Privacy Notice

Who is responsible

Restorative Rhythms Institute, ZVR 1875830526, is responsible for the personal data used to run the Musical Oracle and administer membership applications. Contact contact@restorativerhythms.love about your data or the association’s registered details. This notice describes the current beta service.

What we use and why

Account and membership: your verified email, name, country of residence, membership request and status, chosen editions, access dates and the dates and versions of your confirmations. We use these to handle your application, provide the experience you request and manage access (GDPR Article 6(1)(b): steps at your request and performance of the service agreement). These fields are required by the current registration process; without them registration cannot be completed.

Email news: only if you separately opt in, we use your name, email and preference to send Restorative Rhythms news and invitations (Article 6(1)(a): consent). This is optional and does not affect access. Login codes and essential account messages are service communications, not newsletter subscriptions.

Security and operation: hosting and login services process technical information such as IP addresses, browser details, request times and delivery/error records. The app also keeps hashed rate-limit identifiers and aggregate event counts by day and edition. Our legitimate interest is protecting accounts, preventing abuse and understanding service reliability (Article 6(1)(f)). Aggregate event counters do not include your journal text, email or user ID. Provider request logs can still contain identifying technical data.

Your optional journal

Your writing, Arkan references and reflections are encrypted in your browser before being sent for storage. The server keeps the encrypted journal, account identifier, revision number and save time so it can return your journal to you. This supports the journal service you choose to use (Article 6(1)(b)). The application does not send journal plaintext or your recovery key to the server, analytics or an AI service.

You can export or delete individual entries after unlocking the journal. Keep your recovery key safe; an email login cannot recover a lost key. Please avoid recording sensitive information about other people. Encryption reduces exposure but does not make account-linked data anonymous or remove data-protection obligations.

Service providers and external content

Supabase handles authentication and member records; Resend delivers login emails; ChatGPT Sites and Cloudflare host the site and the encrypted journal; Bunny.net delivers videos. Authorised association administrators may access membership and support information needed for their work. They do not receive your journal recovery key through this application.

When you choose to load an embedded video, your browser connects to Bunny.net and shares technical data needed for playback. Spotify links open a separate service only when you follow them. Those services have their own privacy information.

The Supabase project is configured in the EU West region. Hosting, delivery, support and subprocessors may process data outside the EEA. Signing up is not consent to an unrestricted international transfer. Contact us for current recipient locations and copies or details of applicable transfer safeguards. Supplier agreements, transfer mechanisms and provider retention settings still require confirmation for this beta; this notice does not certify that review as complete.

Cookies and device storage

The site uses necessary login cookies to keep you signed in and protect your session. Blocking them can prevent login. This version does not add advertising cookies or third-party analytics scripts. Basic event counts are recorded by the application. Video players are loaded only when you choose to load them; you can remove the player again on the page. The journal recovery key is held in page memory while unlocked, not saved as a login cookie.

How long information remains

Trial expiry does not automatically delete your account or journal: they remain available for account management and exporting reflections. Account and application information remains while your account or application is open, and membership records while needed to administer an ongoing membership. Ask us to close your account or withdraw an application when you no longer need it.

Newsletter use stops when you withdraw consent. A limited record of your preference and previous confirmations may be kept where necessary to demonstrate how requests were handled or resolve a specific dispute. Where data must be retained for a legal obligation or claim, we will explain the reason and applicable period when handling your request.

There is currently no automatic account-deletion schedule in this beta. Provider logs and backup copies have separate retention settings which still need to be confirmed. Deleting an entry updates the current encrypted journal; it does not guarantee immediate removal from every backup. Contact us for the applicable retention details.

Your choices and rights

Change your profile and newsletter preference through My account → Update signup and preferences, or contact us. You may withdraw newsletter consent at any time without affecting the lawfulness of earlier use or your access to the Oracle.

Where applicable, you can request access, a copy, correction, deletion, restriction and portability of your personal data, and object to processing based on legitimate interests. Email contact@restorativerhythms.love, preferably from your account email. We may ask for proportionate identity verification. Please never send a login code or journal recovery key.

We will respond without undue delay, normally within one month. If the law permits extra time for a complex request, we will explain this within the first month. You can complain to a data-protection supervisory authority, including the authority where you live or work, without contacting us first.

Automation and updates

The system calculates trial expiry and checks edition access automatically. It does not automatically approve formal association membership or analyse your journal to make decisions about you. Contact us if you believe an access calculation is wrong. We will update this notice and bring material changes in data use to your attention. Reading this notice is an acknowledgement, not blanket consent to every kind of processing.