Privacy Policy

Summary

We collect only what the Service needs: your account details, your learning activity, and the interests and quiz answers you give us.

We do not sell your data, show third-party advertising, or use advertising or analytics trackers. Our website sets no cookies.

Your app data is stored in the European Union (Ireland).

Your journal is private. What you write there is stored only so that you can read it again. We do not read or analyse it, and we never share it with any AI service.

You can access, export, correct and delete your data at any time, including deleting your account from inside the app.

ASIRAL is designed for and intended to be used by adults aged 18 years and over.

1. Who is responsible for your data

1.1 Controller

The controller of your personal data is:

Larisa Fechete, MA trading as ASIRAL (sole proprietorship), Keldorfergasse 11/6, 1100 Vienna, Austria. Email: privacy@asiral.ai. GISA number: 40105383

Larisa Fechete is also the person in charge of the protection of personal information for the purposes of Canadian and Quebec privacy law. You can reach her at privacy@asiral.ai.

1.2 Data Protection Officer

ASIRAL is not required to appoint a Data Protection Officer under Article 37 of the General Data Protection Regulation (GDPR), as it does not carry out large-scale monitoring or large-scale processing of special categories of data.

2. Which laws apply

ASIRAL is established in Austria. Our processing of personal data is therefore governed by the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Austrian Data Protection Act (Datenschutzgesetz, DSG) and, for cookies and similar technologies, section 165 of the Austrian Telecommunications Act 2021 (TKG 2021). What this means for you:

2.1 The GDPR protects you wherever you live

The GDPR applies to all processing carried out in the context of a business established in the EU, whether or not the processing takes place in the EU (Art. 3(1) GDPR), and it protects people regardless of their nationality or place of residence (Recital 14 GDPR). Every ASIRAL user, whether in Europe, the United States, Canada or elsewhere, therefore has the full protection and rights described in this policy.

2.2 Your local law may give you additional rights

Depending on where you live, the privacy law of your own country may also apply, for example the laws of US states, Canada and Quebec, the United Kingdom, Switzerland or India. It does not replace the GDPR, but it may add further rights or a complaint authority in your own country. Section 12 sets out these additions country by country, so you know which extra rights you have and which authority you can contact.

3. What data we collect

3.1 Setting up your account

When you register, we collect your email address and your first and last name, and you choose a password. We store your password only as a secure hash, so we can never read it. As part of registration, we also ask for your date of birth to verify that you meet the minimum age of 18 years required to use ASIRAL (see section 13). We do not store your full date of birth: we keep only your year of birth and the time of the age check. We also use your year of birth for general statistics, for example how many of our users are between 25 and 34 years old. These statistics only ever show groups of users, never you as a person, and help us create content that suits our audience (see section 5.2). Our systems also record when your account was created, whether your email address has been confirmed, and when you last signed in. We also store your timezone, so that your streaks, journal entries and other features based on days follow your local calendar day.

3.2 Personalising your learning

To suggest the lessons that suit you, we use three kinds of information.

During onboarding, you tell us which interest areas you enjoy. In the Archetype quiz, which is explained in detail in the next section (section 4), your answers produce trait scores and a recommended Archetype with alternatives, from which you choose your own. Together, these build your personalised lesson journey.

As you use the app, we also record your learning activity: the lessons and steps you start and complete, your progress and time spent, your quiz answers, points and confidence ratings, your bookmarks and badges, the days you are active (for streaks), and any feedback you give on a lesson. This lets you continue where you left off, see your progress, and receive suggestions that fit your journey.

3.3 Your journal and reflections

If you use the journal, we store the entries you write there and the reflections you add to lessons, so that you can read them again (see section 6).

3.4 Contacting us

When you email us, at privacy@asiral.ai or support@asiral.ai, we receive your email address and the content of your message.

3.5 Subscriptions

When you buy a subscription in the app, Apple or Google confirms the purchase to us through RevenueCat (see section 7). We receive whether you have premium access and for which product, a transaction ID, the purchase, renewal and expiry dates, the status (active, cancelled or refunded), and the store country and price.

3.6 Technical data

Whenever your device connects to our website or servers, our hosting providers automatically record technical data: your IP address and the approximate location derived from it (country and city), your device and browser type, operating system and app version, the page you came from, the pages or features requested, the time of each request, sign-in events, and error messages.

3.7 What we do not collect

We do not collect your precise location, contacts, photos, microphone or camera data, advertising identifiers, or payment card details. We do not ask for health information or other special categories of data, and we do not buy data about you from third parties.

3.8 Is providing data mandatory?

To create an account, you must provide your email address, a password, your first and last name, and your date of birth. These are required because the Service is account-based and available only to adults. Your interests and Archetype quiz answers are needed to personalise your learning journey. Using the journal, reflections, bookmarks and lesson feedback is entirely optional.

