Privacy Policy

1. Introduction

This Privacy Policy explains how Smart Digital SRL ("SelfOS", "we") processes personal data when you use SelfOS. For direct-to-consumer accounts and our own operational, security, billing, product, and compliance activities, Smart Digital SRL generally acts as controller. For certain processing performed solely on an organization's documented instructions, the organization may be the controller and Smart Digital SRL its processor. The exact role depends on the processing purpose, not simply on who pays for the account.

2. Data We Collect

Depending on the features you choose or that your organization enables, we may process the following categories of personal data:

• Account, identity and organization data: name, email, profile details, locale, account role, organization membership, department, coach relationship and settings you provide
• Personal development content: habits and habit logs, goals and milestones, daily check-ins (priority, gratitude note, focus, reflection), weekly reviews, life-area (LADI) self-assessments and targets, journal entries, community posts and reactions, challenges, points, badges and rewards.
• Health and wellbeing information you choose to enter or connect. Usage data about how you live and train, such as mood, stress and energy ratings, self-reported sleep, workouts, meals, body measurements, data from a connected device (for example heart rate), goals, habits and check-ins, is saved and used to provide the service. Medical information (allergies, intolerances and health conditions you choose to add) is special-category health data under GDPR Article 9 and is saved and used only with your optional consent.
• Personal finance data you choose to enter: financial goals (target, current amount, deadline), monthly budget and income, expenses and your preferred currency. Card data is handled by Stripe, not stored by SelfOS.
• Work context, if you joined through an employer: the answers you give about your work rhythm and model, workload, ability to switch off and support at work. These answers are for your own coaching and are never shown to your employer.
• Life Profile: the answers you choose to give about yourself and your everyday life, for example how you usually work, what a typical day looks like for you, how you have been sleeping lately or who you would like to spend more time with. For each answer we keep where it came from (your onboarding answers, a Life Profile form, the question of the day or a conversation with KAI) and when you gave it or last confirmed it is still true. An answer from a conversation with KAI is saved only after you confirm it, together with the others from that conversation, in a single step. You can change or delete any answer at any time. The Life Profile does not ask for diagnoses, allergies, intolerances, conditions or other medical details. Please enter that information in your Health Profile, where saving it and using it to personalise KAI's recommendations depend on your single, optional consent for medical data. We apply automated checks to free-text Life Profile answers before they are saved or included in KAI's context. If we find indications that an answer contains medical information, it is refused. Automated checks have limits and cannot identify every case. We use the information in your Life Profile to personalise the coaching features you request. To the extent the processing is objectively necessary to provide those features, the legal basis is performance of a contract (Art. 6(1)(b) GDPR). Processing of medical information in the Health Profile is treated separately, under the rules and consent that apply to it. Your Life Profile is private. The page and its answers are not automatically accessible to your coach or your organisation. KAI may use relevant information for your recommendations, under the conditions explained in the section on AI processing. Information you explicitly choose to share with a coach is managed through separate permissions.
• KAI conversations: the messages you write to KAI (including voice messages converted to text, where available), KAI's replies, your feedback on replies, and your KAI preferences (coaching style, tone, check-in time, topics to focus on or avoid).
• Coaching data, if you work with a coach: the relationship and the permissions you grant, bookings and session times, notes you add to a booking, and the notes and session summaries your coach writes.
• Billing data: plan, subscription status and history, payment records, card brand and card country (from Stripe), vouchers and sponsored access, refunds and disputes, and for organisations their fiscal identification and billing address.
• Usage and Product Data: feature usage, settings, consent records, support interactions, security events, and product analytics where you have enabled analytics cookies.
• Technical Data: IP address, device/browser information, authentication/session data, security logs, and cookie or local-storage identifiers necessary to operate the Service or used with your consent.
• Approximate location: your country only, as reported by our hosting provider's edge network (Vercel) from your connection. We use it to show prices in your currency and keep the result privately in your browser for 1 hour. No third party looks up your IP address, and we do not collect your city, region or precise location.
• Contact data you add: phone number (for verification or SMS notifications) and postal address (for invoices or physical deliveries).
• Integration data: identifiers, encrypted access credentials and the data you allow when you connect an optional service such as Google sign-in, Google Calendar, Google Meet (coaches) or, when offered, a health or wearable provider.

