InnerSignals — Privacy Policy
Effective date: 29/07/2026 · Last updated: 08/08/2026
1. Who we are
InnerSignals ("we", "us", "our") provides a self-reflection tool that generates a personalised "reading" from a questionnaire you complete.
- Data controller: Denis Aptula, trading as "InnerSignals" (a sole trader based in the United Kingdom).
- Contact: hello@innersignals.me
- UK/EU users' complaints: you may complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.
- EU representative (Art. 27): to be appointed before InnerSignals is actively promoted to individuals in the EU.
2. The data we collect
| Category | Examples | Provided by |
|---|---|---|
| Identity | The name you give us | You |
| Contact | Email address (optional — only if you ask us to save/send your reading) | You |
| Date of birth | Optional — only if you choose to unlock the "Timing Signature" | You |
| Assessment answers | Your responses to the questions, including free-text answers | You |
| Your reading | The Signal, scores and personalised text we generate | Generated |
| Payment/billing | If you buy a reading: the email and billing country you enter at checkout, received via our payment provider — never your full card details | You / payment provider |
| Technical | IP address, device/browser type, timestamps, essential-cookie data | Automatic |
| Usage analytics | Anonymous, aggregate counts (e.g. tests started/completed) — no profiling | Automatic |
3. Special-category data — please read this
Your assessment answers and the reading we generate may be treated as special-category data under Article 9 UK/EU GDPR, because our purpose is to reflect back aspects of your personality and inner state, which can be health- or wellbeing-adjacent.
We only process this data with your explicit consent, which we ask for clearly before you begin. You can withdraw that consent at any time (see Section 8). InnerSignals is a reflective tool, not a medical or psychological diagnosis, and must not be used as one.
4. Why we use your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Generate and show your reading (incl. any special-category inferences) | Explicit consent — Art. 6(1)(a) + Art. 9(2)(a) |
| Email your reading / waitlist updates (only if you opt in) | Consent — Art. 6(1)(a) |
| Keep the service secure, prevent abuse, run aggregate analytics | Legitimate interests — Art. 6(1)(f) (non-sensitive data only) |
| Provide, deliver and support a paid reading you purchase (including emailing it to the address you used at checkout) | Contract — Art. 6(1)(b) |
5. Automated processing
Your Signal and scores are produced by an automated system (deterministic scoring plus an AI language model that writes the text). This is not a decision that produces legal or similarly significant effects about you — it is a reflective reading you request. You can contact us to discuss any result. We do not use your data for automated decisions about credit, employment, insurance or similar.
6. Who we share your data with (our processors)
We do not sell your data. Ever. We share it only with the service providers that run InnerSignals, under contract:
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Anthropic, PBC | AI that writes your reading text | USA | Data Privacy Framework and/or Standard Contractual Clauses; data-processing agreement in place |
| Supabase | Database (stores your reading) | EU (Ireland) | EU processing; DPA in place |
| Resend | Sends your email | EU (Ireland) | EU processing; DPA in place |
| Render | Hosting | EU (Frankfurt) | EU processing; DPA in place |
| Gumroad (Gumroad, Inc.) | Payment processing & Merchant of Record — sells the reading to you and handles the card payment and any applicable taxes | USA | Standard Contractual Clauses / UK IDTA and/or Data Privacy Framework; data-processing agreement in place |
7. International transfers
To generate your reading, your answers are sent to Anthropic in the United States. If you buy a reading, your payment and billing details are processed by our Merchant of Record, Gumroad, in the United States. These transfers are protected by the EU–US Data Privacy Framework / UK–US Data Bridge and/or Standard Contractual Clauses (UK IDTA), with a transfer risk assessment on file. You can ask us for details. Your stored data otherwise remains in the EU.
8. Your rights
Under UK/EU GDPR you have the right to: access your data · correct it · erase it ("right to be forgotten") · restrict or object to processing · data portability · and to withdraw consent at any time (which stops future processing but doesn't undo what was lawful before).
To exercise any right, email hello@innersignals.me — we respond within one month. You can also delete your reading yourself using the deletion link on your result page. Withdrawing consent or requesting deletion will not disadvantage you.
Complaining to us. You have the right to complain to us directly if you think we've mishandled your personal data. Email hello@innersignals.me with the details — we will acknowledge your complaint within 30 days and respond as quickly as we can. This does not affect your right to complain to the ICO (ico.org.uk) or your local EU supervisory authority at any time.
9. How long we keep your data
- Readings + answers: 90 days from your last activity, then deleted or anonymised for research.
- Email (if you opted in): until you unsubscribe or ask us to delete it.
- We keep only what we need, for as long as we need it. If you never return, your data is removed on the schedule above.
10. Security
We protect your data with encryption in transit (HTTPS/TLS), access controls, EU-hosted infrastructure, secrets kept server-side, and least-privilege database rules. No system is perfectly secure, but we follow recognised practices (aligned to the OWASP Top 10) and will notify you and the ICO of any breach that legally requires it.
11. Cookies
We use only strictly-necessary cookies to make the site work. We do not use advertising or cross-site tracking cookies. See our Cookie Policy. EU visitors are shown a consent notice for any non-essential cookies (currently none).
12. Children
InnerSignals is for adults. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18; if you believe a child has used it, email us and we will delete their data.
13. Additional rights for US residents
If you are a US resident, you may have rights to access, delete, correct or opt out of the "sale"/"sharing" of your personal information. We never sell or share your data for advertising. Residents of Washington State: because your reading may be "consumer health data" under the My Health My Data Act, we process it only with your consent, do not sell it, and honour deletion requests. To exercise any US right, email hello@innersignals.me. We honour Global Privacy Control (GPC) signals.
14. Changes to this policy
We'll post any changes here and update the "last updated" date; material changes affecting your rights will be notified by email where we hold one.
15. Contact
Questions or requests: hello@innersignals.me.