4. Your Archetype and personalised journey

To personalise your learning, ASIRAL uses your answers to a short quiz and the interests you select to recommend a learning Archetype and to suggest the lessons that suit you best. This is a form of profiling.

You always choose your Archetype yourself, and you can retake the quiz or change your Archetype at any time. The result only affects which lessons are suggested first. It never restricts access to content, is not used for pricing or advertising, and has no legal or similarly significant effects for you, so it is not an automated decision within the meaning of Article 22 GDPR. You can ask us to delete your quiz results at any time.

Your Archetype is a learning aid, not a psychological assessment.

5. Purposes and legal bases

5.1 Providing the Service

• Your account. We create and manage your account, sign you in and send account emails such as confirmation and password reset. We also use your email address to send you important service messages, for example about changes to this policy, our terms or your account. Legal basis: performance of a contract, Art. 6(1)(b) GDPR; for notices we are legally required to send, legal obligation, Art. 6(1)(c) GDPR.
• Age verification. We check your date of birth at registration to confirm that you are at least 18, and keep only your year of birth and the time of the check. Legal basis: necessary to enter into the contract, Art. 6(1)(b) GDPR, and our legitimate interest in ensuring that the Service, which includes content about alcoholic beverages, is used only by adults, Art. 6(1)(f) GDPR.
• Lessons and progress. We provide lessons and save your progress, bookmarks, badges and streaks, using your timezone so that days follow your local calendar. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
• Your personalised journey. We use your interests and quiz answers to provide the personalised learning journey you request, including your Archetype recommendation and the order of suggested lessons. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
• Your journal. We store your journal and reflections and show them back to you. Legal basis: performance of a contract, Art. 6(1)(b) GDPR; for sensitive information you choose to include, your explicit consent, Art. 9(2)(a) GDPR (see section 6).
• Premium access. We unlock premium features after an in-app purchase. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
• Your enquiries. We answer the questions and requests you send us by email, and keep a record of privacy requests to demonstrate that we handled them correctly. Legal basis: performance of a contract, Art. 6(1)(b) GDPR; our legitimate interest in responding to enquiries, Art. 6(1)(f) GDPR; for privacy requests, our legal obligation to handle them and to be able to demonstrate compliance, Art. 6(1)(c) in conjunction with Art. 5(2) and Art. 12 GDPR.

5.2 Security and improvement

• Security. We use technical data to deliver the website and app securely, prevent abuse, and find and fix errors. Legal basis: our legitimate interest in a secure, working Service, Art. 6(1)(f) GDPR.
• Better lessons. We improve our content using aggregated statistics that do not identify you, for example about which lessons are popular and which age ranges use ASIRAL, and the feedback you give on lessons. You may object to this use at any time. Legal basis: our legitimate interest in understanding our audience and improving our content, Art. 6(1)(f) GDPR.

5.3 Legal obligations

• Tax records. We keep accounting records based on Apple's and Google's sales reports. Legal basis: legal obligation, Art. 6(1)(c) GDPR, together with section 132 of the Austrian Federal Fiscal Code (BAO).
• Legal requests and claims. We comply with legal requests and establish, exercise or defend legal claims. Legal basis: legal obligation, Art. 6(1)(c) GDPR, and legitimate interest, Art. 6(1)(f) GDPR.

Where we rely on legitimate interest, you may object at any time (section 11). Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

6. Your private journal

What you write in your journal and lesson reflections is stored only so that you can return to it.

• We do not read, analyse or mine your journal. It is not used for your Archetype, for recommendations, for statistics or for marketing.
• It is not sent to any AI service or other third party, apart from our hosting provider, which stores it encrypted on our behalf (section 8).
• Access is restricted so that only your signed-in account can read your entries. ASIRAL accesses the database only where strictly necessary for maintenance or security.
• Sensitive information: we never ask for it, but you may write about anything, including health, beliefs or relationships. When you first activate the journal, we ask for your explicit consent to store any such information you choose to include, for the sole purpose of providing your private journal (Art. 9(2)(a) GDPR). You can use the rest of ASIRAL without the journal, and you can withdraw your consent at any time by deleting the journal entries concerned or your account.

7. In-app purchases

ASIRAL Premium is sold only as an in-app purchase through the Apple App Store or Google Play. Apple or Google is the seller and processes the payment: your name, payment card, billing address and receipt remain with them under their own privacy policies. We never see or store your payment details.

When you buy or renew a subscription, Apple or Google confirms the purchase to RevenueCat, our subscription service, which passes the result to us. We store only the subscription data listed in section 3.5 and link it to your account so that premium access works on all your devices. RevenueCat identifies you only by a random account ID, not by your name or email address.

