Privacy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

You may contact us at the above email address at any time with any questions concerning data protection and in order to exercise your rights.

2. Personal data processed

When you use AENEA, we process the following categories of personal data:

• •Account and profile data: email address, name and voluntary information such as age, time zone and personal goal, as well as your notification settings.
• •Authentication data: login credentials as well as session and access tokens that are stored on your device in order to manage your sign-in.
• •Health and wellbeing data: your daily check-ins and the analyses derived from them (see section 3).
• •AI interaction content: your messages to the AI companion "GAIA" and the guidance generated from them.
• •Subscription and payment data: identifiers of your payment and subscription transaction, product, status and terms.
• •Team and organisation data: team name, role, team membership and, in the case of invitations, the email address of the invited person.
• •Communication data: recipient address and delivery status of the emails we send, as well as unsubscribe information.
• •Usage and analytics data: device and usage information as well as, where the corresponding consent has been given, session recordings (see sections 9 and 10).
• •Technical log data: for the purpose of secure and stable operation.

3. Health data (Article 9 GDPR)

AENEA processes data concerning your health, which therefore belongs to the special categories of personal data under Article 9(1) GDPR. This concerns in particular:

• •information on sleep (for example sleep duration),
• •information on fluid intake,
• •information on stress and mood,
• •information on movement and activity,
• •information on nutrition,
• •information on body and recovery,
• •free-text notes that you record as part of your check-ins,
• •the content of your GAIA chat histories,
• •the analyses derived from this information (for example your “AENEA Score”, trends and AI-assisted guidance).

The legal basis for processing this health data is exclusively your explicit consent pursuant to Article 9(2)(a) GDPR. Without this consent we neither collect nor process any health data; the corresponding functions, in particular the daily check-in, are then not available to you.

We obtain consent to the processing of health data through a separate, standalone consent procedure that is technically separated from the other consents (cookies, analytics, session replay, general AI processing). Before you can use health functions, a dedicated consent dialog is shown in which you can expressly accept or refuse the processing. Your decision is documented together with the time and the version status; if the consent texts change materially, you will be asked for your decision again.

You may withdraw this consent at any time with effect for the future (see section 5). The lawfulness of the processing carried out until the withdrawal remains unaffected.

4. Consent

Certain processing operations that are not strictly necessary require your consent. For this purpose our application contains a consent management system with a consent banner and a settings area that can be reached at any time. There you can accept or refuse individual categories.

We distinguish the following consent categories:

• •Strictly necessary (always active, no consent required), for example storing your sign-in token for session management.
• •Analytics: Article 6(1)(a) GDPR, Section 25(1) TDDDG (see section 9).
• •Session replay: Article 6(1)(a) GDPR, Section 25(1) TDDDG (see section 10).
• •AI processing: consent to the processing of your input by AI functions (see sections 7 and 8).
• •Health data (Article 9 GDPR): separate explicit consent (see section 3).

Your consent decisions are stored locally on your device, together with a timestamp and a version status, so that your choice can be taken into account on later visits. The respective processing does not take place before consent has been given; all consents are deactivated by default (opt-in) and must be actively granted by you.

5. Withdrawal of consent

You may withdraw any consent given at any time with effect for the future. The following options are available to you:

• •through the consent settings area in the application, which can be reached at any time and in which you can deactivate individual categories (analytics, session replay, AI processing) or reset your consent in full;
• •through the separate settings for the health data consent (Article 9), by which you can withdraw that consent;
• •for email notifications, additionally through the relevant settings in your profile and through the unsubscribe link in every email.

Following a withdrawal, the processing concerned is discontinued. If you withdraw your consent to the processing of health data or to AI processing, the functions that depend on it are no longer available to you. The lawfulness of the processing carried out until the withdrawal remains unaffected.

6. Check-ins

The daily check-in is at the centre of AENEA. In it you voluntarily record information on sleep, fluid intake, stress, mood, movement, nutrition as well as body and recovery, and you can additionally add free-text notes. From this information the application calculates a summary orientation value (the “AENEA Score”) and presents trends to you.

This data concerns your health. It is processed exclusively on the basis of your explicit consent pursuant to Article 9(2)(a) GDPR. Access to the check-in function is technically protected by an upstream consent procedure: without health data consent, the consent dialog is displayed to you instead of the check-in.

Your check-in data is assigned exclusively to your account and is protected by technical access restrictions (see section 20) in such a way that only you have access to it. You can delete individual check-ins yourself at any time.

7. GAIA (AI companion)

“GAIA” is an AI-assisted companion integrated into the application. You can send messages to GAIA and receive calm, comprehensible guidance and context on your health patterns. Your messages and the relevant context, in particular your check-in data, are transmitted to our AI service provider (see section 17) in order to generate the responses and are processed there.

The content of your GAIA chats may contain health data. The legal basis is therefore your explicit consent pursuant to Article 9(2)(a) GDPR in conjunction with your consent to AI processing. The AI functions are technically designed in such a way that they cannot be used without the required consent; instead, a notice referring to your consent settings is displayed.

No decision based solely on automated processing which produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR takes place. The guidance serves solely for your orientation and does not replace medical advice.

GAIA preview on the public website. On our public website we offer a freely accessible preview of the GAIA function. If you send a message there, it is transmitted server side to the AI service provider used for that purpose, Anthropic (see section 17), in order to generate the response; the messages are not stored permanently. If you use the optional voice output, the response text is transmitted to our service provider ElevenLabs in order to be converted into speech. If you use the optional voice input (microphone), your speech input is converted into text by the speech recognition built into your browser; depending on the browser, this may involve processing by the respective browser provider, over which we have no influence. The legal basis is Article 6(1)(b) and (f) GDPR (provision of the preview function you requested).

8. AI-assisted analyses

Beyond the chat function, the application generates AI-assisted analyses on the basis of your check-in data, such as pattern recognition, personal guidance and summary reports. For this purpose the necessary data is transmitted to our AI service provider and processed there.

Because these analyses are derived from health data, their processing is likewise based on your explicit consent pursuant to Article 9(2)(a) GDPR as well as on your consent to AI processing. Without these consents, no AI-assisted analyses are created. Here too, no automated decision within the meaning of Article 22 GDPR takes place.

9. Analytics

In order to improve our services we use the analytics tool Amplitude. With it we collect pseudonymous usage information such as page views and interaction events. We have taken technical measures to ensure that particularly sensitive content does not enter the analytics events.

Analytics takes place only after you have given your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG). The analytics system is initialised only once your consent has been given; before consent, no analytics data is collected or transmitted. Within the signed-in application (AENEA), processing takes place in the server region of the European Union. You may withdraw your consent at any time with effect for the future (see section 5).

Public website (marketing website). On our public website, meaning the freely accessible information and product pages outside the signed-in application, we use Amplitude in order to understand how the website is used and to improve content, navigation and conversion paths. Here too, Amplitude is activated only after your explicit analytics consent; without consent the analytics system is not loaded and no events are sent (legal basis: Article 6(1)(a) GDPR, Section 25(1) TDDDG).

Your consent decision for the website is stored locally on your device (key elessar.marketing.consent.v1) and can be changed or withdrawn at any time through the Cookie Settings. After a withdrawal, the collection of future events is discontinued.

Within website analytics we process exclusively pseudonymous usage data, in particular:

• •the pages visited as well as page path and page title (page_path, page_title);
• •clicks on buttons and on navigation and footer links (cta_label, cta_location, link_href, section_name) and, where applicable, the designation of a selected plan (plan_name);
• •an approximate time of the event (timestamp) as well as the technical environment (environment);
• •technical and browser-related usage information, insofar as this is required for the analysis.

Within website analytics we process no health data, no check-ins, no scores, no notes or messages and no content of form entries. No names, email addresses or telephone numbers are collected as event data. No autocapture takes place, meaning there is no automatic recording of all interactions.

With the same analytics consent you additionally activate session replay on the public website. There is no separate toggle for this: your single decision on the “Analytics” category controls both together. Section 10 describes the details and the safeguards.

The provider of the analytics tool used on the website is:

Processing by Amplitude may involve a transfer of data to the USA. Where such a third country transfer takes place, we base it on appropriate safeguards within the meaning of Articles 44 et seq. GDPR, in particular on standard contractual clauses of the European Commission and/or an adequacy decision. On request we will provide you with further information on the safeguards in place.

