Privacy policy

1. Controller

INAQ s.r.o., [PLACEHOLDER: registered office street, postcode, city, Slovakia]. Privacy contact: privacy@feelsright.ai. [PLACEHOLDER: data protection officer, only if one is appointed.]

2. What we process, why, and on what basis

• Account and login data (email, name, password hash or sign-in provider ID). Purpose: provide the account. Basis: contract, Art. 6(1)(b) GDPR.
• Room photos and your answers to the onboarding questions. Purpose: create your analysis and report. Basis: contract, Art. 6(1)(b).
• Payment and invoice data (Stripe customer ID, order, amounts, VAT). Purpose: take payment, issue invoices, meet tax law. Basis: contract and legal obligation, Art. 6(1)(b) and (c).
• Comments on shared rooms (comment text, and name and email where you give them for confirmation). Purpose: show comments and send confirmation mail. Basis: your consent for email opt-in, Art. 6(1)(a), and legitimate interest in moderation, Art. 6(1)(f).
• Service emails (receipts, results ready, comment confirmation). Basis: contract. Marketing email only with your opt-in, with unsubscribe in every mail.
• Security and server logs, abuse prevention. Basis: legitimate interest, Art. 6(1)(f).
• Product analytics (PostHog) and A/B test events. Purpose: improve the product and test homepage variants. Basis: your consent, Art. 6(1)(a) GDPR and section 25 TDDDG. Only after you click Accept.
• Aggregate A/B counts for every visitor, see section 6. Basis: legitimate interest, Art. 6(1)(f). [PLACEHOLDER: pending lawyer opinion.]

3. Recipients and processors

We use these providers under data processing agreements. Where a provider is outside the EU, we rely on the EU-US Data Privacy Framework or standard contractual clauses. [PLACEHOLDER: verify each contract and transfer mechanism.]

• Supabase (EU region): database, authentication and file storage.
• Stripe: card payments and payment fraud checks. Stripe acts as an independent controller for some processing.
• PostHog (EU cloud): analytics, only after consent.
• Mistral AI (EU): automated moderation of comments. Comment text is sent for the check.
• Resend: sending service emails.
• Cloudflare: DNS, CDN and bot protection. It can see IP addresses and requests.
• Hetzner (Germany): servers, including the analysis queue.
• [PLACEHOLDER: GPU and AI inference providers used for room analysis, once the owner confirms the production setup.]

4. Photos and privacy of shared links

Your room photos are stored in private storage and shown only through time-limited signed links. If you share a room, people with the share link can view it, and the signed photo links expire after a short time. Please avoid photographing people, documents or screens. We do not use your photos to identify individuals.

5. Retention

• Account data and rooms: until you delete them or your account.
• Deleted photos and rooms: kept for a 90-day grace period, then permanently purged.
• Invoices and tax records: as long as the law requires. [PLACEHOLDER: tax adviser to confirm the period in Slovakia.]
• Analytics events in PostHog: [PLACEHOLDER: set and confirm project retention].
• Optional cookies fr_anon_id and fr_exp_hero: 90 days. See the Cookie policy.
• Aggregate A/B counters: contain no personal data and are kept as long as useful.

6. Cookies and A/B testing

Details are in the Cookie policy. In short: analytics loads only after Accept. After Accept we set fr_anon_id, a random first-party ID (90 days), and fr_exp_hero, which remembers your homepage variant (90 days). If you reject or ignore the banner, nothing is stored on your device and PostHog is not loaded.

To test homepage headlines, our server randomly picks one of three variants on each page load. For every visitor we add 1 to a daily total for the variant shown and, when the button is used, 1 to a daily total for the variant clicked. The totals hold no cookie, IP address, user agent or identifier, so we cannot tell who they came from.

7. Your rights

You may ask for access, correction, deletion, restriction and portability, and object to processing based on legitimate interest. You can withdraw consent at any time with effect for the future. Write to privacy@feelsright.ai. You may complain to a supervisory authority, for example the Office for Personal Data Protection of the Slovak Republic or the authority where you live.

8. Automated processing

Your room analysis and the comment moderation use automated tools. Suggestions are advice only and have no legal or similarly significant effect on you. [PLACEHOLDER: lawyer to confirm the Art. 22 position.]

9. Changes

We update this policy when processing changes. Last updated: 7 October 2026 (draft).