August 21, 2026
Amallight ("we", "us", "Amallight") provides a mental wellness platform including anonymous peer support ("vents"), an AI companion ("Moa"), licensed psychologist sessions, and mood and growth tracking tools. This policy explains what personal data we collect, why, and what rights you have.
Amallight is the data controller for the personal data described in this policy. If you have questions about this policy or how we handle your data, contact us at hello@amallight.com.
Account data: name, email address, username, password, phone number, and country, collected when you register. Professional data (psychologists only): professional license number, specializations, languages, years of experience, and verification documents. Health and wellbeing data: the content of vents you post, messages exchanged with Moa or with psychologists, mood tracker entries, and AI-generated assessments derived from that content, including sentiment history, risk scores, and clinical state summaries used to detect signs of crisis. This is "special category" data under Article 9 GDPR and receives extra protection. Payment data: subscription and billing information processed by our payment provider, Stripe. We do not store full card numbers ourselves. Technical data: device and log information, and the local storage / cookie data described in our Cookie Policy. Communications: messages you send us, including support and feedback submissions.
To provide the service (Article 6(1)(b) GDPR, contract): creating your account, enabling vents, chat, bookings, and mood tracking. To process health and wellbeing data (Article 9(2)(a) GDPR, explicit consent): analyzing vent and chat content, including with AI tools, to provide support and to detect signs of risk. You give this consent when you register and can withdraw it at any time, though this may limit or end your ability to use parts of the service. To protect life and respond to crises (Article 9(2)(c), vital interests): where our systems detect a credible indication of risk to your life or safety, we may escalate to a licensed psychologist or, in serious cases, emergency services, even if you have withdrawn consent for other processing. To bill you (Article 6(1)(b), contract): processing payments for paid plans through Stripe. To keep the service secure and meet legal obligations (Article 6(1)(c) and (f)): fraud prevention, abuse detection, and responding to lawful requests from authorities.
Moa is an AI companion that responds to what you share and helps identify patterns over time. To do this, the content of your vents and conversations is sent to Mistral AI, our AI infrastructure provider, for processing. Mistral AI is a French company that processes this content on servers within the EU/EEA, on our instructions, and is contractually restricted from using it for its own purposes. Our hosting and some other vendors described below still process data outside the EU/EEA — see section 6 for how we safeguard those transfers.
Licensed psychologists you choose to book sessions with, so they can provide care. Infrastructure and service providers acting as our data processors: Amazon Web Services (hosting, authentication, storage), Mistral AI (AI processing of vent and chat content, EU-based), Resend (transactional email), Stripe (payments), Twilio (voice and video calls), and Sentry (error monitoring). Authorities, where required by law, or professionals such as emergency services in a genuine safety emergency. We do not sell your personal data, and we do not share it with advertisers.
Some of our providers process data in the United States and other countries outside the EU/EEA. Our AI processing (Mistral AI) takes place within the EU/EEA. Where we do transfer personal data outside the EU/EEA, we rely on appropriate safeguards recognized under GDPR, such as the European Commission's Standard Contractual Clauses, and we are working to formalize these agreements with all relevant vendors and to evaluate hosting our infrastructure within the EU/EEA where practical.
We keep your account and health/wellbeing data for as long as your account is active. If you delete your account, it is deactivated immediately and your personal data is permanently deleted or anonymized within 30 days, except where we are required to retain limited records for longer, such as financial records for tax purposes or safety escalation records that are anonymized rather than deleted (see section 9). You can read more about how account deletion works in our Terms of Service.
Under GDPR you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure of your data; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where processing is based on consent. You can exercise most of these rights directly from your account settings, or by contacting hello@amallight.com. If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or with the supervisory authority in your own EU/EEA country of residence.
Our AI systems monitor vent and chat content for signs of serious risk, such as suicidal ideation. Where a credible risk is detected, we may escalate your case to a licensed psychologist or, in urgent situations, to emergency services, in order to protect your life and safety. Records of safety escalations are kept even after account deletion, but are anonymized so they can no longer be linked to your identity, except where retaining the link is necessary to comply with a legal obligation.
We use strictly necessary browser local storage to keep you signed in and remember your language preference. We do not currently use advertising or analytics cookies. See our cookie banner and preferences for full details, available on every page of the site.
Amallight is intended for users aged 15 and over. If you are 15 to 17, you can use Amallight's free features, but a paid subscription must be purchased by a parent or legal guardian on your behalf — we do not allow anyone under 18 to enter into a paid subscription themselves. We do not knowingly collect data from children under 15. If you believe a child under 15 has provided us with personal data, contact us and we will take steps to delete it.
We use industry-standard security measures, including encryption in transit and access controls, to protect your data. No system is completely secure, and we continuously work to improve our safeguards, including strengthening encryption of data at rest.
We may update this policy from time to time. If we make material changes, we will notify you and may ask you to re-confirm your consent before continuing to use features that depend on it.
For any privacy questions or to exercise your rights, contact us at hello@amallight.com.