Stressbuoy – Privacy policies & Notices

Effective date: November 8, 2023​

Please read carefully and make sure you fully understand our practices in relation to your personal information. 

Our Privacy Commitment to You

Stressbuoy cares deeply about the privacy of its visitors and users. Here are fundamental principles we want you to know:

·       We don't ask you for personal information unless we truly need it.

·       We don't share your personal information with anyone except to comply with the law, develop our products, or protect our rights.

·       We don't store personal information on our servers unless required for the ongoing operation of one of our services.

This Privacy Policy, which applies to all Stressbuoy users, including unregistered visitors, registered users, and premium users (collectively, “Users”, “you”, or “your”), explains what personal data is collected when you use the Stressbuoy mobile application (“App”), our website, which is located at https://www.stressbuoy.com/ (the “Website”) and related services (together with App and the Website, the “Services”), how such personal data will be used, shared or otherwise processed and the choices you have associated with that data. This Privacy Policy is not intended to override the terms of any contract you have with us, nor any rights you may have under other applicable data privacy laws.

PRIOR TO ACCESSING OR USING OUR SERVICES, YOU CONFIRM THAT (II) YOU ARE OVER 16 YEARS OF AGE (OR HAVE HAD YOUR PARENT OR GUARDIAN READ AND AGREE TO THIS PRIVACY POLICY FOR YOU) AND LEGALLY CAPABLE OF ENTERING INTO BINDING CONTRACTS. IF YOU READ AND FULLY UNDERSTAND THIS PRIVACY POLICY, AND REMAIN OPPOSED TO OUR PRACTICES, YOU MUST IMMEDIATELY LEAVE AND DISCONTINUE ALL USE OF ANY OF OUR SERVICES. 

In such case, you must (a) delete your account using the functionality found in “Settings” in App or the Website, or contact us at hello@stressbuoy.com and request deletion of your data; (b) cancel any subscriptions depending on how you subscribed (using the functionality provided by Apple or Google if you subscribed via an app store; or the functionality of our Website if you purchased subscription via the Website); and (c) delete App from your device(s).

Collection of personal information

For purposes of this Privacy Policy, “personal information” means any information that relates to an identified or identifiable individual. The personal information we collect through our Services will be apparent by the context of the page and/or the circumstances in which the personal information is being collected. This may include collection and processing of personal information including, but not limited to, the following categories of information:

We collect data you give us voluntarily (for example, when you enter your email to register) for and/or use the Services. We also may receive data about you from third parties (for example, when you sign in via Google). We also collect data automatically (for example, your IP address) and use third-party service providers for such collection.

Information You Provide to Us

Payment Information: When you purchase a subscription to the Services, you will need to provide payment information (e.g., financial account details, shipping information) to process your subscription. We use third-party payment providers to process payments on the Services. We may receive information associated with your payment information, such as billing address and transaction information, but we do not directly store payment information on the Services. Payment information is stored and processed by our payment providers on our behalf.

Data provided to us by third parties

When you decide to log in using Google, we may get personal data from your Google account. This includes your email, name, profile image, and Google ID. You can revoke access provided to us on Apps Permissions page. To know more about how Google processes your data, visit its Privacy Policy.

When you use Sign In with Apple to register an account in App, we get personal data from your Apple ID account. This data may include, in particular, your name and verified email address. You may choose to share your real email address or an anonymous one that uses the private email relay service. Apple will show you their detailed privacy information on the Sign In with Apple screen. Apple lets you revoke access provided to App in your Apple ID settings by following these steps. Find more about Sign In with Apple here.

Data we collect automatically:

Data about how you found us

We collect data about your referring app or URL (that is, the app or place on the Web where you were when you tapped on our ad).   

Cookies

Stressbuoy’s website uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app. For information about the cookies from our website hosting provider, Squarespace, please visit The cookies Squarespace uses.

Stressbuoy uses Google Analytics for Firebase (Stressbuoy app’s backend hosting provider) to gather statistical data. Google Analytics sets cookies to help us accurately estimate the number of visitors to the App and the volumes of its usage. This is done to ensure that the Services are available when you want them and are fast. Google allows its users to opt out of Google’s personalized ads and to prevent their data from being used by Google Analytics. For more data on how Google Analytics processes this data, visit https://policies.google.com/privacy. We occasionally partner with Meta, to manage our marketing, where such advertising is based on your past visits to our Products using Meta Pixel that allows us to deliver advertising to you on the Meta platform.