Cancellations and refunds are handled by Apple or Google. You can manage your subscription in your Apple ID settings or in Google Play under Subscriptions. Deleting your ASIRAL account does not cancel a subscription.

8. Service providers and recipients

We do not sell or rent personal data and do not share it for advertising. We share it only with the following recipients, and in the cases described in section 8.3:

8.1 Service providers

These providers process data on our behalf:

• Supabase (Supabase Pte. Ltd., Singapore, and its affiliates, including Supabase Inc., USA, using Amazon Web Services): app database, accounts and sign-in, server functions and file storage. Data is stored in the EU (Ireland), with limited access from outside the EU (section 9). Privacy policy: supabase.com/privacy
• Cloudflare, Inc. (USA): hosting and delivery of our website, and protection against attacks, through its global network (section 9). Privacy policy: www.cloudflare.com/privacypolicy
• RevenueCat, Inc. (USA): verifying in-app purchases and premium status. Data is stored in the USA (section 9). Privacy policy: www.revenuecat.com/privacy
• Google (Google Ireland Ltd for users in the EU; Gmail): receiving and answering the emails you send us. Privacy policy: policies.google.com/privacy

8.2 App stores

Apple and Google decide independently how they process your payment data, under their own privacy policies:

• Apple Inc. (App Store): selling and billing subscriptions on iPhone and iPad. Privacy policy: www.apple.com/legal/privacy
• Google (Google Play): selling and billing subscriptions on Android. Privacy policy: policies.google.com/privacy

Our processors act only on our instructions and are bound by data processing agreements under Article 28 GDPR.

8.3 Other disclosures

Beyond the service providers and app stores listed above, we disclose personal data to third parties only where the law permits it, in particular:

• Legal obligation: where we are legally required to do so, for example under a binding order of a court or public authority (Art. 6(1)(c) GDPR).
• Legal claims: where necessary to establish, exercise or defend legal claims (Art. 6(1)(f) and Art. 9(2)(f) GDPR).
• Vital interests: where necessary to protect the life or physical safety of a person in an emergency (Art. 6(1)(d) and Art. 9(2)(c) GDPR).
• Business transfer: if the ASIRAL business is sold or transferred, to the acquirer, based on our legitimate interest (Art. 6(1)(f) GDPR). The acquirer remains bound by this policy, and we will inform you before your data is processed in any other way.

9. International data transfers

Your data is transferred only to the service providers named in section 8, only to the extent needed to run the Service, and never for sale or advertising:

• App data (account, learning activity, Archetype, journal, year of birth, timezone) is stored in the European Union (Ireland). Our hosting provider Supabase may access it from outside the EU only to operate and maintain the systems.
• Purchase data (a random account ID, transaction details and basic device information) is processed by RevenueCat in the United States.
• Connection data (IP address and technical data) is handled by Cloudflare's global network when you use our website or app.

Transfers outside the European Economic Area are protected by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), and, where a provider is certified, by the EU-US Data Privacy Framework. These safeguards are part of each provider's published data processing agreement: Supabase supabase.com/legal/dpa, RevenueCat www.revenuecat.com/dpa and Cloudflare www.cloudflare.com/cloudflare-customer-dpa.

If you use ASIRAL from outside the EU, your data is transferred to the EU and processed under the GDPR.

10. How long we keep your data

10.1 Your account and app data

• Account, profile, learning activity, Archetype, journal, reflections and subscription data: kept for as long as your account exists. When you delete your account, this data is deleted immediately. Remaining copies in our backups are overwritten automatically (see Backups below).
• Backups: overwritten on a rolling basis within 7 days. Deleted data disappears from backups after that period.
• Technical logs: deleted automatically by our hosting providers after a short period.

10.2 Communication

• Emails you send us: kept for up to three years after your request has been handled, also if you delete your account.

10.3 Legal and statistical records

• Accounting and tax records: generally seven years, and longer where needed for pending tax proceedings (section 132 BAO). These are based on Apple's and Google's sales reports, which do not identify you by name.
• Aggregated statistics: may be kept indefinitely, as they do not identify you.