You need to give your name, email and a password (or a sign-in provider) to create an account, and billing data to buy a paid plan; without them we cannot provide the account or the purchase. Everything else is optional. If you leave it out, the related feature simply works with less personalisation.

3. How We Use Your Data

We use your data for the following purposes:

• To create and operate your account, provide requested features, synchronize data, deliver subscriptions and support, and perform our contract with you or our customer organization
• To personalize the Service and, where enabled, provide AI-generated coaching, plans, summaries, and insights. AI processing is not used by SelfOS to make employment, credit, insurance, medical, or other decisions producing legal or similarly significant effects about you.
• To show you your progress and, if your account is sponsored by an organisation, to produce only the information described in section 5.2.
• To provide KAI, your AI coach, as described in section 5.1.
• To send service, security, billing and requested notification messages and, only where permitted, marketing communications
• To send reminders, check-ins and suggestions based on your activity in SelfOS (for example, when you have not opened a habit for some time). You can change or switch these off in your notification and KAI settings, and you can object at any time (section 6).
• To show prices in the right currency on our public pages, using the country reported by our hosting provider's edge network (country only, cached privately in your browser for 1 hour).
• To maintain, debug, measure and improve the Service using data minimisation and consent-gated analytics where required
• To authenticate users, enforce permissions, prevent fraud and abuse, investigate incidents, protect users and comply with legal obligations

4. Data Storage and Security

Our database (Supabase) and our application servers (Vercel functions, Stockholm region) are located in the European Union. We use access controls, row-level security, encryption in transit, encrypted storage of integration credentials, security logging and least-privilege design. No online service can guarantee absolute security, and we review safeguards as the Service changes. Some service providers process data outside the EU; see section 13.

5. Data Sharing

We do not sell personal data. We disclose personal data only where there is a lawful basis and the recipient needs it for the stated purpose, including:

• With a coach you choose, only for the categories you allow (see section 5.3).
• With the service providers listed in section 13.1, which process data on our behalf under contracts that limit them to our instructions.
• Where required by EU or national law, a valid legal process, regulatory obligation or binding request from a competent authority
• To establish, exercise or defend legal claims, prevent fraud or abuse, or protect the security and rights of users and the Service, where the law permits.
• With your organisation, if your account is sponsored by one, only as described in section 5.2.

Google user data

SelfOS lets you sign in with your Google account and connect Google Calendar and, for coaches, Google Meet. This section explains which Google user data we access, why, and how we protect it. It adds to the rest of this Privacy Policy.

What we access and why

• Sign in with Google (optional): we receive your name, email address and profile picture. We use them only to create and secure your SelfOS account and to show your name and picture inside SelfOS. You can change your name and picture in SelfOS at any time.
• Google Calendar (optional): if you connect it in Settings, SelfOS can see your list of calendars and your events, and can create, update and delete events. We use this only for the features you turn on: adding your habits and goals to your calendar; for coaches, keeping the sessions booked in SelfOS in your calendar; and helping KAI plan around your schedule. For KAI we read only the start and end times and status of the events in your primary calendar for the next 7 days, and send KAI only a daily free/busy summary (number of events, busy time, longest free window), never titles, descriptions, locations or attendees. We store the calendar you chose, the Google email address you connected, the IDs of the events SelfOS creates and the credentials that keep the connection working. Clients never see the contents of a coach's calendar.
• Google Meet (coaches, optional): if you connect it in your coach video settings, SelfOS creates events in your Google Calendar with a Google Meet link for the sessions booked with you and invites the session participants. We store the Google email address you connected and the credentials that keep the connection working, and we use this access only to create, update and cancel the meetings for your sessions.

