Privacy Policy

Scope

This Privacy Policy explains how SpiritIndex ("we," "us") collects, uses, shares, and safeguards personal information when you use our mobile apps, web app, and sites (the "Service").

We act as a data controller for consumer accounts. For enterprise/clinical pilots where SpiritIndex processes data on behalf of an organization, we act as a processor under a separate DPA.

What We Collect

A) You Provide:

• Account data (name, email, password or SSO).
• Profile data (preferred language, assessment preferences).
• Assessment inputs & journal entries (your responses in the app).
• Support requests and feedback.
• Payment info (processed by our payment provider; we do not store full card numbers).

B) Collected Automatically:

• Device & log data (app version, device model, OS, IP address, timestamps).
• Usage analytics and diagnostics (events, crashes, performance).
• Cookies/SDKs for authentication, preferences, and analytics.

C) From Third Parties:

• App stores (receipt status, subscription entitlements).
• Payment processors (payment status, last 4 digits & expiry token).
• SSO providers (email, name, org identifier, if applicable).

We do not collect precise geolocation or contact lists. We do not sell personal information.

Purposes & Legal Bases (GDPR)

We process data to:

1. Provide and improve the Service, features, scoring and dashboards (contract necessity).
2. Personalize content and measure usage (legitimate interests / consent where required).
3. Communicate about updates, security, billing, and support (contract / legitimate interests).
4. Process payments and manage subscriptions (contract).
5. Ensure security, prevent fraud/abuse, and comply with law (legitimate interests / legal obligation).
6. With your explicit consent, enable optional features such as email newsletters or research participation.

Sensitive Data

Assessment inputs may reflect personal wellbeing experiences. We treat these as sensitive and apply enhanced access controls. SpiritIndex is a general-wellbeing service and not a HIPAA-covered entity. We do not use sensitive inputs for advertising.

Sharing

We share limited data with service providers under contract, solely to operate the Service:

• Cloud hosting, backups, and content delivery (DigitalOcean and Cloudflare)
• Analytics and diagnostics providers, where those features are enabled
• App stores and payment providers, where purchases are available
• Email delivery and in-app messaging providers

We may disclose data if required by law, to protect users, or in connection with a merger/acquisition (subject to this Policy).

We do not sell or "share" personal info for cross-context behavioral advertising as defined by the CCPA.

International Transfers

We may transfer data to the U.S. and other countries where we and our providers operate, using appropriate safeguards (e.g., SCCs for EEA/UK/Swiss data).

Retention

We retain personal data while your account is active and as needed for the purposes above, then delete or de-identify it. You can request deletion at any time (see "Your Rights").

Security

We implement organizational and technical measures including encryption in transit, access controls, least-privilege principles, secure development practices, and vendor due diligence. No method is 100% secure; please protect your credentials.

Children

The Service is not directed to children under 13 (or under 16 where required). We do not knowingly collect children's data. If you believe a child has provided data, contact us for deletion.

Your Rights

Depending on your jurisdiction (e.g., GDPR/UK GDPR, CCPA/CPRA, PIPEDA, etc.), you may have rights to access, correct, delete, port, or restrict processing of your data, and to object or withdraw consent.

• EU/UK users may contact egomemmanuel@gmail.com to exercise rights or lodge a complaint with a supervisory authority.
• California users may exercise CCPA rights and use an authorized agent; we will not discriminate for exercising rights.

Research & Analytics

De-identified and aggregated insights may be used to improve assessment quality and product performance. We do not use identifiable assessment content for advertising.

Automated Decision-Making

SpiritIndex may generate scores or insights based on your inputs. You may contact support to request human review or context.

Data Deletion & Account Closure

Request deletion of your SpiritIndex account and associated data on our account deletion page, through Account Settings → Delete Account in the mobile app, or by emailing egomemmanuel@gmail.com. We verify account ownership before processing a request. Live account data is deleted; encrypted recovery backups expire under the backup retention schedule (local backups: 14 days; off-site current versions: 90 days; superseded versions: 30 days). Security logs rotate daily with 14 retained rotations. Any legal retention exception, its purpose, and its applicable period will be explained when handling your request.

Changes to This Policy

We will update this Policy as needed and post the revised date above. Material changes will be communicated in-app or by email where required.

Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Privacy inquiries & rights requests: egomemmanuel@gmail.com
• Security reports: egomemmanuel@gmail.com
• Mailing address: Available on request