PRIVACY POLICY

1. Data Controller

The entity responsible for processing your personal data is:

2. Summary

3. Data We Collect

3.1 Account Information

When you create an account, we collect:

• Email address (required)
• First name
• Last name (only if you sign in with Google or Apple)

Legal basis: Performance of contract (GDPR Art. 6(1)(b))

3.2 Journal and Mood Data

Vellme allows you to track your daily affirmations. You may optionally provide:

• Mood ratings (1-5 scale)
• Personal notes and reflections
• Daily ritual summaries

Important: This data represents your subjective self-assessment and personal journal entries – it is not health or medical data. We do not diagnose, treat, or provide any health-related services.

Legal basis: Performance of contract (GDPR Art. 6(1)(b))

3.3 Technical Data

We automatically collect:

• Device type and operating system version
• App version
• Crash logs and error reports
• IP address (anonymized for analytics)
• Country/region (from device settings, NOT precise GPS)

We do NOT collect: precise location, contacts, photos, microphone or camera data.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) – app functionality and security

3.4 Subscription Data

If you subscribe to Premium features, we receive:

• Subscription status (Free, Premium, Trial)
• Subscription dates

Payment processing is handled entirely by Apple (App Store) or Google (Play Store). We never see or store your payment information.

Legal basis: Performance of contract (GDPR Art. 6(1)(b))

4. How We Use Your Data

To provide the service:

• Create and manage your account
• Store and display your journal entries and mood history
• Generate personalized affirmations
• Sync data across your devices

To improve the app:

• Analyze usage patterns (anonymized)
• Fix bugs and crashes

To communicate with you:

• Send transactional emails (password reset, account changes)
• Send push notifications (only if you opt-in)
• Respond to support requests

We do NOT:

• Sell your personal data
• Use your data for targeted advertising
• Share your data with insurance companies, employers, or data brokers

5. Service Providers

We work with trusted third-party services to deliver Vellme. These providers act as data processors under GDPR and are contractually obligated to protect your data.

5.1 Core Infrastructure

• Cloud database and backend services – for storing your account and journal data (EU/USA)
• Authentication services – for secure login via email, Google, or Apple (USA)
• Crash reporting services – for identifying and fixing app errors (USA)

5.2 Payment Processing

All payments are processed by Apple (App Store) or Google (Play Store). We never see or store your payment information.

5.3 Other Service Providers

We may also use other service providers for subscription management, email communications, and marketing campaign management. These providers process only the minimum data necessary to perform their services.

Complete list of data processors: Available upon request at support@stellarxlab.com

5.4 International Transfers

Some of our service providers are located outside the European Economic Area (primarily in the USA). All international data transfers are protected by Standard Contractual Clauses (SCC) approved by the European Commission and industry-standard encryption.

6. Data Retention

• Account data: Until you delete your account
• Journal and mood data: Until you delete your account or 24 months of inactivity
• Technical logs: Up to 12 months
• After account deletion: Data is permanently removed within 30 days

7. Your Rights

7.1 All Users

• Access: Request a copy of your data
• Correction: Update your information in Settings
• Deletion: Delete your account in Settings > Account > Delete Account
• Opt-out: Disable push notifications in device settings

7.2 EU/EEA Residents (GDPR)

You also have the right to:

• Object to processing based on legitimate interest
• Restrict processing
• Data portability
• File a complaint with your supervisory authority

Poland (UODO): ul. Stawki 2, 00-193 Warszawa – uodo.gov.pl

7.3 California Residents (CCPA)

• Right to know what data we collect
• Right to delete your data
• Right to correct inaccurate data

We do NOT sell your personal information. We do NOT use it for targeted advertising.

8. Data Security

We protect your data with:

• Encryption during transmission (TLS) and storage
• Secure authentication
• Access controls ensuring users see only their own data
• Regular automated backups

No Internet transmission method is 100% secure, but we use industry best practices.

9. Children's Privacy

Vellme is intended for users 16 years and older.

We do not knowingly collect data from children under 16 (or under 13 in the USA). If you believe a child has provided us with personal data, contact us immediately for deletion.

10. Important Notice

Vellme is NOT a medical, therapeutic, or health service. It is an affirmation and journaling app designed for personal reflection.

If you are experiencing mental health difficulties, please consult a licensed healthcare professional.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or in-app notification. The latest version is always available in the app settings.

12. Contact Us

For privacy questions or to exercise your rights: