Privacy Policy

This Privacy Policy explains how Rensleigh & Co Enterprises ("we", "us") collects, uses, and protects information when you use Today Is Your Day™ (the "Service"). We are the data controller for the personal data described below.

1. Information we collect

We collect only what is needed to run the Service:

• Account data: email address and an encrypted password (or OAuth identifier if you sign in with a provider).
• Reflections and responses: the written content you submit during the assessment, conversation, and daily check-ins.
• Generated content: reports and section summaries produced for you.
• Email-delivery metadata: send status, bounces, and unsubscribe state, so we don't keep emailing addresses that fail or opt out.
• Technical data: minimal server logs (timestamp, request path, error codes) for security and debugging. We do not run third-party analytics or advertising trackers.

2. How we use it

• To create and secure your account;
• To generate your personalised report and 21-day plan;
• To send transactional emails you've asked for (account, report-ready, daily check-in);
• To debug, prevent abuse, and keep the Service running;
• To comply with legal obligations.

We do not sell your personal data, do not use it for advertising, and do not use your reflections to train AI models.

3. Legal basis (GDPR / UK GDPR users)

• Contract: to provide the Service you signed up for.
• Legitimate interests: security, fraud prevention, and product improvement, where not overridden by your rights.
• Consent: for any optional communications, withdrawable at any time.
• Legal obligation: where we must retain or disclose data by law.

4. POPIA (South African users)

Rensleigh & Co Enterprises is the Responsible Party under the Protection of Personal Information Act 4 of 2013 ("POPIA"). We process personal information in line with the eight conditions for lawful processing in POPIA: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data-subject participation.

Under sections 23–25 of POPIA you have the right to:

• Confirm whether we hold your personal information and request access to it;
• Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained;
• Object to the processing of your personal information on reasonable grounds;
• Withdraw any consent you previously gave;
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

To exercise these rights, email privacy@todayisyourday.app. We may ask you to verify your identity before acting on the request.

5. Sub-processors

We use a small number of trusted providers to operate the Service. They process your data on our behalf, under contract, and only for the purposes below:

• Lovable Cloud (hosting, database, authentication, email queue) — stores your account, reflections, and reports.
• Stripe — processes payments, calculates and collects applicable taxes, and handles billing security. When you purchase, Stripe receives the personal data needed to process the transaction (name, email, billing country, and payment details). See Stripe's privacy notice.
• Anthropic (Claude AI) — generates parts of your report from your reflections. Anthropic states it does not train models on API inputs by default.
• OpenAI — used for parts of report generation. OpenAI states it does not train models on API inputs by default.
• Resend — delivers transactional emails (report-ready, daily check-in, account notices).
• Google — if you choose to sign in with Google, Google handles authentication.

6. International transfers

Some sub-processors are located outside your country, including in the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers of personal data.

7. Retention

• Account, reflections, and reports: retained while your account is active.
• After account deletion: we delete or irreversibly anonymise your personal data within 30 days, except where we must keep it longer for legal, security, or backup reasons (in which case we isolate it and stop active use).
• Email-suppression list: we retain bounced/unsubscribed addresses indefinitely so we don't accidentally email them again.
• Server logs: typically retained for up to 30 days.

8. Your rights

Depending on where you live, you may have rights to: access your data; correct it; delete it; restrict or object to processing; receive a portable copy; and lodge a complaint with your local data-protection authority. To exercise any of these, email privacy@todayisyourday.app. We aim to respond within 30 days.

9. Security

We use industry-standard measures — encryption in transit (HTTPS), encryption at rest provided by our hosting platform, scoped database access controls (row-level security), and password hashing — to protect your data. No system is perfectly secure; we cannot guarantee absolute security and you use the Service at your own risk.

10. Children

The Service is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

11. Cookies

See our Cookie Policy for details on the essential cookies and local storage we use.

12. Changes to this policy

We may update this Policy. If changes are material, we will notify you by email or in-app notice before they take effect.

13. Contact

Data controller: Rensleigh & Co Enterprises, South Africa.
Privacy enquiries: privacy@todayisyourday.app.