What we do not do

• We do not sell Google user data.
• We do not use Google user data for advertising and we do not share it with advertisers or data brokers.
• We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models. The only Google data that reaches our AI provider is the daily free/busy summary described above, sent to generate KAI's reply to you; it is never used to train models. Google Meet data is never sent to KAI or to any AI provider.
• No one at SelfOS reads your Google user data unless you ask us to for support, it is needed to investigate security or abuse, or the law requires it.

We share Google user data only as needed to provide the features above: with the service providers that host and operate SelfOS on our behalf, under contracts that require them to protect it and use it only for that purpose; for the KAI summary above, with our AI provider (section 5.1); when the law requires it; or, with these protections kept in place, as part of a merger, acquisition or sale of our business.

Google user data is encrypted in transit and at rest, and the credentials SelfOS keeps for your Google connection are additionally encrypted. Access is limited to the systems and people that need it to run these features.

Retention and deletion

• Disconnect Google Calendar or Google Meet at any time in Settings (coaches: in coach settings). We delete the stored credentials, the connected email address and any stored event IDs and, when you disconnect your last Google connection, we ask Google to revoke SelfOS's access.
• You can also check or revoke SelfOS's access at any time from your Google Account permissions: myaccount.google.com/permissions. If Google cannot process the revocation request immediately, you can revoke SelfOS's access directly there.
• If you delete your SelfOS account, we delete your Google user data as described in this Privacy Policy.

SelfOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Your Rights

Subject to the conditions and exceptions in applicable law, you may have the following rights:

• Access: obtain confirmation and a copy of personal data we process about you
• Rectification: correct inaccurate or incomplete personal data
• Erasure: request deletion where the legal conditions are met; some records may be retained where required by law or needed for legal claims
• Portability: receive eligible data in a structured, commonly used, machine-readable format and, where technically feasible, transmit it to another controller
• Withdraw consent and marketing choices: withdraw consent as easily as it was given and opt out of direct marketing at any time
• Restriction: ask us to restrict processing in the situations provided by GDPR Article 18
• Objection: you can object at any time to processing based on our legitimate interests, including activity-based reminders and suggestions (section 3), and you can always object to direct marketing; we then stop unless the law allows otherwise.
• Complaint: lodge a complaint with ANSPDCP in Romania or another competent EEA supervisory authority, without affecting other remedies

You can download a copy of your data and request deletion in Settings → Privacy, change most data directly in the app, or write to contact@selfos.club. We answer within one month of receiving your request. We can extend this by two more months for complex requests, and if we do, we tell you within the first month. Withdrawing a consent or objecting is always free.

7. Cookies

We use strictly necessary storage for authentication, security, consent recording, and core preferences. Non-essential analytics or marketing technologies are activated only after the applicable consent choice. You can change non-essential cookie choices through the cookie controls described in our Cookie Policy.

8. Children's Privacy

SelfOS is for people aged 16 and over. We do not knowingly create accounts for or collect data about children under 16. If you believe a child under 16 has an account, contact us and we will delete it.

9. Changes to This Policy

We may update this notice when our processing, providers or legal obligations change. We publish the effective date and will provide prominent notice of material changes where appropriate. A privacy notice update does not convert processing that requires consent into consent.

If we change the AI provider named in section 5.1, we will update this policy and tell you in the app before the change applies. If you gave the KAI health consent, we will ask for a new consent (a new consent version) before the new provider receives your health information.

10. Contact Us

If you have any questions about this privacy policy or our data practices, please contact us at:

Email: contact@selfos.club

For each processing purpose we rely on one or more legal bases under GDPR Article 6 and, for special-category data, a separate Article 9 condition where required:

