Privacy Act applies to Imcy, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, to opt out of its sale or sharing, and to limit the use of sensitive personal information (we use only booking-account log-in details, as the law permits). We will not discriminate or retaliate against you for using your rights.

10.4 Other US states. Residents of other states with privacy laws, such as Virginia, Colorado, Connecticut, Texas and Oregon, have similar rights where those laws apply to Imcy, including a right to appeal our decision by replying to it. If we deny your appeal, you may contact your state attorney general.

10.5 EU, UK and Switzerland. You may complain to your data protection authority, such as the ICO in the UK, the authority in your EU country or the Swiss FDPIC, but we would like the chance to help first.

10.6 Australia. Where the Australian Privacy Act 1988 applies to Imcy, you may access and correct your information and complain to us; if you are not satisfied, you may complain to the Office of the Australian Information Commissioner.

10.7 How to make a request. Use the 1.15 Data Request Form or email support@imcy.world. Requests are free. We confirm receipt within 10 business days and reply within one month, extendable by two months for complex requests (GDPR and UK GDPR), or within 45 days, extendable once by 45 days (California and other US states). You may use an authorized agent, who must show your signed permission.

10.8 Information held by your Coach or the Supervisor. Contact them directly. If you send such a request to us, we pass it on and tell you we have done so.

11. SECURITY, BREACHES AND CHANGES

11.1 Security. We use two-factor log-in, role-limited access, encryption in transit and access logging, and require our providers to protect information to a similar standard. No method is perfectly secure.

11.2 Breach notice. If a security breach is likely to put your rights at high risk, or the law otherwise requires it, we will tell you, and the authorities where required, without undue delay.

11.3 Changes. We publish any update on our website with a new version number and date, and email you about a material change at least 30 days before it takes effect.

11.4 Effective date. This Policy takes effect on 10 November 2026. Last updated: 10 November 2026.

12. COACHES' OWN PRIVACY NOTICES

12.1 Each Coach is a separate controller. Each Coach is the controller of information about your Child and of everything shared in or about the Intro Call and Sessions. Your Coach gives you their own privacy notice and sensitive-information consent before the first Session. This Policy does not cover how Coaches handle information.

ANNEX: CALIFORNIA NOTICE AT COLLECTION: CATEGORIES

Sources, purposes and retention are in articles 2, 5 and 8. We do not sell personal information. We share internet activity for cross-context behavioral advertising only if you accept marketing cookies, and you can opt out at any time. We do not collect information about your child.