PRIVACY POLICY

withUs

Effective Date: 1 August 2026   |   Last Updated: 1 August 2026

1. Introduction and Scope

Lightstream LLC, a Virginia limited liability company doing business as withUs ("withUs," "we," "us," or "our"), provides this Privacy Policy to describe how we collect, use, disclose, and protect Personal Information in connection with the withUs mobile application and the website located at withuspray.com (together, the "Services").

This Privacy Policy applies to all users of the Services. It does not apply to the practices of third parties that we do not own or control. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

The Services are presently offered in the United States only. Provisions of this Privacy Policy that refer to the United Kingdom General Data Protection Regulation or the General Data Protection Regulation of the European Union apply if and to the extent that the Services are made available in those jurisdictions, or that such legislation otherwise applies to our processing. Where it does apply, Lightstream LLC is the controller of Personal Information processed through the Services.

This Privacy Policy is supplemented by the notice provided at or before the point at which Personal Information is collected, and should be read together with our Terms of Service.

2. Personal Information We Collect

2.1 Information You Provide

• Account Information. Name, email address, and password. Where you authenticate through a third-party sign-in provider, we receive basic identifying information from that provider.

• Profile Information. Display name, profile photograph, and biographical text, to the extent you elect to provide them.

• Contact Information. Telephone number, where you elect to receive text message notifications.

• User Content. Prayers, prayer requests, prayer chains, Blessages, posts, comments, direct messages, uploaded images, saved verses, and any descriptive text you submit to content generation features.

• Communications. Correspondence you send to us through in-app contact forms or by electronic mail.

2.2 Information Collected Automatically

• Device and Technical Information. Device model, operating system and version, application version, language settings, and time zone.

• Usage Information. Features accessed, actions taken within the Services, session duration, and navigation patterns.

• Diagnostic Information. Crash reports, error logs, and performance data.

• Network Information. Internet protocol address and approximate location derived from it. We do not collect precise geolocation data and we do not make location available to other users.

2.3 Information We Do Not Collect

We do not collect advertising identifiers, we do not engage in cross-context behavioural tracking, and we do not acquire Personal Information from data brokers.

2.4 Statutory Categories

For purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), we collect the following categories of Personal Information:

Statutory Category

Examples Collected by withUs

Identifiers

Name, email address, telephone number, account identifier, internet protocol address.

Personal Records

Account credentials in hashed form.

Internet or Network Activity

Usage, diagnostic, and interaction data relating to the Services.

Geolocation Data

Approximate location inferred from internet protocol address only.

Visual Information

Profile photographs and images uploaded to User Content.

Inferences

We do not derive inferences from Personal Information to create profiles reflecting the preferences, characteristics, or psychological trends of individual users. Should we introduce any such processing, we will amend this Privacy Policy and provide notice before it takes effect.

Sensitive Personal Information

Religious or philosophical beliefs, and information concerning health or condition, to the extent disclosed within User Content. See Section 6.

 

3. How We Use Personal Information

We process Personal Information for the following purposes:

• To establish and maintain your account and to provide the Services.

• To generate content you request through the features described in Section 4.

• To operate content moderation, safety, and abuse-prevention measures, including screening of User Content, review of user reports, and enforcement of our Terms of Service.

• To deliver notifications you have elected to receive and to send service-related communications concerning your account.

• To respond to your enquiries and provide support.

• To analyse usage of the Services in aggregate form for the purpose of maintaining, securing, and improving them.

• To comply with applicable law and to establish, exercise, or defend legal claims.

4. Artificial Intelligence Processing

Four features within the Services employ a third-party artificial intelligence provider: Blessage generation, prayer generation, prayer chain generation, and Bible verse lookup. When you use one of these features, the text you submit is transmitted to that provider for the purpose of generating a response, which is returned to you within the Services.

• Input submitted to these features is processed solely to generate your requested output. We configure our artificial intelligence providers so that submitted content is not used to train or improve their models, to the extent such configuration is supported under our agreements with them.

• The provider may retain input transmitted to it for a limited period for the purpose of monitoring misuse, in accordance with its own terms and applicable data processing agreement.