We do NOT use cookies so that third parties can serve ads to you about their own products or services.

We do NOT sell or rent your personal information to any third parties for their own advertising or marketing purposes.

How do I disable cookies?

You can generally activate or later deactivate the use of cookies through your web browser. Find your browser below to learn more about how to manage your cookie settings.

  • Firefox: Click here to learn more about “Private Browsing” and managing cookie settings.

  • Chrome: Click here to learn more about “Incognito” and managing cookie settings.

  • Internet Explorer: Click here to learn more about “InPrivate” and managing cookie settings.

  • Safari: Click here to learn more about “Private Browsing” and managing cookie settings.

If you want to learn more about cookies or how to control, disable, or delete them, please visit http://www.aboutcookies.org for detailed guidance.

In addition, certain third party advertising networks, including Google, allow users to opt out of or customize preferences associated with your internet browsing. To learn more about this feature from Google, click here.

Use of Data 

Stressbuoy OÜ uses the collected data for various purposes: 

·      To provide and maintain our Service thereby fulfilling our contract with you; To host personal data and enable our Services to operate and be distributed we use cloud platforms for on-demand deployment, related hosting and backend services: Google Cloud (Privacy Policy). To learn more, please visit Google’s Privacy Policy, Privacy and Security in Firebase.

  • Processing your payments (which are processed and stored by our third-party payment processors on our behalf) and otherwise servicing your purchase orders;

  • Managing your account - We process your personal data in order to secure your access to your personal account and send you technical notifications or emails about the performance or changes of our Services, security, payment transactions, notices regarding our Terms and Conditions of Use or this privacy policy

  • Answering requests for customer or technical support, responding to questions, comments, and other requests;

  • Providing access to certain areas, functionalities, and features of our Services; and

  • To detect, prevent and address technical issues 

  • Pursuing legitimate interests, such as research and development (including marketing research) in order to improve our Services, network and information security, and fraud prevention;

  • We communicate with you, for example, by push notifications or by emails. Email communications could be about new product features, promotions and other news about Stressbuoy; Push notifications may include reminders and motivational messages encouraging you to track your daily stress or joy, journal prompts, prompts to activities within programs or other information about the Services.  To opt out of receiving push notifications, you need to change the settings on your device. To opt-out of receiving emails, you should click unsubscribe link in the footer of our email. The third-party services that we use for these purposes may collect data concerning the date and time when the push notification or email was viewed by you, as well as when they interacted with it, such as by clicking on links included in the email. Please note that if you opt out of receiving promotional emails from us, we may still send you important administrative messages that are required in order to provide you with our Products and Services or for other reasons disclosed in this Privacy Policy. For EU-based users only, we will ask for your consent prior to sending you any promotional electronic communications. To communicate with you via push notifications, we use a third-party service, WonderPush (Privacy policy). WonderPush anonymizes your data (random id, no ip, no precise geoloc, no idfa, no phone number...), encrypts them at rest, does not accumulate them over time and does not share them with any third-party system. The data is stored exclusively in the EU and the possible unwanted extraction by a third party (due for example to an application of the Cloud Act), does not allow any possible re-identification, nor use.

  • Measuring interest and engagement in our Services, including analyzing your usage of the Services;

  • Ensuring internal quality control and safety;

  • Authenticating and verifying individual identities;

  • Carrying out audits;

·       To comply with legal obligations, enforce our Terms and Conditions of Use and to prevent and combat potentially prohibited, illegal activities or fraud - We may process, use, or share your data when the law requires it, in particular, if a law enforcement agency requests your data by available legal means. 

Notice - Legal Basis for Processing Personal Data under the General Data Protection Regulation (GDPR) 

If you are from the European Economic Area (EEA), Stressbuoy OÜ’s legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Data (meaning any information relating to an identified or identifiable natural person) we collect and the specific context in which we collect it. 

Stressbuoy OÜ may process your Personal Data (i) as necessary to perform our contractual obligations to you; (ii) as necessary to pursue our legitimate interests as further detailed below; (iii) as necessary for our compliance with our legal obligations such as a request or order from courts, law enforcement or other government authorities; and/or (iv) with your consent, including to send you marketing email messages and other information that may be of interest to you, which you may withdraw at any time.

