PRIVACY POLICY

1. Data Controller

The controller of your personal data is:

963 sp. z o.o.
ul. Aleksandra Gryglewskiego 6 lok. 8
80-303 Gdańsk
NIP: 5842878792 · REGON: 543615988 · KRS: 0001214277

For matters relating to the protection of personal data, please contact: olimpia@intuflow.pl.

2. What Data We Collect

2.1. Data provided during registration:

• E-mail address – required to create an account and log in
• Password – stored solely in encrypted form (hash) in the Supabase Auth system
• First name – required to personalise the account
• Intention (optional) – a text field in which you can describe your goal or intention related to personal development

2.2. Data created or saved while using the application:

• The account creation date and the user identifier (UUID) assigned by the Supabase Auth system
• The date and version of the accepted terms of service and privacy policy
• Answers given in the onboarding quiz, if you choose to complete it
• The content of conversations with the Lumi assistant, their abbreviated technical records and conversation memory summaries, if you use this feature
• Content published in the community – forum threads and messages on the public chat, visible to other logged-in users of the application. Published content contains your first name or the nickname displayed in your profile
• Private messages – the content of messages exchanged with other users, visible to the sender and the recipient. We do not review them unless a fragment of a message is reported to us (see “Content reports” below)
• Journal, habits and session notes – entries you create in the personal tools, visible only to you
• Genesis module – progress and answers in the exercises. If you use the “Higher Power” suggestion, selected data from your answers (and, if you enable this option in your profile, also a broader profile context) are passed to the AI model provider in order to generate the suggestion
• Date, time and place of birth – if you use the “Soul Path” analysis: we use them once to calculate the profile and to have the analysis generated by the AI model provider; we do not store them on your account
• Profile picture (avatar) – if you choose to upload one; stored in the Supabase Storage system
• Progress in courses and records of completed lessons and quizzes
• Push notification subscription token – if you consent to browser notifications; stored only until consent is withdrawn or the account is deleted
• Content reports – if you report a post, a message or an AI assistant response: your account identifier, the type and reason of the report, the identifier and a fragment of the reported content (in the case of a private message – also a fragment of that message), your comment (optional), the app language, the review status and the date of the report. The fragment of the reported content may contain data of the person who published it
• User blocks – if you block another user in private messages: a pair of identifiers (who blocked whom) and the date of the block. The blocked person does not receive a notification of the block from us

2.3. Technical data:

• IP address – to the extent necessary to ensure the security of the system
• Session data and cookies – necessary to maintain the login session
• Technical logs related to the operation of the application, security and feature usage limits
• Analytics data – pages you open, clicks, device and browser information, and an analytics identifier stored in your browser's local storage (not in cookies)
• Session recordings without content – a record of the screen layout, clicks, scrolling and technical errors. All text is masked: we record neither what you type nor what is displayed on the screen – words appear as asterisks. Details in section 6

2.4. Sensitive data:

The “intention” field, the onboarding quiz and conversations with Lumi may contain information concerning health, emotional well-being or other special category data within the meaning of Art. 9(1) GDPR. If you voluntarily enter such information, we process it solely on the basis of your explicit consent (Art. 9(2)(a) GDPR). You may withdraw this consent at any time – e.g. by deleting the content, opting out of a given feature or deleting your account.

2.5. Android app from Google Play:

• The INTUflow app available in the Google Play store opens the same web application (app.intuflow.pl) in the Chrome browser on your device (Trusted Web Activity technology). In it we process the same data, for the same purposes and on the same basis as in the browser version, as described in this Policy.
• The Google Play app does not collect any additional data from the device and does not request access to location, contacts, microphone or camera. The only system permission it may request is notifications; you can turn them off at any time in your phone settings. A profile picture reaches us only if you choose and upload a file.
• Downloading and updating the app, your Google account data and transactions in the Google Play store are handled by Google Ireland Limited as a separate data controller, on the basis of its own privacy policy (policies.google.com/privacy). We do not receive from Google any data about your Google account or your device in connection with the installation of the app – other than aggregated, anonymised statistics made available to app publishers in the Google Play Console.
• In order to display the version of the app appropriate for Google Play, we store in the browser the technical cookie app_channel (section 6.1).

3. Purposes and Legal Bases of Processing

4. Data Recipients

4.1. Your data may be transferred to the following categories of recipients:

• Supabase (Supabase Inc.) – the backend platform handling authentication and the database. Supabase may store data in data centres located within or outside the European Union, depending on the service configuration.
• Vercel (Vercel Inc.) – the hosting platform on which the application runs. Vercel may process technical data, including the IP address, as part of the hosting services provided.
• Google – a provider of the AI models used by the Lumi feature. Conversation content and the limited context necessary to generate a response may be transferred to Google.
• Anthropic – a provider of the AI models used by the Lumi feature, the “Dreams” exercise, the “Soul Path” analysis, the “Higher Power” suggestions and the translation of posts in the community. Conversation or post content and the limited context necessary to generate a response may be transferred to Anthropic.
• OpenStreetMap Foundation (Nominatim service) – receives only the name of the town or city entered in the “Soul Path” analysis, sent from our server in order to determine the coordinates and time zone, without your IP address and account data.
• Brevo (Sendinblue SAS) – a platform for sending transactional e-mail messages (registration confirmation, password reset). The user's e-mail address is transferred to Brevo in order to deliver the messages.
• Bunny.net (BunnyWay d.o.o.) – a platform for streaming the video embedded in course lessons. When playing video materials, Bunny.net may process technical connection data, including the IP address.
• PostHog (PostHog, Inc.) – a tool for application usage analytics and session recording with masked content. We use the European instance of the service, with servers in Frankfurt, so analytics data stays within the European Union. PostHog receives: the user identifier (UUID), pages opened, clicks, technical browser data and session recordings without any text content. We do not send your e-mail address, first name or any content you create in the application.
• Providers of accounting and legal services – solely to the extent necessary to fulfil the controller's obligations.

