Privacy Policy – Ethics Book

Version: 1.0
Effective date: June 4, 2026
Last updated: June 4, 2026

Note on language: This document is an English translation of the Romanian original ("Politica de Confidențialitate"). In case of any discrepancy, the Romanian version prevails as the legally binding text. The Romanian original is available at: politica-de-confidentialitate.html

Data Controller

SC WEST MOUNTAING TRAINING SRL
Tax ID (CUI): 43545060
Registered office: Constanța, Romania
E-mail: businessmihai123@gmail.com

(hereinafter "the Controller", "we", or "West Mountaing Training")

1. About this policy

This Privacy Policy explains what personal data we process through the mobile application "Ethics Book" (hereinafter "the Application"), why we process it, with whom we share it, and what rights you have under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Romanian Law No. 190/2018.

The Application is intended exclusively for persons aged 18 or over.

By installing, registering, and using the Application, you agree to the data processing described in this policy.

2. What the Application does

The Application is a digital personal development tool that offers:

ethical and moral principles for personal reflection;
personal reflection journal (daily and per-principle);
meditation timer;
daily practice tracker;
paid subscription for access to premium content;
push notifications for reminders and announcements;
user accounts with cloud sync across devices.

Important: Unlike an offline application, the Application uses cloud storage (Supabase), allowing user data to be accessed from any device through authentication.

3. Categories of data processed

3.1 Account and authentication data

E-mail address
Password (stored as a hash, never in clear)
Display name (optional)
Unique Google identifier (if you authenticate via Google Sign-In)
Preferred language (RO/EN)

3.2 In-app activity data

Reflections on principles (text entered by the user)
Meditation sessions (duration, associated principle)
Daily practices marked (e.g., water, exercise, sleep)
Personal journal notes
Progress on principles

3.3 Subscription and payment data

Subscription status (active/cancelled/expired)
Stripe IDs (customer ID, subscription ID)
Transaction history (amounts, dates)

Bank card data is NOT stored by the Controller – it is processed directly by Stripe, according to their security policy (PCI-DSS).

3.4 Technical data

Operating system version (Android/iOS)
Device model
Unique install identifier (Expo Install ID)
Push token (for notifications)
IP address (at the time of server requests, stored temporarily in logs)
Application crash data (if applicable)

3.5 Optional data

Preference settings (notification intervals, meditation sounds, theme)

4. Purpose of processing and legal basis

Purpose	Data processed	Legal basis
Account creation and administration	E-mail, password, name	Performance of contract (Art. 6.1.b GDPR)
Authentication via Google	Unique ID, e-mail	Performance of contract (Art. 6.1.b GDPR)
Data sync across devices	All activity data	Performance of contract (Art. 6.1.b GDPR)
Subscription processing	Stripe IDs, subscription status	Performance of contract (Art. 6.1.b GDPR)
Sending transactional e-mails	E-mail (password reset, confirmation)	Performance of contract (Art. 6.1.b GDPR)
Sending push notifications	Push token, user ID	Consent (Art. 6.1.a GDPR) – revocable
Security and fraud prevention	IP, technical data, logs	Legitimate interest (Art. 6.1.f GDPR)
Fiscal compliance (invoices, registers)	Payment data, legal identity	Legal obligation (Art. 6.1.c GDPR)
Application improvement (aggregated statistics)	Technical and usage data	Legitimate interest (Art. 6.1.f GDPR)

5. Sub-processors and third parties with whom we share data

For the operation of the Application, we use the following service providers, which process data on our behalf as data processors or joint controllers:

5.1 Supabase Inc.

Role: Main database, authentication, edge functions
Data processed: All user data (account, activity, subscription)
Server location: EU (Frankfurt, Germany)
Policy: https://supabase.com/privacy
Certifications: SOC 2 Type II, GDPR-compliant

5.2 Stripe Payments Europe Ltd.

Role: Payments and subscriptions processing
Data processed: Card name (not number), e-mail, transaction ID
Server location: EU, USA (with Standard Contractual Clauses for transfer)
Policy: https://stripe.com/privacy
Certifications: PCI-DSS Level 1

5.3 Resend Inc.

Role: Sending transactional e-mails (account confirmation, password reset)
Data processed: E-mail address, message content
Server location: EU (Ireland)
Policy: https://resend.com/legal/privacy-policy
Certifications: SOC 2, GDPR-compliant

5.4 Google LLC (Google Sign-In, Firebase Cloud Messaging, Google Play)

Role: Authentication with Google, push notifications delivery (FCM), distribution via Play Store
Data processed: User's Google ID, e-mail, push token
Server location: Global
Policy: https://policies.google.com/privacy
Standard Contractual Clauses (SCC) applicable for transfers outside EEA

5.5 Expo (650 Industries, Inc.)

Role: Push notifications infrastructure, application build
Data processed: Push token, install identifier
Policy: https://expo.dev/privacy
SCC applicable

5.6 Hostico SRL (DNS and transactional e-mail)

Role: DNS management for the diamondteachings.com domain
Data processed: Does not process end-user personal data
Policy: https://www.hostico.ro/termeni-si-conditii

6. International transfers

Some of our sub-processors (in particular Stripe, Google, Expo) may store or process data outside the European Economic Area (EEA), mainly in the United States of America.