Legitimate business interests

We may collect, process, and maintain personal data to pursue the legitimate business interests outlined below.  To determine these legitimate interests, we balance our legitimate interests against the legitimate interests and rights of you and others, and only process personal data in accordance with those interests where they are not overridden by your data-protection interests or fundamental rights and freedoms.

Our legitimate interests generally include:

  • Provide you with customer service and support, including to send you messages and provide user support, and to facilitate other communications that you request or are required to render our Products and Services to you. This may include providing you with information about new products and other opportunities we offer that we believe may be of interest to you based upon your interactions with us, and to personalize, measure, and improve such offers.

  • Provide, personalize, measure and improve our marketing, including to send you promotional messages and other information that may be of interest to you with your consent. We may also use personal data to understand our user base and the effectiveness of our marketing.  This processing is done pursuant to our legitimate interest in undertaking marketing activities to offer products or services that may be of interest to you.

  • to research and analyze your use of the Services - our legitimate interest for this purpose is our interest in improving our Services so that we understand users’ preferences and are able to provide you with a better experience (for example, to make the use of App or the Website easier and more enjoyable, or to introduce and test new features).

  • Protect you and others and to create and maintain a trusted environment, such as to ensure compliance our agreements with you and other third parties, to ensure safe, secure, and reliable sites and products, and to detect and prevent wrongdoing and crime, assure compliance with our policies, and protect and defend our rights, interests, and property. 

  • For risk management purposes, including compliance with our legal and regulatory obligations and for fraud detection, prevention and investigation, including “know your customer,” anti-money laundering, conflict and other necessary onboarding and ongoing client checks, due diligence and verification requirements, credit checks, credit risk analysis, compliance with sanctions procedures or rules, and tax reporting.

  • Comply with laws and regulations applicable to us, including any legal or regulatory guidance, codes, or opinions and to other legal process and law enforcement requirements, including any internal policy based on or reflecting legal or regulatory guidance, codes, or opinions. We may also respond to subpoenas, court orders, or legal process, and establish and exercise our legal rights or defenses against legal claims. 

Data security 

The security of your personal information is important to us. We follow generally accepted standards, practices, and procedures to protect the personal information submitted to us, both during transmission and once it is received. We maintain appropriate technical, administrative and physical safeguards to help protect the security of your personal information against unauthorized access, destruction, loss, alteration, disclosure or misuse. Please remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. 

If you have an account with us and you suspect unauthorized use of your account or its credentials, you should notify us immediately using the information in the Contact Us section at the end of this Privacy Policy.

Sharing of Data 

We share information with third parties that help us operate, provide, improve, integrate, customize, support, and market our Services. We may share some sets of personal data, in particular, for purposes indicated in the section “Use of Data” of this privacy policy. The types of third parties we share information with include, in particular:

Service providers

We may share personal data with third parties that we hire to provide services or perform business functions on our behalf, based on our instructions. We share your personal information with the following types of service providers:

·       cloud storage and data analytics providers (Google);

·       payment processing providers (Revenuecat);

·       Push notification services providers (Wonderpush)

·       Website hosting service (Squarespace)

Third parties as part of a merger or acquisition

As we develop our business, we may buy or sell assets or business offerings. Customers’ information is generally one of the transferred business assets in these types of transactions. If Stressbuoy is involved in a merger, acquisition or asset sale or any other corporate combination, your Personal Data may be transferred to the acquiring or surviving entity. If such transfer results in a material change to the use of your personal information, we will provide notice before your Personal Data is transferred and/or becomes subject to a different Privacy Policy. 

Disclosure for Law Enforcement 

If we are under a duty to disclose or share your personal information in order to comply with any legal obligation, such as to comply with a subpoena, bankruptcy proceeding, similar legal process, or in order to enforce or apply our agreements with you; or to protect the rights, property, or safety of Stressbuoy OÜ, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction. We may also disclose personal information where we believe that doing so would be in accordance with or required by any applicable law, regulation or legal process.

Your privacy rights

To be in control of your personal data, you have the following rights:

Accessing / reviewing / updating / correcting your personal data. You may review, edit, or change the personal data that you had previously provided on the Services.

Deleting your personal data. You can request erasure of your personal data as permitted by law.

When you request deletion of your personal data, we will use reasonable efforts to honor your request. In some cases, we may be legally required to keep some of the data for a certain time; in such event, we will fulfill your request after we have complied with our obligations.

Objecting to or restricting the use of your personal data. You can ask us to stop using all or some of your personal data or limit our use thereof.

