Privacy Policy

Effective July 23, 2026 · Last updated July 23, 2026

This policy explains what [LEGAL_ENTITY_NAME] (“Exeluma”, “we”, “us”) does with your personal information when you use our website and application. We have written it in plain language rather than boilerplate, because you should actually be able to tell what happens to your data.

The short version: we collect what we need to run an execution system for you, we send some of what you write to AI providers so the coaching features can work, we never sell your data, and you can export or delete everything at any time.

1. Who is responsible for your data

[LEGAL_ENTITY_NAME] is the data controller (under GDPR) and the business responsible for your personal information (under CCPA/CPRA, PIPEDA and Quebec Law 25).

• Registered address: [STREET, CITY, STATE/PROVINCE, POSTAL CODE, COUNTRY]
• Privacy contact: [privacy@exeluma.com]

2. What we collect

Information you give us

• Account details — name, email address, and authentication credentials. If you sign in with Google, we receive your name, email and profile image from Google.
• Profile and calibration — business type, coaching style preference, and your stated main focus.
• Your work — goals, milestones, tasks, weekly sprints and anything else you type into the product.
• Billing details — handled by Stripe. We receive confirmation and limited billing metadata; we never receive or store your full card number.

Information about how you work (please read this one)

The product is built around honest self-reporting, which means some of what we store is genuinely personal. Daily check-ins record your self-reported mood and energy level, the obstacles you describe, your written reflections, and confidence ratings before and after a task. From these we build a “resistance profile” — a behavioural model of the patterns behind your procrastination — which the AI uses to tailor its feedback.

This is behavioural and emotional information about you. We treat it as sensitive, we do not use it for advertising, and we never sell it. If you are in the EU/UK and you consider any of it health-related, you can object to this processing at any time and we will disable the feature for your account.

Information collected automatically

• Technical data — IP address, browser and device type, pages requested, and timestamps. Used for security, rate limiting and debugging.
• Error diagnostics — when something breaks, Sentry receives a stack trace and your account identifier so we can fix it.
• Product analytics — only if you consent. See Cookies below.
• AI request logs — we log AI interactions to audit the system, control abuse and manage cost.

3. Why we use it, and our legal basis

4. AI processing — what leaves our systems

Exeluma's coaching features work by sending your content to third-party AI providers. Specifically, the following can be transmitted to OpenAI and, in the Growth Challenge programme, Google (Gemini):

• Your goals, milestones and task descriptions
• Your check-in notes, stated obstacles and written reflections
• Your business type, coaching style and main focus

We send this only to generate your plans, reviews and coaching responses. We do not permit these providers to use your content to train their general models under our API agreements. If you would rather not have your content processed this way, do not use the AI features — the rest of the product works without them.

AI output is not professional advice. It is generated text and it can be wrong. It is not financial, legal, tax, medical or mental-health advice. See our Terms of Service.

5. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined under the CCPA/CPRA. We have never done so.

We use the following service providers (subprocessors):

We may also disclose information where legally required, or in connection with a merger or acquisition — in which case we will notify you before your data becomes subject to a different privacy policy.

6. International transfers

We are based in North America and our providers are primarily in the United States. If you access Exeluma from the EU, UK, or elsewhere, your information will be transferred to and processed in the United States. For transfers of EU/UK personal data we rely on the European Commission's Standard Contractual Clauses. You can request a copy of the safeguards at [privacy@exeluma.com].

7. How long we keep it

• While your account is active — we keep your content so the product works.
• After you delete your account — we delete your personal data within 30 days, except where we must keep records longer.
• Billing records — retained up to 7 years to meet tax and accounting obligations.
• Security and error logs — typically 90 days.

8. Your rights

Wherever you live, you can export all of your data and delete your account directly from your settings — no email required, no retention flow.

If you are in the EU, UK or Switzerland (GDPR)

You have the right to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.

If you are in California (CCPA/CPRA)

You have the right to know what we collect and why, to delete it, to correct it, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights.

If you are in Canada (PIPEDA and Quebec Law 25)

You may access and correct your personal information and withdraw consent. Under Quebec Law 25 you additionally have the right to data portability, the right to be informed when a decision is made about you based solely on automated processing, and the right to request that such a decision be reviewed by a person.

Automated processing notice: Exeluma uses automated systems to generate your plans, score your execution and build your resistance profile. These affect the guidance you see inside the product. They do not produce legal effects and are not used to deny you any service. You can ask us to explain or review any of it at [privacy@exeluma.com].

Making a request

Email [privacy@exeluma.com]. We respond within 30 days (45 days in California where permitted). We may need to verify your identity first. An authorised agent may act on your behalf with proof of authorisation.

9. Cookies and tracking

We use a deliberately small number of cookies, in two categories:

• Strictly necessary — authentication, security and remembering your cookie choice. These cannot be switched off, because without them you cannot stay logged in.
• Analytics (optional) — PostHog, used to understand which features are actually used. These load only after you accept them.

We do not run advertising or cross-site tracking cookies. Because Quebec Law 25 and the GDPR require prior consent, non-essential cookies stay off until you opt in — everywhere, for everyone, not just in those regions. You can change your choice at any time from the “Cookie settings” link in the footer.

10. Security

Data is encrypted in transit and at rest. Database access is enforced per-user at the database layer through row-level security, so one account cannot read another's records. Access to production is limited to people who need it. No system is perfectly secure, but if a breach affects you we will notify you and the relevant regulators as the law requires.

11. Children

Exeluma is for adults running businesses. It is not directed at anyone under 18, and we do not knowingly collect their information. If you believe a minor has given us data, contact us and we will delete it.

12. Changes

If we make a material change, we will notify you by email or in the product before it takes effect. The date at the top always reflects the current version.

13. Contact

[LEGAL_ENTITY_NAME]
[STREET, CITY, STATE/PROVINCE, POSTAL CODE, COUNTRY]
[privacy@exeluma.com]