Privacy Statement

    Last updated: December 2025

    QOZY is a brand of VANA&Co, located at Claude Debussytraat 63, 1544 NP Zaandijk, The Netherlands, registered with the Dutch Chamber of Commerce under number 96848103. Your privacy is very important to us. This statement explains what data we collect, how we use it, and how we keep it secure.

    ⚠️ Belangrijke Veiligheidsmededeling

    Qozy en Luma zijn hier om je te helpen groeien, maar zijn geen vervanging voor spoedinterventie.Als je aan zelfdoding denkt, of je maakt je zorgen om iemand anders: je bent niet alleen, en hulp is er, altijd.Bel of chat gratis en anoniem met 113 Zelfmoordpreventie:• 113 (normale belkosten) of 0800-0113 (gratis) • Dag en nacht bereikbaar • Is er direct gevaar? Bel 112.Deze richtlijnen zijn gebaseerd op best practices van 988 Lifeline, de National Action Alliance for Suicide Prevention, de Jed Foundation en NAMI — met nadruk op het feit dat hulp en hoop altijd beschikbaar zijn.

    1. Data Controller

    VANA&Co is the data controller under the General Data Protection Regulation (GDPR). You can contact us at vanessabos@me.com.

    2. Purpose of Data Processing

    QOZY processes personal data only to deliver and improve the app, including: • creating and managing user accounts; • providing personalized content such as the 'Joy Check-in' and AI coaching by Luma; • improving the app through anonymized usage data; • communicating about updates, feedback and support. Your information will never be sold or shared for third-party marketing purposes.

    3. Use of Artificial Intelligence (AI)

    QOZY uses AI to provide personalized guidance. All user data is stored locally on your device. Once a week, an anonymized dataset is securely transmitted to improve our AI coach. This dataset contains no identifiable personal information.

    4. Hosting and Data Processing Partners

    QOZY operates with trusted technical partners: • Lovable, the development and hosting platform. It processes data solely on behalf of VANA&Co and not for its own purposes. • Supabase (Paris, France) for database management and secure EU data storage. • Triviat, used for coaching features: - text-based communication is hosted on Hetzner servers (Germany); - voice-based communication (via 11Labs) is hosted on servers in the United States, the Netherlands and Singapore. All partners operate under strict data processing agreements that comply with the GDPR.

    5. Data Security

    We apply appropriate technical and organizational measures to protect your information against loss, misuse, or unauthorized access.

    6. Data Retention

    Personal data is retained only as long as necessary. When you delete your account, all associated data is deleted or anonymized within 30 days.

    7. Your Rights

    You have the right to: • access your stored information; • correct inaccurate data; • request deletion ('right to be forgotten'); • object to data processing; • withdraw consent at any time. You can submit any such request via vanessabos@me.com.

    8. Updates

    We may update this Privacy Statement from time to time. The latest version will always be available within the app.

    9. Health and Wellness Data

    QOZY collects and processes the following health-related data to provide personalized wellness support: • Mood scores and emotional states you log • Journal entries about your mental wellbeing • Exercise completion data (breathing, yoga, etc.) • Lifestyle preferences and wellness goals This data is classified as sensitive personal data under GDPR. It is: • Stored securely in encrypted databases within the EU • Never shared with third parties for marketing • Used only to improve your personal wellness experience • Deletable at any time upon request