PRIVACY POLICY

1. Data Controller

The controller of your personal data is:

963 sp. z o.o.
ul. Aleksandra Gryglewskiego 6 lok. 8
80-303 Gdańsk
NIP: 5842878792 · REGON: 543615988 · KRS: 0001214277

For matters relating to the protection of personal data, please contact: olimpia@intuflow.pl.

2. What Data We Collect

2.1. Data provided during registration:

• E-mail address – required to create an account and log in
• Password – stored solely in encrypted form (hash) in the Supabase Auth system
• First name – required to personalise the account
• Intention (optional) – a text field in which you can describe your goal or intention related to personal development

2.2. Data created or saved while using the application:

• The account creation date and the user identifier (UUID) assigned by the Supabase Auth system
• The date and version of the accepted terms of service and privacy policy
• Answers given in the onboarding quiz, if you choose to complete it
• The content of conversations with the Lumi assistant, their abbreviated technical records and conversation memory summaries, if you use this feature
• Content published in the community – forum threads and messages on the public chat, visible to other logged-in users of the application. Published content contains your first name or the nickname displayed in your profile
• Profile picture (avatar) – if you choose to upload one; stored in the Supabase Storage system
• Progress in courses and records of completed lessons and quizzes
• Push notification subscription token – if you consent to browser notifications; stored only until consent is withdrawn or the account is deleted

2.3. Technical data:

• IP address – to the extent necessary to ensure the security of the system
• Session data and cookies – necessary to maintain the login session
• Technical logs related to the operation of the application, security and feature usage limits
• Analytics data – pages you open, clicks, device and browser information, and an analytics identifier stored in your browser's local storage (not in cookies)
• Session recordings without content – a record of the screen layout, clicks, scrolling and technical errors. All text is masked: we record neither what you type nor what is displayed on the screen – words appear as asterisks. Details in section 6

2.4. Sensitive data:

The “intention” field, the onboarding quiz and conversations with Lumi may contain information concerning health, emotional well-being or other special category data within the meaning of Art. 9(1) GDPR. If you voluntarily enter such information, we process it solely on the basis of your explicit consent (Art. 9(2)(a) GDPR). You may withdraw this consent at any time – e.g. by deleting the content, opting out of a given feature or deleting your account.

3. Purposes and Legal Bases of Processing

4. Data Recipients

4.1. Your data may be transferred to the following categories of recipients:

• Supabase (Supabase Inc.) – the backend platform handling authentication and the database. Supabase may store data in data centres located within or outside the European Union, depending on the service configuration.
• Vercel (Vercel Inc.) – the hosting platform on which the application runs. Vercel may process technical data, including the IP address, as part of the hosting services provided.
• Google – a provider of the AI models used by the Lumi feature. Conversation content and the limited context necessary to generate a response may be transferred to Google.
• Anthropic – a provider of the AI models used by the Lumi feature. Conversation content and the limited context necessary to generate a response may be transferred to Anthropic.
• Brevo (Sendinblue SAS) – a platform for sending transactional e-mail messages (registration confirmation, password reset). The user's e-mail address is transferred to Brevo in order to deliver the messages.
• Bunny.net (BunnyWay d.o.o.) – a platform for streaming the video embedded in course lessons. When playing video materials, Bunny.net may process technical connection data, including the IP address.
• PostHog (PostHog, Inc.) – a tool for application usage analytics and session recording with masked content. We use the European instance of the service, with servers in Frankfurt, so analytics data stays within the European Union. PostHog receives: the user identifier (UUID), pages opened, clicks, technical browser data and session recordings without any text content. We do not send your e-mail address, first name or any content you create in the application.
• Providers of accounting and legal services – solely to the extent necessary to fulfil the controller's obligations.

4.2. We do not transfer your data to other entities for marketing purposes, nor do we sell personal data.

5. Data Transfers Outside the European Economic Area (EEA)

5.1. Some of our providers, including providers of infrastructure or AI models, may process or store data outside the European Economic Area, including in the United States.

