Terms & Conditions
Terms and Conditions (“T&Cs”)
These Terms and Conditions apply to your use of and purchases on the website (the “Site”) operated by The Secret Buddha (hereinafter “we,” “us,” or “our”). By accessing or using any part of the Site—including our webshop for digital products such as eBooks or online courses (collectively, the “Products”), our online community (the “DiaryX Community”), and our AI-powered chat advisor (the “Secret Buddha Advisor” or the “Agent”)—you agree to be bound by these T&Cs. If you do not agree, please do not use the Site.
1. Contact Information
Business Name: The Secret Buddha
Address: E Stander, Bertelestr. 21, DE 81479 Munich
Email: etienne.stander@feelandflowsurf.com
These T&Cs are governed by the laws of the Federal Republic of Germany, subject to any overriding consumer protection regulations in your country of residence (for consumers).
2. Scope
These T&Cs govern:
- All sales contracts concluded between us and any natural person or legal entity (hereinafter “User”) in relation to digital Products offered on the Site.
- Participation in our online community, the DiaryX Community, which is accessible to registered Users internationally.
- The use of the Secret Buddha Advisor (AI Agent) made available on the Site.
- The use of all informational materials (articles, blog posts, coaching insights, etc.) provided on the Site.
“Consumer” means any natural person who enters into a legal transaction for purposes that are predominantly outside his or her trade, business, or profession. “Entrepreneur” means a natural or legal person or a legal partnership who, when entering into a legal transaction, acts in the exercise of their commercial or independent professional activity.
If you choose to view any part of our website or these T&Cs in a language other than English using automated translation, please note that translations may contain inaccuracies. The contract language is the language selected and confirmed during checkout.
3. Conclusion of Contract
3.1 Product Offers
Any listings or advertisements of Products on the Site constitute a binding offer to conclude a purchase contract, subject to your proper completion of the order process and acceptance of these T&Cs.
3.2 Order Process
To place an order, add your chosen digital Products to the shopping cart and proceed through the checkout steps. You will be prompted to enter your personal details (and, if required, billing/payment information). By clicking on the final purchase button (e.g., “Buy Now”), you submit a legally binding order to purchase the selected Products.
You will receive a confirmation email acknowledging receipt of your order (“Order Confirmation”), which signifies acceptance of your offer and the formation of the contract.
3.3 Contract Storage
We store the contract text (i.e., the T&Cs and order data), and you may print or save them during the ordering process. After the order process is completed, we will provide you with an Order Confirmation that contains relevant contractual information. The final contract text may no longer be accessible online after completion of your order.
3.4 Account Creation
You can register for a unified account, which grants access to both the webshop and the DiaryX Community. Details of personal data processing and usage can be found in our Privacy Policy and in the respective account registration pages.
3.5 Age Requirement
By placing an order or registering for the Community, you confirm that you are at least 18 years old or otherwise have reached the age of majority in your jurisdiction. If you are under 18, parental or guardian consent is required before using the Site.
4. Prices, Payment, and Taxes
4.1 Pricing
All prices displayed on the Site are total prices and include any applicable taxes in accordance with German law. If your country of residence imposes different VAT or import duties, you are responsible for those according to applicable local regulations.
4.2 Payment Methods
- Bank Transfer: We will provide you with our bank details upon checkout; the total is payable immediately.
- PayPal: You must have a valid PayPal account or register for one. By selecting PayPal, you consent to PayPal’s terms and conditions.
- Credit Card (via WooCommerce or associated payment gateway): We accept major credit cards (e.g., Visa, MasterCard). The payment gateway provider will handle your transaction securely.
- Other WooCommerce Options: If other payment options are integrated (e.g., Apple Pay, Google Pay), you agree to abide by their respective terms.
4.3 Currency
Unless otherwise specified, prices are listed in Euros (EUR). You bear any currency conversion fees charged by your bank or payment provider.
4.4 Payment Due Date
Payment is due immediately upon conclusion of the contract, unless otherwise stated. If, for any reason, your payment is not received, we reserve the right to withhold delivery of the digital Products or suspend Community access until full payment is received.
