← Back to Sleep Lab EngineClose this page (Done / ✕) to return to the app.
DRAFT — pending legal review. Text in [BRACKETS] must be completed by the operator before public release.
Privacy Policy
1. What this policy covers
This policy explains what personal data the Sleep Lab Engine web application and its backend collect, why, where it is stored, and the choices you have.
2. Data we process
| Data | Why | Where |
|---|---|---|
| Google or Apple account identifier, email address (for Sign in with Apple this may be a private relay address) and email-verified flag | Account sign-in, linking your purchases and saved soundscapes to you | Supabase (authentication) |
| Purchase records: order code or store transaction id, product, list price, discount applied (promotion or agent offer), amount, currency, country / market used for pricing, time, payment / refund status, and for subscriptions their status and renewal dates | Delivering Premium / Credits, accounting and tax obligations, fraud prevention | Supabase; payment processing by PayOS (web, Vietnam), PayPal (web, other countries), Apple App Store or Google Play (apps) |
| Language you use in the app, and a record of the service e-mails we send you (type, time, delivery status — not the content) | Sending receipts, refund, subscription and account notices in your language | Supabase; e-mails are delivered by Resend |
| Credit balance and credit history | Operating the Credits feature | Supabase |
| Saved soundscapes, Sound DNA ownership and license records, export registry (export time, duration, format, file fingerprint) | Delivering the service and verifying licenses you hold | Supabase |
| Free-trial anti-abuse signals: a one-way keyed hash of a browser device identifier, of your network address, and of your email address | Limiting repeated free trials. The raw network address is not stored. | Supabase |
| Short-lived request counters (per account or per network) for rate limiting | Protecting the service from abuse | Supabase |
| Technical request data (IP address, user agent) processed transiently by our hosting provider | Delivering and securing the service | Cloudflare |
| Settings, favorites, history and a local audio cache | App preferences and faster playback | Your browser only (localStorage / IndexedDB); not sent to us |
We do not use advertising trackers and we do not sell personal data. The application contains no analytics or advertising SDK.
3. Legal bases
Performance of a contract (providing the service you requested), legal obligations (accounting records), and legitimate interests (security, abuse prevention). [LEGAL REVIEW: confirm bases under Vietnamese Decree 13/2023/ND-CP and, if EU/UK users are served, the GDPR.]
4. Processors
- Supabase (database and authentication) — hosted in Singapore (AWS ap-southeast-1)
- Cloudflare (hosting, Workers, R2 storage)
- Google (Sign-In; Google Play billing in the Android app)
- Apple (Sign in with Apple; App Store billing in the iOS app)
- PayOS (payment processing in Vietnam — we never receive your card or bank credentials)
- PayPal (payment processing outside Vietnam — we never receive your card or bank credentials)
- Resend (delivery of service e-mails such as receipts — receives your e-mail address and the message)
- Google Fonts and the jsDelivr / cdnjs CDNs (your browser loads fonts and libraries from them, which exposes your IP address to those providers)
5. Retention
Account data is kept while your account exists. When you delete your account, your profile, saved soundscapes, exports registry, license records and trial records linked to your account are deleted. Financial records we are legally required to keep are retained in pseudonymised form (your account identifier is replaced by a one-way hash) for [RETENTION PERIOD — e.g. 10 years under Vietnamese accounting law; LEGAL REVIEW]. Anti-abuse hashes that are not linked to an account are kept for [PERIOD].
6. Your rights and choices
- Delete your account at any time: Account panel → “Delete account”. This is immediate and cannot be undone.
- Access, correction, objection and other rights: contact support@sleeplabengine.com.
- Clear local data: use your browser's “clear site data”.
7. Children
The service is not directed to children under [13/16 — LEGAL REVIEW].
8. Security
Data is transmitted over HTTPS. Database access is restricted by row-level security; payment confirmations are verified by the server, never by the browser.
9. Changes
We will post changes on this page and update the effective date.
← Back to Sleep Lab EngineClose this page (Done / ✕) to return to the app.