• We maintain records of interactions with these features for the purposes of safety investigation and quality assurance. Such records are retained in accordance with Section 9.

• Text submitted to these features is subject to automated safety screening prior to generation. Where submitted text indicates that a user may be at risk, the Services present professional crisis resources in place of generated content. Records created by this screening process are maintained under a pseudonymous identifier, which permits investigation of a specific incident but is not used to construct any profile of the user, and are deleted within ninety (90) days.

• Generated content is provided for informational and devotional purposes only. It does not constitute spiritual counsel, medical advice, mental health treatment, or professional guidance of any kind.

5. Sensitive Personal Information and Special Category Data

User Content submitted to the Services may reveal religious or philosophical beliefs and may disclose information concerning physical or mental health, whether relating to you or to third parties on whose behalf you submit a prayer request. Such information constitutes Sensitive Personal Information under the CCPA and special category data within the meaning of Article 9 of the UK and EU General Data Protection Regulation.

Where we process such information in reliance on Article 9, we do so on the basis of your explicit consent. Such consent is obtained through a separate affirmative action at the point of registration, distinct from your acceptance of this Privacy Policy and of our Terms of Service, and a record of the consent given is retained.

You may withdraw your consent at any time, without deleting your account, by writing to info@withuspray.com or by using the corresponding control within the Settings area of the application. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Because the generation and sharing features of the Services cannot operate without processing this information, withdrawal will restrict your use of those features while leaving your account intact.

We process Sensitive Personal Information only as necessary to provide the Services and to maintain the safety and integrity of the community. We do not use Sensitive Personal Information to infer characteristics about any individual, we do not disclose it other than as set out in Section 6, and we do not make assessments concerning the emotional or spiritual state of identified individuals available to community administrators or any other party. Where future features of the Services would alter this position, we will amend this Privacy Policy and provide notice before those features take effect. Analysis undertaken to improve the Services is performed on aggregated data that does not identify any individual.

User Content submitted to shared areas of the Services, including feeds, comments, and prayer chains, is visible to other users of those areas. Section 7 describes the consequences of disclosure within those areas.

6. How We Disclose Personal Information

6.1 Disclosure to Other Users

User Content is disclosed to other users in accordance with the settings and context in which you submit it. Direct messages are disclosed to the recipient. Posts, comments, and prayer chains are disclosed to users with access to the relevant area. Profile Information is disclosed to users with whom you are connected and, subject to your settings, to other users within your community.

6.2 Disclosure to Service Providers

We disclose Personal Information to the following categories of service provider, each of which is bound by written agreement to process Personal Information solely on our documented instructions and for no independent purpose:

• Artificial intelligence processing (OpenAI).

• Authentication, database, messaging, analytics, and diagnostic services (Google Firebase).

• Cloud hosting and file storage (Amazon Web Services).

• Text message delivery (Twilio), where enabled.

• Software development and maintenance services.

6.3 Legal and Protective Disclosure

We may disclose Personal Information where required by applicable law, regulation, legal process, or governmental request, or where we determine in good faith that disclosure is reasonably necessary to investigate a suspected violation of our Terms of Service, to protect the safety of any person, or to establish, exercise, or defend legal claims.

6.4 Corporate Transactions

In connection with a merger, acquisition, financing, reorganisation, or sale of assets, Personal Information may be transferred as part of the transaction. We will provide notice of any such transfer, and the transferred information will remain subject to this Privacy Policy or to a successor policy providing equivalent protection until you are notified otherwise.

7. Community Visibility and Conduct of Other Users

Information you post within prayer chains, communities, feeds, comments, and other shared areas of the Services may be visible to other users in accordance with the settings applicable to that area. Once you voluntarily share content with other users, those users may copy, retain, reproduce, or further disseminate that content outside the Services. Content shared in this manner cannot be recalled. You should exercise discretion when posting information concerning yourself or others that you would not wish to become more widely known.

Where User Content concerns a person other than yourself, including a prayer request submitted on another person’s behalf, you are responsible for ensuring that you have a proper basis for disclosing information about that person within the Services.