Your Data Protection Rights under the General Data Protection Regulation (GDPR) 

If you are a resident of the European Economic Area (EEA) and UK, in certain circumstances, you may have certain data protection rights: 

The right to access, update or delete the information we have on you. Whenever made possible, you can access, update or request deletion of your Personal Data directly within your account settings section. If you are unable to perform these actions yourself, please contact us at hello@stressbuoy.com to assist you. You may be required to put your request in writing for security reasons. You may have the right to request confirmation of whether Stressbuoy OÜ processes personal data relating to you, and if so, to request a copy of that personal data.

The right of rectification. You may have the right to have your information rectified if that information is inaccurate, outdated or incomplete, subject to exceptions allowed by law.

The right to object to processing. You may have the right to object to our processing of your Personal Data under certain conditions. 

The right of restrict processing. You have the right to request that we restrict the processing of your personal information in certain circumstances. 

Right to deletion. You may have the right to request that Stressbuoy OÜ erase your personal data in certain circumstances provided by law.

The right to data portability. You may have the right to request that Stressbuoy OÜ export the data that we have collected to you or another company, under certain conditions.

The right to withdraw consent. You also have the right to withdraw your consent at any time where Stressbuoy OÜ relied on your consent to process your personal information. 

If you would like to exercise any of these rights, please submit a written request to hello@stressbuoy.com.

If you wish to be informed about what Personal Data we hold about you and if you want it to be removed from our systems, please contact us at hello@stressbuoy.com. Stressbuoy OÜ will provide the first copy of your personal data free of charge. Any further copies may be subject to a reasonable fee. We will respond to these requests in accordance with applicable data protection laws. Please note that we may ask you to verify your identity in order to help us respond efficiently to your request.

We would love you to contact us directly, so we could address your concerns. Nevertheless, you have the right to lodge a complaint with a competent Data Protection Supervisory Authority, in particular in the EU Member State where you reside, work or where the alleged infringement has taken place. For more information, please contact your local data protection authority in the European Economic Area (EEA) here. If you are in the UK, please visit this page. 

Supplemental notice for California residents

This Supplemental California Privacy Notice only applies to our processing of personal information that is subject to the California Consumer Privacy Act of 2018 (the “CCPA”). The CCPA provides California residents with the right to know what categories of personal information we have collected about them and whether we disclosed that personal information for a business purpose (e.g., to a service provider) in the preceding twelve months. California residents can find this information below.

Category of Personal Information Collected

Categories of Third Parties to which your Personal Information is Disclosed to for a Business Purpose

Identifiers -Service providers

Personal information categories listed in Cal. Civ. Code § 1798.80(e) - Service providers

Commercial information - Payment solutions partners; entities for legal purposes; entities for business transactions; entities with your consent.

Internet or other electronic network activity - Service providers; entities with your consent.

The categories of sources from which we collect personal information and our business and commercial purposes for using personal information are set forth above.

“Sales” of Personal Information under the CCPA. For purposes of the CCPA, we do not “sell” personal information, nor do we have actual knowledge of any “sale” of personal information of minors under 16 years of age.

Non-Discrimination. California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.

Authorized Agent. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. To designate an authorized agent, please contact us as set forth below.

Verification. When you make a request, we will ask you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include confirming the email address associated with any personal information we have about you.

If you are a California resident and would like to exercise any of your rights under the CCPA, please contact us as at hello@stressbuoy.com. We will process such requests in accordance with applicable laws.

Our Policy on "Do Not Track" Signals under the California Online Protection Act (CalOPPA) 

Except as otherwise stipulated in this Privacy Policy, this App does not support “Do Not Track” requests. To determine whether any of the third-party services it uses honor the “Do Not Track” requests, please read their respective privacy policies.

Your Nevada privacy rights

Nevada residents have the right to request to opt out of any “sale” of their personal information under Nevada SB 220. We do not currently sell personal information under Nevada law; however, you may still request to opt out of the future sale of your personal information. If you are a Nevada resident and would like to make such a request, please contact us using the information in the Contact us section at the end of this Privacy Policy, and provide “Nevada Privacy Rights” in the subject line. You must include your full name, email address, and postal address in your request so that we can verify your Nevada residence and respond. In the event we sell your personal information after the receipt of your request, we will make reasonable efforts to comply with such request.