4.2. We do not transfer your data to other entities for marketing purposes, nor do we sell personal data.

4.3. Report contents may be viewed only by the application administrator in the moderation panel. We may pass a report of content that violates the law to the competent authorities if required by law.

5. Data Transfers Outside the European Economic Area (EEA)

5.1. Some of our providers, including providers of infrastructure or AI models, may process or store data outside the European Economic Area, including in the United States.

5.2. In such cases, we take measures to ensure an adequate level of data protection, in particular:

• we use Standard Contractual Clauses (SCC) approved by the European Commission, where required,
• where available and applicable, we also use other lawful transfer mechanisms, including adequacy decisions,
• we verify whether the provider offers appropriate technical and organisational safeguards,
• we monitor changes in the regulations governing transatlantic data transfers.

5.3. Since 29 July 2026, analytics data and session recordings have been processed exclusively in the European instance of PostHog, on servers in Frankfurt. Previously they were sent to that provider's servers in the United States; after the migration this data does not leave the European Economic Area.

6. Cookies and Similar Technologies

6.1. The INTUflow Application uses cookies and similar technologies solely for technical purposes necessary for the proper functioning of the application:

• Session cookies – used to maintain the user's login session. They are deleted after logging out or closing the browser.
• Third-party cookies – Supabase and Vercel may set their own technical cookies necessary for the operation of their services.
• app_channel cookie – stored only in the app installed from Google Play; it remembers that you are using this version of the app, in order to display the features appropriate for it. It contains no personal data and is stored for up to 12 months.

6.2. Analytics and session recording. The application uses PostHog in order to know which features are used and where errors occur. It does not set cookies – the analytics identifier is stored in your browser's local storage and is not attached to requests sent to our server.

6.3. Session recordings contain no text at all. Both what you type and what is displayed on the screen are masked – in the recording, words are replaced by asterisks. This means the recording does not contain the content of your journal, your conversations with Lumi, forum posts or quiz answers. What remains visible is: page layout, clicks, scrolling, transitions between screens and technical error messages.

6.4. The application does not use cookies or any other marketing technologies, does not profile you for advertising purposes and does not transfer data to advertising networks.

6.5. You can manage cookie settings in your browser. However, disabling cookies may prevent proper login and use of the application.

7. Data Retention Period

• Analytics data and session recordings – analytics events are kept for no longer than 12 months and session recordings for about 30 days, after which they are automatically deleted by the service provider. You may object to this processing at any time by writing to the address given in section 1.
• Account data – we store it for the duration of your use of the application. After the account is deleted, the account data, profile picture and push notification token are permanently deleted. We also delete your email address from the contact database of our email delivery provider (Brevo). Content published in the community (forum threads, chat messages) is anonymised – the author's name is replaced with the designation “Deleted user”, and the content remains visible in order to preserve the coherence of the conversations. Data stored solely for the purpose of defending against claims is deleted after the limitation period has elapsed (as a rule, up to 6 years in accordance with Article 118 of the Polish Civil Code).
• Onboarding answers, intention and data saved for feature personalisation – as a rule, for the duration of the account or until earlier deletion by you, subject to data necessary to defend against claims.
• Legal document acceptance logs – for the period needed to demonstrate when and which version of the documents was accepted, no longer than the limitation period for claims.
• Data related to Lumi – for the time needed to operate the feature, personalise responses and retain the technical history, as a rule for the duration of the active account or until it is deleted earlier in accordance with the applicable process.
• Content reports – for the duration of the handling of the report and 12 months after its closure (the taking of a decision), and if the report is needed for defence against claims or in proceedings before an authority – until their conclusion. After the reporter’s account is deleted, the report remains unlinked to their account.
• User blocks – until unblocking or deletion of the account of either party.
• Private messages – until the account of the sender or the recipient is deleted; deleting an account deletes the conversation for both parties.
• Technical data and logs – for a period no longer than necessary to ensure the security of the system, and no longer than 12 months.
• Sensitive data voluntarily entered by the user – until the account is deleted or consent is withdrawn, subject to the limitation period for claims.

8. Your Rights

Under the GDPR, you have the following rights:

• Right of access – you can obtain information about what data of yours we process, as well as a copy of that data.
• Right to rectification – you can request the rectification of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) – you can request the deletion of your data if there is no legal basis for its further processing.
• Right to restriction of processing – you can request the temporary restriction of data processing in certain situations.
• Right to data portability – you can receive your data in a structured format and transfer it to another controller.
• Right to object – you can object to processing based on the controller's legitimate interest.
• Right to withdraw consent – in the case of sensitive data, you can withdraw your consent at any time.
• Right to lodge a complaint – if you believe that the processing infringes the provisions of the GDPR, you may lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa).

To exercise the above rights, write to: olimpia@intuflow.pl. We respond, as a rule, within 30 days.

9. Contact

For matters relating to the protection of personal data, this Privacy Policy or the exercise of your rights, please contact us:

E-mail: olimpia@intuflow.pl
Correspondence address: 963 sp. z o.o., ul. Aleksandra Gryglewskiego 6 lok. 8, 80-303 Gdańsk.

10. Changes to the Privacy Policy

10.1. This Privacy Policy may be updated in the event of legal, technical or organisational changes.

10.2. We will inform users of the application of any significant changes by means of a notification in the application or an e-mail message.

10.3. We recommend that you regularly review this Policy.