Privacy policy
Last updated: October 25, 2026
Primal Ember takes your privacy seriously. This policy explains which data we process, why, and which rights you have under the General Data Protection Regulation (GDPR).
Who are we?
Primal Ember is the controller for the processing of your personal data. Contact details of the controller and any data protection officer will be listed here before launch.
Which data do we process?
- Account data: email address, display name and your language and appearance preferences.
- Consents: which consents you have given or withdrawn, with date and version.
- Contact messages: name, email address and content of messages you send through the contact form.
- In later phases, only if you enter them: training, nutrition, journal, measurements and — with separate explicit consent — health and cycle data.
Special categories of data
Health and cycle data are special categories of personal data. We only process them with your separate, explicit consent, which you can withdraw at any time. This data is private by default, stored logically separated, and never ends up in analytics, logs or error reports.
Why do we process your data?
- To provide and secure your account (performance of contract).
- To answer your questions (legitimate interest).
- To provide optional health features (explicit consent).
- We never sell your data and do not use it for advertising.
Retention periods
We keep account data for as long as your account exists. After deletion your data is removed from active systems within 30 days and from backups within the backup cycle. Contact messages are kept for a maximum of 12 months.
Who do we share data with?
We use carefully selected processors for hosting and database (such as Supabase and Netlify), with whom data processing agreements are concluded. Data is stored within the EU wherever possible. A full overview will follow before launch.
Security
We use encrypted connections (TLS), Row Level Security at database level, least-privilege access and secure sessions. Administrators do not automatically have access to your private health data.
Your rights
You have the right to access, rectification, erasure, restriction, portability and objection. You can export your data and delete your account in your account settings. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).