Privacy Policy

This Privacy Policy explains how Money Lat SpA ("Money Lat", "we", "us", or "our") collects, uses, shares, stores and protects personal information in connection with the Permitly mobile application and any related websites and services (together, the "App" or the "Service"). Permitly helps you study for and pass the written knowledge test for a United States learner's permit or driver licence — car (Class C), motorcycle (Class M) and commercial (CDL).

Money Lat SpA is the entity responsible for the App (the "data controller" under the GDPR and the "business" under California law). Our privacy point of contact is support@permitly.app.

1. Information We Collect

a. Account information

To save your progress you sign in with Sign in with Apple or Google Sign-In. Permitly never asks for or stores a password. From that sign-in we receive:

• An authentication identifier assigned to your account by our backend (Firebase Authentication)
• Your email address — if you use Sign in with Apple and choose "Hide My Email", we only ever receive Apple's private relay address
• Your display name and profile photo URL, where the provider supplies them and you allow it
• Which providers are linked to your account (Apple, Google)
• The dates your account was created and last updated

b. Your study profile and onboarding answers

During onboarding the App asks a short series of questions in order to build your study plan. We store your answers as part of your profile:

• The first name you asked to be called
• The licence type you are studying for (car, motorcycle or CDL) and, for CDL, the endorsements you selected
• The U.S. state whose rules and question bank you want — this is a state you choose from a list; it is not derived from GPS or any location sensor
• Whether you have already booked your knowledge test and, if so, the exam date you entered
• Your self-rated confidence, the obstacle you named as your biggest, whether you have sat the test before, and the weekly study time you committed to

c. Study activity and progress

• Lessons opened and completed, and where you stopped reading, so "continue" resumes correctly
• Practice quizzes and exam simulations you finished: your answers, score, duration and date
• Per-question statistics (times seen, times correct) used to calculate your readiness score, surface your weak topics and rebuild your missed-question set
• Bookmarked questions and your study streak

d. AI Teacher conversations

If you use the in-app Teacher, the messages you type are sent to our server and from there to Google's Gemini API so an answer can be generated. See Section 4 for exactly what is sent.

e. Subscription and purchase information

• Your subscription status, product identifier, period type, renewal date and whether the subscription is set to renew
• A random subscriber identifier (a UUID) that the App generates on your device on first launch and uses to attach a purchase to your account after you sign in. It is not derived from your name, email or device identifiers
• The store transaction identifier reported to us by our paywall provider

Payments are processed entirely by the Apple App Store or Google Play. We never receive or store your card number, bank details or billing address.

f. Device and diagnostic information

• Device model, operating system and version, app version and language
• IP address (used for security, abuse prevention and coarse country-level statistics) and a Firebase app-instance identifier
• Anonymous usage events — for example, that an onboarding step was completed, a lesson was opened, an exam was finished, or a paywall was shown — used to understand how the App is used and where it can be improved
• Crash and error logs

g. What we do not collect

2. How We Use Your Information

• To create and secure your account and keep you signed in across devices
• To build and adapt your study plan from the onboarding answers you gave
• To deliver the right course — the lessons, question bank and exam rules for your licence type and the state you selected
• To save and sync your progress, so switching phones or reinstalling does not lose your work, and so you can keep separate progress for each licence type
• To calculate your readiness score, streak, weak topics and missed questions
• To answer your questions in the Teacher and ground those answers in your own course material
• To determine whether you have an active subscription and to restore purchases
• To keep the Service reliable and safe — diagnosing crashes, preventing fraud and abuse, and enforcing our Terms of Service
• To provide customer support when you contact us
• To comply with legal obligations and respond to lawful requests

3. Legal Bases for Processing (EEA / UK)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR:

4. The AI Teacher

The Teacher tab is an AI assistant that answers driving-theory questions. It is powered by Google's Gemini API, called from our own server so that no model credentials ever ship inside the App. When you send a message, the following is transmitted:

• The message you typed and the recent turns of that conversation (capped at the last 12 turns and 1,000 characters per message)
• A short description of your study situation: licence type, the state you selected, your readiness percentage, how many lessons you have completed, and your weakest topics — so the answer is tailored rather than generic
• Excerpts of the Permitly lesson text or practice questions that match what you asked, looked up on your device, so the Teacher can explain the exact wording the App showed you

Your name, email address and account identifier are not sent to the model. Requests are authenticated with your Firebase ID token so that only signed-in users can invoke the service. The Teacher also performs Google Searches restricted to official sources (state DMV/BMV/MVA sites, state vehicle codes, FMCSA and NHTSA) so that answers about rules, fees, ages and limits come from the live official web rather than from the model's memory; the search queries derived from your question are processed by Google.

Google processes this data as our service provider under the Gemini API terms in order to return an answer. Conversation transcripts are kept on your device; we do not build a profile from them or use them for advertising.

5. Subscriptions and Payments

Full access to Permitly requires an auto-renewing subscription, purchased through the Apple App Store or Google Play. Our paywall and subscription infrastructure is provided by Superwall.

• Apple and Google process the payment and hold your payment details. We do not see them.
• Apple and Google notify Superwall, and Superwall notifies our server, when a subscription starts, renews, is cancelled, expires or is refunded. We store that status against your account so the App knows whether to unlock the course.
• Because a subscription belongs to your Apple or Google account rather than to your Permitly account, we allow a small number of Permitly accounts to claim the same subscription over its lifetime — this covers honest cases such as signing in with a different email — and we record which accounts have done so in order to prevent subscription sharing.
• If you request a refund, the store may ask us to confirm your usage of the App; we may share the minimum activity information needed to review the request fairly.