Supplemental notice for Virginia residents

This Supplemental Virginia Privacy Notice only applies if you reside in the Commonwealth of Virginia. Where applicable, it describes how we use and process your personal data and explains your particular rights under Virginia Consumer Data Privacy Act (“VCDPA”).

Disclosures about the use of your personal data

We may collect and use certain information about you, some of which may be personal data (such as your name, email address, IP address, or other information which may be reasonably linked to you), in order to operate the Services and to maximize your experience.

If you would like more information about the categories of your personal data we collect or the purposes for which we collect them, please read sections about “Collection” and “Use” of Data sections. To learn more about sharing of your personal data with our business partners and other third parties, please read section, “Sharing” of Data.

Data Rights

“Your privacy rights” section of our Privacy Policy describes the data rights we offer to all users and how to execute these rights. This includes the right to access, review, correct, update your data, obtain a portable copy of your data, or delete data related to your stored preferences and your use of the Services. Before completing your request, we may require some information sufficient to authenticate your identity.

Additionally, VCDPA provides Virginia residents with these data rights:

Opt out of the Processing of your Personal Data for Targeted Advertising. In order to exercise your choice as a Virginia resident, please contact us at hello@stressbuoy.com with the subject line “Virginia Do Not Sell Request”. We will process such requests in accordance with applicable laws.

Please note that we do not process personal data for purposes of (1) the sale of personal data, as defined by the VCDPA, or (2) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Confirm whether your Personal Data is being Processed. You may confirm whether your personal data is being processed by emailing us at hello@stressbuoy.com.

Appeal a Case with regard to your Request. In the case where we declined to take action on your data rights request or have rejected your request, you may contact us at hello@stressbuoy.com to initiate an appeal of this decision. Please use the subject line “Appeal of Refusal to Take Action on Privacy Request” and provide the relevant information in the email. Once we receive your appeal, we will notify you in writing within 60 days of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

If your appeal is denied, you may contact the Office of the Virginia Attorney General by these means:

Office of the Attorney General | Virginia.gov
www.virginia.gov/agencies/office-of-the-attorney-general/#vagov
202 North Ninth Street
Richmond, VA 23219

Children's Privacy 

Our Platform is intended for individuals at least 16 years of age, or the age of majority in your province, territory or country. Individuals ages 13 - 16, or the applicable age of majority, may utilize the Stressbuoy Platform only with the consent and involvement of a parent of legal guardian. This provision is not applicable to registrations made under select subscriptions or special offerings, including business to business sales and enterprise partnerships, where specified in applicable contracts. 

We do not knowingly collect personally identifiable information from anyone under the age of 16. If you are a parent or guardian and you are aware that a Child under age 16 has provided us with Personal Data without parental consent, please contact us at hello@stressbuoy.com. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers. 

Retention of Data 

Stressbuoy will retain your Personal Data only for as long as is necessary or permitted for the purpose(s) for which it was obtained. We will retain and use your Personal Data to the extent necessary to have an ongoing relationship with you, comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes and enforce our legal agreements and policies. 

International data transfers

We do business globally. We may transfer personal data to countries other than the country in which the data was originally collected in order to provide the Services set forth in the Terms and Conditions of Use and for purposes indicated in this Privacy Policy. If these countries do not have the same data protection laws as the country in which you initially provided the information, we deploy special safeguards.

In particular, if we transfer personal data originating from the EEA to countries with not adequate level of data protection, we use one of the following legal bases: (i) Standard Contractual Clauses approved by the European Commission (details available here), or (ii) the European Commission adequacy decisions about certain countries (details available here).

Changes to This Privacy Policy 

We may update this Privacy Policy from time to time to reflect new services or changes in data practices or relevant laws. The “effective date” legend at the top of this Privacy Policy indicates when this Privacy Policy was last revised. Any changes are effective when we post the revised Privacy Policy on the Stressbuoy Platform, including the App and Website. If you are subscribed to our email notifications, we may take reasonable measures to notify you via email and/or a prominent notice on Stressbuoy app/website prior to certain changes becoming effective and will update the effective date at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Personal data controller

Stressbuoy OÜ, a company registered and acting under the laws of the Republic of Estonia, with a registration number 14783750, having its registered address at Stressbuoy OÜ, Ahtri 12, Tallinn, 10151, Estonia will be the controller of your personal data.

Contact Us 

If you have any questions, comments or requests about this Privacy Policy, you can contact us: hello@stressbuoy.com.