Karuma Privacy Policy
Karuma is an app for stress reduction and burnout prevention based on the polyvagal theory. We handle your data with care and as minimally as possible. This statement explains what data we process, why, and what rights you have.
Contents
1.What data do we process?
Data on our secure platform (Supabase)
- Account Information — your email address and (encrypted) password. Required only if you create an account to access a program (SSP, RRP, or the team training).
- Access Status — whether you have access to a paid or business plan, and until when.
- Code Redemptions — only an anonymous, irreversible hash of a password you’ve used, to prevent duplicate logins. It cannot be traced back to you.
- Questionnaire (BAT) — When you complete the burnout questionnaire in the business module, your answers are submitted anonymously to provide aggregated group insights. They are not linked to your account as personal results; the app calculates and stores your scores locally on your device.
Data that stays only on your device
The following data is not sent to us: your language selection, onboarding preferences, days practiced and milestones, listening schedule checkmarks, reminder settings, and vibration preference. If you delete the app, this data will be deleted.
2.What We Don't Do
- No ads and no sale of data to third parties.
- No tracking or advertising cookies, no advertising SDKs, and no analytics software.
- No payment information is stored in the app—payments are processed outside the app via our website (brainarts.nl / safeandsoundprotocol-ssp.nl). We do not receive or store any credit card or bank information in the app.
3.Why and on what basis
- Account & Access: in order to provide you with the programs (performance of the agreement).
- Password Recovery: to help you regain access (legitimate interest / contract).
- Anonymous survey: Based on your consent, for aggregated insights within an organization.
4.Data Processors and Where Your Data Is Stored
- Supabase — Hosting of the database, accounts, and security features. Region: EU (Ireland).
- Resend — sends only system emails (such as confirmation and password reset emails).
- Payment provider via brainarts.nl — processes payments outside the app (see the privacy policy on our website).
Data processing agreements have been entered into with these parties where necessary. If data is processed outside the EEA, this is done with appropriate safeguards in place.
5.Retention Period
We retain your account information for as long as you have an account. If you delete your account, we will delete your account information (see below). Anonymous code hashes and anonymous survey data are retained because they cannot be traced back to you .
6.Your Rights
You have the right to access, correct, delete, restrict, and transfer your personal data, and you may withdraw any consent you have given. To do so, please email william@brainarts.nl.
Delete Account: You can do that right in the app via Settings > Delete Account, or through our page brainarts.nl/delete-account.
If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority ( authoritypersonal-data.nl).
7.Children
Karuma is not intended for children under the age of 16 and does not knowingly collect data from them.
8.Security & Changes
We take appropriate technical and organizational measures to protect your data (including encrypted connections and access controls). We may update this statement; the date at the top indicates the latest version .