Privacy policy

Last updated: November 2026. The controller is PK Ventures Limited, Unit 909, Prosperity Millennia Plaza, 663 King's Road, Quarry Bay, Hong Kong (contact: [email protected], see also legal notice).

This website

The website is delivered via Cloudflare (Cloudflare, Inc., USA, certified under the EU-US Data Privacy Framework). Cloudflare processes technically necessary data such as IP address, time and requested address to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR). We choose the language of the home page based on your browser's language setting, without storing it. We use no cookies, no tracking, no analytics tools and no third-party fonts or content.

Waitlist

When you join the waitlist, we store your email address, the page language, the time and the text of your consent. We then send you an email with a confirmation link (double opt-in). Only once you click it are you on the list; we store the time of confirmation as proof. Unconfirmed addresses are deleted after 30 days.

Purpose: we write to you once when Bhava launches. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by emailing us. Data is stored with Supabase (see below) on servers in London. We delete your address after the launch email or after 24 months at the latest, unless you use the app.

Email delivery: Resend

We send waitlist and app emails (e.g. sign-in links) via Resend (Resend, Inc., USA). Resend processes your email address and the content of the email. The transfer to the USA is based on the EU Commission's standard contractual clauses. We do not track opens or clicks.

The Bhava app

• Account and sign-in. You need an account to use the app. You sign in with an email link or your Google account. From Google we receive your name, email address and profile picture, never your password.
• Your content. We store your answers and life profile, your visualizations and a history of your edits (e.g. “longer”, “more emotional”) so we can improve the texts. Every user only sees their own data.
• Servers: Supabase. Database and sign-in run at Supabase, Inc. in a data center in London (United Kingdom). The EU Commission has issued an adequacy decision for the United Kingdom, so its data protection level is considered equivalent. We have a data processing agreement with Supabase.
• Texts: OpenAI. To write your visualization, we send the necessary content (your answers and profile, without your email address) to the OpenAI API (OpenAI, L.L.C., USA). OpenAI does not use this data to train its models and keeps it for at most 30 days to prevent abuse. The transfer to the USA is based on the EU Commission's standard contractual clauses. Please don't enter health data or data about other people that you don't want to share.
• App hosting. The web app and its API run on Cloudflare (see above).
• Legal basis. Processing is necessary to provide the app to you (Art. 6(1)(b) GDPR). The edit history used to improve the texts is based on our legitimate interest (Art. 6(1)(f) GDPR).
• Retention. As long as you have your account. If you delete it or ask us to, we delete your data within 30 days.
• No ads. We don't sell data and don't use it for advertising.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. Just email [email protected]. You can also lodge a complaint with a data protection supervisory authority, for example in the country where you live.