4.5 Default in Payment
In the event of late payment, we may charge statutory default interest and/or block your access to the Site or Community until the overdue amounts are settled.
5. Delivery of Digital Products
5.1 Immediate Delivery
All Products sold are digital (e.g., eBooks, downloadable PDFs, online course material). No physical shipping occurs, and no shipping costs apply. Unless stated otherwise, digital files are made available for immediate download upon successful order completion and payment confirmation.
5.2 System Requirements
You are responsible for ensuring that you have the necessary hardware, software, and internet connectivity to access or download digital Products. We are not liable for any inability to download due to technical issues on your side.
5.3 License and Usage Rights
Digital Products are sold for personal, non-transferable use unless expressly stated otherwise. You may not modify, distribute, sell, or share the digital files beyond the scope of what is permitted by applicable law or explicitly stated in the Product description.
5.4 Right of Withdrawal for Digital Products
For digital content not supplied on a tangible medium, your statutory right of withdrawal generally exists. However, it expires once we have begun performing the contract after you have expressly consented to us beginning performance before the withdrawal period ends. We will confirm this to you on a durable medium after purchase.
6. Community Participation and User-Generated Content
6.1 Access and Rules
By creating an account, you gain access to our DiaryX Community. You agree to post content (text, images, comments, etc.) that is lawful, non-defamatory, non-infringing, and respectful of other Users. We reserve the right to remove any content that violates these T&Cs or applicable law.
6.2 License to Use Content
By posting any content in the Community, you grant us a worldwide, non-exclusive, royalty-free license to use, display, reproduce, and distribute your content for the operation of the Community. This license ends when you delete the content or terminate your account unless the content has been shared or stored by other Users.
6.3 Prohibited Conduct
You agree not to engage in harmful or harassing behavior, spam, hate speech, or any content that violates applicable local, national, or international laws. Impersonation, use of false account information, or unauthorized collection of personal data are strictly prohibited.
6.4 Community Availability and Fees
Currently, Community membership is free of charge. However, we reserve the right to introduce subscription fees or additional paid features in the future. In such an event, we will notify you in advance, and you may choose to continue or cancel your membership.
6.5 Termination
We may suspend or terminate your account if you breach these T&Cs or if required by law. You may also request account deletion at any time by contacting us at etienne.stander@feelandflowsurf.com. After termination, your access to the Community and any purchased digital content linked to that account may be affected, subject to applicable law and relevant licensing terms.
7. Secret Buddha Advisor (AI Agent)
7.1 Description of the Service
The Secret Buddha Advisor (the “Agent”) is an AI-powered chat advisor available as a floating bubble and/or inline dialog on the Site. It provides general self-improvement guidance, planning support, and optional personalisation features.
7.2 Modes of Operation
- Stateless mode: Works without storing conversation history. Available to guests and logged-in Users who have not enabled memory.
- Memory (personalisation) mode: If you are logged in and explicitly consent, the Agent may store short summaries of conversations, your Key Facts (e.g., goals, preferences, constraints), and your Active Plan. You can withdraw consent at any time in the Agent settings (
).
7.3 Commands
The Agent supports convenience commands (examples): /help, /plan add <item>, /forget <keyword>, /remember <type>: <value> (types: goal, preference, constraint, trigger, habit), and /export (download your Agent data).
7.4 Availability, Rate Limits, and Fallback
- We may throttle usage to preserve stability. If you exceed limits, the Agent may temporarily reject requests.
- If the external AI provider is unavailable or returns an error, the Agent may switch to a local Lite mode with more generic tips.
- We may modify, suspend, or discontinue the Agent at any time for maintenance, security, or legal reasons.
7.5 Accuracy & Responsibility
AI-generated output can be incomplete or incorrect. You remain responsible for evaluating the Agent’s suggestions and making your own decisions. The Agent is not a substitute for professional advice (medical, psychological, legal, financial). Do not use the Agent for emergencies.
7.6 Acceptable Use (Agent)
- No content that is unlawful, harmful, harassing, defamatory, infringing, or otherwise prohibited by law.
