Privacy Policy

1. Who we are

EQHekademia OÜ (registry code 17483439, address: E. Vilde tee 89-68, Tallinn, 12911, Estonia) is the data controller for the Akadem1k application (web version, Telegram Mini App, mobile apps) and the akadem1k.app and akademia.website sites. Privacy enquiries: office@eqhekademia.ee.

2. Data we process

• Account data: name, email address, Telegram identifier (when signing in via Telegram) or Google identifier (when signing in with Google).
• Content you create: journal entries, observations, state check-ins, answers in the "Pyramid" section, homework (text and photos), messages to the AI companion.
• Voice recordings: audio is sent for transcription and is not stored - only the transcribed text is kept.
• Technical data: in-app usage events (screen opens, entry saves) and their timestamps. On the akadem1k.app site and in the app there are no third-party advertising trackers or advertising cookies.
• Requests from the "For teams" form on akadem1k.app: name, company, contact, team size and the request text. A request reaches us via Telegram or, if Telegram is unavailable, by email to EQHekademia.
• Payment data is processed by Stripe and Telegram, and iOS purchases by Apple (App Store) and RevenueCat (purchase management); we never receive or store card numbers.

Journal entries and state check-ins may reflect your emotional state - a special category of data under Art. 9 GDPR. We process it only on the basis of your explicit consent given at registration. You may withdraw consent at any time by deleting your account or writing to the address above.

3. Purposes and legal bases

• Providing the service - journaling, AI reviews, programmes, subscription (performance of a contract).
• Processing state-related entries - explicit consent only (Art. 9(2)(a) GDPR).
• Sign-in and account emails - performance of a contract; product update emails - consent, unsubscribe at any time.
• Replying to a "For teams" form request - pre-contractual steps at your request or legitimate interest; request data is used only to reply to it.
• Security and abuse prevention - legitimate interest.

4. AI processing

Entry reviews, recommendations and AI-companion replies are generated by Anthropic models (Claude). Voice recordings are transcribed by Groq (Whisper model). Only the data required for the specific feature is sent; processing is governed by these providers' data processing agreements, and API request data is not used by them to train models. AI responses are educational support for an observation practice, not medical or psychotherapeutic care.

5. Sub-processors

• Supabase - database and file storage; EU region (Frankfurt, eu-central-1).
• Vercel - web application and website hosting.
• Railway - bot backend and reminders.
• Anthropic - AI reviews and recommendations.
• Groq - voice transcription.
• Stripe - payments and subscriptions.
• Apple - App Store purchases.
• RevenueCat - iOS purchase management.
• Resend - transactional emails (sign-in, confirmations) and backup delivery of website requests.
• Telegram - Mini App platform, bot notifications and delivery of website requests.

We do not sell data or share it with third parties for advertising. Transfers outside the EEA (e.g. to AI providers in the US) rely on Standard Contractual Clauses (SCC).

6. Retention

For as long as your account exists. On account deletion all data, including entries, photos and history, is removed immediately and cascadingly; copies in infrastructure backups disappear within 30 days at most. A subscription paid by card is cancelled automatically on deletion. Deleting the account does not cancel App Store or Telegram subscriptions: cancel them in your Apple ID settings or in Telegram. Requests from the For teams form are kept while talks are ongoing and no longer than 12 months after the last contact; after that, under the contract if one is concluded.

7. Your rights

• Export all your data as a single file: Profile → "Data & account" → "Export data".
• Delete your account and all data: Profile → "Data & account" → "Delete account".
• Request access, rectification, restriction or portability - by email to the address above.
• Withdraw consent for processing state-related entries.
• Lodge a complaint with the supervisory authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, aki.ee).

8. Age

The service is intended for users aged 16 and over.

9. Security

Data is transmitted over encrypted channels (TLS). Access to entries is restricted at database row level: each user sees only their own data. Photos are served via signed URLs with limited validity.

10. Changes

Policy changes are published on this page. We will notify you of material changes in the app or by email.