Privacy Policy

Who we are

Aikaya is a platform where wellness creators sell recorded video. We are the data controller for your account data. For a creator’s audience and buyer data, the creator may be the controller and we the processor. [DECISION: legal entity name, registered address, and a contact email.]

What we collect

Your email, an optional name, and locale/timezone; magic-link tokens; your session IP address and browser user-agent; if you are a creator, your profile (handle, display name, bio, avatar and cover images, country, currency); your watch progress and playback events; email captures and marketing-consent records; and payment references (Stripe customer and payment identifiers).

We do not store card or bank details — Stripe does, as our payment processor.

A note on health-adjacent data

Watching breathwork or meditation content could hint at health interests. We keep this behavioural data for a short time only (six months), and we do not profile you on it.

Why we are allowed to (lawful bases)

• Performing our contract with you — your account, purchases, and content delivery.
• Legal obligation — keeping a financial record for seven years for tax law.
• Your consent — marketing email only, which is separate and never bundled with access.
• Our legitimate interests — security, fraud and abuse prevention, and aggregate delivery metering.

Who processes data for us

We use a small set of sub-processors, each under a data-processing agreement:

• Bunny Stream — video hosting and delivery.
• Stripe — payments, Connect payouts, and tax.
• Neon — our database (EU region).
• Vercel — application hosting (EU region).
• Resend — transactional email (magic links, receipts).
• Upstash — caching and rate-limiting.
• Sentry — error monitoring (configured to redact personal data).

How long we keep it

• Sessions and magic-link tokens: until they expire, then purged daily.
• Webhook records: 90 days.
• Audit logs: 2 years.
• Financial records (orders and subscriptions): 7 years, then purged.
• Watch progress and playback events: 6 months, then deleted.
• Accounts you ask us to delete: deactivated immediately, then anonymised 30 days later.

Your rights

You can download a complete copy of your data at any time, and you can delete your account from your account settings. Deleting an account is reversible for 30 days, after which your identifying data is anonymised. You can correct your profile details, and withdraw marketing consent at any time. We aim to respond to any request within one month.

Where data is processed

Our primary processing is in the EU (database and hosting in an EU region). Any transfer outside the EU by a processor is covered by an appropriate safeguard. [DECISION: confirm each processor’s transfer mechanism.]

Cookies

We set an essential cookie for your sign-in session, and a couple of small first-party cookies for preferences you have already told us about — that you dismissed a prompt, or your cookie choice itself. Neither needs consent, and neither is shared with anyone. If you accept tracking when asked, landing on Browse, Classes, Free, or a discipline page also sets a short-lived (30-day) first-party cookie noting that a visit started there, so we can measure it in aggregate — declining, or not answering yet, means that cookie is never set. We do not use any third-party analytics or advertising cookies.

Contact

[DECISION: privacy contact / DPO, and how we notify you of changes.]