Privacy Policy

1. Introduction

This Privacy Policy explains how SIA “AE Lux” (“we”, “us”, or “our”) collects, uses, and protects your personal data when you use Insight · Vision · Path (the “App”). We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and applicable Latvian and EU data protection law.

2. Data Controller

The data controller responsible for your personal data is SIA “AE Lux”, Reg. No. 40203065425, Ezera iela 5, Talsi, Talsu nov., LV-3201, Latvia. Contact: getivp@aelux.lv.

3. What Data We Collect

• Email address — provided by you when you register and sign in with your email and password.
• Name — the name or nickname you choose when you register, used to address you personally within the App. You may enter any name you wish; it need not be your legal name.
• Date of birth — optional. If you choose to provide it, we use it to confirm you meet the minimum age of 16 required by our Terms of Service, and to understand the general age profile of our users in aggregate. You can use the App without providing it.
• Password — stored only in hashed form by our authentication provider (Supabase); we never see or store your plain-text password.
• Journal entries — the text content you write in the in-app journal feature.
• Usage data — basic technical data such as your browser type, device type, and access timestamps, collected automatically via Supabase infrastructure.
• Authentication tokens — session tokens stored in your browser to keep you signed in.
• Card draw history — which cards you have drawn and when. We need this to enforce the two-cards-a-day limit and to avoid showing you the same card again while unseen ones remain.
• Subscription status — whether you have an active subscription, which plan, and the customer and subscription identifiers issued by Stripe. We do not receive or store your card number.
• Journal display preferences — the typeface and ink colour you last wrote with, so your next entry starts the way you left off.

Anonymous usage counts. To understand whether the App is useful — how many people open it, how many go on to create an account, how many subscribe — we record a small number of anonymous events. Each record contains exactly three things: what happened (for example “the app was opened”), a two-letter country code, and the time. It contains no identifier of any kind: no IP address, no account, no session, no device fingerprint, no cookie. The country is worked out at the moment of the request by our hosting provider and only the two-letter code is passed on; your IP address is never recorded. Because these rows cannot be linked to you or to each other, they tell us how many times something happened, but never who did it. We rely on Art. 6(1)(f) GDPR, our legitimate interest in knowing whether the service works, and this is why the App asks nobody to accept cookies.

We do not store your IP address, build advertising profiles, track you across other websites, or use your journal entries for any purpose other than showing them back to you. Nobody at SIA “AE Lux” reads your journal entries in the ordinary course of running the service, and the operator’s own statistics screen is incapable of displaying them — the database refuses to return journal text to it.

4. Legal Basis for Processing (GDPR)

• Performance of a contract (Art. 6(1)(b) GDPR) — processing your email, name, and journal data is necessary to provide the App and your subscription.
• Legitimate interests (Art. 6(1)(f) GDPR) — processing basic usage data to maintain security and improve the App, and using date of birth in aggregate to understand who the App serves.
• Legal obligation and age verification (Art. 6(1)(c) GDPR) — where you provide a date of birth, checking that you meet the minimum age of 16 stated in our Terms of Service.
• Consent (Art. 6(1)(a) GDPR) — for cookies and non-essential tracking, where your consent is obtained.

5. How We Use Your Data

• Create and manage your account via email-and-password sign-in, including email confirmation and password-reset emails.
• Address you by the name you chose, so the App feels personal to you.
• Where you provide a date of birth, confirm you meet the minimum age of 16, and compile anonymous, aggregated age statistics. We do not use your date of birth to profile you individually, and we never sell or share it.
• Store and sync your journal entries across devices.
• Process subscription payments through Stripe.
• Maintain the security and integrity of the App.
• Comply with legal obligations.

6. Payment Processing

Payments are processed by Stripe, Inc. When you make a payment, you provide your payment details directly to Stripe — we do not store or have access to your full card details. Stripe’s privacy policy is available at stripe.com/privacy. We receive from Stripe only the information necessary to confirm your subscription status.

7. Who Else Processes Your Data

We use a small number of external providers to run the App. Each processes data only as needed to provide its part of the service:

• Supabase, Inc. — database, authentication, and the emails sent when you confirm your address or reset your password. This is where your account and journal entries are stored.
• Stripe, Inc. — subscription payments. See section 6.
• Netlify, Inc. — hosting of the website itself. Netlify processes the technical request data inherent in serving any web page, including your IP address, and derives the country code described above. Your IP address is not passed on to us or stored by us.
• Google Fonts and unpkg — the App loads its typefaces from Google Fonts (fonts.googleapis.com) and its core software library from unpkg.com. When your browser fetches these files, your IP address is necessarily visible to those services. They set no cookies and receive nothing about you beyond that request. We use them under Art. 6(1)(f) GDPR, our legitimate interest in delivering the App reliably.

8. Data Storage, Transfers and Retention

Your data is stored on servers provided by Supabase, Inc. Some data may be transferred to countries outside the European Economic Area (EEA). Where such transfers occur, they are subject to appropriate safeguards in accordance with GDPR (such as Standard Contractual Clauses).

We retain your personal data for as long as your account is active. If you delete your account from within the App, your journal entries, name and date of birth are removed immediately, not after a delay. If you instead ask us to erase your data by email, we will complete it within 30 days. In either case we may keep records we are legally required to retain, such as the transaction records Stripe holds for accounting and tax purposes.

9. Your Rights Under GDPR

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data (“right to be forgotten”).
• Right to restrict processing — request that we limit how we use your data.
• Right to data portability — request your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

You can exercise the right to erasure yourself at any time: open your account page in the App and choose Delete account. This permanently removes your account, your journal entries, your name and date of birth, and cancels any active subscription. It cannot be undone.

One item is deliberately kept after deletion: an irreversible, salted cryptographic hash of your email address, recording only that a free trial week has already been used. It is not your email address, cannot be converted back into it, and is never used to contact you or to rebuild a profile of you. Its sole purpose is to stop the same address claiming an unlimited series of free trials, which we retain on the basis of our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). If you sign up again with the same address, you continue with whatever remains of that original free week.

To exercise any of the other rights, contact us at getivp@aelux.lv. We will respond within 30 days. You also have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) at www.dvi.gov.lv.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS), access controls, and secure authentication.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a prominent notice in the App. The “Effective date” at the top of this document will always reflect the latest version.

12. Contact

For any questions or requests, contact us at getivp@aelux.lv — SIA “AE Lux”, Ezera iela 5, Talsi, Talsu nov., LV-3201, Latvia.