Privacy Policy
Vixana
Effective date: 8 October 2026
This Privacy Policy explains how Monday Labs Inc. ("Company", "we", "our", or "us") collects, uses, shares, and protects your information when you use Vixana mobile application, websites, and related services (collectively, the "Services"). It also describes your privacy rights and how you can exercise them.
By downloading, installing, registering for, accessing, or using the Services, you agree to this Privacy Policy and our Terms of Service.
1. Information We Collect
Account & Authentication
Data: Email address, name, avatar URL, Apple ID or Google ID tokens, Supabase session JWT
Source: You via Apple Sign‑In / Google Sign‑In / guest flow
Purpose: Create & secure your account
Legal Basis: Contract (Art. 6 (1)(b))
Demographic (voluntary)
Data: Gender / pronouns, age range, zodiac sign
Source: You during onboarding
Purpose: Personalise content & voice
Legal Basis: Consent (Art. 6 (1)(a))
User‑generated content
Data: Manifestation goals, desires, journal entries, mood logs
Source: You in‑app
Purpose: Provide AI content & tracking
Legal Basis: Contract / Consent
Device & Technical
Data: Device model, OS, IP address, Expo push token, network status, app version, internal UUID
Source: Automatically from your device
Purpose: App security, diagnostics, push notifications
Legal Basis: Legitimate interest (Art. 6 (1)(f))
Usage & Progress
Data: App‑open timestamps, streak counts, listening stats, achievements
Source: Automatically in‑app
Purpose: Feature analytics, habit tracking
Legal Basis: Legitimate interest
Subscription / Purchase
Data: Original purchase date, renewal & expiry dates, product ID, platform, subscription event log, entitlement status
Source: Subscription provider events
Purpose: Fulfil premium features & bookkeeping
Legal Basis: Contract / Legal obligation (Art. 6 (1)(c))
Sensitive Data Flags (optional)
Data: Mental‑health intentions (e.g., anxiety, stress)
Source: You during onboarding
Purpose: Tailor affirmations
Legal Basis: Explicit Consent (Art. 9 (2)(a))
Audio Recordings
Data: Microphone input (voice prompts)
Source: You in‑app
Purpose: Transcribed to generate AI content (audio deleted immediately; transcript stored)
Legal Basis: Contract
| Category | Data Elements | Source | Purpose | Legal Basis (GDPR Art. 6) |
|---|---|---|---|---|
| Account & Authentication | Email address, name, avatar URL, Apple ID or Google ID tokens, Supabase session JWT | You via Apple Sign‑In / Google Sign‑In / guest flow | Create & secure your account | Contract (Art. 6 (1)(b)) |
| Demographic (voluntary) | Gender / pronouns, age range, zodiac sign | You during onboarding | Personalise content & voice | Consent (Art. 6 (1)(a)) |
| User‑generated content | Manifestation goals, desires, journal entries, mood logs | You in‑app | Provide AI content & tracking | Contract / Consent |
| Device & Technical | Device model, OS, IP address, Expo push token, network status, app version, internal UUID | Automatically from your device | App security, diagnostics, push notifications | Legitimate interest (Art. 6 (1)(f)) |
| Usage & Progress | App‑open timestamps, streak counts, listening stats, achievements | Automatically in‑app | Feature analytics, habit tracking | Legitimate interest |
| Subscription / Purchase | Original purchase date, renewal & expiry dates, product ID, platform, subscription event log, entitlement status | Subscription provider events | Fulfil premium features & bookkeeping | Contract / Legal obligation (Art. 6 (1)(c)) |
| Sensitive Data Flags (optional) | Mental‑health intentions (e.g., anxiety, stress) | You during onboarding | Tailor affirmations | Explicit Consent (Art. 9 (2)(a)) |
| Audio Recordings | Microphone input (voice prompts) | You in‑app | Transcribed to generate AI content (audio deleted immediately; transcript stored) | Contract |
Children's Data. The Services are not directed to anyone under 13 and we do not knowingly collect personal data from children under 13. If we discover such data, we will delete it.
2. How We Use Your Information
We use your information to:
- Provide & operate the Services (create affirmations, generate audio, save journals).
- Personalise content, voice, and notifications to your stated goals and mood.
- Maintain security (authenticate users, detect fraud, secure infrastructure).
- Measure & improve features, performance, and user engagement.
- Process payments & subscriptions and comply with tax / bookkeeping laws.
