Privacy policy

1. The controller

• Name: [Company name]
• Registered office: [Address]
• Company registration number: [Number]
• Tax number: [Tax number]
• Represented by: [Viki’s full name]
• Email: [email protected]

Write to this address with any question about your data.

2. What it covers

The beyondconditionsapp.com website, the Beyond Conditions iOS and Android app, and the servers and emails behind them.

3. What we process, why, and on what legal basis

Account and sign-in. Your name, email address, app language, password (only as an irreversible argon2id hash), whether your email address is confirmed, your two-step sign-in key (encrypted) and the hashes of your recovery codes. If you sign in with Google or Apple, the account identifier and email address they provide. For your sign-ins, the type of device (browser or app identifier), the IP address and the times. Purpose: providing the service and protecting your account. Legal basis: performance of the contract (GDPR Art. 6(1)(b)); for security data, our legitimate interest (Art. 6(1)(f)).

Membership. Your membership level, the start and end of your membership periods, and Viki’s note on the payment (such as the invoice number). You pay outside the system, by invoice; we process no card or payment data. Purpose: access to the content of your level, a reminder before your membership ends. Legal basis: performance of the contract.

Saved and finished practices. The practices you save, and when you saved them; and the practices you listen to or watch to the end, and when. Purpose: so you can find what you saved in your profile, and later see what you practised. We make no analyses, rankings or statistics of them. Legal basis: performance of the contract.

Community and personal guidance. What you write or upload in the community rooms (text, voice messages, images, reactions), the practices and notes Viki recommends to you, the summaries of your sessions, and your 1:1 bookings. If you share a link, our server opens the page to show a preview (title, description); the page sees only our server’s address, not yours. Purpose: the community and mentoring service. Legal basis: performance of the contract. If you share information about your health or other special categories of data there, we may process it only on the basis of your explicit consent (Art. 9(2)(a)), which you can withdraw at any time by deleting the content. [How consent is asked for: to be settled with a lawyer.]

Messages to Viki. On the website’s contact form, your name, email address and message; for a message from the app, also your membership level and the title of the content you wrote about. Purpose: answering you and arranging a membership. Legal basis: steps before entering into a contract (Art. 6(1)(b)), and our legitimate interest in answering enquiries.

Emails. We send service emails: invitations, email confirmation, password resets, security notices (such as a new sign-in method or a password change) and a reminder before your membership ends. We send no newsletters or advertising. Legal basis: performance of the contract; for security notices, our legitimate interest.

Notifications. In the app’s notification list we keep what we told you about (for example a message from Viki, an event reminder) and whether you read it; your notification settings per category; and which events you asked to be reminded of. If you allow push notifications, also your device’s notification identifier, its type (iOS or Android), its language, the app’s version and when it last checked in, so we can notify you. Legal basis: the performance of the contract; for push notifications, your consent, which you can withdraw in your device settings at any time.

Where you left off. The app remembers on your phone where you stopped each practice, so you can go on from there. This stays on your device, never reaches us, and is deleted when you sign out. Legal basis: performance of the contract.

Health sync. If you turn it on (on iPhone for now), the app writes the time of each practice you finish to your device’s Health app (Apple HealthKit) as Mindful Minutes; on Android, to Health Connect later. This stays on your device and never reaches us. Legal basis: your consent, withdrawn by turning the switch off.

Security and troubleshooting. The servers log requests (IP address, time, requested address, response); security events on your account (such as sign-ins and password changes) are recorded with the IP address. Errors produce reports about what happened (such as the requested address, with internal identifiers, and the type of device); they contain no messages, passwords or request contents. Purpose: protecting the service and accounts, preventing abuse, fixing errors. Legal basis: our legitimate interest.

Website. The website uses no tracking or advertising cookies. Cloudflare, which protects the website, may set security cookies, and Cloudflare Turnstile protects the contact form from bots. Both are needed for the site to work securely.

4. Who can access the data

Viki and the people who run the service, as far as their work requires. We use these processors:

• Contabo GmbH (Germany): the servers, in the European Union.
• Cloudflare, Inc. (United States): protecting the website’s and the app’s traffic, filtering bots, storing media files and backups, playing videos (Cloudflare Stream).
• [Email provider’s name and seat]: delivering emails.
• Functional Software, Inc. (Sentry, United States): error tracking.
• Cal.com, Inc. (United States): booking 1:1 sessions in Viki’s calendar (your name, email address, language and the times booked), and the emails and calendar invitations about them.
• Google LLC and Apple Inc.: delivering push notifications, if you allow them. Google and Apple sign-in is provided by these companies as independent controllers, under their own privacy policies.

Transfers outside the European Union (to the United States) are covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

5. How long we keep data

• Your account data, while your account exists. When you delete your account (in the app: Profile → Delete account), we delete at once your name, email address, password, two-step sign-in data, connected Google and Apple accounts, your sign-ins, your saved and finished practices, your reactions, your profile photo, your voice messages and photos in the community, your notifications and notification settings, your devices’ notification identifiers, and your messages to Viki. The files of the profile photo, voice messages and photos are removed from our storage too, within about a week. What you wrote in the community rooms stays under the name “Törölt tag” (deleted member), so the conversations still read. Your membership periods remain in Viki’s records without your name. The email notices Viki received about your messages stay in her mailbox until she deletes them.
• Your 1:1 sessions (time, status, Viki’s message, notes and summary), while your account exists. When you delete your account, your sessions still to come are cancelled, Viki’s notes and summaries are deleted, and the sessions’ times remain without your name. Cal.com keeps the bookings’ data (your name, email address and the times) in Viki’s account after that, until Viki deletes them there.
• Sign-ins expire after 30 days without use, and last at most 180 days; their data (the type of device and the IP address) is deleted 30 days after they expire.
• The web server’s request logs are kept for 14 days; the application servers’ logs rotate by size [exact retention].
• Security events on your account are kept for [retention period]; when your account is deleted, your IP addresses are removed from them.
• Contact messages, until the matter is closed and at most [retention period]. When you delete your account, the messages you sent from the website with the same email address are deleted too.
• Daily backups are deleted after [30] days.
• Viki keeps invoices for 8 years under Hungarian accounting law; they are outside the system.

6. Your rights

You can ask to access your data, to have it corrected or deleted, to restrict its processing, or to receive it in a machine-readable form. You can object to processing based on legitimate interest, and withdraw your consent at any time, without affecting earlier processing. You can change your name, language, password and sign-in methods in the app yourself, and delete your account there.

You can also ask for your account’s deletion without the app. The Delete account page gives the steps, and says what is deleted and what stays.

We answer within one month. If you feel we have violated your rights, you can complain to the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9–11., www.naih.hu), or go to court.

7. How we protect data

Every connection is encrypted (HTTPS). Passwords are stored only as irreversible hashes and two-step sign-in keys encrypted. Web traffic reaches the servers only through Cloudflare, access is strictly limited, and backups are made every day.

8. Providing data

Without the data an account needs (name, email address) we cannot create one; everything else (such as push notifications, health sync, messages to Viki) is voluntary. There is no automated decision-making or profiling.

9. Age

The service is for people aged 18 and over. [Confirm the age limit.]

10. Changes

If this policy changes materially, we tell you in advance in the app or by email. Effective: [date].