Privacy Policy
Last updated / effective: 1 August 2026
This Privacy Policy explains how Victory Extraction ("the Service", "we", "us") collects and uses your personal data, and the rights you have. It applies to the website and app at https://victoryextraction.com and our mobile apps.
Please read it together with our Cookie Policy and Terms of Service.
1. Who we are (Data Controller)
The data controller is:
- Štefan Letošťák, a sole trader (SZČO) registered in the Slovak Republic
- Place of business: Betliarska 22, 851 07 Bratislava-Petržalka
- IČO: 57190097 · DIČ: 1130650631 · IČ DPH: SK1130650631
- Trade register: Okresný úrad Dolný Kubín, číslo živnostenského registra 560-34185
- Contact for privacy matters: info@victoryextraction.com
We have assessed our processing and are not required to appoint a Data Protection Officer. For any data-protection question, contact us at the address above.
2. Scope
This policy covers personal data of registered users and visitors. The Service is intended for users aged 16 or older. We do not knowingly process data of anyone under 16.
3. What data we collect
You give us:
- Account data — first name, email address, password (stored only as a salted hash), and, for social sign-in, your Google or Apple account identifier.
- Onboarding answers — optional nickname, your stated goal, recurring patterns you want to change, and an optional "letter to your future self".
- Diary / journal entries — free-text reflections and an optional daily energy value (0–10). Diary text may, depending on what you choose to write, reveal sensitive information (see Section 5).
- Voice notes — if you use voice input, the audio is transcribed to text and is not retained as audio after transcription.
- Community content — posts, comments, likes, poll votes, reports, and any images or videos you upload.
- Support communications — anything you send us by email.
Created as you use the Service:
- Progress data — daily task completion, daily scores, to-dos, streaks, certificate of completion.
- AI-derived data — facts extracted from your diary, AI "observations" and pattern notes, chatbot conversation context, and AI token-usage logs (see Section 6).
- Billing data — subscription/customer identifiers and status from our payment provider. We do not store full card numbers.
- Notification data — your notification preferences, web-push subscription, and time zone (auto-detected to time messages locally).
Collected automatically:
- Technical data — IP address, browser/user-agent, device and app version, and similar log data, used for security, abuse prevention, and audit logging.
- Cookies / local storage — see the Cookie Policy.
4. Why we use your data and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account; deliver the 30-day program, diary, community, and support | Performance of a contract (Art. 6(1)(b)) |
| Process your payment and manage your plan | Performance of a contract (Art. 6(1)(b)) |
| AI analysis of your diary and AI features (see Section 6) | Explicit consent (Art. 6(1)(a) + Art. 9(2)(a)) where special-category data may be involved |
| Send service/transactional emails and in-app notifications | Performance of a contract / legitimate interest (Art. 6(1)(f)) |
| Send occasional updates and offers about our own similar services | Legitimate interest / soft opt-in (Art. 6(1)(f)); easy opt-out anytime via the unsubscribe link or your profile |
| Web-push notifications | Consent (Art. 6(1)(a)) — you opt in via the toggle |
| Security, fraud/abuse prevention, community content moderation, audit logging | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal, tax, and accounting obligations | Legal obligation (Art. 6(1)(c)) |
You can withdraw any consent at any time; this does not affect processing done before withdrawal.
5. Special category data (diary)
Your diary is a free-text space. Depending on what you write, it may contain special category data under Art. 9 GDPR (for example information revealing health, mental or emotional state, sex life, religious or philosophical beliefs).
- We process this content only on the basis of your explicit consent, captured as two separate opt-ins — one to collect and store your diary, and one to share it with our AI providers (Section 6). Each can be withdrawn independently in your profile.
- You are never required to write sensitive information. Withdrawing the AI-sharing consent stops AI processing; withdrawing the collection consent stops us saving new entries.
- Washington (US) residents: see our separate Consumer Health Data Privacy Policy.
