Privacy Policy

1. Introduction

Refindy ("we", "us", "our") operates the Refindy platform including Refindy Web, Refindy Studio (Jarvis), and Terra. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services.

2. Data We Collect

We collect the following categories of personal data:

• Account information: email address, display name, profile data you provide
• User content: links, notes, projects, conversations with AI assistants, saved blocks, and session insights
• Usage data: feature usage patterns, API request logs (anonymized), device/browser type
• Payment data: processed securely by Stripe — we never store your full card number
• Terra-specific data: self-reflection entries, meditation progress, emotional patterns, wellness reports — treated as sensitive personal data with enhanced protections

3. How We Use Your Data

• Providing and maintaining the service, including AI-powered features (summaries, chat, insights)
• Improving our services through anonymized, aggregated usage analytics
• Communicating with you about account updates, security alerts, and service changes
• Protecting against fraud, abuse, and unauthorized access

4. AI Data Processing

Your conversations and content may be processed by third-party AI providers (Anthropic, OpenAI, Google) to power our AI features. We send only the minimum necessary data to these providers. AI providers process data under their own data processing agreements and do not use your data to train their models when accessed via API. Terra's psychological and emotional data receives enhanced protections — it is processed with strict purpose limitation and is never used for advertising or profiling.

5. Third-Party Services

We use the following third-party services to operate:

• Supabase — database hosting and authentication (data stored in AWS, subject to SOC 2 compliance)
• Stripe — payment processing (PCI DSS Level 1 compliant)
• AI providers (Anthropic, OpenAI, Google) — AI processing via API (no training on user data)
• Vercel — application hosting and CDN

6. Data Retention

We retain your personal data for as long as your account is active. You can delete individual conversations or your entire account at any time. Upon account deletion, all data is permanently removed within 30 days. Anonymized, aggregated analytics may be retained indefinitely. Stripe retains payment records as required by financial regulations.

7. Your Rights (GDPR & Global)

You have the following rights regarding your personal data:

• Right of access — request a copy of all your personal data
• Right to data portability — export your data in machine-readable format (JSON)
• Right to erasure — permanently delete your account and all associated data
• Right to rectification — correct inaccurate personal data through your profile settings
• Right to object — opt out of non-essential data processing by contacting us

8. Cookies & Local Storage

We use essential cookies for authentication (Supabase session tokens) and locale preferences. We do not use third-party tracking cookies or advertising cookies. You can manage cookie preferences through your browser settings.

9. Children's Privacy

Our services are not intended for users under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us for removal.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 30 days before they take effect.

11. Contact Us

For privacy inquiries, data requests, or to exercise your rights, contact us at: privacy@refindy.com