Privacy Notice

Effective date: 3 June 2026

1. Who we are

Everyday Noesis ("we", "us", "our") is the seller of the Everyday Noesis service and the data controller for the personal data you provide when using our service. We are responsible for deciding how and why your personal data is processed.

2. What personal data we collect

We collect and process the following categories of personal data:

• Identity and contact data: name, email address;
• Account data: login credentials, user ID, profile information (vision, values, goals, focus areas);
• Content data: journal entries, documents, and other materials you upload or create within the service;
• Usage and technical data: IP address, browser type, device information, access times, and interaction logs;
• Payment data: we do not store payment card details. Payment information is collected and processed by our Merchant of Record, Paddle.com.

3. Why we collect it & legal basis

4. Who we share your data with

We do not sell your personal data. We share it only with:

• Paddle.com — our Merchant of Record and online reseller for the sale of the product, subscription management, payments, tax compliance, invoicing, customer service inquiries, and returns;
• Lovable / Supabase — our hosting and database infrastructure providers;
• Professional advisers — such as legal or accounting professionals, when necessary;
• Authorities — where required by law or to protect our rights.

5. Data retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you cancel your subscription, we retain your data for a reasonable period to allow you to reactivate your account or resolve disputes. After that period, we delete or anonymise your data, except where we are required to retain it by law.

6. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you;
• Rectification — request correction of inaccurate or incomplete data;
• Erasure — request deletion of your data in certain circumstances;
• Restriction — request that we limit processing of your data;
• Portability — request transfer of your data to another service;
• Objection — object to processing based on legitimate interests;
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at tom@hellotom.co.uk. We will respond within one month.

You also have the right to lodge a complaint with your local supervisory authority.

7. Security

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS/SSL), access controls, and secure hosting infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. International transfers

Your data is stored and processed within the United Kingdom and the European Economic Area via our infrastructure providers. If data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

9. Cookies

We use essential cookies to enable core functionality (authentication, session management). We may also use analytics cookies to understand how the service is used. You can manage cookie preferences through your browser settings.

10. Changes to this notice

We may update this Privacy Notice from time to time. We will notify you of material changes via email or within the service.

11. Contact

If you have any questions about this Privacy Notice or our data practices, please contact us at tom@hellotom.co.uk.