Privacy Policy

Controller

Constructive Microbes S.L. Avinguda de ses Palmeres, 99 07560 Sa Coma, Balearic Islands Spain Email: florian@constructive-academy.com

Data minimisation

We collect as little data as possible. The birth-energy calculator processes the date you enter solely to compute your energy. That date is not stored in an account and is not shared with third parties.

Hosting

The website is delivered via the Vercel Inc. (USA) platform. When pages are requested, Vercel processes technically necessary access data (e.g. IP address, time, requested resource) for delivery and security. Account, journal and subscription data is stored in a database hosted with Neon (Neon, Inc., USA), run out of a data centre in Frankfurt, Germany.

Both providers are engaged as processors; as both are based in the USA, the transfer relies on the EU Standard Contractual Clauses. The legal basis is our legitimate interest in reliable, secure delivery (Art. 6(1)(f) GDPR) or, for contract data, performance of the contract (Art. 6(1)(b) GDPR).

Analytics (Plausible)

For anonymous analytics we use Plausible Analytics. Plausible sets no cookies, collects no personal data and builds no cross-device profiles; processing takes place within the EU. The legal basis is our legitimate interest in privacy-friendly statistics (Art. 6(1)(f) GDPR).

Cookies

We use only strictly necessary cookies. Once accounts are available, a session cookie supports sign-in. No marketing or tracking cookies are set. Your acknowledgement of the cookie notice is stored locally in your browser (localStorage), not as a cookie.

Account

An account is optional for the calculator. Reports need a free account so we can deliver your PDF securely. If you create an account, we store your email address and a securely hashed password (bcrypt), plus optional details you choose to add: display name, birth date and time, timezone and your reading preferences. These are used solely to give you your personal readings, your resonance and your journal in one place. At registration we record the timestamp of your consent to the privacy policy and terms. A strictly necessary session cookie keeps you signed in. The legal basis is performance of the usage relationship (Art. 6(1)(b) GDPR).

For an optional daily energy email we obtain your explicit consent (double opt-in), which you can withdraw at any time. Delivery is handled by a processor (Resend).

Journal and saved connections

Your journal is a private space for reflection. It may hold sensitive content: free text, mood, energy level, body feeling, reflection answers, ritual notes and evening integration. Saved connections hold a name or alias you choose, a birth date and a relationship type. This data is processed solely to show you your entries and readings.

Your journal is yours. Deleted entries rest in a trash for 30 days, then are permanently removed. You can export all of your data as JSON at any time and delete your account entirely (which also removes your journal, connections and settings). We do not sell your data, we run no advertising based on your journal content, and we perform no manipulative analysis. The legal basis is performance of the usage relationship (Art. 6(1)(b) GDPR).

Payments and subscription (Stripe)

For paid reports and the Maya Plus subscription we use the payment provider Stripe (Stripe Payments Europe, Ltd.) as a processor. When you make a purchase, Stripe processes the data required for payment (e.g. name, email address, payment method). We do not receive or store full card details.

For your purchase or subscription we store only what is needed to fulfil the contract: product, amount, status, time, a Stripe identifier (customer, session or subscription id) and, for logged-in members, the link to your account. The legal basis is performance of the contract (Art. 6(1)(b) GDPR); where data is transferred to third countries, Stripe relies on the EU Standard Contractual Clauses. Retention follows statutory commercial and tax obligations.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can exercise access and portability yourself at any time via the data export in your account settings, and erasure via “Delete account”. You also have the right to lodge a complaint with a data protection authority. To exercise your rights, contact us at the address above.