6. AI processing and profiling
To power diary reflections, the "Victor" assistant, and related features, we use AI providers:
- Anthropic (Claude models) — diary reflections, pattern notes, the end-of-program summary, and the "Victor" chatbot.
- OpenAI — transcription of voice diary input (speech-to-text).
Separately, Anthropic (Claude) also performs automated moderation of community content you submit — posts, comments, poll questions and options, tasks, and the display name (nickname/first name) shown with them — to screen it against our community guidelines before it is published. This is done on the legal basis of our legitimate interest in a safe community (Section 4), not on your consent, and it is not automated decision-making with legal or similarly significant effects (Art. 22).
What this means:
- Your diary text (and, where relevant, your progress and onboarding answers) is sent to these providers to generate output for you. We instruct providers to process this data only to provide the service and not to train their models on it, as set out in our data processing agreements with them.
- We create a profile of recurring themes/patterns from your entries to personalize reflections.
- These AI features are not automated decision-making that produces legal or similarly significant effects about you (Art. 22). They do not determine pricing, eligibility, or account status, and the Service does not show you a "score" of yourself based on diary content.
- AI features are optional and consent-based (Section 5).
The AI assistant is a software tool, not a human, and does not provide medical, psychological, or professional advice (see Terms, Section 9).
7. Who we share data with
We share data with processors who act on our instructions. Current categories and providers are listed in the Sub-processors list, and include: payment processing (Stripe), AI (Anthropic, OpenAI), media/file storage (AWS, us-east-1), email (Resend), hosting and analytics (Vercel), caching/rate-limiting (Upstash), database hosting (Supabase — PostgreSQL, us-east-1 region, United States), and social sign-in (Google, Apple).
We may also disclose data where required by law, to enforce our Terms, or to protect rights and safety. We do not sell your personal data.
8. International transfers
Our database and file storage are hosted in the United States (Supabase and AWS, us-east-1 region). This means your account data — including your diary, which may contain special-category data (Section 5) — is stored and processed in the US, together with our other US-based providers. Where personal data is transferred outside the EU/EEA, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework; the specific safeguard for each provider is shown in our Sub-processors list. You can request more detail using the contact in Section 1.
9. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, diary, progress | While your account exists; deleted when you delete your account |
| "Victor" chatbot messages | Ephemeral — automatically deleted after ~48 hours |
| AI token-usage logs (no message content) | Retained as cost/operational records |
| Community content | Until you delete it or delete your account |
| Billing/tax records | As required by Slovak accounting/tax law (typically up to 10 years) |
| Security/audit logs (incl. IP) | Limited period for security purposes |
When you delete your account, we delete your personal data across our systems, remove your uploaded media, and cancel any active plan. Some records may be retained where the law requires (e.g. accounting), or in backups for a limited time until they rotate out.
10. Your rights
Under GDPR you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and to withdraw consent at any time.
To exercise these rights, email info@victoryextraction.com, or use the tools in your profile (account deletion, data export, and consent settings). We respond within one month.
You also have the right to lodge a complaint with the Slovak supervisory authority:
Úrad na ochranu osobných údajov Slovenskej republiky Hraničná 12, 820 07 Bratislava 27 · https://dataprotection.gov.sk
11. Cookies
We use only strictly necessary cookies plus a cookieless, privacy-friendly analytics tool. See the Cookie Policy for details.
12. Security
We protect your data with measures including encrypted transport, hashed passwords, HttpOnly authentication cookies, access controls, audit logging, and restricted admin access with step-up authentication. No system is perfectly secure, but we work to protect your data and will notify you and the authority of a personal data breach where the law requires.
13. Children
The Service is intended for users aged 16 or older (the GDPR age of digital consent). We do not knowingly collect data from anyone under 16. If you believe a person under 16 has created an account, contact us and we will delete it.
14. Changes to this policy
We may update this policy. We will post the new version here with an updated date and, for material changes, notify you in-app or by email.
15. Contact
Questions about this policy or your data: info@victoryextraction.com.