Privacy Notice

1. Who is responsible

Baldeo and Co operates Stoic and is the data controller for the personal data described here. Contact us at support@thatstoic.com.

2. What we collect and why

• Account data (name, email, sign-in details from magic link or Google): to create and secure your account. Basis: contract.
• Content you create (check-ins, mood and stress scores, journal entries, control maps, habits, AI Coach conversations): to provide the Service and your insights. Basis: contract.
• Plan and usage data (plan, usage counts, billing period): to apply plan limits. Basis: contract.
• Technical data (IP address, device and browser information, logs): to keep Stoic secure, prevent fraud, and fix problems. Basis: legitimate interests.
• Support and waitlist messages (email, name, plan interest): to reply to you and send plan updates you asked for. Basis: consent or legitimate interests.

Paddle collects and handles your payment details directly. We do not store your card details.

3. AI processing

When you use the AI Coach, the message you send is processed by an AI model provider only to generate your response. We do not sell your content, and we do not use it for advertising.

4. Who we share data with

• Service providers who help us run Stoic, such as hosting, database, authentication, and AI model processing, under confidentiality and data protection terms.
• Paddle, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance, and invoicing.
• Professional advisers such as legal and accounting advisers, where needed.
• Authorities, when required by law.

5. International transfers

Our providers may process data outside your country. Where this happens, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions.

6. How long we keep data

We keep your data while your account is active. You can delete AI Coach chats and other content from Settings at any time. When you close your account, or when data is no longer needed, we delete or anonymise it, except where the law requires us to keep it for longer, for example tax records.

7. Your rights

Depending on where you live, including under the GDPR, UK GDPR and South Africa's POPIA, you can ask to access, correct, delete, restrict, or export your data. You can also object to some processing and withdraw consent at any time. Email us and we will respond within one month. You also have the right to complain to your local data protection authority.

8. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, and per-user data isolation, so that only you can read your entries.

9. Cookies and local storage

Stoic uses only essential browser storage to keep you signed in and remember basic preferences. We do not use advertising cookies. You can clear this storage in your browser, but you will then be signed out.

10. Changes

We may update this notice and will tell you about material changes.