• Consent: for optional activities such as non-essential analytics, marketing, and other processing where consent is the appropriate legal basis. Consent is specific, can be refused without losing unrelated core functionality, and can be withdrawn for the future.
• Contract (Art. 6(1)(b)): where processing is objectively necessary to provide the account, subscription or feature you requested. We do not use contract necessity as a substitute for consent for optional processing.
• Legitimate Interests: for proportionate activities such as service security, fraud prevention, abuse detection, essential product administration, and limited service improvement where our interests are not overridden by your rights. We do not rely on legitimate interests to bypass consent required by ePrivacy rules or Article 9 GDPR.
• Legal obligation (Art. 6(1)(c)): for tax, accounting, consumer, regulatory, security or other obligations imposed by law.
• Medical information (special-category data): the allergies, intolerances and health conditions you choose to add are saved and used, including to personalise KAI, only with your explicit and optional consent (GDPR Article 9(2)(a)), given for one purpose: health personalisation. You can give it in onboarding (including when you sign up with Google or another single sign-on), in Settings → Privacy, or in context, with one tap, when you save medical information in your Health Profile. We record the purpose, version and date of your choice. KAI stays available without it, and you can withdraw it at any time in Settings → Privacy. The automatic safety screening of messages to KAI is separate and rests on its own basis (see the purposes below). In an employment context, accepting an organisation seat is never consent to employer access to health or AI-coaching data.

You can withdraw consent for future processing using the available settings/consent controls or by contacting us. Withdrawal does not affect processing already lawfully carried out, and it does not affect processing that is necessary on another valid legal basis.

Purposes and legal bases

• Account, core features, the usage data you log (mood, stress, energy, sleep, workouts, meals, body measurements, device data, goals, habits, check-ins, onboarding answers) and KAI coaching with it, Google Calendar features you turn on: contract (Art. 6(1)(b)).
• Medical information (allergies, intolerances, conditions) and its use to personalise KAI: explicit consent (Art. 6(1)(a) and 9(2)(a)).
• Wellbeing Pulse: participation is voluntary; sensitive information is processed on the basis of explicit consent where that is the applicable basis.
• Administering organisation accounts, invitations, subscriptions and benefits: SelfOS and participating organisations process the data needed on the basis of the applicable contractual grounds and justified legitimate interests. For employee-account administration (invitations, activations, roles, seats) we rely on legitimate interests (Art. 6(1)(f)), because the employee is not a party to the organisation's contract.
• KAI safety filtering to prevent dangerous replies: legitimate interests (Art. 6(1)(f)), after a proportionality assessment. Personalising KAI with sensitive health information is separate and rests on explicit consent given in onboarding or later in Settings → Privacy (Art. 9(2)(a)). Only in a real emergency to protect life, when the person is physically or legally incapable of consenting, can vital interests apply (Art. 6(1)(d) and 9(2)(c)), under their strict conditions.
• Security, fraud prevention, error logs: legitimate interests.
• Activity-based reminders and suggestions: legitimate interests (you can object).
• Payments and invoices: contract and legal obligation.
• Analytics cookies and similar technologies: consent.
• Marketing emails: consent.
• Currency from IP country: legitimate interests.

We keep personal data only for as long as needed for the relevant purpose, taking into account account status, contractual needs, security, dispute limitation periods, and legal retention duties.

• Active account data: retained while needed to provide the requested Service and associated features
• Deletion Requests: data is deleted or irreversibly anonymized according to our deletion workflow, except for information that must be retained by law, is needed to establish or defend legal claims, or remains temporarily in backups until normal rotation.
• KAI conversations: kept while your account exists and deleted together with your account; you can ask us to delete them earlier. Withdrawing health personalisation does not delete what you wrote in a conversation.
• Life Profile: each answer is kept until you change or delete it, or until your account is deleted. When you delete an answer, we remove its content from the Life Profile and keep a technical record without the answer's value, to prevent an older onboarding version from being accidentally restored. This record and your question preferences are kept until your account is deleted and are included in your data export.
• Security and error logs: kept only as long as needed for security and troubleshooting.
• Inactive accounts: we plan to introduce an inactivity process and will update this policy before it starts. Once it is in place, an account with no active subscription or sponsored access and no meaningful activity for 24 months will be deleted or anonymised, after warnings 90, 30 and 7 days before. Signing in resets the clock. Legal holds suspend this.
• Withdrawing consent: you can withdraw the health personalisation consent at any time in Settings → Privacy. KAI stops using your medical information immediately, and your saved allergies, intolerances and conditions are deleted; you can download them first. The summaries and topics SelfOS derived from your earlier KAI conversations are also deleted. Your original KAI conversations stay visible to you, but KAI no longer uses messages from before the withdrawal, even if you later turn the consent back on or continue an old conversation; KAI's context is rebuilt only from data you still allow (goals, habits, profile, usage data) and from new conversations. Nothing else is deleted: usage data, goals, habits and preferences stay. We do not keep medical data in case you change your mind, and withdrawal does not affect the lawfulness of processing before it. Conversations themselves are deleted with your account, or earlier on request.
• Financial records: invoices, payments and accounting records are kept for the periods required by Romanian accounting and tax law.
• Anonymous Data: genuinely anonymous or irreversibly aggregated information that no longer identifies a person may be retained for statistical purposes.

