Privacy Policy

1. Data Controller

The controller responsible for processing your personal data on this website under the Swiss Federal Act on Data Protection (DSG) and the EU General Data Protection Regulation (GDPR) is:

OWYA Movement / OWYA Academy
Leo Laut
Bleicherweg 10
8002 Zürich, Switzerland
E-Mail: hello@owya.io

2. Data Collection and Purpose

We process personal data that you provide directly to us or that is generated during your use of our platform. This includes:

• Account Data: Name, email address, password hash (created during registration to manage your account and course access).
• Learning Records: Server-recorded lesson completion, factual quiz-attempt records, and versioned Mirror questionnaire answers, contextual notes, Pattern signals, consent preference, and agreement/disagreement. Mirror data is non-diagnostic and does not determine course access or completion.
• Reflections: The current workbook pages do not submit or save what you type. A legacy authenticated reflection API can store text only when a compatible client explicitly submits it, with private or member-circle visibility selected for that record.
• Legacy Data: A legacy single archetype code may remain on an older account for migration integrity; the current Mirror does not create or overwrite that value.
• Payment Logs: Transaction metadata, product code, and status. Credit card details are processed directly and securely by Stripe (our payment gateway) and never touch our servers.

3. Legal Basis for Processing

In accordance with GDPR (Art. 6 Abs. 1) and Swiss DSG, we process your data based on:

• Contractual Necessity: To provide account, course access, server progress, optional Mirror records, and forum interactions.
• Legitimate Interests: To maintain platform security, prevent fraud, and handle technical logs.

4. Data Sharing & Third-Party Processors

We do not sell your personal data. We transfer data to third-party providers only as strictly necessary to host and run the platform:

• Stripe: Intended payment provider. The exact contracting entity, transfer safeguards, and TEST MODE integration must be verified before public sales.
• Hostinger: Intended hosting provider. The actual deployment region, processor terms, and technical configuration must be verified before public release.

5. Your Rights

Depending on your residency (Switzerland or EU/EEA), you have the following legal rights regarding your personal data:

• Right of Access: You can request info about what data we store about you.
• Right to Rectification & Deletion: You can request the correction of inaccurate data or the full deletion of your account.
• Right to Object & Restrict: You can object to processing based on legitimate interests.
• Right of Complaint: You have the right to lodge a complaint with a data protection authority (such as the Swiss FDPIC / EDÖB or your local EU supervisory authority).

To exercise any of these rights, please contact us at hello@owya.io.

6. Browser Storage and Preferences

The current release candidate uses browser storage for authentication state, language selection, and the essential-storage notice. It includes no analytics, advertising pixel, or marketing integration. Stripe may use technically necessary storage after a user starts its hosted checkout. Review the current storage details: