What we do with your data.
On this page
This policy explains what we do with personal data when you buy a membership or use ExhalePLR.
Who is responsible
The data controller is CALLIE VOX SL (NIF B05604376), trading as ExhalePLR, registered address De la Punta del Cavall 44, Esc. 1, 4º 27, 43840 Salou, Tarragona, Spain. Privacy questions: support@exhaleplr.com.
What we process, and why
- Your e-mail address and password — to create your account and let you sign in. Necessary to perform our contract with you.
- Purchase and subscription details — plan, status, renewal and end dates, and the Stripe customer and subscription identifiers. Necessary to perform the contract and to meet accounting obligations.
- Optional visitor measurement — public page views and product clicks are sent only after consent. Start uses a separate measurement choice which does not consent to advertising. Operational, sign-in and security logs are processed separately to perform the contract and protect the service.
- Support messages — to answer you, and to keep a record of what was agreed.
- Withdrawal notices — the purchase reference, product, receipt time and acknowledgement reference are recorded with Stripe to handle your notice, meet legal obligations and document potential legal claims.
We do not sell personal data, and we do not use it for automated decisions that produce legal effects.
Card details
We never receive your card number. Payment is entered on Stripe's own checkout page, and we are told only the outcome, your e-mail address and the identifiers we need to link a payment to an account.
Who processes data on our behalf
- Supabase — accounts, authentication and the database. Hosted in London, United Kingdom.
- Stripe — payment processing and subscription management, as an independent controller for its own compliance purposes.
- Cloudflare — storage and delivery of the library files.
- Vercel — hosting of the website and the member portal.
- Brevo — delivery of transactional account and sign-in e-mails.
- Meta — After separate consent to advertising measurement, the Meta pixel measures visits and product clicks. For completed purchases, the server sends a hashed email address, purchase time, event ID, amount and currency to Meta to measure advertising results. No purchase data is sent without this consent. Change your choice in the Start page measurement settings.
Some of these providers are established outside the EU/EEA. Where data is transferred, it is covered by the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
Account and entitlement data is kept for as long as your membership exists and then for as long as needed to handle disputes. Records that accounting law requires us to keep are kept for seven years. Activity logs are kept while they remain operationally useful and are then deleted.
Your rights
You may ask for a copy of your data, correction of it, deletion, restriction, portability, or object to processing based on legitimate interest. Write to support@exhaleplr.com. If you are unhappy with how we respond you can complain to Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority.
Cookies
See the Cookie Policy.