Privacy policy

Data controller

Heaven Interactive Ltd. („Хевън Интерактив“ ООД), company no. 201565871, info@heaven-interactive.com.

Free version

All data stays only in your browser (localStorage). We do not receive it.

The browser may delete it (Safari, for example, after a period without a visit), so keep your result as a file, an e-mail to yourself, or with Plus.

Plus

Only if you turn it on and explicitly consent (separately for each purpose): (1) a copy of your data (logs, lab results, profile, results and settings) is stored in the EU (Frankfurt) for sync; (2) when you ask the AI coach for a note — at most once a week — only aggregated metrics are sent to a language model hosted in the EU: 0–100 scores, coverage, activity minutes, the fitness-age difference and whether each lab marker sits inside its reference range. Raw entries and lab values are never sent.

This is health data under GDPR Art. 9; the legal basis is your explicit consent, which you can withdraw in Settings → Plus. “Delete cloud data” deletes the cloud copy at once.

The AI coach is currently off: no data is sent to any language model.

License key

Plus works with a license key instead of an account. The key lives in your browser and in our EU database. Link (Stripe) only receives a non-secret license identifier, the chosen plan and your immediate-start acknowledgement, never the key itself.

With the license we keep the plan, the period and status of the subscription, and the records of your consents (text version and time).

Payments

The sale goes through Link (Stripe), which is the merchant of record and handles the payment, taxes, receipts, cancellation and refunds. From Link we receive the customer identifier and the plan, period and status of the subscription; card details never reach us.

Your e-mail address stays with Link. We look it up there only when you ask us to resend your key; it is then used once for that message, and all we keep is a one-hour hash of the address that limits repeat requests.

Processors

Vercel (hosting), Upstash (database, EU), Stripe/Link (payments), each under a data processing agreement.

Traffic analytics

Anonymous statistics without cookies or a visitor profile (Vercel Web Analytics and Speed Insights): which pages are opened, how fast they load and which steps are completed. No health values, only aggregated events such as whether the test result came out below, around or above calendar age.

Retention

The cloud copy is kept until you delete it, and at most 90 days after the subscription ends.

Coach notes are kept for up to 14 days so they are not generated twice.

The license record is kept while the license exists. You can ask for its deletion at info@heaven-interactive.com.

Your rights

Access, erasure, portability, objection: info@heaven-interactive.com.

You can withdraw any consent at any time; withdrawal does not affect the lawfulness of processing before it.

You may complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).

Changes

When this policy changes we update the date above. Every consent is recorded with the version of the text you agreed to.