Privacy Policy

ND Flow State, operated by Ida Kuhlmann, is the data controller responsible for the personal data processed through Heron. Our contact details are:

Ida Kuhlmann / ND Flow State
Birken 10, 4.TV
4300 Holbæk
Denmark
Email: ida@ndflowstate.com

When you use Heron, we may collect the following types of information:

• Account information: email address, password hash, and authentication method (e.g., email or Google sign-in).
• Profile information: your name or display name, onboarding answers, intentions, preferences, and wellbeing ratings.
• Flow and ritual data: flow session history, journal entries, dysregulation checks, flow scores, and related notes.
• AI chat messages: conversations you choose to have with the Heron assistant, and any memories you allow Heron to remember.
• Payment information: billing status, subscription plan, and payment history. We do not store full credit card numbers; these are handled securely by Stripe.
• Technical data: browser type, device type, IP address, and cookies or local storage data needed to operate the Service.

We process your personal data on the following legal bases:

• Performance of a contract: to provide your account, subscription, and the features of Heron.
• Consent: for optional features such as AI chat memory and certain research or analytics uses.
• Legitimate interests: to maintain security, prevent fraud, and improve the Service.
• Legal obligation: to comply with tax, accounting, and other applicable laws.

We use your data to:

• Create and manage your account
• Provide personalized flow rituals, reminders, and AI conversation support
• Process subscriptions, payments, and cancellations
• Communicate with you about your account, updates, and support
• Maintain security and troubleshoot issues
• Improve Heron based on aggregated, anonymized insights where possible

Conversations with the Heron AI assistant may be processed to generate personalized responses. You choose whether Heron remembers details from your chats. This memory is stored under your account and is only used to personalize your experience.

You can review, update, or delete stored memories in your settings at any time. You may also choose to have the AI forget everything.

We do not sell your personal data. We share data only with trusted service providers necessary to operate Heron:

• Lovable Cloud / Supabase: for secure hosting, authentication, and database services.
• Stripe: for payment processing and subscription management.
• Google: for authentication if you choose to sign in with Google.
• Email service providers: for sending transactional and account-related emails.

These providers are contractually bound to process data only on our instructions and in compliance with applicable data protection laws.

Heron uses cookies and browser storage to keep you signed in, remember your preferences, and operate the Service. For more details, see our Cookie Policy.

We keep your personal data for as long as your account is active, and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce agreements. If you delete your account, we will delete or anonymize your data unless a longer retention period is required by law.

Under the GDPR and other applicable laws, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and personal data in certain circumstances
• Object to or restrict certain processing
• Export your data in a portable format
• Withdraw consent at any time where processing is based on consent

To exercise your rights, contact us at ida@ndflowstate.com. We will respond within one month.

Heron is hosted on Lovable Cloud infrastructure. While our primary users are in the EU, some supporting services may process data outside the European Economic Area. In such cases, we rely on appropriate safeguards, such as Standard Contractual Clauses, to protect your data.

We take reasonable technical and organizational measures to protect your data, including encryption in transit, access controls, and secure authentication. However, no online service is completely secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we do, we will post the revised version and update the “Last updated” date. For significant changes, we will notify you by email or through the Service.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at ida@ndflowstate.com.