Lightstream LLC does not verify the identity, credentials, theological beliefs, denominational affiliation, qualifications, or authority of any user, community, organisation, ministry, leader, or business appearing within or connected to the Services. Presence within the Services does not constitute endorsement, accreditation, vetting, or approval by Lightstream LLC, and you are responsible for exercising your own judgement in your dealings with other users and organisations.

8. Sale and Sharing of Personal Information

We do not sell Personal Information and we do not share Personal Information for cross-context behavioural advertising, as those terms are defined under the CCPA. We have not sold or shared Personal Information within the twelve (12) months preceding the Effective Date of this Privacy Policy. We do not sell or share the Personal Information of consumers under sixteen (16) years of age.

9. Data Retention

We retain Personal Information for the periods set out below, or for such longer period as may be required by applicable law:

• Account and Profile Information: for the duration of the account.

• User Content: for the duration of the account, or until deleted by the user.

• Safety screening records: ninety (90) days, in a form that does not identify the user.

• Diagnostic and usage records: not longer than twenty-four (24) months.

• Communications with us: for such period as is necessary to resolve the matter and maintain a record of it.

Following account deletion, Personal Information is removed from active systems. Residual copies may persist in encrypted backup media, which are overwritten on a rolling schedule. We may retain a limited record where necessary to comply with legal obligations, resolve disputes, or enforce our Terms of Service.

10. Account Deletion

You may delete your account at any time through the Settings area of the application. Deletion removes your Profile Information, saved items, and associated Personal Information from our active systems.

User Content transmitted to other users, including Blessages and direct messages, may remain accessible to the recipient. Contributions to shared prayer chains may persist in a form that does not identify you.

Where you are unable to access the application, you may request deletion by writing to info@withuspray.com from the electronic mail address associated with your account. Instructions are also available at withuspray.com/support.

11. Your Privacy Rights

11.1 General Rights

Regardless of your location, you may request access to the Personal Information we hold about you, request correction of inaccurate information, or request deletion. Requests should be submitted to info@withuspray.com. We will not discriminate against you for exercising any right described in this Section.

We respond to requests submitted under United States state privacy legislation within forty-five (45) days, which period may be extended once by a further forty-five (45) days where reasonably necessary, with notice to you. We respond to requests submitted under the United Kingdom or European Union General Data Protection Regulation within one (1) month, which period may be extended by two (2) further months where the request is complex or numerous, with notice to you within one (1) month.

11.2 Verification of Requests

Before acting upon a request, we will take reasonable steps to verify that the request originates from the individual to whom the Personal Information relates, or from an authorised agent acting on that individual’s behalf. Verification is ordinarily accomplished by requiring that the request be submitted from, or confirmed through, the electronic mail address associated with the account, and by requesting such additional information as is reasonably necessary to match the request to the account. We use information provided for verification solely for that purpose. Where we are unable to verify a request, we will inform you and explain why.

11.3 United States State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Virginia, or another state with comprehensive privacy legislation, you have the right to know the categories and specific pieces of Personal Information we have collected, the categories of sources, the purposes of collection, and the categories of third parties to whom it is disclosed; the right to obtain a portable copy; the right to correction; the right to deletion; and the right to limit the use and disclosure of Sensitive Personal Information. We already limit such use to that which is necessary to provide the Services and maintain their integrity. As stated in Section 8, we do not sell or share Personal Information, and accordingly no opt-out mechanism is required. You may designate an authorised agent to submit a request on your behalf, subject to verification.

We honour opt-out preference signals, including the Global Privacy Control, transmitted by a browser or device where applicable law requires us to do so.

11.4 Appeal of a Denied Request

If we decline to act upon a request submitted under this Section, we will inform you of the reason and of your right to appeal. To appeal, write to info@withuspray.com within a reasonable period of receiving our decision, stating that you wish to appeal and identifying the request concerned. We will review the appeal and inform you in writing of our decision, together with a written explanation of the reasons for it, within sixty (60) days of receipt. If the appeal is denied, we will provide you with a means of contacting the Attorney General of your state to submit a complaint. This right of appeal is available to residents of Virginia, Colorado, Connecticut, and any other jurisdiction whose law provides for it.