- No attempts to manipulate or bypass safety features, probe for vulnerabilities, or overload the service.
- No attempts to extract other Users’ personal data or confidential information via the Agent.
7.7 Data Handling, Consent, Export & Erasure
Data processing for the Agent (including memory features, retention schedules, international transfers to AI providers, and your rights) is described in our Privacy Policy. You can export your Agent data (JSON) and request erasure at any time via the Agent settings. Consent can be withdrawn at any time with future effect.
7.8 Third-Party Providers
To generate replies, the Agent may use an external AI provider (currently OpenAI) as our processor. Processing may occur outside the EU with appropriate safeguards in place as detailed in the Privacy Policy.
8. Disclaimer for Informational and Coaching Content
8.1 No Medical or Psychological Advice
All articles, blog posts, coaching information, and Agent responses on the Site are for general educational and informational purposes. They do not replace professional medical, psychological, financial, or legal advice. Always consult a qualified professional for individualized guidance.
8.2 Results May Vary
We do not guarantee any specific outcomes or results from using our Products, reading our articles, using the Agent, or implementing suggestions in the Community. You agree to use our content and the Agent at your own risk.
8.3 Limitation of Liability
We disclaim liability for any direct or indirect losses or damages arising from the use of our informational content and/or the Agent’s output, except where liability is mandatory by law (e.g., injury to life, body, or health). In any event, our liability for simple negligence is limited to foreseeable, contract-typical damages for breaches of essential contractual obligations (cardinal duties).
9. Right of Withdrawal (Widerrufsrecht)
9.1 General
If you are a consumer residing in the European Union, you have a statutory right of withdrawal for certain purchases. For digital Products delivered by immediate download, your right of withdrawal expires once we begin contract performance with your prior express consent.
9.2 Withdrawal Form
You may notify us (see Contact Information) with a clear written statement (email is sufficient). We can provide a standard withdrawal form template upon request.
9.3 Consequences of Withdrawal
If a valid withdrawal occurs before you have accessed or downloaded any digital Product, we will refund payments received in relation to that product within fourteen (14) days of receiving your notice of withdrawal.
10. Legal Warranty and Liability
10.1 Legal Warranty
If you are a consumer, you benefit from statutory warranty rights for digital Products. You must notify us promptly if you encounter any defect or issue with purchased digital content.
10.2 Exclusions
Any warranty is void if the defect arises from unauthorized manipulation, misuse, or failure to comply with recommended usage guidelines.
10.3 Limitation of Liability
For simple negligence, we are only liable for breach of essential contractual obligations (cardinal duties). Liability for breach of these obligations is limited to foreseeable damages typical for such contracts. We disclaim any liability for data loss or site unavailability beyond what is mandated by law. Nothing in these T&Cs excludes or limits liability to an extent prohibited by applicable law.
11. Intellectual Property Rights
11.1 Ownership
All content, trademarks, logos, and intellectual property displayed on the Site are owned by or licensed to The Secret Buddha, unless otherwise indicated.
11.2 User Obligations
You must not infringe, misuse, or otherwise violate any intellectual property rights. Reproduction, distribution, modification, or public display of any content on the Site without our prior written consent is prohibited (except for private, non-commercial use allowed by law).
12. International Use
12.1 Compliance with Laws
We make no representation that our Site or Products are appropriate or available for use in locations outside Germany. Accessing the Site from territories where its content or transactions are illegal is prohibited. You are responsible for compliance with local laws if and to the extent they are applicable.
12.2 Customs and Export Controls
For international Users, you agree to comply with any applicable export and customs regulations. We are not responsible for any delays, duties, taxes, or seizures related to international downloads or usage.
13. Automatic Translation Disclaimer
The Site and these T&Cs may be made available in multiple languages. The automatic translation functionality aims to assist non-English speakers. In the event of conflict between the English version and any translated version of these T&Cs or other Site content, the version confirmed at checkout prevails to the extent permitted by law.
14. Data Protection
14.1 Privacy Policy
Personal data processing is governed by our Privacy Policy, which details what data we collect and how we use it. By using the Site (including the Agent), you agree to our data practices.
