Privacy Policy

The party responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR):

Wise Lifestyle LTD
36 St Dminka Street
Victoria (Gozo), VCT9030, Malta
Registry: Malta Business Registry · Reg. No. C 92030
Email: mail@wise-lifestyle.com

We treat your data confidentially and in accordance with the provisions of the GDPR as well as supplementary data protection laws. This policy describes which data we collect, for what purpose and on what legal basis. In principle, you can also use this website without providing any personal data.

3.1 When Visiting the Website

On each visit, our web host (Vercel Inc., USA) automatically records what are known as server log files: IP address, timestamp, page accessed, browser type and referrer. This data serves exclusively for the technical provision and security of the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Storage period: a maximum of 30 days. In addition, Vercel Web Analytics counts page views without cookies: it records the page address, referring page, approximate location (country, region, city), device and browser; visitors are recognised by a check value that expires after 24 hours. For symptom and core-theme pages we report only a general address without the title. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in audience measurement without personal reference).

3.2 Account

When you create an account, we store your email address, optionally your name, and an encrypted (hashed) password in our application database at Supabase Inc. (data centre in Ireland, EU). Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Storage period: until the account is deleted. Which texts you unlock is covered by section 3.9. When you buy a token package, we create an entry in Zoho CRM (EU data centre) with your email address, the package, the amount and the date; Zoho does not learn which texts you read.

3.3 Newsletter

With your consent, we send the BodySignal newsletter via Zoho Campaigns (EU data centre). You can withdraw your consent at any time using the unsubscribe link in every email. Legal basis: Art. 6(1)(a) GDPR.

3.4 Payment Processing

Purchases are processed via Stripe Payments Europe Ltd. (Ireland). Stripe receives payment data directly from you; we store only the purchase confirmation. We only send Stripe what is needed for the payment: product, price, your email address and an internal customer number. Stripe does not learn which symptom texts you read. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Storage period: statutory retention obligations (10 years for tax-relevant records).

3.5 Bookmarks and listening position

We store bookmarks and the point at which you paused an audio only locally in your browser (localStorage); they do not leave your device. Which texts you unlock in your account is stored on our server (section 3.9).

3.6 Audience Measurement with Google Analytics

Only if you allow the “Marketing” category in the cookie notice do we load Google Analytics 4 (Google Ireland Ltd., Dublin). Google then processes truncated IP addresses, page views and events such as sign-up, voucher redemption and purchase. A transfer to Google LLC in the USA is possible and is safeguarded by the guarantees recognised by the EU Commission (adequacy decision and standard contractual clauses). Legal basis: Art. 6(1)(a) GDPR (consent), revocable at any time via “Cookie settings” in the footer. Without your consent, no Google script is loaded. On symptom, core-theme, collection and account pages we send Google only a general page address and a general page title, without the title of the text.

3.7 Protection against Automated Requests

Our forms (contact, sign-in, account creation, voucher, newsletter, applications) check on the server whether an entry comes from a human: invisible check fields, timing, origin of the request and a rate limit per sender. For this purpose we store, for a maximum of 30 days, a non-reversible check value (hash) of your IP address and the normalised email address. On the sign-in pages we additionally use Cloudflare Turnstile (Cloudflare Inc., USA, EU standard contractual clauses); Turnstile checks technical browser characteristics in the background and sets no cookies for advertising purposes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against abuse).

3.8 Audio Versions of the Texts

The audio files are hosted on Cloudflare R2 (Cloudflare Inc., USA, EU standard contractual clauses). When you play a file, Cloudflare receives your IP address to deliver it; no account data is transmitted. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

3.9 Unlocked texts, collection and purchase confirmations

When you unlock a text, we store in your account which text you unlocked: title and number, type of text (symptom text or core-theme text), language, date and time, an order number and the kind of token you paid with, and for purchased or gifted tokens also the related package or voucher. The text is then in your collection. For every unlock we also store your consent to immediate provision (version and time) and when we sent you the confirmation. We send you the confirmation by email; it names the title in the body of the email, not in the subject line.

This information can allow conclusions about your health, your sex life or your sexual orientation, even if you read a text for someone else. It is therefore a special category of personal data (Art. 9(1) GDPR).

Purpose: to provide the unlocked texts to you permanently and on any device, to prevent duplicate purchases, to keep your token balance and to confirm every purchase.

Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which we obtain before your first unlock, together with the contract for the unlock (Art. 6(1)(b) GDPR); for the confirmation email additionally our legal obligation (Art. 6(1)(c) GDPR in conjunction with Section 312f of the German Civil Code or Section 7(3) of the Austrian Distance and Off-Premises Contracts Act). As proof of your consent (Art. 7(1) GDPR) we store when and where you consented (at purchase, in the collection or in your account), which version of the consent text you saw in which language, and a check value of your email address that lets us match the proof to a request even after your account has been deleted.

Recipients: Supabase Inc. (database, data centre in Ireland), Vercel Inc. (hosting) and ZeptoMail (email delivery, data centre in the EU) as processors. Stripe, Zoho CRM, Google and other advertising or analytics services do not learn which texts you unlock. At BodySignal only Felix Scheffel sees this information, where this is necessary for supporting you, for billing or for a request from you. We do not use it for advertising or for recommendations.

Storage period: as long as your consent applies and your account exists. If you withdraw your consent, remove a text from your collection or delete your account, we delete the titles. What remains contains no title: we keep when you used how many tokens, with order number and package, in line with statutory retention obligations. For texts you paid for with tokens from a package, we also keep the record of your consent to immediate provision (order number, version and time of the consent, sending of the confirmation), blocked from any other use, until the right of withdrawal for that package has expired, at most twelve months and 14 days after the package purchase; the legal basis for this is Art. 6(1)(f) GDPR (proof in case of a withdrawal). We keep the proof of consent until the end of the third year after your consent ended.

Collections from before 4 October 2026: Titles that were already in your collection before 4 October 2026 are stored from now on only with your explicit consent. Until you decide, at the latest until 3 November 2026, they are blocked: they appear nowhere and we do not evaluate them. If you consent, you will see your collection again straight away. If you have not consented by then, we delete the titles on 3 November 2026 and credit the tokens used for them back to your balance; with “Delete collection now” you can do this earlier.

Withdrawal: You can withdraw your consent at any time under Account → Privacy, with one button and a confirmation. Withdrawal applies to the future; processing up to then remains lawful. Afterwards you can no longer read the texts you unlocked so far; your token balance remains, and on request we refund purchased tokens you have not redeemed (Terms § 12(10a)).

Voluntary: Consent is voluntary. Without it you cannot unlock texts; all other parts of BodySignal™ remain available, and your token balance is kept.

Your rights: as set out in section 6. You can see the titles in your collection under Account → Privacy as long as your consent applies; you can obtain information about all stored data by email to mail@wise-lifestyle.com.

3.10 Measurement of the core-theme sections

Below symptom texts we show two versions of the heading and introduction above the core themes and measure which one is clearer. For this we count per day how often the section is seen, a tile is expanded and a buy button is tapped, without account and without page. For each account we store only a short code that we derive from your account number with a secret key, the version you see and the date (without time) of the first view, expansion and tap, without title and without page. When the test ends we delete the key; after that this information can no longer be linked to an account. We do not measure on pages about violence, grief and crises or on pages for parents and relatives. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in making the pages clear).

We use cookies in three categories:

• Necessary: Login session, security token, payment status. The website does not function without these.
• Functional: Reading progress, bookmarks, language settings.
• Marketing: Anonymous statistics (click paths, time spent) — only with your express consent.

You can change or withdraw your cookie choices at any time via the „Cookie settings" link in the footer.

We pass your data on exclusively to the following recipients, who are themselves bound to confidentiality (processors under Art. 28 GDPR):

• Vercel Inc. (hosting, USA — EU standard contractual clauses)
• Stripe Payments Europe Ltd. (payment processing, Ireland)
• Zoho Corporation (CRM and newsletter, EU data centre)
• ZeptoMail (email delivery, EU data centre)
• Supabase Inc. (application database, data centre Ireland — EU)
• Cloudflare Inc. (audio delivery R2 and abuse protection Turnstile, USA — EU standard contractual clauses)
• Google Ireland Ltd. (audience measurement Google Analytics 4 — only with your consent)

Information on unlocked texts (section 3.9) is received only by Supabase, Vercel and ZeptoMail.

Under the GDPR, you have the following rights in relation to us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent given (Art. 7(3) GDPR); you withdraw your consent for the collection under Account → Privacy.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, an informal email to mail@wise-lifestyle.com is sufficient.

We store personal data only for as long as is necessary for the respective purpose or for as long as a statutory retention obligation exists. Once the purpose ceases to apply or the period expires, the data is deleted or anonymised.

Transmission is encrypted (TLS 1.3). Only authorised staff have access to personal data. Passwords are stored in hashed form (bcrypt).

This privacy policy may be adapted if legal requirements or our processes change. The version currently in force is available on this page.