10. Session Replay

With a session recording (“session replay”) we record the course of a session in order to understand how the application is operated and to improve it. The provider is Amplitude (address see section 9); processing takes place in the server region of the European Union.

Public website (marketing website). Here the session recording is part of the “Analytics” category and is therefore tied to the same consent as analytics (Article 6(1)(a) GDPR, Section 25(1) TDDDG). There is no separate toggle for it. The recording begins only once this consent has been given; before that, the corresponding software is not loaded. You may withdraw the consent at any time with effect for the future through the Cookie Settings; the recording then in progress ends immediately, without you having to reload the page.

Safeguards on the website. The recording shows the publicly accessible page content, that is, what every visitor to this website can see in any case. All form fields, meaning input fields, select fields and multi-line text fields, including name, email and free-text entries, are by contrast transmitted masked, so that their content is not legible in the recording. Areas in which freely formulated entries can arise, in particular the dialog with our AI companion GAIA on the public pages, are excluded from the recording entirely and are not transmitted at all. Health-related information is not recorded intentionally. This does not amount to a technical guarantee that users will not make such information visible elsewhere.

Signed-in application (AENEA). There the session recording is subject to separate consent and is active only for as long as your corresponding consent exists. The settings of the public website do not apply there.

11. Team functions

If you are part of a team, for example within a corporate offering, the application provides team administrators with exclusively anonymised, aggregated analyses at team level, for example summarised key figures on energy, recovery, stress, mood and activity as well as guidance derived from them.

In order to protect your privacy, the following principles apply and are implemented technically:

• •team administrators receive no access at any time to individual values, names or individual check-ins of individual members.
• •aggregated analyses are created and displayed only from a minimum number of three members onwards, in order to prevent conclusions being drawn about individual persons.
• •the data is consolidated exclusively server side; the underlying individual data remains protected in your account.

In a corporate context, the respective employer is regularly also jointly responsible as a controller; the contractual arrangements required for this are agreed separately.

12. Payments and subscriptions

For paid offerings, including monthly and annual Pro plans as well as team plans, we process subscription-related and payment-related data, in particular identifiers of your payment and subscription transaction, product, status and terms. Payment is processed through our payment service provider (see section 17).

The legal basis is Article 6(1)(b) GDPR (performance of the contract); insofar as statutory retention obligations exist, additionally Article 6(1)(c) GDPR. We do not store complete payment means data such as credit card numbers; this data is processed directly by the payment service provider.

13. Email communication

In the course of your use we send various emails:

• •Transactional emails (for example for confirmation, for resetting a password or for team invitations) on the basis of Article 6(1)(b) GDPR (contract);
• •Notifications and reports (for example a morning prompt, an evening reminder, a weekly review and, where applicable, team reports) on the basis of your consent or your profile settings.

You can deactivate the receipt of notifications and reports at any time in your profile settings or withdraw it through the unsubscribe link in every email. In order to ensure proper delivery and to observe unsubscribe requests, we process delivery logs as well as a suppression and unsubscribe list.

Early access and contact requests through the website. If you submit the early access or contact form on our public website, we process the information you provide, in particular company, email address, industry, approximate number of employees and your free-text entries, in order to handle your request and to reply to you. The transmission takes place server side by email through our email service provider Resend (see section 17) to our contact address; the data is not stored in a database in the process. The legal basis is Article 6(1)(b) GDPR (performance of pre-contractual measures) or Article 6(1)(f) GDPR (our legitimate interest in handling your request).

14. Data export (Article 20 GDPR)

You have the right to data portability. For this purpose the application provides an “Export my data” function with which you can retrieve your personal data in a structured, commonly used and machine-readable format (JSON).

The export covers the data belonging to your account, in particular your profile, your check-ins, your GAIA messages, your AI guidance, your team membership and your subscription data. For data protection reasons, data of other persons, operational and security-related artefacts as well as team-related aggregate analyses are excluded. Retrieval takes place exclusively for your own account and is secured by authentication as well as technical access restrictions.

15. Account deletion (Article 17 GDPR)

You have the right to erasure of your data. For this purpose the application provides a “Delete account” function. Before it is carried out, you receive a preview of the effects of the deletion, in particular which teams will be deleted together with you and which teams prevent deletion because you are the sole administrator there.