14.2 Community and Agent Data
If you join our DiaryX Community or use the Agent, additional data related to your profile, activity, and chat usage may be collected and processed. Please refer to the Privacy Policy and the Agent Information & Policy page for details, including consent, retention, export, and erasure options.
15. Amendments to These T&Cs
15.1 Right to Modify
We reserve the right to modify these T&Cs at any time for future transactions or participation, for example, due to changes in law or updates to our business model (including the Agent).
15.2 Notification and Acceptance
We will notify Users of significant amendments. Continued use of the Site, Community, or Agent after the effective date of such changes constitutes your acceptance of the revised T&Cs.
16. Governing Law and Jurisdiction
16.1 Applicable Law
All contracts concluded with us are governed by the laws of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG). If you are a consumer with habitual residence outside Germany, mandatory consumer protection laws in your country of residence remain applicable.
16.2 Jurisdiction
In business transactions with Entrepreneurs, the place of jurisdiction is our registered office in Munich, Germany. Mandatory statutory provisions on exclusive jurisdictions remain unaffected for consumers.
17. Severability Clause
If any provision of these T&Cs is found to be unlawful, void, or unenforceable, that provision shall be deemed severable from the remaining provisions, which will continue to be valid and enforceable to the fullest extent permitted by law.
18. Dispute Resolution in Consumer Matters (VSBG)
18.1 ODR Platform discontinued
The European Commission’s Online Dispute Resolution platform was permanently discontinued on 20 July 2025. References to that platform are no longer applicable.
18.2 Voluntary alternative dispute resolution (ADR)
We always seek to resolve concerns directly with you. Participation in consumer ADR procedures is voluntary unless we are legally obliged or have agreed to participate.
18.3 Our current stance under § 36 VSBG
We are not obliged to participate in consumer arbitration proceedings before a consumer dispute resolution body and we are generally not willing to participate.
18.4 Information duty after a dispute (§ 37 VSBG)
If a dispute relating to a consumer contract cannot be settled between you and us, we will inform you in text form of the competent consumer dispute resolution body and whether we are willing to participate in a procedure before that body.
18.5 Competent ADR body (general)
Universalschlichtungsstelle des Bundes
Zentrum für Schlichtung e. V.
Straßburger Straße 8, 77694 Kehl am Rhein, Germany
www.universalschlichtungsstelle.de
Thank you for reading our Terms and Conditions. If you have any questions, concerns, or feedback, please contact us at etienne.stander@feelandflowsurf.com.
Privacy Policy
Privacy Policy
In this privacy policy, we inform you about the type, scope, and purpose of the personal data we collect, use, and process. “Personal data” means any information relating to an identified or identifiable natural person (e.g., name, address, email address, online identifiers, and information about your use of our website). We use SSL encryption on our website to protect your personal data and other confidential content (e.g., during order processing and inquiries via our contact form).
If you have any questions about the collection, processing, or use of your personal data, or if you require information, correction, restriction or deletion of data, as well as the withdrawal of any consent given or objection to a specific data processing, please contact the person responsible as mentioned below.
I. Name and Contact Details of the Responsible Party
Responsible within the meaning of Art. 4 No. 7 GDPR, other data protection laws applicable in the member states of the European Union, and other provisions related to data protection:
Mr. Etienne Stander
Bertelestr. 21
81479 Munich
Email: etienne.stander@feelandflowsurf.com
II. Your Rights
You have the following rights with respect to the personal data concerning you:
- Right of access (Art. 15 GDPR): confirmation as to whether personal data concerning you is being processed by us and, where that is the case, access to that personal data and information about the processing.
- Right to rectification (Art. 16 GDPR): the rectification of inaccurate or completion of your personal data stored by us without undue delay.
- Right to erasure (Art. 17 GDPR): the deletion of your personal data, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims.
- Right to restriction of processing (Art. 18 GDPR): where you contest the accuracy of the data, where processing is unlawful and you oppose erasure, where we no longer need the data but you require it for legal claims, or where you have objected pursuant to Art. 21 GDPR.
