Last updated: 12 August 2026
1. Controller
Spirit Guide (trade name of Ginsen (eenmanszaak), owned by Daan H. Teer, KVK 91451094, BTW NL004890910B95) is the controller of your personal data. Contact: contact@spiritguide.one.
2. What We Collect
Account data: your first name, email address, gender (optional), and account preferences.
Conversation content: the messages you send during explorations and the AI-generated responses.
Generated content: stories, journal entries, and reflections created during your explorations.
Memory data: our memory system is designed to record archetypal themes and patterns relevant to your self-discovery. It is specifically instructed not to record medical or clinical information, expressions of self-harm or suicidal ideation, specific descriptions of trauma or abuse, substance use disorders, financial details, legal situations, or identifying details of third parties. As an additional safeguard, a secondary filter screens memory content before it is stored. If despite these measures, the memory system records anything that you personally do not want recorded, you can delete your data at any time in Settings. For more information, contact us at contact@spiritguide.one.
Usage data: technical information such as login timestamps and conversation counts, and how you use the app: which screens you open and for how long, which buttons and popups you use, and which steps of the purchase flow you reach. This is stored with your account, used only to improve the service, deleted with your account, and never shared.
Payment data: payments are processed by Stripe. We do not store your card details. We receive confirmation of payment status and transaction identifiers.
Approximate location: your country, derived from your IP address by GeoJS, solely to display prices in the correct currency.
3. How We Use Your Data
Providing the service: processing your conversations, generating stories and journal entries, maintaining memory data for personalised exploration, and managing your account and library.
Improving the service: if we use your conversations or memories to improve the app, your account details (ID, email) are removed — only the content itself remains. You can turn this off at any time in Settings, which stops future use of your conversations for this purpose. Improvement copies are reviewed without your account details attached. If you ask us to delete your data, these copies are deleted too. We do not use your personal conversation content for AI model training.
Security and enforcement: reviewing account activity to investigate potential violations of our Terms of Service, prevent abuse, and maintain the security of the service.
Communication: responding to support requests and sending essential service notifications.
Legal compliance: meeting our obligations under GDPR, tax law, and other applicable regulations.
4. Legal Basis
Consent (Article 6(1)(a) GDPR): we ask for your consent before your first conversation. This covers processing of your conversation content, memory data, and generated content.
Contract performance (Article 6(1)(b) GDPR): processing necessary to provide the service, including account management and coin/subscription processing.
Legitimate interest (Article 6(1)(f) GDPR): service improvement through analysis of conversations with account details removed, aggregated usage data, and ensuring security and preventing abuse.
We recognise that conversations may touch on personal themes. We take this seriously — we have conducted a Data Protection Impact Assessment to ensure your data is handled with the highest standard of care.
5. Service Providers
We do not sell your data, use it for advertising, or share it with third parties for their own purposes. We share data only with the following providers, each acting under our instructions:
Anthropic (Claude API) — United States. Processes your conversation messages to generate Spirit Guide responses. Not used for AI training. Logs retained up to 7 days for safety monitoring, then deleted. Transfers: SCCs + EU-US Data Privacy Framework.
Supabase — European Union (Frankfurt, Germany). Hosts the database and user accounts, including conversations, stories, journal entries, and memory records. Data stored in EU data centers.
Pinecone — United States. Stores vector embeddings of memory data for semantic search. Transfers: Standard Contractual Clauses.
Voyage AI (MongoDB) — United States. Generates text embeddings from memory data. Ephemeral processing — no data retained. Transfers: SCCs + EU-US Data Privacy Framework.
Stripe — United States. Processes payments and manages subscriptions. Receives payment information directly. Transfers: SCCs + EU-US Data Privacy Framework.
Runware — United Kingdom. Generates avatar images. Receives archetype descriptions only, not personal conversation content. UK has an EU adequacy decision.
Vercel — United States. Hosts the frontend application and runs server-side functions. Transfers: Standard Contractual Clauses.
Railway — United States. Hosts backend proxy server. Transfers: Standard Contractual Clauses.
Cloudflare — United States. Provides CAPTCHA verification to prevent automated abuse. Processes IP address and browser data during verification. Ephemeral processing — no personal data retained. Transfers: SCCs + EU-US Data Privacy Framework.
Zoho Mail — European Union (Netherlands). Email service for support communications. Data stored in EU data centers.
GeoJS — Australia. Converts your IP address to an approximate country for currency display. Ephemeral processing — no data stored.
6. International Transfers
Several providers are based in the United States. We protect your data during transfer using Standard Contractual Clauses (SCCs) approved by the European Commission, and where available, the EU-US Data Privacy Framework. Supabase (Frankfurt), Runware (UK), and Zoho Mail (Netherlands) process data within the EU or in jurisdictions with EU adequacy decisions.
We have assessed transfer risks and implemented additional safeguards including data minimisation, encryption in transit and at rest, and contractual restrictions on processor use of data. Our primary database is hosted in the EU (Frankfurt, Germany). Remaining US-based processors handle specific functions (AI processing, vector search, payments, frontend hosting, backend proxy) and do not store the primary database.
7. How Long We Keep Your Data
Account and conversation data: retained while your account is active and for 30 days after deletion to process removal across all systems.
Memory data: retained while your account is active. Deleted on account deletion or upon request.
Payment records: retained as required by Dutch tax law (7 years for financial records).
AI processing logs: Anthropic retains API logs up to 7 days, then auto-deletes. Voyage AI retains no data.
8. Your Rights
Under the GDPR, you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time without affecting prior processing.
To exercise any right, contact contact@spiritguide.one. We will respond within 30 days. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
9. Data Deletion
When you delete your account or request erasure, we remove your personal data from the following systems within 30 days: Supabase (account, conversations, stories, journal entries, all associated records), Pinecone (vector embeddings and metadata), Railway (no persistent personal data stored), Anthropic (API logs auto-expire within 7 days), Voyage AI (no data retained).
Payment records held by Stripe and financial records required by Dutch tax law are retained as legally required.
10. Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), access controls and authentication for all backend services, rate limiting and input validation, restricted API access with secret-based authentication, and regular review of processor security practices.
11. Cookies
We use only essential cookies needed to run the service and keep you logged in. We do not use advertising cookies, tracking pixels, or third-party analytics that identify individual users.
12. Children
Spirit Guide is not intended for anyone under 18. We do not knowingly collect their data. If we become aware that we have collected data from a person under 18, we will delete their account and data promptly.
13. Changes
We may update this policy from time to time. For material changes, we will notify you at least 30 days in advance via email or in-app notification. The date at the top reflects the most recent revision.
14. Contact
Data controller: Daan H. Teer, trading as Spirit Guide
KVK: 91451094 · BTW: NL004890910B95
Contact: contact@spiritguide.one
Supervisory authority: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl