Privacy Policy

What data we collect

• Answers to the wellness questionnaire: a special category with its own rules (see “Your health data” below).
• Your email, which Stripe (our payment processor) requests as part of the payment itself.
• Card details, entered directly into Stripe — Ouzentia never receives or stores them.
• A random identifier stored in your browser (not tied to an account, not linked to your email) that lets us recall the focus and date of your last reading when you return — never your literal answers. It’s stored in our database (Supabase). It’s only created if you accept non-essential cookies in the notice you see when you enter the site; you can delete it at any time with "Forget this browser’s history" or from cookie preferences.
• A draft of your half-finished questionnaire (the area you chose and your answers to the first 3 questions), saved only in your browser so a page refresh doesn’t force you to start over. It never leaves your device or reaches our servers, and it’s deleted automatically after 3 days.
• If you explicitly ask for it (by leaving your email at the end of the free reading), we store that email alongside the area of your reading for up to 90 days, solely so we can write to you later and ask if it was useful. It’s optional: not leaving it doesn’t change anything about the reading you receive.
• During a launch promotion (when the automatic reading is free), we store your complete answers to that reading anonymously —without your email, your IP, or your browser identifier, nothing that connects them to you— for up to 90 days, so we can review real examples and catch system flaws while the promotion lasts.

The full detail of what we store in your browser, what for, and how long each thing lasts is in our cookie policy.

Your health data

The questionnaire asks about things related to your health —how you sleep, your stress level, your weight, how you eat, how you train, your focus. The General Data Protection Regulation (GDPR) treats this as a special category of data (Article 9), with a higher level of protection than the rest. That’s why we ask for your explicit consent, expressly and separately, before starting the questionnaire — it’s not enough to simply keep browsing the site. As proof of that consent we keep which version of the text you accepted and when —alongside the reading’s non-identifying telemetry and, if you pay, in the payment session—, with no data that identifies you. You can withdraw that consent at any time by writing to info@ouzentia.com; withdrawing it doesn’t affect the rest of the site, but it does prevent generating a new reading.

About payment: what Stripe sees

When you pay, your answers to the questionnaire travel along with the payment and are stored in Stripe (not in our database), encrypted —neither Stripe nor anyone with access to its dashboard can read them without our key—: we need them there to be able to retrieve your exact reading right after the payment is confirmed, and —for the personalised report— so Diego de Souza Ranalli can review your case. This means that, unlike a free reading (whose answers, if stored during a promotion, are never associated with your identity — see above), if you pay, your answers become associated with the email you gave at payment, within Stripe’s systems, subject to its own privacy policy and to the retention periods required by applicable tax and accounting regulations. In addition, so we can confirm a payment if someone writes to say they didn’t receive their reading, the notice Stripe sends to our server when a payment completes is recorded (payment ID, email, amount —never your answers) in the technical logs of our hosting provider, Vercel, for that provider’s log retention period.

What it’s used for

• Generating the automatic or personalised report requested.
• Communication related to the purchase (sending the report, support). The payment receipt is sent to you directly by Stripe via email automatically; we don’t send any separate email.
• Unidentified internal telemetry, for product improvement purposes: which areas and connections come up and how often, at which questionnaire screen people stop, which payment steps are reached, and your answer to “Did you recognise yourself in this reading?”. Only the area, the step, the screen or the answer and the date are stored, never anything that identifies you.
• Showing continuity between visits (“last time your focus was…”) to someone returning from the same browser, and applying the daily limit of free readings — both only if you accepted non-essential cookies.
• Your anonymous identifier may be combined with your IP address to apply a daily limit of free readings per device (to prevent abuse of the service); this combination is not stored permanently or linked to your email.

Legal basis for each processing activity

• Generating your automatic or personalised reading: performance of the contract you accept by requesting it (Article 6(1)(b) GDPR).
• Your health-related answers (sleep, stress, weight, eating, training, focus): your explicit consent (Article 9(2)(a) GDPR), requested expressly before the questionnaire.
• The anonymous identifier (continuity between visits and the daily free-reading limit): your consent (Article 6(1)(a) GDPR), given or withdrawn from the cookie notice.
• Unidentified internal telemetry about the system’s behaviour: our legitimate interest in improving the product (Article 6(1)(f) GDPR).
• The daily limit by IP address, without an anonymous identifier: our legitimate interest in preventing abuse of the service (Article 6(1)(f) GDPR).

Retention and third parties

The anonymous identifier and continuity history are kept until you delete them yourself (“Forget this browser’s history”, or by rejecting cookies after having accepted them) or, at most, 90 days after your last reading; unidentified internal telemetry is kept for up to 180 days. The anonymous answers stored during a launch promotion and the email you voluntarily leave for the follow-up a few weeks later are each kept for a maximum of 90 days. If you answer the follow-up email through one of its links, your answer (yes, partly or no) is stored together with the area of your reading; as soon as your email is deleted it is no longer associated with you, and it is kept as unidentified telemetry for up to 180 days. Data tied to payment (email, answers stored in Stripe) is kept for as long as required by applicable tax and accounting regulations. Data is not sold to third parties. We use five infrastructure providers: Stripe (payment processing), Supabase (database), Vercel (site hosting), Upstash (abuse prevention: temporary counters for the daily reading limit, tied to your IP address or your anonymous identifier, which delete themselves after 24 hours) and Resend (internal email notices to Diego de Souza Ranalli when a payment completes or someone asks for the follow-up: they carry the area of the reading and the payment ID, never your answers or your email), all under their own confidentiality and data protection agreements.

International transfers

Stripe, Supabase, Vercel, Upstash and Resend are based in the United States. This may mean your data is transferred outside the European Economic Area. When this happens, it’s done under the safeguards GDPR requires for this kind of transfer —typically standard contractual clauses approved by the European Commission— detailed in each provider’s own privacy policy.

User rights

You can request access to, correction of, or deletion of your data by writing to info@ouzentia.com, in accordance with the General Data Protection Regulation (GDPR) applicable in the European Union. For data stored in Stripe (answers associated with a payment), we handle the deletion request directly with Stripe on your behalf; tax retention periods may limit immediate deletion.

Besides access, correction and deletion, you also have the right to object to processing, to request that it be restricted, and to data portability.

If you believe we haven’t resolved your request properly, you can complain to the Spanish Data Protection Agency (AEPD) if you live in Spain, or to the Data Protection Commission (DPC) if you live in Ireland.