- Right to data portability (Art. 20 GDPR): to receive your personal data which you have provided to us, in a structured, commonly used and machine-readable format or to request the transfer to another controller.
- Right to withdraw consent at any time (Art. 7(3) GDPR). The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
- Notification obligation (Art. 19 GDPR): if you assert your rights to rectification, erasure, or restriction of processing, we will inform all recipients to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about those recipients.
- Right to lodge a complaint (Art. 77 GDPR): with the supervisory authority responsible for us (e.g., https://www.datenschutz-bayern.de/).
III. Provision of Our Website and Creation of Server Log Files
When using our website for informational purposes only (i.e., you do not register or otherwise provide us with information), we collect only the personal data that your browser transmits to our server. If you visit our website, we collect the following data, which is technically necessary for us to display our website and ensure its stability and security:
- IP address
- Date and time of access
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request comes (referrer)
- Subpages visited on our site
- Browser type and version used
- Operating system and its interface
- Language and version of the browser software
These data are stored temporarily in the server’s log files separately from personal data that you may provide to us voluntarily. The anonymously collected data and information in the log files are evaluated statistically with the aim of increasing data protection and data security and ensuring an optimal level of protection for the personal data we process. This also applies to the REST endpoints used by our on-site “Secret Buddha Agent” (see Section XII), which are served by our website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests).
Storage duration: until the end of the session or when no longer necessary for the purpose.
Note: The collection and storage in log files are mandatory for the operation of our website; there is no possibility to object.
IV. Use of Cookies
When using our website, we additionally use cookies. Cookies are small text files stored on your device by your browser. Cookies help us to:
- Make our website easier to use and more effective,
- Recognize you on return visits (so you do not have to re-enter login data),
- Temporarily store items placed in your shopping cart,
- Provide access to protected areas of our website,
- Retain text you entered so it is not lost when the page refreshes.
We use session cookies (deleted after you close the browser or log out) and persistent cookies (stored until you delete them or they expire) to store preferences and recognize you on return visits.
We may also use third-party cookies (e.g., Google) so that third-party providers can provide services. Details are provided elsewhere in this policy.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests). You can configure your browser to accept or reject cookies (including third-party cookies). Some site functions may not work if cookies are disabled.
Note on the Secret Buddha Agent (Section XII): the Agent itself does not set additional tracking cookies. It relies on standard WordPress session/auth cookies when you are logged in. For short-term abuse prevention, we use transient counters keyed to a hashed version of your IP address (no cookie is set for this). These counters automatically expire after ~10 seconds or ~60 seconds, depending on the rate-limit window.
V. Registration on Our Website: DiaryX Community / Customer Account
1. Description and Scope of Data Processing
We offer you the opportunity to register to obtain a customer account for our online shop and simultaneously join our online community (“DiaryX Community,” currently powered by BuddyBoss). By registering, you create one unified account that grants access to both webshop functions and community features.
Mandatory data: salutation; first name; last name; address (street, postal code, city, country); email address; password. We also record your IP address as well as the date and time of registration. If you voluntarily provide additional data (e.g., telephone number), we store it as part of your profile.
2. Purpose of Processing
- Set up and administer your customer account (e.g., order history),
- Provide access to the DiaryX Community (e.g., posts, groups, connections),
- Identify and authenticate you for secure access to webshop and community.
3. Visibility of Your Data Within the Community
Currently, only logged-in members can view other member profiles, activity feeds, and related data. If we later activate RSS or REST APIs for certain areas (e.g., public feeds or user profiles), some content may be visible to non-logged-in visitors or external platforms. We will inform you in advance so you can adjust your data-sharing preferences.
4. Voluntary Nature & Future Adjustments
Registration is currently free. We may introduce paid services or features in the future. Any material change to cost or scope of processing will be communicated in due time; you may then continue or discontinue membership.
5. Legal Basis
- Consent (Art. 6(1)(a) GDPR) for registration/community processing;
- Contract performance (Art. 6(1)(b) GDPR) for webshop orders.
