Last updated: July 11, 2026 · Version: 1.2
pendiente: razón social, Alvaro Villablanca
pendiente: Bochum · dirección postal pendiente, Germany
Privacy email: support@vinyala.com
| Data | Purpose | Legal Basis (Art. 6 / 9 GDPR) |
|---|---|---|
| Email and password (encrypted) | Create and authenticate your account | Art. 6(1)(b) performance of the contract (Terms) |
Display name (display_name), language | Customize your account | Art. 6(1)(b) |
Account type and status (entitlements) | Manage access (currently: free) | Art. 6(1)(b) |
| Your practice journal (sessions, notes, goals, and fields such as sensation, injury, pregnancy if you fill them out) | To track and view your progress and the muscle map | Art. 9(2)(a) explicit consent (we treat this as health data as a precaution) |
| Post-class somatic notes (body area, type of sensation—discomfort, tension, or accomplishment—and context of the course/session/circle) | Save them in your log and, only if you choose to share them, contribute to collective insights so the instructor can adapt the class | Art. 6(1)(a) and Art. 9(2)(a): explicit, specific, and revocable consent |
| Optional course participation survey (e.g., first session and frequency of participation, without revealing individual records) | Provide the instructor with collective metrics on course usage | Art. 6(1)(a): revocable consent |
| Questions, answers, and private messages within the course | To enable communication between the student and the instructor in charge | Art. 6(1)(b) |
| Voice recordings by the instructor and technical metadata of the file | To enable the instructor to prepare the audio for |
Important (health): The sensitive fields in the journal are optional. We only
process them if you choose to enter them and give your explicit consent; you can
withdraw it at any time (see §7), which will stop such processing going forward.
Somatic marks and collective body: We do not store or share a somatic mark without
your prior explicit consent. Your instructor and the other students can never view
your individual entries. The “collective body” only displays totals when at least
five students participate and excludes completely homogeneous groups that could facilitate inferences.
You may withdraw your consent at any time; your shared markers will be deleted and
future processing will cease, without affecting the lawfulness of processing prior to withdrawal.
Course Pulse: Sharing the pulse is optional. It is only available for courses published by
the circle instructor and for authorized members. The instructor only receives
aggregated totals when at least three students participate; she cannot view individual entries,
and her own activity does not count. Disabling this option removes your shared activity and
blocks new contributions until you give your consent again.
The questions, answers, and letters in the course are private to authorized participants.
If the instructor voluntarily turns an answer into an FAQ, only the topic and the
instructional answer are published—never the original question or the student’s identity.
Voice recordings are stored in a private object storage system, and, at this stage,
only the instructor who uploaded them can access or delete them. Uploads require a
one-time technical authorization and are subject to safeguards against abuse.
We do not currently use advertising, third-party tracking, profiling, or automated decision-making
with legal effects (Art. 22). If this were to change, we would update this policy and request
your prior consent where applicable.
We work with vendors that act as data processors under contract
(Art. 28 GDPR — Data Processing Agreement):
| Vendor | Role | Data Location | International Transfer |
|---|---|---|---|
| Supabase (authentication, database) | Accounts and storage of your data | EU — Ireland (West EU) | Parent company in the U.S. → covered by TTC/SCC and/or EU-US Data Privacy Framework |
| Cloudflare (hosting/CDN, Worker, and private R2) | App delivery, edge security, and voice recording storage | Global network; encryption in transit | US → CCT/SCC / DPF |
| pendiente: proveedor email (e.g., Resend/SES/Postmark) | Sending emails from the account (confirmation, recovery) | pendiente: región email | Depending on the provider → CCT/SCC if applicable |
*(We no longer load fonts from Google: we host them on our own domain, so
browsing Vinyala does not transmit your IP address to Google. The exception is voice dictation, which
we explain right below.)*
The note fields include an optional microphone button. When you use it, **neither we
nor a provider contracted by us transcribes the text: it’s the speech recognition feature of the
browser you’re using, which is why it doesn’t appear in the table above**—that table lists contracted
data processors (Art. 28), and we don’t have such a contract with your browser’s manufacturer.
| What leaves your device | The audio you speak while the microphone is on |
| Who receives it | The browser's speech recognition service. In Chrome, that's Google |
| What is NOT sent | None of this reaches Vinyala’s servers: we receive the text already transcribed, just as if you had typed it |
| How to avoid it | Don’t use the microphone: what you type never goes through it. In browsers without this engine (e.g., Firefox), the button doesn’t even appear |
| Legal Basis | Art. 6(1)(a): You activate it yourself, step by step, and you can choose not to |
We do not sell or share your data with third parties for commercial purposes.
your account, or it is no longer necessary for the course, whichever comes first.
exists, unless you delete them sooner.
≤ 30 days), except for data we are required by law to retain. Voice recordings are actively deleted;
a daily sweep removes any orphaned files after a technical grace period of
24 hours (approximate maximum target: 48 hours from the time they become orphaned).
they are deleted when the account is deleted or, if resolved earlier, 30 days after resolution.
We implement technical and organizational measures (Art. 32): encryption in transit (HTTPS),
hashed passwords, **data isolation per user through row-level security
(RLS)** in the database, and access control. No system is 100% secure, but
we work to protect you.
Vinyala is intended for people 16 years of age or older. We do not knowingly collect data from
minors under that age without the consent of their legal guardian (Art. 8 GDPR).
If you believe a minor has provided us with data, please write to us at support@vinyala.com.
You have the right to: access (Art. 15), correction (16), **deletion / "right to
be forgotten" (17), restriction (18), portability (20), objection (21), and to withdraw
your consent** at any time (without affecting the lawfulness of processing prior to withdrawal). You may also
file a complaint with a supervisory authority (in Germany, the authority of the relevant Land
; or that of your country of residence in the EU).
How to exercise these rights: Write to support@vinyala.com. We will respond within the legal timeframe
(1 month, extendable). The app allows you to request a structured export of your
account data, including your journal and preferences, F13 participation (somatic markers, heart rate, questions,
answers, letters, and your own audio recordings), as well as to delete your account directly. Security logs
linked to your email address are not included in the self-service options to avoid mixing them if an
address is reused; you can request them by submitting an access request with verified
identity.
We may update this policy; we will publish the new version with its date, and if the
changes are substantial (e.g., new processing activities), we will notify you.