11.5 United Kingdom and European Economic Area Rights

If you are located in the United Kingdom or the European Economic Area, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You have the right to lodge a complaint with your national supervisory authority.

11.6 Legal Bases for Processing

Where the General Data Protection Regulation applies, we rely on the following legal bases: performance of a contract to which you are party, in order to provide the Services; your explicit consent, in respect of the special category data described in Section 5; our legitimate interests in maintaining the security, safety, and proper functioning of the Services; and compliance with legal obligations to which we are subject.

12. Children and Minors

12.1 Children Under Thirteen

The Services are not directed to children under thirteen (13) years of age, and we do not knowingly collect Personal Information from such children. If we become aware that we have collected Personal Information from a child under thirteen (13), we will delete it without undue delay. A parent or guardian who believes that a child under thirteen (13) has provided Personal Information may contact us at info@withuspray.com.

12.2 Users Between Thirteen and Eighteen

Users aged thirteen (13) to seventeen (17) may use the Services. We encourage such users to review this Privacy Policy with a parent or guardian before creating an account. We do not sell or share the Personal Information of any user under sixteen (16) years of age, and we do not process the Personal Information of known minors for targeted advertising or profiling in furtherance of decisions producing legal or similarly significant effects.

Where a user located in the United Kingdom or the European Economic Area has not attained the age at which consent may be given under the law of their jurisdiction, consent to processing of special category data must be given or authorised by the holder of parental responsibility, and we may decline to provide the affected features until such consent is obtained.

The Services are not a reporting mechanism. Where content submitted to the Services discloses that a minor is at risk of harm, we may be required or permitted by applicable law to disclose that content to appropriate authorities, and we may do so in accordance with Section 6.

13. Information Security

We maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorised access, disclosure, alteration, and destruction. These measures include encryption of Personal Information in transit and at rest, role-based access controls limiting internal access, and contractual security obligations imposed upon service providers. No method of transmission or storage is entirely secure, and we do not warrant absolute security. Where a security incident affecting your Personal Information occurs and notification is required by applicable law, we will provide such notification without undue delay.

14. Cookies and Similar Technologies

The withuspray.com website uses cookies and similar technologies that are strictly necessary for the site to function, together with analytics technologies that allow us to understand how the site is used. We do not use cookies or similar technologies for advertising purposes, and we do not permit third parties to collect information through the site for cross-context behavioural advertising.

Where required by applicable law, including in the United Kingdom and the European Economic Area, non-essential technologies are deployed only after you have given consent through the notice presented on first visit, and you may withdraw or vary that consent at any time through the same notice. The mobile application does not use cookies, though it does collect the diagnostic and usage information described in Section 2.

15. International Data Transfers

The Services are operated from the United States, and Personal Information is stored and processed there. Our software development and maintenance provider is located in India and may access Personal Information in that jurisdiction for the purpose of building, supporting, and troubleshooting the Services, subject to written obligations of confidentiality and security and restrictions on the purposes for which such access may be exercised.

Where Personal Information is transferred from the United Kingdom or the European Economic Area to a jurisdiction that has not been the subject of an adequacy decision, such transfers are effected pursuant to Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with such supplementary measures as may be appropriate.

16. No Medical, Crisis, or Professional Services

The Services provide devotional and community features only. They do not constitute medical advice, mental health treatment, crisis intervention, diagnosis, or professional counselling, and use of the Services does not create any professional relationship between you and Lightstream LLC.

If you are experiencing a medical or mental health emergency, contact emergency services immediately. In the United States, the Suicide and Crisis Lifeline may be reached by calling or texting 988 at any time.

17. Changes to This Privacy Policy

We may amend this Privacy Policy from time to time. Where an amendment is material, we will provide notice through the Services or by electronic mail prior to the amendment taking effect. The Effective Date at the head of this document indicates the date on which the current version came into force.

18. Contact Information

Questions, requests, and complaints concerning this Privacy Policy should be directed to:

Lightstream LLC, doing business as withUs

PO Box 191, Crozet, Virginia 22932, United States

info@withuspray.com

We endeavour to respond to privacy enquiries within five (5) business days.