Privacy policy

Data controller

The controller responsible for your data is:

• [BUSINESS NAME]
• [ADDRESS]
• VAT / AFM: [VAT/AFM]
• Email: [EMAIL]
• Privacy contact: [EMAIL]

What we collect

• Account data: email address, display name, language, sign-in records.
• Relationship content: entries, moods, intensity, check-ins, gestures, shared tasks, coffee-talk transcripts, agreements and the cards and reports produced from them.
• Profile answers about how you handle conflict, care and boundaries.
• Billing data: plan, subscription status and payment references (card details are held by the payment processor, never by us).
• Professional data (therapists only): name, title, practice, licence number, issuing body, country, uploaded licence document and dictated session notes.

Why we use it and on what legal basis

• Providing the app, your account and your couple space — performance of our contract with you (Art. 6(1)(b)).
• Relationship and wellbeing content, which can reveal health or sex-life information (special category data) — your explicit consent (Art. 9(2)(a)), given when you create your account. You can withdraw it at any time by deleting the content or your account.
• Payments, invoices and tax records — contract and legal obligation (Art. 6(1)(b) and (c)).
• Security, fraud prevention and abuse handling — our legitimate interests (Art. 6(1)(f)).
• Verifying therapists — legitimate interest in protecting couples, and the therapist's contract with us.
• Service emails and notifications you switch on — contract, and consent where required.

Who can see it

• Solo reflections are visible only to you.
• Joint entries, coffee cards, gestures and shared tasks are visible to you and your connected partner.
• A therapist sees nothing unless both partners explicitly consent. Even then they see aggregated patterns, self-described profile answers and the professional companion of shared reports — never raw entries, transcripts or solo reflections.
• Either partner can withdraw therapist consent at any time from the account page; access closes immediately for the therapist.
• Our staff access data only when needed to keep the service running or when you ask for help.

Processors we use

• Supabase (database, authentication and file storage, EU/US infrastructure) — hosting of all app data.
• Stripe (payments and billing portal) — processes payment details and invoices as an independent controller for payment-law purposes.
• Our AI provider, accessed through Lovable's AI gateway — receives the text needed to generate feedback, cards, reports and note drafts, without your email or account identifiers. It is not used to train models.
• All processors are bound by data processing agreements. Transfers outside the EEA rely on Standard Contractual Clauses or an adequacy decision.

Voice recordings and dictated notes

• Audio from voice entries, coffee talks and therapist dictation is sent for transcription and then discarded — the recording is not stored.
• Only the resulting text is kept: in your entry or coffee talk, or — for therapists — in the draft note.
• A therapist's dictated note is saved only if the therapist chooses to save it, is visible only to that therapist and is never shown to the couple or used for the app's analysis.
• Therapist notes are kept while the professional account exists and deleted with it, or earlier on the therapist's request.

How long we keep data

• Account and relationship content: while your account is active; deleted within 30 days of account deletion, except backups which roll off within a further 30 days.
• Billing records: as long as Greek tax law requires (normally 5–10 years).
• Licence documents: for the life of the professional account, and up to 12 months after a rejected application.

Your rights

• Access and a copy of your data — download everything from the account page.
• Rectification of inaccurate data.
• Erasure — delete your account from the account page.
• Data portability — the export is a machine-readable file.
• Restriction and objection to processing based on legitimate interests.
• Withdrawal of consent at any time, without affecting earlier processing.
• To exercise any right, write to [EMAIL]. We answer within one month.

Complaints

You can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1–3, 115 23 Athens, www.dpa.gr, or to the authority of your EU country of residence.

Changes

We will announce material changes in the app and by email before they apply.