6. Retention and Your Rights
You can view, edit, or delete your profile information at any time (subject to legal retention obligations). You may withdraw consent at any time with future effect. Where data is required for contract performance or legal retention, we will restrict processing where possible.
7. Deletion of Account
You may request deletion of your unified DiaryX account (webshop + community) at any time. After deletion, access to features ceases. Statutory retention periods (e.g., for invoices) remain unaffected.
By registering, you acknowledge that community-related personal data (including any optional information) may be processed and displayed as outlined above and that visibility settings could change if RSS/REST features become necessary.
VI. Use of Our Online Shop (Ordering Function)
If you place an order in our shop, providing the personal data listed in Section V is necessary to conclude the contract. Without this data, you cannot use the ordering function. We process your data to handle your order, cancellations, warranty claims, and to answer inquiries.
Your personal data will be transmitted to third parties only if necessary for contract and payment processing. Third parties (e.g., shipping and payment providers) receive personal data only to the extent required to deliver your order and process payment.
PayPal: If you choose “PayPal,” your data is transmitted to PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Typical data: first/last name, address, email address, IP address, phone, mobile, and order-related data (items, invoice amount, taxes). PayPal may transmit your personal data to affiliated companies/service providers or subcontractors where necessary to fulfill contractual obligations or if data is processed on behalf of PayPal. PayPal may transmit your data to credit agencies for identity and credit checks. See PayPal privacy policy and annex for credit agencies: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
You may object at any time. The lawfulness of processing up to the time of objection remains unaffected.
Credit card via PAYONE: If you choose “credit card” (VISA, MasterCard), your data is transmitted to PAYONE (BS PAYONE GmbH, Lyoner Straße 9, 60528 Frankfurt/Main). You will be redirected to PAYONE’s secure website. Credit card data is processed only by PAYONE. Typical data: first/last name, address, email, IP address, and order-related data (items, invoice amount, taxes). You may object at any time; the lawfulness of prior processing remains unaffected. PAYONE privacy policy: https://www.bspayone.com/de/privacy
Legal basis: Art. 6(1)(b) GDPR (contract performance/pre-contractual measures).
Retention: We are obliged by commercial and tax regulations to store address, payment, and order data for up to ten years. After two years, processing is restricted to legal obligations.
VII. Contact Form / Communication via Email
You can contact us at any time via our contact form. When sending a message, your email address (mandatory) and the date/time are stored. Alternatively, you can contact us by email; only the data you send us will be stored.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests). We use the data exclusively to respond to your request. Data is deleted when storage is no longer necessary or restricted if legal retention periods apply. You can object at any time; however, correspondence cannot then be continued.
VIII. Use of Google Maps
We use Google Maps (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). This allows us to display interactive maps. By visiting the page, Google receives information that you accessed the corresponding subpage, plus the data mentioned in Section III. If you are logged in to your Google account, your data may be assigned to your profile. If you do not want assignment, log out before using the map. Google stores your data as usage profiles for advertising, market research, and/or needs-based website design (including for users not logged in). You can object to the creation of these profiles by contacting Google.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests). Further information is available in Google’s privacy policy: http://www.google.de/intl/de/policies/privacy.
Google may process personal data in the USA. Transfers are protected under applicable safeguards (e.g., the EU–U.S. Data Privacy Framework and/or standard contractual clauses, as applicable).
IX. Use of YouTube Videos
We embed YouTube videos (YouTube/Google LLC). Videos are embedded in extended data protection mode; no data is transmitted to YouTube unless you play a video. Only when you play the video will the data mentioned in Section III be transmitted to YouTube. If you are logged into Google, your data may be assigned to your account; log out to prevent this. YouTube uses cookies and stores data as usage profiles for advertising, market research, and/or needs-based design. Regardless of playback, a connection to the Google “DoubleClick” network may be established when the page loads.
You can object to the creation of these profiles by contacting YouTube directly.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests). Further information: http://www.google.de/intl/de/policies/privacy.
Google may process personal data in the USA. Transfers are protected under applicable safeguards (e.g., the EU–U.S. Data Privacy Framework and/or standard contractual clauses, as applicable).
