Privacy Policy

1. Controller

The controller for data processing is: Detox Daughters LLC, 6650 Rivers Ave. STE 100, Charleston, South Carolina 29406, USA Represented by Sara de Oliveira · Email: hello@detoxdaughters.com

EU representative pursuant to Art. 27 GDPR: a representative in the Union is being appointed; the contact details will be added here once the appointment is complete. As we process health data (Art. 9 GDPR), we continuously assess whether the appointment of a data protection officer is required.

2. Principles and legal bases

We process personal data only where necessary and on the basis of the GDPR – in particular to perform a contract or pre-contractual measures (Art. 6(1)(b)), based on your consent (Art. 6(1)(a) or Art. 9(2)(a) for health data), to comply with legal obligations (Art. 6(1)(c)) or based on our legitimate interest in a secure, functioning service (Art. 6(1)(f)).

3. Hosting and server log files

The application is hosted by Vercel Inc. (USA). When you access it, the server automatically collects technical data transmitted by your browser (e.g. IP address, date/time, page requested, browser type). This is technically necessary to deliver the site securely and reliably (Art. 6(1)(f)). Server log data is generally deleted after no more than 14 days. A data processing agreement is in place with Vercel; the transfer to the USA is safeguarded by standard contractual clauses (SCC).

4. Database, account and sign-in

We operate our database, sign-in and file storage via Supabase with servers located in the EU (Europe region). For a member account we process your email address, a password stored in encrypted form, optionally your name and your language setting (Art. 6(1)(b)). A data processing agreement is in place with Supabase.

5. Booking and payment

Bookings and the monthly subscription are handled via our payment provider Lemon Squeezy. Lemon Squeezy acts as the “Merchant of Record”: as the reseller, Lemon Squeezy issues the invoice and remits the applicable VAT itself; the resulting revenue is paid out to us via the financial service provider Wise. This processes, among other things, your email address, booking/subscription data and payment references (Art. 6(1)(b)). You enter your full payment data (e.g. card number) directly with Lemon Squeezy or its payment partners; it is processed there in a PCI-compliant manner and is not visible to us. We only store reference IDs and the subscription status. Retention and accounting obligations may require invoice data to be stored for up to 10 years.

6. Health profile and AI companion (Alma)

When you use the AI companion Alma, you can voluntarily provide health information – e.g. a health profile (such as birth data, notes), individual health facts (allergies, intolerances, medication, goals), uploaded results (e.g. blood values) and your chat history with Alma. This constitutes special categories of personal data (health data, Art. 9 GDPR).

This processing takes place solely on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give before use and can withdraw at any time with effect for the future. The AI responses are generated by our provider Anthropic (Claude) in a processing region within the EU. Uploaded results are read out automatically once on upload; during the conversation only the text content of your active entries is passed to the AI, not the original file.

Your health data is protected by strict access separation at database level (row-level security): only you have access. The administration (Sara) has no standard access to your health entries or chat content. You can delete individual entries, your chat history and your account yourself at any time.

7. Health information before booking

Depending on the offer, we ask you for health information before you take part. The basis is always your explicit consent (Art. 9(2)(a) GDPR). Without that consent we store nothing. How we handle the information depends on the offer – please read both paragraphs.

Online programmes and courses

Here we ask a few points (e.g. pregnancy, certain pre-existing conditions, medication) to check whether participation is suitable for you. These answers are stored confidentially and separately; the administration only sees THAT approval is required, not your medical answers. The details are kept until the respective booking is completed or expires, and then deleted.

On-site live retreats

For a live retreat we ask you to complete a more detailed health form (including date of birth, height and weight, previous fasting experience, certain pre-existing conditions, medication). You receive it after your request via a personal link by email; it is not publicly accessible. You complete the form BEFORE any payment is due.

