Privacy Policy — Daily Stoic Notes

This Privacy Policy explains how Northfacestudios Ltd ("we", "us"), the data controller, processes your personal data when you use Daily Stoic Notes and Stoic Journal (the "Service"). We follow the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act.

1. Data we collect

Account data: email address, hashed password (or Google OAuth identifier), account creation date.
Journal content: entries and AI reflections you create.
Subscription data: plan, status, trial end date, Stripe customer and subscription IDs. Card details are handled solely by Stripe and never reach our servers.
Technical data: IP address, browser type, and standard server logs used for security and troubleshooting.

2. Why we process it (legal bases)

Contract: to provide the Service you signed up for (Art. 6(1)(b) GDPR).
Legitimate interest: to keep the Service secure, prevent abuse, and improve reliability (Art. 6(1)(f)).
Legal obligation: to keep accounting records where required (Art. 6(1)(c)).

3. Processors (subprocessors)

We use trusted providers to run the Service. They act as processors on our behalf:

Supabase — hosting, database, authentication (EU region).
Stripe — payment processing.
Google (Gemini via Lovable AI Gateway) — generating reflections from the entry text you submit at the moment you press the button. We do not send your entries to Google for model training.
Lovable — application hosting and delivery.

4. AI reflections

When you request a reflection, the text of that specific entry is sent to the AI provider to generate a response, then returned and stored under your account. We do not use your journal content to train AI models and we do not share it with any party for advertising or profiling.

5. Retention

Journal entries and reflections: kept until you delete them or delete your account.
Account data: kept for the life of the account plus up to 30 days after deletion for backups.
Invoicing records: kept for 6 years as required by Finnish accounting law.

6. Your rights

You have the right to:

access, correct, or delete your personal data;
export your data in a portable format;
object to or restrict certain processing;
withdraw consent where processing is based on consent;
lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

To exercise any of these rights, email northfacestudios@gmail.com.

7. Cookies

We use only strictly necessary cookies and local storage for authentication and to remember your language preference. We do not use tracking or advertising cookies.

8. International transfers

Our primary storage is in the EU. Some processors (e.g. Stripe, Google) may transfer data outside the EEA under Standard Contractual Clauses approved by the European Commission.

9. Changes

We will post any changes to this policy on this page and update the "Last updated" date.

10. Controller

Northfacestudios Ltd · Finland
Business ID: [to be added]
Email: northfacestudios@gmail.com