Privacy Policy · Zenflow

1. Data controller

The data controller responsible for processing your personal data is Gilberto Ramirez, operator of Zenflow. We act as the data controller for the information we collect when you use our service.

Contact: zenflowapp.taichi@gmail.com

2. Data we collect

Account: name, email address, encrypted password.
Quiz answers: wellness goals, experience level, preferences.
Progress: completed sessions, mood logs, journal notes.
Support: messages you send us by email.
Technical usage: IP address, device type, browser, pages visited.

Payment data (card, billing address) is collected and processed directly by Paddle. We do not store card data.

3. How we use your data

Create and manage your account.
Deliver your personalized plan and progress tracking.
Send you transactional emails (confirmations, reminders).
Security, fraud prevention, and legal compliance.
Improve the product and provide support.

4. Legal basis

Contract performance: to provide the service you purchased.
Legitimate interest: security, fraud prevention, product improvement.
Consent: marketing communications (you can withdraw it at any time).
Legal obligation: accounting, tax compliance.

5. Who we share your data with

Paddle.com Market Limited — Merchant of Record. Manages payments, billing, taxes, and refunds.
Supabase — database hosting and authentication.
Resend — sending transactional emails.
Cloudflare — infrastructure and network protection.
Professional advisors (legal, accounting) when necessary.
Authorities when required by law.

6. International transfers

Some of our providers process data outside your country of residence (for example, in the EU or the US). These transfers are carried out with appropriate safeguards, such as approved Standard Contractual Clauses (SCCs).

7. Retention

We retain your data while your account is active and for as long as necessary to comply with legal obligations (for example, accounting). You may request deletion at any time; some data may be retained anonymized or when required by law.

8. Your rights

Depending on your jurisdiction, you may have the right to:

Access your data and obtain a copy.
Correct inaccurate data.
Request deletion ("right to be forgotten").
Object to or restrict processing.
Data portability.
Withdraw consent.
File a complaint with your country's data protection authority.

To exercise these rights, write to us at zenflowapp.taichi@gmail.com. We will respond within 30 days.

9. Security

We apply reasonable technical and organizational measures: encryption in transit (HTTPS), access control, backups, and per-user isolation at the database level (RLS).

10. Cookies

We use essential cookies to keep you signed in. We do not use third-party marketing cookies. You can manage cookies from your browser.

11. Changes

We will update this policy when necessary. The "last updated" date indicates its effective date.