Privacy Policy

Last updated: 2026-03-30

⚠️ This document is a template and requires review by a lawyer before publication.

Last updated: 2025-01-01

Data Controller

The data controller is the operator of the Samlla platform (samlla.com). For matters related to personal data protection, please contact: privacy@samlla.com.

What Data We Collect

Registration Data

During registration and login, we collect data via the Kinde service (kinde.com):

  • email address,
  • first name (optional).

This data is processed by Kinde as a data processor acting on our behalf.

User Content

As part of using the platform, we store:

  • journal entries (text, date, mood),
  • tracker data (names, values, entry history),
  • goals and progress towards them.

This content is visible only to the logged-in user.

Technical Data

We automatically collect:

  • IP address,
  • browser and operating system type (user agent),
  • session cookies necessary to maintain the logged-in session.

Analytics Data

We use PostHog (posthog.com) to collect anonymous data about how the application is used. This data does not allow identification of a specific person and is used solely to improve the quality of the service. PostHog may collect information such as clicks, navigation within the app, and errors — in anonymized form.

Processing Purposes

We process data for the following purposes:

  • Service provision — enabling registration, login, storage and display of user content.
  • Security — protecting user accounts, preventing abuse and unauthorized access.
  • Analytics and service improvement — analyzing anonymous usage patterns to improve features and interface.
  • Communication — responding to inquiries sent to the support email address.

Legal Bases

Data processing is carried out on the following legal bases under GDPR (Art. 6):

  • Consent (Art. 6(1)(a)) — for analytics cookies and voluntarily provided data such as first name.
  • Performance of a contract (Art. 6(1)(b)) — processing data necessary to provide the service (registration, login, content storage).
  • Legitimate interests (Art. 6(1)(f)) — for technical data related to platform security and abuse prevention.

Retention Period

  • Account data and user content — retained for the duration of account activity. After account deletion, data is erased within 30 days, unless legal requirements mandate longer retention.
  • Technical data (logs) — retained for a maximum of 90 days.
  • Analytics data (PostHog) — in accordance with PostHog's data retention policy.

User Rights (GDPR)

As a user, you have the following rights:

  • Right of access (Art. 15) — you may request information about the data being processed.
  • Right to rectification (Art. 16) — you may request correction of inaccurate data.
  • Right to erasure (Art. 17) — you may request deletion of your data ("right to be forgotten").
  • Right to data portability (Art. 20) — you may receive your data in a structured format.
  • Right to object (Art. 21) — you may object to processing based on legitimate interests.
  • Right to restriction of processing (Art. 18) — you may request restriction of processing in certain cases.
  • Right to lodge a complaint — you have the right to lodge a complaint with a supervisory authority.

To exercise any of the above rights, please contact: privacy@samlla.com.

Cookies and Tracking Technologies

We use the following types of cookies:

  • Session cookies — necessary to maintain the logged-in state. They expire when the browser is closed or upon logout. These do not require consent.
  • Analytics cookies (PostHog) — collect anonymous data about user behavior in the application. You can opt out using browser settings or PostHog's opt-out mechanism.

The platform does not use advertising or remarketing cookies.

Data Transfers to Third Parties

Data may be transferred to the following entities:

| Entity | Purpose | Server Location | | ------------------------- | ------------------------------------- | --------------- | | Kinde (kinde.com) | Authentication and account management | EU / US | | PostHog (posthog.com) | Anonymous usage analytics | EU / US | | Railway (railway.app) | Application and database hosting | EU / US |

Each of these entities acts as a data processor under appropriate data processing agreements. When data is transferred outside the European Economic Area, Standard Contractual Clauses (SCCs) or other mechanisms ensuring an adequate level of protection are applied.

Contact for Data Protection Matters

If you have questions about this privacy policy or the processing of your personal data, please contact us:

Email: privacy@samlla.com Platform: samlla.com

We will endeavor to respond to your inquiry within 30 days of receipt.