Anawim LLC · Personal data
Privacy Policy
Version 2026-10-08.1
Draft for review; not published as effective. Legal contact details and implementation procedures must be verified before adoption.
This policy explains data relating to accounts, community features, prayer, AI assistance and physical-item payments. Each processing purpose requires a valid basis; accepting service terms is not unconditional agreement to every use of data.
1. Responsibility and scope
Anawim LLC, a Delaware limited liability company, determines the purposes and means of personal-data processing for its operation of the Anawim ecosystem. This policy covers the Web, app and support communications. Payment providers, app stores and independent services may have their own responsibilities for their activities.
Contact [email protected] with “Anawim data rights” in the subject. Legal postal contact, data-protection contact and local representative details must be published when verified and legally required. A notice at collection explains a new purpose or specific activity; it must not silently expand processing permissions.
2. Data categories and sources
From you: registration and contact information, optional profile fields, language choices, posts, images, videos, messages, prayer content, AI prompts and relevant history, and support requests. Content supplied by you or others may reveal religion, health, family circumstances or beneficiary information.
From use and providers: account identifiers, sign-in and security logs, IP or connection information where recorded by the relevant systems, device/browser information, privacy choices, errors and activity needed to provide features. External sign-in provides fields permitted by that platform and your choices.
From transactions: item types/quantities, prices/fees, order references, selected campaigns, payment time/status, Stripe customer/transaction identifiers, acceptance records, fulfillment, refunds and disputes. Anawim receives transaction data and status from Stripe; do not send full card numbers or security codes through email, chat or support forms.
3. Purposes and legal bases
Accounts, requested features, selected content, orders and support: necessary processing for entering into or performing a contract, or another valid local basis. Not every profile field is mandatory; omission of optional data affects only features that need it.
Fraud prevention, security, moderation, complaints and defence of Anawim’s lawful interests: where available, legitimate interests are assessed for necessity and balance; that basis is not presumed automatically available in Vietnam. Appropriate accounting, competent-authority responses and mandatory reporting rely on applicable legal obligations.
Purposes requiring consent, such as sensitive processing without another basis, non-essential tracking or marketing where required, need separate informed choices that can be withdrawn. They are not bundled into payment acceptance. Withdrawal does not invalidate earlier lawful processing but stops future processing relying solely on the withdrawn consent.
4. Faith, sensitive data and beneficiaries
Prayer content, religious practice, health, voice/biometric data and inferences from activity may receive special protection. Where UK GDPR or EU GDPR applies, both an ordinary basis and an Article 9 special-category condition are needed; a Catholic-oriented LLC does not automatically qualify for the religious nonprofit exception.
Processing is limited to necessary disclosed purposes and legal conditions, including explicit consent where required. Private prayer content is not automatically available for advertising, character scoring or model training. Public posting does not authorize every later use.
Do not supply another person’s private data without appropriate authority or basis. Beneficiary images and records are limited to verification needs; agreement to publicity is not forced as a condition of aid. Delivery evidence may use obscured faces/names and restricted access.
The Speech Recognition Lab (SR Lab) processes voice on-device to match prayer text; when an account separately opts in to the SR Lab's own “training data contribution” setting, only voice-derived numeric features (never an audio recording) and the recognized text transcript are sent, never an audio file. This is biometric/special-category data: a specific consent, separate from accepting the general Terms, is the basis relied on, and may be withdrawn or deleted at any time through the SR Lab screen or [email protected], without affecting other features.
5. AI assistance and model providers
Bean connects to Google Gemini through Firebase/Vertex AI or a configured fallback; relevant queries may be sent to Magisterium AI for source retrieval. Inputs may include the prompt, relevant conversation history, language, screen context, retrieved sources and profile/personalization context used by the feature.
Inputs are transmitted to providers for processing and are not necessarily confined to your device. Do not put passwords, payment credentials, identity documents or others’ secrets into AI prompts. This policy does not assert that every provider has zero retention or prohibits training; retention, use and processing locations must be verified for the actual service/account and disclosed before adoption.
Improvement or training beyond answering the current request is not deemed consented to merely by using Bean. Anawim must establish the basis, notice and separate consent where needed, especially for sensitive data. AI output can be wrong; significant adverse decisions about people must not rely solely on automation where law requires conditions or human review.
6. Recipients and service providers
As needed for the feature, recipients may include authorized Anawim personnel; Google/Firebase for authentication, database, storage and configured services; Web infrastructure such as Cloudflare; Stripe for payments, fraud prevention and disputes; the AI providers in Section 5; mail/notification providers; suppliers, logistics partners and professional advisers with relevant duties.
Only task-necessary data is supplied. Field partners generally need item and recipient details, not a payer’s complete profile, prayers or payment credentials. Independent providers such as Stripe may process some information under their own policies for their legal duties; Anawim remains responsible for processing it determines and controls.
7. Public content, private content and support
Public posts can be viewed, copied and shared by others; review audience settings before posting. Deletion from Anawim cannot guarantee removal of independent copies lawfully retained by others. Messages and restricted-audience content are not automatically public marketing material.
Anawim does not promise absolute anonymity or end-to-end encryption where a feature does not provide it. Support, moderation and investigation access must be authorized, purpose-limited and appropriately recorded. Permission to use content for the service is not a transfer of all copyright or waiver of data rights.
9. Marketing, sale and sharing
Payment, prayer or acceptance of terms is not consent to marketing or sale of data. Anawim grants no blanket permission to sell personal data or share it for cross-context behavioural advertising. Applicable Vietnamese prohibitions on data trading are observed and are not replaced by consent.