Unlike the online programmes, the retreat lead (Sara Oliveira) can see this information in full. This is necessary and is the explicit purpose: during a live retreat we accompany you physically while fasting and carry responsibility for that. Should something happen during the retreat, we need to know what to take into account – for example which medication you take or which condition exists. The information is used solely to assess your participation and for this support, not for marketing and not for analytics.

On the page of the respective retreat you will find, in advance, a list of conditions that may prevent participation. If the form shows nothing of note, you continue without further review. Otherwise the retreat lead looks at it personally and decides; the decision is logged with a timestamp.

The health form is stored separately from your Alma health profile and chat history (section 6). The administration still has NO access to that data. Conversely, the information from the retreat form is not fed into Alma.

8. Live online courses (Zoom)

Live courses take place via video conference (Zoom). The data required for participation (e.g. name, email, connection data) is processed (Art. 6(1)(b)). Where data is transferred to the USA, this is safeguarded by standard contractual clauses.

9. Email delivery

We send our emails – such as the confirmation of your sign-up, the delivery of material you asked for, or booking confirmations with the date – from the mailbox hello@detoxdaughters.com, using the “Private Email” service of Namecheap, Inc. (USA). This processes your email address and the details needed for the message in question (e.g. name, date): for material you requested yourself on the basis of your consent (Art. 6(1)(a)), for confirmations relating to a booking in order to perform the contract (Art. 6(1)(b)). A data processing agreement is in place with the provider; the transfer to the USA is covered by standard contractual clauses (SCC). We do not send health data by email.

10. Companion channel (Telegram)

For some courses we optionally offer a companion channel via Telegram in which we send general companion messages (e.g. daily impulses). Use is voluntary; no health data is processed via Telegram. By joining Telegram, Telegram’s privacy terms additionally apply.

11. Anonymous safety statistics

For quality and safety control of the AI companion, we record anonymous events (e.g. that a safety notice was triggered, with a rough age indication and language). This data contains no identifier and does not allow conclusions about individuals; it is therefore not personal data.

12. Recipients and transfers to third countries

We use carefully selected processors. Here we name the categories of recipients; we will provide the specific list of service providers on request (hello@detoxdaughters.com):

• •Database and file-storage provider (servers in the EU).
• •AI provider for the companion’s responses (processed in an EU region).
• •Payment and subscription provider acting as “Merchant of Record” (international, with appropriate safeguards).
• •Email provider for sending our messages (USA, safeguarded via standard contractual clauses).
• •Messenger service for the optional companion channel (general messages only).
• •Application hosting (third country, safeguarded via standard contractual clauses).

Where data is transferred to countries outside the EU/EEA, this only takes place on the basis of appropriate safeguards within the meaning of Art. 44 et seq. GDPR (in particular standard contractual clauses).

13. Storage period

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. Account data is stored until you delete your account; you can delete chat history and health entries yourself at any time; eligibility details for online programmes are kept until the booking is completed; the health form for a live retreat is kept until 3 years after the end of the retreat (purpose: traceability in the event of health incidents) and deleted thereafter; invoice/accounting data for up to 10 years; server logs generally for up to 14 days.

14. Your rights

You have the following rights at any time:

• •Access to your stored data (Art. 15)
• •Rectification of inaccurate data (Art. 16)
• •Erasure (Art. 17) and restriction of processing (Art. 18)
• •Data portability (Art. 20)
• •Objection to certain processing (Art. 21)
• •Withdrawal of consent given, with effect for the future (Art. 7(3))
• •Lodging a complaint with a data protection supervisory authority (Art. 77) – e.g. the authority of your country of residence

An informal message to hello@detoxdaughters.com is enough to exercise these rights.

15. Data security

We protect your data through technical and organizational measures, in particular access separation at database level (row-level security), encrypted transmission and storage, and a principle of data minimization. In the event of a database error, access to sensitive data is denied as a precaution (fail-closed).

16. Changes to this policy

We will adapt this privacy policy as soon as features or the legal situation change. The version published here applies at any given time.