Privacy Policy
Data controller
Mirian Pereira Soares, tax number 322839661, Av. Prof. Eng. Joaquim Vieira Natividade, 1, 2460-071 Alcobaça, Portugal. Contact for personal data matters: info@flowgrounded.com.
We have not appointed a data protection officer because we are not required to. Requests are handled directly by the person who runs the business.
What data we process
Purchase: email, name, country, product bought, amount, date, payment session ID and the last four digits of the card, which Stripe passes back to us. We never receive the full card number or the security code.
Invoicing: name, address and tax number, when you give them for the invoice.
Email support: the content of the messages you send us and the address you write from.
WhatsApp guidance (Guided Bundle only): your phone number, your profile name, the messages, voice messages, photos and videos you send us, and our replies.
Health data: if, during the guidance or by email, you tell us something about your health (an injury, a pregnancy, pain), that information is special category data. Please share only what is necessary.
Access to the lessons: the signed proof of purchase stored in your browser. We do not record which lessons you watch or for how long.
Browsing: IP address, device and browser type, and pages requested, in the hosting provider's technical logs. If you accept analytics or marketing cookies, the data collected by those tools.
What we use the data for and on what legal basis
To give you access to the lessons, provide the guidance and perform the purchase contract. Legal basis: performance of a contract.
To use what you tell us about your health only to adapt the pointers we give you in the guidance or to answer your request. Legal basis: your explicit consent, which you give by sending us that information and can withdraw at any time by asking us to delete it.
To issue invoices and meet tax and accounting obligations. Legal basis: legal obligation.
To answer support requests, handle refunds and defend ourselves in payment disputes. Legal basis: performance of a contract and legitimate interest.
To prevent fraud and misuse of access. Legal basis: legitimate interest.
To measure visits and ad results, if and when we switch those tools on. Legal basis: your consent, given in the cookie notice, which you can withdraw under Manage cookies.
What we do not do
We do not sell or pass on your data to third parties for commercial purposes.
We do not send you advertising by email or WhatsApp without your consent. The messages you receive are about your purchase, your access and the guidance.
We do not make automated decisions that have legal effects on you. Stripe may apply automatic anti-fraud rules to a payment; if one of your payments is declined this way, write to us and we will review it manually.
Who processes data on our behalf or alongside us
Stripe Payments Europe, Ltd. (Ireland): payment processing and fraud prevention. Stripe also processes data as a controller in its own right, under Stripe's privacy policy.
Vercel Inc. (United States): website hosting and running the functions that check access to the lessons.
Resend, operated by Plus Five Five, Inc. (United States): sending the emails with your access and the purchase confirmation.
WhatsApp Ireland Limited (Ireland): the messaging service used for the guidance. Messages are end-to-end encrypted. WhatsApp processes your account data as a controller in its own right, under its own policy, and may transfer it to Meta Platforms, Inc. in the United States.
Analytics or advertising tools, only if we switch them on and only after you accept. The up-to-date list is in the Cookie Policy.
Providers that process data on our behalf are bound by data processing agreements and only use the data to provide their service to us.
Transfers outside the European Union
Some providers are based in the United States. Transfers rely on the EU-US Data Privacy Framework, where the provider is certified, and on the Standard Contractual Clauses approved by the European Commission.
The website's fonts are served from this domain. Normal browsing does not send requests to third-party servers before you give consent.
How long we keep data
Purchase and invoicing data: 10 years, as required by tax law.
Support emails: 2 years after the last contact.
WhatsApp guidance chat: up to 6 months after the guidance ends, so we can answer questions about the service. Videos and photos you send us are deleted from our phone within 30 days of our reply.
Information about your health: we delete it when the guidance ends, or sooner if you ask.
Hosting technical logs: up to 12 months.
Proof of access in your browser: until you delete it. You can do this in your browser settings.
Your rights
You can ask for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest. You can withdraw your consent at any time, without affecting processing already carried out.
Write to info@flowgrounded.com. We reply within one month. We only ask for what is needed to confirm your identity.
You can also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt), or to the supervisory authority in your country of residence.
Security
The website only works over HTTPS. Card details are entered directly on Stripe's page and never pass through our servers.
The proof of access is cryptographically signed and cannot be altered without becoming invalid.
If there is a data breach that puts your rights at risk, we report it to the CNPD within 72 hours and tell you directly when the risk is high.
Minors
Our products are for people aged 18 and over. We do not knowingly collect data from minors. If you know that a minor has given us data, write to info@flowgrounded.com and we will delete it.
Changes to this policy
If we change this policy, we update the date at the top of the page. We tell existing customers about significant changes by email.