praxisloom

Legal

Privacy Policy

Last updated: 2026-06-10 · Version 1.0

This policy explains what personal data Praxisloom collects, why, how it is protected, and the rights you hold over it. It applies to every user of the platform, regardless of subscription tier, including users who have signed up but never paid.

1. Who we are

Praxisloom is a relational-intelligence platform operated by Praxisloom (operator entity details — Romanian SRL name and registration number — to be completed before public launch), referred to in this document as “we,” “us,” “Praxisloom,” or “the platform.”

If you have any questions about this Privacy Policy or how we process your personal data, contact us at hello@praxisloom.com or by mail to (registered postal address to be completed before public launch).

We are the data controller for the personal data we process about you in connection with your use of the platform. Where we use third-party service providers (Supabase, Vercel, Google for the Gemini AI API, our payment processor, and others listed in Section 8), those providers act as our data processors under signed Data Processing Agreements.

2. What this policy covers

This policy describes:

What personal data we collect about you and why
How we use, share, and protect that data
Your rights regarding that data (GDPR, CCPA, Washington MHMDA, and other applicable laws)
How long we keep your data
How to exercise your rights, including deletion

3. What data we collect

We organize the data we collect into five categories. We collect only what is necessary to provide the service.

3.1 Account and contact data

Email address (used as your unique identifier)
An alias you choose to display (does not have to be your real name)
Authentication credentials (password hash; we never see or store your plaintext password)
Account creation date, last login date

3.2 Subscription and payment data

Payment processor’s customer ID (we do not store your card number; this is held by the payment processor)
Subscription tier and status
Billing country and tax-relevant information (for VAT purposes)
VAT ID for business customers requesting B2B invoices

3.3 Calibration data (the Foundation profile)

Self-reported architecture: age stage, professional foundation, declared endgame, polarity (Directive/Receptive — decoupled from gender), temperament, MBTI type, attachment style, shadow archetype, dissonance status
18+ confirmation timestamp
Free-text relational status, known patterns, romantic endgame (if you provide them)

This is the most sensitive data we hold. It qualifies as Special Category Data (“emotional/psychological data”) under GDPR Article 9 and as “consumer health data” under Washington’s My Health My Data Act. We process this data only with your explicit consent, given separately during onboarding, and you can revoke consent and delete this data at any time.

3.4 Conversation data

Messages you send to the AI (across all channels: Mirror, Tether, Arsenal, Compass, Vanguard, Investment, Hub, Atelier)
AI-generated responses to those messages
Risk-level classifications, calibration suggestions, routing tags
Pattern Atlas matches retrieved at runtime
Listening history if you use the Hub audio channel

This data is also Special Category under GDPR Art. 9 and is processed only with your explicit consent.

3.5 Behavioral telemetry

Per-session tactical-restraint, directness, and empathy scores
Engagement events (which channels you used, when, for how long)
Pattern Atlas encounter history (which scenario types you have been retrieved against)
Soul-Print architecture vectors

We do NOT collect: biometric data, voice recordings (the platform is text-only in v1), location data beyond country-level region for crisis-resource routing, contacts list, social-graph data, or any data from devices outside what you actively input.

4. How we use your data — lawful bases

For each purpose, we identify the lawful basis under GDPR Article 6 and (where applicable) Article 9.

Purpose	Lawful basis (Art. 6)	Special category (Art. 9)
Provide the service you signed up for	Contract performance (6(1)(b))	Explicit consent (9(2)(a)) for emotional data
Authenticate you and prevent unauthorized access	Legitimate interests (6(1)(f))	n/a
Process payments and issue invoices	Contract performance (6(1)(b)) + legal obligation (6(1)(c))	n/a
Send transactional emails (account verification, password reset, billing receipts)	Contract performance (6(1)(b))	n/a
Send the weekly retrospective email (opt-in only)	Explicit consent (6(1)(a))	Explicit consent (9(2)(a))
Improve the AI’s responses (anonymized aggregates only)	Legitimate interests (6(1)(f))	Explicit consent (9(2)(a))
Match you with other users (Reunion Protocol, opt-in only)	Explicit consent (6(1)(a))	Explicit consent (9(2)(a))
Comply with legal obligations (tax, anti-fraud, response to lawful requests)	Legal obligation (6(1)(c))	Substantial public interest (9(2)(g)) where applicable
Detect and respond to crisis disclosures	Vital interests (6(1)(d)) + legitimate interests (6(1)(f))	Vital interests (9(2)(c))

5. Automated decision-making

We use Google’s Gemini AI to generate the platform’s responses. This is automated processing under GDPR Article 22. We have evaluated whether it constitutes “solely automated decision-making with legal or similarly significant effects” and concluded it does not — the AI generates reflective text and tactical suggestions, but does not make decisions affecting your legal status, employment, credit, insurance, or government benefits.

The matching algorithm (Reunion Protocol) uses similarity over architecture-coded data, gated by a Readiness Threshold computation. You explicitly opt in to the matching pool; you can withdraw at any time without penalty; and any match introduction can be passed without explanation. No automated decision is made that you cannot override.

We do not use AI for emotion recognition under EU AI Act terms. The platform classifies risk via lexicon-based text matching only (not facial-expression analysis, not voice tone, not biometric inference).

6. Retention

Data category	Retention
Account & contact	Lifetime of the account + 30 days after deletion request
Subscription & payment	7 years (Romanian/EU tax obligation)
Calibration / Foundation profile	Lifetime of the account; deleted within 30 days of account deletion
Conversation data	Lifetime of the account; you can delete individual messages or the full history at any time
Behavioral telemetry (live)	Session-only; never persisted across sessions
Behavioral telemetry (logs)	Lifetime of the account; deleted when you delete your account
Crisis-flagged turns	Held in your private conversation vault (same protections as your other conversation data); deleted when you delete your account
Backups	Up to 90 days after primary deletion; then permanently purged

You can request deletion of all your data at any time (Section 7). For data we retain due to legal obligations (e.g., billing records), we retain only the specific records required by law and segregate them from active platform data.

7. Your rights

Depending on your country of residence, you have some or all of the following rights:

7.1 GDPR rights (if you are in the EU/EEA/UK/Switzerland)

Right to access (Art. 15): receive a copy of all data we hold about you
Right to rectification (Art. 16): correct inaccurate data
Right to erasure / “right to be forgotten” (Art. 17): delete your account and all associated data
Right to restriction (Art. 18): limit how we process your data
Right to data portability (Art. 20): receive your data in a machine-readable format
Right to object (Art. 21): object to processing based on legitimate interests
Right to withdraw consent (Art. 7(3)): withdraw your explicit consent for emotional data processing at any time
Right not to be subject to solely automated decisions (Art. 22): see Section 5 above
Right to lodge a complaint with your local Data Protection Authority

To exercise any of these rights, email hello@praxisloom.com with your request. We will respond within 30 days. Account deletion and a full machine-readable data export are also available directly from your account settings.

7.2 CCPA / CPRA rights (if you are a California resident)

Right to know what personal information we collect, use, disclose, and sell
Right to delete personal information we have collected from you
Right to correct inaccurate personal information
Right to opt-out of sale or sharing of personal information (we do not sell; see Section 8)
Right to limit use of sensitive personal information
Right to non-discrimination for exercising these rights

To exercise: same channel — hello@praxisloom.com.

7.3 Washington My Health My Data Act (if you are a Washington State resident)

The platform processes “consumer health data” as defined under MHMDA. You have:

Right to confirm what consumer health data we collect about you
Right to delete consumer health data
Right to revoke consent for collection, use, sharing, or sale (we do not sell)

To exercise: hello@praxisloom.com.

7.4 Other US state privacy laws

Virginia, Colorado, Connecticut, Utah, Texas, and other states with consumer privacy laws afford similar rights. We honor them under one unified process. Contact: hello@praxisloom.com.

8. Third-party service providers (data processors)

We use the following providers under signed Data Processing Agreements. Each is contractually bound to process your data only for the purposes we direct. We do not sell, share, or syndicate your data for marketing or advertising purposes — ever.