The commercial terms of the subscription — price, billing period, renewal and cancellation — are set out in our Terms of Service.

6. How We Share Information

We do not sell your personal information. We share it only with the service providers that make the App work, and only with what they need to perform their function:

We may also disclose personal information:

• For legal reasons — to comply with applicable law, a valid subpoena, court order or governmental request, or to establish, exercise or defend legal claims
• To protect people — where we believe in good faith that disclosure is necessary to prevent fraud, abuse, or harm to any person or to the security of the Service
• In a corporate transaction — if Money Lat is involved in a merger, acquisition, financing or sale of assets, your information may be transferred as part of that transaction, subject to this policy and with notice to you where required by law

You can review Google's and Firebase's privacy practices at firebase.google.com/support/privacy and Superwall's at superwall.com/privacy.

7. International Transfers

Money Lat SpA is established in Chile, and our infrastructure and service providers are located primarily in the United States. If you use the App from outside those countries, your personal information will be transferred to and processed in them, where data protection laws may differ from those of your own country.

Where we transfer personal information out of the EEA, the United Kingdom or Switzerland, we do so on the basis of an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism offered by the provider concerned.

8. How We Protect Your Information

• All traffic between the App, our servers and our providers is encrypted in transit using HTTPS/TLS. Data at rest is encrypted by our cloud providers.
• Authentication is delegated to Apple, Google and Firebase; we never handle a password.
• Database rules enforce that a signed-in user can read and write only their own profile, progress and attempts. There is no path from the App that lets one user read another user's data.
• Subscription status is written only by our server from verified store events — a modified app cannot grant itself access, and subscription records are not readable by any client.
• API keys for the AI model live only on our server and are never shipped inside the App binary.
• Access to production data is limited to the people who need it to operate the Service.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security.

9. Data Retention and Account Deletion

We keep your personal information only for as long as you maintain an account, plus any period we are required to retain records by law. Analytics and crash data are retained on our providers' standard schedules, typically no longer than 14 months.

Deleting your account without the App: if you cannot access the App — for example you deleted it, changed device, or lost access to your sign-in provider — email support@permitly.app from the address associated with your account with the subject "Delete my account". We will verify the request and complete it within 30 days, and will confirm by email when it is done.

After deletion we may retain a limited set of records where the law requires it or where we have a legitimate need — specifically purchase and tax records required by accounting law, and the subscription record held against the store transaction identifier, which is needed to prevent subscription abuse and to honour refunds. These records are not used to rebuild your study profile. Aggregated or de-identified statistics that can no longer be linked to you may be retained indefinitely.

10. Your Privacy Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and know how we use it
• Correct information that is inaccurate or incomplete
• Delete your personal information (see Section 9)
• Port your data — receive a copy in a portable, machine-readable format
• Object to or restrict certain processing, including processing based on our legitimate interests
• Withdraw consent at any time, where processing is based on consent
• Opt out of the sale or sharing of personal information, and of profiling for decisions with legal or similarly significant effects — we do not do any of these
• Not be discriminated against for exercising any of these rights

To exercise any right, email support@permitly.app. We will respond within the period required by the applicable law — 30 days under the GDPR and 45 days under California law, each extendable where permitted. We may need to verify your identity by confirming control of the email address linked to your account; we will not ask you for more information than is necessary to do so. An authorised agent may submit a request on your behalf with written proof of authorisation.

These rights are available to residents of the EEA, the United Kingdom and Switzerland (GDPR / UK GDPR); California (CCPA/CPRA); Colorado, Connecticut, Virginia, Utah, Texas and other U.S. states with comprehensive privacy laws; Brazil (LGPD); and Chile (Ley N° 19.628 sobre Protección de la Vida Privada, as amended by Ley N° 21.719). If you are in the EEA or the UK you also have the right to lodge a complaint with your local supervisory authority.

11. Additional Notice for California Residents

This section supplements the rest of this policy for California residents, under the California Consumer Privacy Act as amended by the CPRA. In the preceding twelve months we have collected the following categories of personal information:

We do not collect sensitive personal information as defined by the CPRA, we do not use or disclose personal information for purposes other than those described above, and we do not sell or share personal information — including the personal information of consumers under 16 years of age. We retain each category for the period described in Section 9. Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" link; there is nothing to opt out of. We do not respond to browser Do Not Track signals, as no uniform standard exists.

12. Children's Privacy

Permitly is intended for people preparing for a driving knowledge test and is not directed to children under 13. In line with the U.S. Children's Online Privacy Protection Act (COPPA) and equivalent laws, we do not knowingly collect personal information from any child under 13.

If you are between 13 and the age of majority where you live (typically 18), you may use the App only with the involvement and consent of a parent or legal guardian, who is responsible for your use of the App, including any purchase.

If you believe a child under 13 has provided us with personal information, a parent or guardian may contact us at support@permitly.app and we will delete it from our records.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If the changes are material — for example, a new category of data or a new purpose — we will give notice within the App or by email before they take effect. Continuing to use the App after a change takes effect means you accept the updated policy.

14. Contact Us

For any privacy question, request or complaint, contact us at:
Money Lat SpA — Santiago, Chile
support@permitly.app

This policy should be read together with our Terms of Service.