- Communicate with you, including service messages, push notifications, and marketing (you can opt out of marketing at any time).
- Comply with legal obligations and enforce our Terms of Service.
We do not use your data to train public AI models. Enterprise APIs (e.g., OpenAI, ElevenLabs) process prompts/transcripts only to return results and cannot retain or reuse them for their model training.
3. Sharing & Disclosure
We share your information only as necessary to operate the Services:
Supabase
Service: Cloud database & auth
Data Shared: All stored data
Safeguard: DPA & SCCs in place
OpenAI (Enterprise API)
Service: Language generation
Data Shared: Prompt text / context
Safeguard: No training / 30‑day retention cap
ElevenLabs (Enterprise API)
Service: Voice synthesis
Data Shared: Text prompts
Safeguard: No training
Superwall
Service: Subscription management
Data Shared: Purchase & entitlement data
Safeguard: DPA
Expo Services
Service: Push notifications, device constants
Data Shared: Device ID & token
Safeguard: DPA
Apple & Google
Service: Sign‑in & payments
Data Shared: Auth & transaction data
Safeguard: Platform terms
| Recipient | Role / Service | Data Shared | Safeguard |
|---|---|---|---|
| Supabase | Cloud database & auth | All stored data | DPA & SCCs in place |
| OpenAI (Enterprise API) | Language generation | Prompt text / context | No training / 30‑day retention cap |
| ElevenLabs (Enterprise API) | Voice synthesis | Text prompts | No training |
| Superwall | Subscription management | Purchase & entitlement data | DPA |
| Expo Services | Push notifications, device constants | Device ID & token | DPA |
| Apple & Google | Sign‑in & payments | Auth & transaction data | Platform terms |
| Law enforcement / regulators | Legal compliance | As required by law | Legal obligation |
| Acquirers | Corporate transaction | Limited data as part of due diligence | Appropriate safeguards |
We do not sell your personal information.
4. International Data Transfers
Supabase and several processors store data in the United States. When we transfer data from the EU/UK/EEA, we rely on Standard Contractual Clauses or other approved safeguards under GDPR.
5. Retention & Deletion
Account profile & UGC
Until you delete the account or request erasure
Subscription & purchase records
7 years (tax & accounting)
Logs & diagnostics
12 months, unless needed for security investigations
Audio recordings
Deleted immediately after transcription
Local device cache (AsyncStorage)
Cleared on sign‑out or app uninstall
| Data Category | Retention Period |
|---|---|
| Account profile & UGC | Until you delete the account or request erasure |
| Subscription & purchase records | 7 years (tax & accounting) |
| Logs & diagnostics | 12 months, unless needed for security investigations |
| Audio recordings | Deleted immediately after transcription |
| Local device cache (AsyncStorage) | Cleared on sign‑out or app uninstall |
When you delete your account, we soft‑delete your profile, scramble personal identifiers, and queue associated content for permanent deletion within 30 days (unless retention is required by law).
6. Your Rights & Choices
Depending on your jurisdiction, you may have rights to:
- Access a copy of your personal data.
- Correct inaccurate data.
- Delete your data ("right to be forgotten").
- Port your data to another service.
- Restrict or object to certain processing.
- Withdraw consent at any time (does not affect prior lawful processing).
- Opt out of marketing emails and push notifications.
You can exercise these rights via in‑app settings or by emailing support@thevixapp.com. We may verify your identity before responding. To delete your account specifically, see our Account Deletion page. EU/UK users may lodge a complaint with their local data‑protection authority.
7. Security
We implement technical and organisational measures to protect your data, including:
- TLS encryption in transit
- Encryption‑at‑rest by Supabase (AWS KMS)
- Role‑based access controls & MFA for staff
- Regular security reviews & penetration testing
- Responsible‑disclosure programme (support@thevixapp.com)
Despite these measures, no system is 100% secure; you use the Services at your own risk.
8. Cookies & Similar Technologies
The mobile App uses local storage and push‑notification tokens to operate. Our websites (if any) may use first‑party cookies for session management and analytics. We do not use third‑party advertising cookies.
9. Automated Decision‑Making & Profiling
Vixana uses AI to generate personalised content based on your inputs and mood history. This profiling is non‑consequential—it affects only the wording and tone of affirmations—and has no legal or similarly significant effect on you.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the App or by email at least 7 days before the new policy takes effect. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.
11. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, contact us at: