Právní dokument · verze 1.2
Privacy Policy
What personal data RingsFlow processes, why, on what legal basis, for how long, and who receives it (version 1.2).
1. Data controller
The controller of personal data is CONSCIOUS PATHS LTD, a Private limited company registered in the United Kingdom, number 17290124, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
- Data protection and exercising your rights: hello@ringsflow.com
- Reporting illegal content: hello@ringsflow.com
Processing is governed in particular by Regulation (EU) 2016/679 (GDPR), the UK Data Protection Act 2018 and the UK GDPR, and, to the extent applicable, the rules on privacy in electronic communications (ePrivacy).
If an obligation to appoint a representative under Article 27 GDPR arises for processing affecting users in the EU, we will state here its exact title and postal address. Until the relevant mandate exists, we do not name a representative — and we do not state any address by guesswork.
2. What data we process
- Account data: name, email, password hash, language and visibility settings.
- Profile data you enter yourself: bio, city, values, topics, relationship preferences and other profile sections.
- Content: posts, comments, messages, media, content in Rings, courses and Live.
- Technical data: IP address, logs, request ID, device and browser information for security and stability.
- Payment metadata: subscription identifiers and billing data. Card details are collected directly by Stripe and are not stored by us.
- Consent records and related audit data (document version, time, scope).
We do not sell personal data and we do not use it for third-party advertising. We do not publish your precise location — we work only with the city or region you provide.
3. Purpose, legal basis, retention and recipients
| Účel | Data | Právní základ | Retence | Příjemci / zpracovatelé |
|---|---|---|---|---|
| Account, sign-in, authentication | Name, email, password hash, session identifiers | Performance of contract | For the life of the account; sign-in credentials are erased on account deletion | Own infrastructure |
| Profile and profile content | Profile data you enter (name, city, bio, values, topics) | Performance of contract | For the life of the account | Own infrastructure |
| Security and abuse prevention | IP address, logs, request ID, sign-in records | Legitimate interest (service security) | Logs 90 days | Own infrastructure |
| Social content (posts, comments) | Content you publish, metadata, timestamps | Performance of contract | Until content or account deletion | Own infrastructure |
| Messages | Conversation content, participants, delivery and read times | Performance of contract | Until conversation or account deletion | Own infrastructure |
| Rings and communities | Membership, roles, content in a Ring | Performance of contract | Until you leave the Ring or delete the account | Own infrastructure |
| Media (images, video) | Uploaded files, variants, technical metadata | Performance of contract | Originals per retention policy; variants while needed for the service | Own distributed storage |
| Live streams | Stream metadata, recording only where made | Performance of contract | Metadata for the life of the account | Own infrastructure |
| Studio (content creation) | Content, drafts, publications | Performance of contract | Until content or account deletion | Own infrastructure |
| Courses and lessons | Course progress, completed lessons, content entitlements | Performance of contract | For the life of the account | Own infrastructure |
| Memberships | Membership status, entitlement history | Performance of contract | For the term + statutory accounting period | Stripe |
| Payments and subscriptions | Customer identifier, subscription status, amounts, billing metadata (no card data) | Performance of contract; legal obligation (accounting) | As required by tax and accounting law | Stripe |
| Website analytics | Aggregated visit records, where enabled | Consent (optional cookies) | Max. 13 months | Not established — no external analytics deployed |
| Registration attribution (rf_attr cookie) | Registration source and first-touch UTM parameters | Consent (optional cookies); the cookie is not set without consent | Max. 90 days | Own infrastructure |
| Support | Request content, contact details, communication history | Performance of contract / legitimate interest | 24 months after resolution | Own infrastructure |
| Moderation and notices handling | Notices, decisions, statements of reasons, appeals | Legal obligation; legitimate interest (safety) | Notice, decision and appeal records 3 years | Own infrastructure |
| Abuse and fraud prevention | Behavioural patterns, duplicates, incident records | Legitimate interest (security) | 12 months | Own infrastructure |
| Recommending people and content | Profile data and interactions to the extent needed for ranking | Performance of contract / legitimate interest | For the life of the account | Own infrastructure |
| Automated translations | — | — | — | The feature is not deployed at present, so no such processing takes place |
| Automated content generation | Drafts and published content created automatically | Legitimate interest / performance of contract | For the life of the publication | External content generator (outside this application) |
| Partner and business verification | Business data, evidence of authority to act | Legal obligation; legitimate interest | For the partnership term + 3 years | Stripe (Stripe Connect onboarding) |
| Legal compliance | Records required by law, consent records | Legal obligation | As required by the applicable law | Own infrastructure |
| Special category — spiritual and relationship dimension | Faith, philosophical beliefs, spirituality, relationship preferences you share | Explicit consent where the data is not data you have manifestly made public yourself | For the life of the account or until consent is withdrawn | Own infrastructure |
4. Special category data (spirituality, beliefs, relationships)
Some data on RingsFlow may reveal your beliefs, spiritual practice or relationship preferences. For such processing we rely on separate explicit consent, which is not part of general consent to use the service and which you may withdraw at any time.