Some service providers may process data outside the EEA. Where GDPR Chapter V applies, we use an available lawful transfer mechanism and assess supplementary safeguards appropriate to the transfer.

Depending on the destination and provider, safeguards may include:

• European Commission Standard Contractual Clauses, together with supplementary technical or organizational safeguards where required.
• An applicable European Commission adequacy decision, including an applicable certified framework where legally available.
• Explicit consent for a specific transfer only where GDPR permits this derogation and after the required information is provided; we do not use consent as the default transfer mechanism for routine outsourcing.
• Another specific GDPR Article 49 derogation only where its strict conditions apply; recurring transfers are not based on a convenience interpretation of these derogations

Our database and application servers are in the EU (section 4). Providers that process data outside the EEA do so under appropriate safeguards under GDPR Chapter V; for Anthropic, these are the safeguards under Article 46 GDPR set out in our data processing agreement. You can ask us for a copy of the relevant safeguards at contact@selfos.club. Where you allow analytics cookies, Google Analytics 4 (provided by Google Ireland Limited, which processes this data on our behalf) may involve transfers to Google LLC in the United States under the EU–US Data Privacy Framework or, where that framework is not relied on, Standard Contractual Clauses.

14. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: You have the right to opt out of the sale of your personal information. Note: We do not sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, please contact us at contact@selfos.club. We will respond to your request within 45 days.

SelfOS uses automated processing and generative AI to personalize suggestions, summaries, plans, and insights. These functions are assistive and are not designed by SelfOS to make solely automated decisions that produce legal or similarly significant effects about you within GDPR Article 22.

• Nature: AI may analyze data you choose to provide, permitted context, habits, goals, wellbeing inputs, and prior interactions to generate probabilistic suggestions or summaries. See section 5.1 for exactly what KAI uses.
• No Significant Decision: SelfOS does not use AI outputs to decide recruitment, dismissal, promotion, compensation, credit, insurance, medical diagnosis, or comparable high-impact outcomes about you.
• Your Control: AI suggestions are optional. Where a feature or context control is available, you can choose whether to use it and what information to provide. Coach access to sensitive context is permission-based.
• No emotion inference: SelfOS does not use AI to infer your emotions or mental state. It uses only the ratings you report yourself.
• Personalisation and engagement: we use your activity (for example habits completed, areas you have not worked on recently, how you use SelfOS) to choose the daily recommendation, reminders and suggestions, and to decide which plan or coaching offers to show you. This has no legal or similarly significant effect. You can object at any time (section 6).
• Human Contact: if you believe an automated feature materially affected your account or rights, contact us so we can investigate and, where applicable, provide human review.

When you interact directly with an AI feature, SelfOS is intended to identify that interaction as AI. AI outputs may be inaccurate or fabricated and should be verified before important decisions.

16. Business Transfers

If control of the business or relevant assets changes, personal data may transfer as part of the transaction only subject to applicable data-protection law, confidentiality safeguards, purpose compatibility and required notice. A transaction does not remove your GDPR rights.