X. Routine Deletion and Blocking of Your Personal Data
We process and store your personal data only for the period necessary to achieve the purpose or as required by EU or national law. If the storage purpose ceases to apply or a statutory storage period expires, personal data will be blocked or deleted in accordance with legal requirements unless you have consented to further use.
XI. Right to Object (Art. 21 GDPR)
If we process your personal data based on our legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time for reasons arising from your particular situation, with effect for the future and free of charge.
If we process your personal data for direct marketing purposes, you also have the right to object to processing for such advertising purposes at any time with effect for the future, free of charge; this also applies to profiling to the extent that it is related to such direct marketing.
Please address your objection to the responsible party named in Section I (e.g., by email).
XII. Processing by the “Secret Buddha Agent” Advisor Chat Agent (Link: Agent Information & Policy)
1. What the Agent Is
We provide an AI-powered “Secret Buddha Agent” that appears as a chat bubble and/or inline dialog. It offers general self-improvement guidance and planning support.
2. Data Categories Processed
Depending on how you use the Agent and your choices, we may process:
- Chat messages you type (to generate a reply).
- Summaries of prior conversations (short, privacy-preserving) — only if you consent.
- Key Facts you save (e.g., “goal: run daily”, “preference: morning routine”) — only if you consent.
- Active Plan items you add/edit — only if you consent.
- Consent state and timestamp (whether you enabled memory).
- Operational metadata: timestamps, UI surface (bubble/inline), limited error and rate-limit events without storing your full message content for those events.
3. Purpose of Processing
- Generate responses to your queries (stateless or personalized).
- Provide continuity (remembering summaries, facts, plan) only with your consent.
- Enable export and erasure upon request.
- Maintain stability and security (rate limiting, safety triage, Lite mode fallback).
4. Legal Bases (GDPR)
- Stateless use (no memory): Art. 6(1)(f) GDPR (legitimate interests) to provide the service you request in the chat.
- Memory features (summaries, facts, plan): Art. 6(1)(a) GDPR (your consent). You may withdraw consent at any time with future effect; the Agent will then operate statelessly.
5. Third-Party Processing & International Transfers
To generate replies, we may send your prompt and relevant context to our AI provider (currently OpenAI) acting as our processor. Processing may occur outside the EU. We implement appropriate safeguards (e.g., standard contractual clauses and/or participation in the EU–U.S. Data Privacy Framework, as applicable). We avoid sending directly identifying data (e.g., your account email). If the provider is unavailable, the Agent switches to a local Lite mode (no external AI call).
6. Retention
- Summaries: automatically purged after a configurable period (default: 180 days).
- Key Facts & Active Plan: retained until you erase them or request deletion.
- Consent state: retained to honor your preference and timestamp.
- Operational metadata (rate-limit counters): stored as short-lived transients keyed to a hashed IP that automatically expire after roughly 10 seconds or 60 seconds.
7. Your Controls
- Consent toggle: turn memory on/off at any time (Agent settings).
- Export: download your Agent data (JSON: summaries, facts, plan).
- Erase: erase all Agent data at any time.
- Commands:
/help,/plan add …,/forget …,/remember <type>: <value>,/export.
8. Safety Triage & Limitations
The Agent includes simple keyword-based triage (e.g., self-harm, violence, medical emergencies). In such cases it provides supportive, non-clinical guidance and suggests contacting appropriate services; it does not provide professional medical or emergency advice.
9. No Automated Decisions with Legal Effects
We do not use Agent data to make automated decisions that produce legal or similarly significant effects on you.
10. Disclaimer
The Agent provides general self-improvement guidance and is not a medical or mental-health professional service, and not legal or financial advice.
XIII. Changes to This Policy
We may update this Privacy Policy to reflect changes in our services (including the Agent), new features, or legal requirements. When material changes occur, we will notify you appropriately and publish the revised policy with its effective date.
XIV. Contact & Data Protection
If you have questions about this policy or your data (including Agent summaries, facts, and plan), or if you wish to exercise your rights, please contact the person named in Section I above.