- Consent is separate, specific and given by an active step (opt-in), never a pre-ticked box.
- We do not tie consent to features that do not need such processing — using the service as a whole does not depend on it.
- Where you have manifestly made the data public yourself (for example in a public profile), we rely on the relevant Article 9(2) exception; even then you can hide or delete the data.
- Each consent is recorded with its type, the text version, the time granted, the time withdrawn and the user identifier.
5. Recipients and processors
We share data only where necessary to run the service or where required by law. Current recipients are:
- Stripe — payment processing, subscriptions and partner onboarding (Stripe Connect). Card details are processed by Stripe as an independent controller.
- Google — if you connect a mailbox in the Mail module, we access the content you expressly authorise through the Google API.
- YouTube and TikTok — if you connect an account for publishing content; data necessary for publishing is transmitted.
- Server infrastructure provider — the operators of the servers on which the service runs, acting as a processor. The concrete processor identity must be completed in the internal processor registry (see below).
The internal subprocessor registry is maintained in the repository compliance documentation. Where a provider’s documented identity or a data processing agreement (DPA) is missing, it is listed as an open item — we do not fill it in by guesswork.
6. Transfers outside the United Kingdom and the EEA
The operator is a company in the United Kingdom. For transfers from the EU/EEA to the United Kingdom we rely on the applicable adequacy decision of the European Commission for the United Kingdom.
Some recipients (for example payment services) may further transfer data to the United States. In that case we rely on the mechanisms that the given provider uses and documents (in particular standard contractual clauses or the relevant data transfer framework).
If a transfer were not covered by an adequacy decision, we would use standard contractual clauses with supplementary measures. The concrete list of countries and mechanisms per processor is maintained in the internal processor registry.
7. Your rights
You have the right to:
- access your data and obtain a copy (export),
- rectify inaccurate data,
- erasure (“right to be forgotten”),
- restriction of processing,
- object to processing based on legitimate interest,
- data portability,
- withdraw consent at any time and as easily as you gave it,
- lodge a complaint with a supervisory authority.
Exercise your rights at hello@ringsflow.com or through account settings (download your data, delete account, manage consents). We respond without undue delay and within one month.
In the United Kingdom you may contact the Information Commissioner’s Office (ICO). If you live in the EU/EEA you may contact the supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement.
8. Privacy and content visibility
Anything you set to “only me” or “friends” is protected by visibility settings and shown only to authorised people. Private Flow entries are not used in recommendations and are not published.
Seed and test accounts never enter relationship recommendations as substitutes for real people.
9. Media and storage
We store media in our distributed storage (primary and replica node). Originals uploaded for display are deleted according to the retention policy; optimised variants (thumbnails and adapted formats) are kept for as long as needed for the service to function.
11. Changes to this policy
For material changes we publish a new version with an effective date and inform users. The version you acknowledged at registration is stored together with the time of acknowledgement.
Contact: hello@ringsflow.com. Controller: CONSCIOUS PATHS LTD, 17290124, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.