Where U.S. state law requires sale/sharing opt-outs or browser preference signals, Anawim must provide and honour the mechanism for covered activities. Requests may be sent to [email protected] without unlawful discrimination. Any “no sale” or “no sharing” representation must be checked against actual providers and configuration before publication.
10. International processing and transfers
Anawim is a U.S. company using providers with international infrastructure; data may be processed outside your residence according to configured regions, support locations and providers. We do not represent that all data stays in or is governed solely by the United States. Storage regions, recipients and transfer mechanisms must be confirmed for each flow.
UK GDPR and EU GDPR restricted transfers require a valid mechanism, such as an applicable adequacy decision or Standard Contractual Clauses/another permitted mechanism with the necessary transfer risk assessment. Vietnamese impact-assessment, dossier and related duties are fulfilled where applicable under effective rules. General acceptance is not a waiver of these safeguards. You may request information about the mechanism and an appropriate copy with protected confidential information redacted.
Anawim is a U.S. (Delaware) company with no EU/UK establishment. Where applicable law requires appointing an EU representative (EU GDPR Article 27) or a UK representative (UK GDPR), representative details are published here and in the contact section once verified — this document is currently still a draft and no representative has been formally published yet.
11. Retention and preservation
Account data and content are retained as needed for features you use, then deleted or genuinely anonymized when no basis remains. Deleted content and erasure requests are handled according to applicable rights, security needs and explained technical limits; immediate removal from every copy is not promised.
Orders, acceptance, invoices, reconciliation and delivery evidence are retained for applicable accounting/tax duties and the period needed for disputes. Security logs are retained proportionately for detection/investigation, not indefinitely by default. Criteria include record type, completion of obligations, limitation periods, risk and specific preservation duties.
For a dispute or valid preservation requirement, Anawim retains the necessary records, restricts access/use and reviews retention when the reason ends. Backups follow a defined cycle and must not restore erased data to ordinary use. We do not assert that the IRS requires every data category to be kept for seven years; category-specific schedules and enforcement must be verified.
SR Lab training samples (numeric voice features and recognized-text transcripts, never audio) are kept for up to approximately 24 months from submission, then automatically deleted under a configured Firestore retention policy; an account may delete them sooner at any time from the SR Lab screen. The 24-month figure is a current technical setting, subject to revision once a data protection impact assessment (DPIA) or specific legal advice is completed.
12. Security, legal requests and protection of Anawim
Safeguards are selected according to risk, including access controls, authentication, connection protection, event records and appropriate incident response. No system guarantees absolute security. Notifiable incidents are assessed and reported as law requires; terms do not remove mandatory responsibility.
Anawim checks the authority, basis and scope of data requests and may seek clarification or challenge invalid requests where justified. Disclosure is limited to lawful, necessary scope, with notification to affected people where permitted and appropriate. We do not promise to obey only U.S. federal courts or disregard valid UK/Vietnamese requirements.
To protect Anawim against fraud and disputes, necessary transaction records may be supplied to Stripe, issuers, lawyers, auditors or competent authorities on an appropriate basis. Complete faith profiles are not supplied where a transaction reference or delivery record suffices; trade secrets and personnel information are protected to the lawful extent.
13. Rights and requests
Subject to applicable law and conditions, you may request information/access and a copy, correction, deletion, restriction, objection, portability, withdrawal of consent, opt-outs of covered sale/sharing or sensitive processing, and review of automated decisions. Rights are not always absolute; Anawim explains lawful restrictions and complaint options.
Email [email protected] with “Anawim data rights”, your account email and request. Do not send passwords or complete identity documents by email. Verification must be proportionate, preferring existing account/order evidence; identity-document images are not required as a social-network authentication condition where prohibited by applicable law.
Anawim responds within the applicable statutory period. UK GDPR and EU GDPR access requests ordinarily have a one-month period, subject to current verification, clarification and justified-extension rules and appropriate notice. Internal reassignment does not itself restart the deadline. Account closure does not itself cancel paid orders; unresolved orders and necessary retained records are explained separately.
You may complain to the competent authority: the UK ICO (ico.org.uk), the competent EU supervisory authority in your member state of habitual residence (under EU GDPR Article 77), an appropriate U.S. state privacy/consumer authority or FTC, or the competent Vietnamese data-protection authority. Contacting Anawim first does not remove complaint or court rights; an internal appeal is provided where required.
For SR Lab data specifically (voice features and transcripts you opted to contribute for training): you can request a copy or delete it directly from the SR Lab screen, without emailing support.
14. Children and vulnerable people
The service is not intended for children under 13; higher local minimum ages and parent/guardian and child consent requirements still apply where required — for example, EU GDPR Article 8 sets a default consent age of 16, which EU member states may lower to a minimum of 13, so 13–15-year-olds in some EU countries still need parent/guardian consent. Payments are limited to people aged at least 18 with capacity. A stated minimum age does not replace appropriate verification and safeguards.
If children’s data is collected without a valid basis, Anawim restricts processing and takes appropriate deletion, valid-consent or other lawful steps. Guardians may contact the data-rights channel; children’s rights and best interests are considered. Religious profiles or vulnerable circumstances of children are not used for unlawful commercial exploitation.
15. Updates and effect
Material changes are appropriately notified before use; new purposes require a basis and fresh consent where needed. Continued use is not used to retroactively authorize processing requiring separate consent. A published version states its version, effective date and contacts; a draft is not confirmation that every operational mechanism is complete.
Vietnamese and English are intended to be equivalent. Applicable mandatory law prevails; Delaware choice of law does not waive data obligations. Contact [email protected] for a retained copy or clarification.