Privacy Policy

Sleep Ritual is operated by 7 Minute Reset, established in France, acting as the data controller for personal data processed through sleepritual.eu. For any privacy question or to exercise your rights, contact us at sevenminutereset@gmail.com or use the GDPR request form.

We collect the minimum data needed to run the service: account information (email, name) when you sign up, subscription status, ritual progress and preferences you set in the app, support messages, and technical data (IP address, device/browser type, anonymized usage analytics). Payment information is collected and processed directly by our payment provider Paddle, acting as Merchant of Record; we do not store your card details.

We process your data on the following GDPR legal bases:

• Performance of contract (Art. 6(1)(b) GDPR) — to create and manage your account, provide the rituals, sync your progress, and manage your subscription.
• Legal obligation (Art. 6(1)(c) GDPR) — to keep invoicing/tax records and respond to lawful requests from authorities.
• Legitimate interests (Art. 6(1)(f) GDPR) — to keep the service secure, prevent fraud and abuse, and improve the product through anonymized usage analytics.
• Consent (Art. 6(1)(a) GDPR) — for any optional cookies and for marketing emails, where applicable. You can withdraw consent at any time.

We do not sell your data and do not use it for advertising profiling.

We share personal data only with service providers acting on our instructions: hosting and database (Supabase / Cloudflare), authentication, email delivery, anonymized analytics, and Paddle (Merchant of Record) for payments, subscription management, invoicing and tax compliance. We may also disclose data to professional advisers or competent authorities where required by law.

We use strictly necessary cookies for authentication and session management. With your consent, we may use analytics cookies to understand how the app is used. You can manage your preferences in your browser settings at any time.

Your data is stored securely using industry-standard encryption (in transit and at rest) and strict access controls. Data is primarily processed within the EU/EEA. Some sub-processors (e.g. Paddle) may process data outside the EEA; in such cases, transfers are framed by appropriate safeguards such as the European Commission Standard Contractual Clauses (SCCs) or adequacy decisions.

We keep personal data only as long as necessary:

• Account data: for the lifetime of your account, and deleted within 30 days after account deletion.
• Subscription and usage data: for the duration of your subscription plus up to 12 months for service continuity and abuse prevention.
• Billing and invoicing records: 10 years, to comply with French and EU accounting/tax law.
• Support correspondence: up to 3 years after the last contact.
• Server logs and security data: up to 12 months.
• Anonymized analytics: kept indefinitely, as it no longer identifies you.

Under the GDPR, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. To exercise these rights, email sevenminutereset@gmail.com. We respond within one month. You also have the right to lodge a complaint with your supervisory authority — in France, the CNIL.

We may update this policy; the "Last updated" date will reflect any change. Continued use after changes means you accept them.