Provider	Purpose	Data shared	Region
Vercel	Application hosting	Runtime processing of platform data	US, EU
Supabase	Database, authentication, storage	All persisted data; encrypted at rest at the infrastructure layer	EU (Frankfurt)
Google (Gemini AI)	AI text generation and embedding	Conversation messages + system prompts at runtime	US
Payment processor	Payment processing — NOT yet active (no billing in the current release; this row will name the processor and data when paid plans launch)	None collected today	—
Resend	Transactional email	Email address, message content	US
Cloudflare	DNS, DDoS protection	IP-level metadata only	Global

For data transferred outside the EEA (notably to Google for AI processing), we rely on the European Commission’s Standard Contractual Clauses and Google’s adequacy commitments under their Data Processing Addendum.

You can request the current list of sub-processors and our DPAs at any time via hello@praxisloom.com.

9. Security

We employ technical and organizational measures appropriate to the sensitivity of the data we process. These include:

Data encrypted in transit (TLS) and at rest at the infrastructure layer
Row-Level Security on every database table, restricting each row to its owning user
Service-role credentials stored only server-side, never reaching client browsers
Rate limiting on AI endpoints to prevent abuse
PII redaction in operational logs
Regular dependency audits in our build pipeline
Periodic rotation of API keys and service credentials

We are a small team and do not currently maintain SOC 2 or ISO 27001 certifications. We will pursue certifications as we scale or when required by enterprise customers. In the meantime, our security posture is documented and continuously improved; we welcome scrutiny.

10. Cookies and similar technologies

We use only the cookies and browser storage required to run the platform:

Strictly necessary authentication cookies set by Supabase Auth to maintain your login session. Without them, you cannot sign in. No consent is required for this category under the ePrivacy Directive.
Local browser storage for interface preferences (e.g., sidebar state, one-time channel briefing acknowledgments) and to remember that you have acknowledged the cookie notice.
Payment-processor cookies may be set on payment surfaces for fraud prevention when paid subscriptions launch.

We do NOT use advertising cookies, cross-site tracking, analytics pixels, Google Analytics, or Facebook Pixel. We do not sell or share your data with advertising networks or data brokers. This is a structural commitment, not a temporary marketing position.

Most browsers let you view, delete, or block cookies. If you block the strictly necessary authentication cookies, you will not be able to sign in.

11. Children

Praxisloom is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. The platform requires age verification at onboarding. If we discover that a user is under 18, we will delete their account and all associated data.

If you believe a minor has registered, contact hello@praxisloom.com immediately.

12. Crisis disclosures

If you describe a situation involving imminent harm to yourself or another person while using the platform, our system will surface region-aware crisis resources (per our internal Crisis & Safety Protocol). Those turns are held in your own private conversation vault — under the same row-level protections as the rest of your conversation data, so the platform can keep continuity of care across that session — and are deleted when you delete your account. We do not keep a separate identity-stripped review log.

We do this under the GDPR lawful basis of “vital interests” (Art. 6(1)(d) and 9(2)(c)).

We are not a crisis intervention service. The platform’s role in a crisis is to surface information; if you are in immediate danger, contact emergency services or a crisis hotline directly — see our crisis resources page. Do not rely on the platform alone.

13. Changes to this policy

We will notify you of material changes by email at least 30 days before the new policy takes effect. Non-material changes (typo fixes, formatting) take effect immediately.

The current effective version is shown at the top of this document.

14. Contact and data protection point of contact

For privacy-related questions, requests, or complaints:

Email: hello@praxisloom.com
Postal mail: (registered postal address to be completed before public launch)

We have not appointed a formal Data Protection Officer at this time (we are below the GDPR Article 37 thresholds). The founder acts as the privacy point of contact and responds personally to data requests.

For EU/EEA users: you can lodge a complaint with the Romanian Data Protection Authority (ANSPDCP) at dataprotection.ro or with your local national authority.

Home Terms of Service Crisis Resources