11. Your rights

11.1 Your rights under the GDPR

Under the GDPR you have the right to:

• access your personal data and receive a copy (Art. 15 GDPR)
• rectify inaccurate data (Art. 16 GDPR); most of it you can edit directly in the app
• erase your data (Art. 17 GDPR); the simplest way is to delete your account (see 11.2)
• restrict processing in certain cases (Art. 18 GDPR)
• data portability: receive your data in a structured, machine-readable format or have it sent to another provider (Art. 20 GDPR)
• object to processing based on legitimate interest (Art. 21 GDPR)
• withdraw consent at any time where we rely on your consent, namely for sensitive information in your journal (Art. 7(3) GDPR). For the journal, you withdraw consent by deleting the entries concerned or your account. Withdrawal ends only that specific use; the rest of the Service is not affected

To exercise your rights, write to privacy@asiral.ai from the email address linked to your account. We may ask you to confirm your identity. We respond within one month; for complex requests this may be extended by up to two further months, in which case we will tell you why. Exercising your rights is free of charge.

11.2 Deleting your account

You can delete your account and all associated data at any time in the app under Profile > Privacy > Delete My Account. If you no longer have access to the app, you can also request deletion by email to privacy@asiral.ai.

Subscriptions are managed separately. Subscriptions are sold and billed by Apple or Google, not by ASIRAL. Deleting your account does not cancel an active subscription. Please cancel it first in your App Store or Google Play subscription settings; otherwise you may continue to be charged.

11.3 Right to lodge a complaint

Pursuant to Article 77 GDPR, every user who considers that the processing of their personal data by ASIRAL infringes the GDPR has the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of their habitual residence, place of work or place of the alleged infringement. Our competent authority is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at. We would appreciate the opportunity to address your concern first, so please feel free to contact us at privacy@asiral.ai. For questions about the app itself, lessons or subscriptions, please contact support@asiral.ai.

12. Information for users in specific countries

The rights in section 11 apply to all users. The following information applies in addition.

12.1 United States

We do not sell or share personal information, and we do not use it for targeted advertising. Where the privacy law of your state grants you additional rights, contact us and we will honour them as that law requires.

12.2 Canada

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector. You have the right to access and correct your personal information and to withdraw consent. Our person in charge of the protection of personal information is named in section 1. Your information is stored and processed outside Canada, mainly in the European Union and the United States (section 9), where it may be accessible to courts and authorities under local law. The competent authorities in Canada are the Office of the Privacy Commissioner of Canada and, for Quebec, the Commission d'accès à l'information.

12.3 United Kingdom

You have the rights described in section 11 under the UK GDPR. The competent supervisory authority in the United Kingdom is the Information Commissioner's Office (ico.org.uk).

12.4 Switzerland

You have corresponding rights under the Swiss Federal Act on Data Protection. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

12.5 India

The Digital Personal Data Protection Act, 2023 and its Rules are being brought into force in stages. We will apply their requirements as they take effect. For any questions about your personal data, contact privacy@asiral.ai.

12.6 All other countries

Users in all other countries benefit from the protection described in this policy, which is based on the GDPR and applies to all users regardless of where they live.

13. Age requirement

ASIRAL is designed for and intended to be used by adults. You must be at least 18 years old to create an account. To verify this, we ask for your date of birth when you register, and you cannot complete registration if you are under 18. Some lessons cover alcoholic beverages, including wine, champagne, cocktails and spirits. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we will delete it. If you believe a minor has given us personal data, please contact us.

14. Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections (TLS/HTTPS), encryption of stored data, access controls that limit each user to their own records, secure password hashing, restricted administrative access with strong authentication, and data minimisation.

The service providers that process personal data on our behalf (section 8) are bound by data processing agreements and maintain independently audited security programmes, such as SOC 2 Type II (Supabase, RevenueCat) and ISO/IEC 27001 (Cloudflare).

No system is completely secure. If a personal data breach is likely to result in a risk to your rights, we will notify the Austrian Data Protection Authority within 72 hours of becoming aware of it (Art. 33 GDPR), and inform you without undue delay where the risk is high (Art. 34 GDPR). Where other applicable laws require notification, for example in Canada, we will notify the competent authorities and affected users as those laws require.

15. Cookies and device storage

15.1 Website

asiral.ai sets no cookies, does not use your browser's storage, and does not load fonts, videos, scripts or other content from third parties. We use no analytics or tracking tools. Our hosting provider Cloudflare may set a strictly necessary security cookie to protect the site against attacks.

15.2 App

The ASIRAL app stores a sign-in token and basic settings on your device so that you stay signed in.

15.3 No consent needed

Both are strictly necessary to provide the service you requested and therefore do not require consent under section 165(3) TKG 2021. If we ever introduce analytics or other non-essential technologies, we will ask for your consent first and update this policy.

16. Changes to this policy

We will update this policy when the Service or the law changes. The effective date at the top shows the current version. If we make material changes, we will inform you in the app or by email before they take effect.

17. Contact

For any questions about this policy or your personal data:

Larisa Fechete, MA, Keldorfergasse 11/6, 1100 Vienna, Austria. privacy@asiral.ai