5.2. In such cases, we take measures to ensure an adequate level of data protection, in particular:

• we use Standard Contractual Clauses (SCC) approved by the European Commission, where required,
• where available and applicable, we also use other lawful transfer mechanisms, including adequacy decisions,
• we verify whether the provider offers appropriate technical and organisational safeguards,
• we monitor changes in the regulations governing transatlantic data transfers.

5.3. Since 29 July 2026, analytics data and session recordings have been processed exclusively in the European instance of PostHog, on servers in Frankfurt. Previously they were sent to that provider's servers in the United States; after the migration this data does not leave the European Economic Area.

6. Cookies and Similar Technologies

6.1. The INTUflow Application uses cookies and similar technologies solely for technical purposes necessary for the proper functioning of the application:

• Session cookies – used to maintain the user's login session. They are deleted after logging out or closing the browser.
• Third-party cookies – Supabase and Vercel may set their own technical cookies necessary for the operation of their services.

6.2. Analytics and session recording. The application uses PostHog in order to know which features are used and where errors occur. It does not set cookies – the analytics identifier is stored in your browser's local storage and is not attached to requests sent to our server.

6.3. Session recordings contain no text at all. Both what you type and what is displayed on the screen are masked – in the recording, words are replaced by asterisks. This means the recording does not contain the content of your journal, your conversations with Lumi, forum posts or quiz answers. What remains visible is: page layout, clicks, scrolling, transitions between screens and technical error messages.

6.4. The application does not use cookies or any other marketing technologies, does not profile you for advertising purposes and does not transfer data to advertising networks.

6.5. You can manage cookie settings in your browser. However, disabling cookies may prevent proper login and use of the application.

7. Data Retention Period

• Analytics data and session recordings – analytics events are kept for no longer than 12 months and session recordings for about 30 days, after which they are automatically deleted by the service provider. You may object to this processing at any time by writing to the address given in section 1.
• Account data – we store it for the duration of your use of the application. After the account is deleted, the account data, profile picture and push notification token are permanently deleted. Content published in the community (forum threads, chat messages) is anonymised – the author's name is replaced with the designation “Deleted user”, and the content remains visible in order to preserve the coherence of the conversations. Data stored solely for the purpose of defending against claims is deleted after the limitation period has elapsed (as a rule, up to 6 years in accordance with Article 118 of the Polish Civil Code).
• Onboarding answers, intention and data saved for feature personalisation – as a rule, for the duration of the account or until earlier deletion by you, subject to data necessary to defend against claims.
• Legal document acceptance logs – for the period needed to demonstrate when and which version of the documents was accepted, no longer than the limitation period for claims.
• Data related to Lumi – for the time needed to operate the feature, personalise responses and retain the technical history, as a rule for the duration of the active account or until it is deleted earlier in accordance with the applicable process.
• Technical data and logs – for a period no longer than necessary to ensure the security of the system, and no longer than 12 months.
• Sensitive data voluntarily entered by the user – until the account is deleted or consent is withdrawn, subject to the limitation period for claims.

8. Your Rights

Under the GDPR, you have the following rights:

• Right of access – you can obtain information about what data of yours we process, as well as a copy of that data.
• Right to rectification – you can request the rectification of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) – you can request the deletion of your data if there is no legal basis for its further processing.
• Right to restriction of processing – you can request the temporary restriction of data processing in certain situations.
• Right to data portability – you can receive your data in a structured format and transfer it to another controller.
• Right to object – you can object to processing based on the controller's legitimate interest.
• Right to withdraw consent – in the case of sensitive data, you can withdraw your consent at any time.
• Right to lodge a complaint – if you believe that the processing infringes the provisions of the GDPR, you may lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa).

To exercise the above rights, write to: olimpia@intuflow.pl. We respond, as a rule, within 30 days.

9. Contact

For matters relating to the protection of personal data, this Privacy Policy or the exercise of your rights, please contact us:

E-mail: olimpia@intuflow.pl
Correspondence address: 963 sp. z o.o., ul. Aleksandra Gryglewskiego 6 lok. 8, 80-303 Gdańsk.

10. Changes to the Privacy Policy

10.1. This Privacy Policy may be updated in the event of legal, technical or organisational changes.

10.2. We will inform users of the application of any significant changes by means of a notification in the application or an e-mail message.

10.3. We recommend that you regularly review this Policy.