During deletion, only your own account is processed; the deletion of third-party accounts is technically excluded. In the course of the deletion, ongoing subscriptions that can be cancelled are cancelled with our payment service provider and your account-related data is then removed. Through the subsequent deletion of your authentication account, the data linked to it, in particular profile, check-ins, AI guidance and subscription data, is deleted automatically along with it; your GAIA messages and team memberships are removed separately. The deletion is final and cannot be reversed.

16. Data subject rights

Under the GDPR you have the following rights:

• •access (Article 15 GDPR),
• •rectification (Article 16 GDPR),
• •erasure (Article 17 GDPR),
• •restriction of processing (Article 18 GDPR),
• •data portability (Article 20 GDPR),
• •objection to certain processing operations (Article 21 GDPR),
• •withdrawal of consent given with effect for the future (Article 7(3) GDPR).

To exercise your rights you may contact us using the contact details given in section 1. Functions for data portability and for deletion are additionally available to you directly in the application (see sections 14 and 15).

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The supervisory authority responsible for us is:

You are also free to contact the supervisory authority of your habitual residence.

17. Processors

We use carefully selected service providers that process personal data on our behalf and in accordance with our instructions (processing on behalf of a controller pursuant to Article 28 GDPR):

• •Supabase: database, authentication and scheduled background tasks; storage in the European Union.
• •Vercel: hosting, operation and delivery of the public website (marketing website).
• •Cloudflare: hosting, operation and delivery of the web application (AENEA app).
• •OpenAI: AI processing within the signed-in application (GAIA chat as well as AI-assisted analyses).
• •Anthropic: AI processing of the freely accessible GAIA preview on the public website (see section 7).
• •ElevenLabs: conversion of text into speech (voice output of the GAIA voice).
• •Stripe: processing of payments and subscriptions; complete payment means data is processed exclusively there.
• •Resend: dispatch of our emails (transactional and notification emails as well as early access and contact requests through the website).
• •Amplitude: analytics and session replay, both within the signed-in application and, subject to analytics consent, on the public website; processing in the server region of the European Union (see sections 9 and 10).

Data processing agreements pursuant to Article 28 GDPR are in place with these service providers or are concluded with them.

18. Transfers to third countries

Personal data is processed primarily within the European Union. Insofar as a transfer to recipients outside the EU or the EEA, in particular to the USA, takes place in the course of AI processing (for example by OpenAI or Anthropic), voice output (ElevenLabs), hosting, payment processing or analytics, this occurs only on the basis of appropriate safeguards within the meaning of Articles 44 et seq. GDPR, in particular on the basis of standard contractual clauses of the European Commission and/or an adequacy decision. On request we will provide you with further information on the safeguards in place.

19. Storage periods

We store personal data only for as long as this is necessary for the provision of our services or as long as statutory retention obligations exist. In detail:

• •Account data: until your account is deleted.
• •Health data: until your account is deleted or until your consent is withdrawn; you can delete individual check-ins and GAIA messages yourself at any time.
• •Payment-related data: in accordance with the applicable tax and commercial law retention obligations.
• •Records of consent: for as long as this is necessary in order to document and demonstrate consent; your consent decisions are retained together with the time and the version status.
• •Technical log data: only for as long as this is necessary for secure operation.

Once the respective purpose no longer applies or statutory periods have expired, the data is deleted or anonymised.

20. Data security

We take appropriate technical and organisational measures to protect your data. These include in particular:

• •a consistent, database-side access restriction at row level (row level security), so that each person can in principle access only their own data;
• •the strict separation of privileged server operations, which are executed exclusively server side and not on the end device;
• •the protection of security-critical interfaces (for example the cryptographic verification of payment webhooks) as well as the use of cryptographically strong, single-use invitation tokens;
• •processing and storage in server regions of the European Union;
• •the transmission of data over encrypted connections.

21. Changes to this privacy policy

We adapt this privacy policy when the underlying processing, the services used or the legal framework change. The current version published on our website applies in each case. In the event of material changes affecting your consents, we will inform you separately and, where necessary, ask for your consent again.

Version of this privacy policy: 1 July 2026.