For these transfers we rely on:

Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914);
Adequacy mechanisms where available (e.g., EU-US Data Privacy Framework, where the provider is certified);
Additional measures such as encryption in transit (TLS) and at rest.

7. Retention period

Data category	Retention period
Account data (e-mail, password)	For the entire account lifetime + 30 days after account deletion (for accidental rollback)
Reflections, journal, meditation sessions	As long as the account exists
Payment data (invoices, transactions)	10 years per Romanian fiscal legislation
Push tokens	As long as the install is active on the device
Server logs (IP, requests)	Maximum 90 days
Technical data for analysis (aggregated, anonymized)	Unlimited

After account deletion, personal data is permanently deleted within a maximum of 30 days, except for:

data necessary for fiscal compliance (kept for 10 years);
anonymized data (which is no longer personal data).

8. User rights

Under GDPR, you have the following rights:

8.1 Right of access (Art. 15 GDPR)

You may request a copy of the data we hold about you.

8.2 Right to rectification (Art. 16 GDPR)

You may correct inaccurate data directly in the Application (Profile → Edit) or by request to businessmihai123@gmail.com.

8.3 Right to erasure ("right to be forgotten", Art. 17 GDPR)

You may delete your account directly from the Application (Profile → Delete account) or by written request. Note: data necessary for fiscal obligations (invoices, transactions) is kept for 10 years per law.

8.4 Right to restriction of processing (Art. 18 GDPR)

8.5 Right to data portability (Art. 20 GDPR)

Under GDPR, you have the right to data portability. To exercise this right, please contact us at businessmihai123@gmail.com and we will respond according to the procedure described below.

8.6 Right to object (Art. 21 GDPR)

You may object to processing based on legitimate interest.

8.7 Right to withdraw consent (Art. 7 GDPR)

For push notifications and other consent-based processing, you may withdraw consent at any time from Settings or by written request.

8.8 Right to lodge a complaint

You may file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP):

Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, Romania
Web: https://www.dataprotection.ro
Phone: +40 318 059 211
E-mail: anspdcp@dataprotection.ro

How to exercise your rights

Send a request to businessmihai123@gmail.com with:

Subject: "GDPR rights request – [type of right]"
The e-mail address associated with your account
Description of the request

We respond within a maximum of 30 days of receipt (extensible by 60 days for complex requests, with notice to you).

9. Data security

We implement technical and organizational measures to protect data:

Encryption in transit: TLS 1.2+ for all communications;
Encryption at rest: AES-256 on Supabase servers;
Authentication: passwords are stored hashed (bcrypt), never in clear;
Restricted access: Row Level Security (RLS) at the database level – each user only sees their own data;
Secure tokens: stored on the device in the OS secure storage areas (Android Keystore / iOS Keychain via expo-secure-store);
Encrypted local storage: temporary data on the device uses expo-sqlite and AsyncStorage;
Audit: administrative access limited to technical accounts, with two-factor authentication.

Limits: No system is 100% secure. We recommend using strong passwords and not reusing your account password on other services.

10. Minors' data

The Application is NOT intended for persons under 18 years of age. By registering, you declare that you are at least 18 years old.

If we learn that we have collected data from a person under 18 without parental consent, we will immediately delete the data.

11. Cookies and similar technologies

The mobile Application does not use cookies in the traditional web sense. However, we use:

AsyncStorage and expo-sqlite for local storage of preferences and cache;
expo-secure-store for authentication tokens;
Device identifiers for push notifications.

These technologies do not collect data about your behavior outside the Application.

12. Changes to this policy

We may update this Privacy Policy periodically. For significant changes:

We notify you by e-mail or in-app notification at least 30 days in advance;
We request acceptance of the new version at your next login.

Previous versions are archived upon request.

13. Contact

For any question regarding this policy or data processing:

E-mail: businessmihai123@gmail.com

Postal address:
SC West Mountaing Training SRL
Constanța, Romania
Tax ID (CUI): 43545060

This policy reflects the technical reality of the Application as of the version date indicated. For specific questions about how your data is stored or processed, please contact us.

Reminder: The Romanian version of this document is the legally binding text. This English translation is provided for convenience only.