Privacy Policy

Who is responsible for your data

The data controller for this service is:

• Dala Primelab AB (company registration number 5595934133, VAT SE559593413301)
• Gamla tunavägen 43i, Borlänge, Sweden
• support@looxmaxxing.me · +46732512559

What we collect

• Assessment answers you provide in the quiz.
• Your name and email address.
• Photos (selfies) you choose to upload for analysis.
• Daily journal entries, notes and progress photos if you use the member area.
• Order and billing data: amount, currency, billing address, country, and a payment token. We never store your full card number.
• Technical data: IP address, browser and device information, referring page, and pages viewed.
• Marketing identifiers from advertising and analytics pixels (Meta, Snapchat).

Why we use it and our legal basis

• To create your report and deliver the service you paid for — performance of a contract (Art. 6(1)(b) GDPR).
• To process payments, prevent fraud and keep accounting records — legal obligation and legitimate interest (Art. 6(1)(c) and (f)).
• To analyse photos with AI in order to produce your report — your consent (Art. 6(1)(a)); photos of a face used for analysis are only processed because you actively upload them for that purpose.
• To send service emails about your account, report and subscription — performance of a contract.
• To send marketing emails and measure advertising — consent and legitimate interest; you can opt out at any time.

Automated profiling

Your assessment answers and uploaded photos are used to automatically generate a personal improvement programme based on your weakest areas. This is profiling under Art. 4(4) GDPR, carried out on the basis of our legitimate interest in delivering the service you purchased. It has no legal or similarly significant effect on you: no decision about credit, employment, pricing or access is made this way.

You can object to this profiling at any time by emailing support@looxmaxxing.me, and you can ask for a human to review any result.

Children's data

The service is intended for adults, and a subscription requires you to be at least 18. If we learn that a minor has used the service without the consent of a parent or guardian, we close the account and delete all associated data, including photos, and confirm this to the guardian on request. Report such a case to support@looxmaxxing.me.

Who we share it with (sub-processors)

We never sell your data. We share only what is necessary with the processors that run parts of the service on our behalf. Each is bound by a data processing agreement:

• Rebilly Inc. (US) — subscription billing and payment orchestration. DPA: rebilly.com/legal/data-processing-addendum.
• Stripe Payments Europe Ltd (Ireland) — card acquiring and fraud screening. DPA: stripe.com/legal/dpa.
• Supabase Inc. — hosting, database and file storage; our project runs in the EU region (Frankfurt). DPA: supabase.com/legal/dpa.
• Resend (US) — delivery of login links, receipts, service and marketing emails. DPA: resend.com/legal/dpa.
• Meta Platforms Ireland Ltd — advertising measurement (only after you accept advertising cookies). Terms: facebook.com/legal/controller_addendum.
• Snap Group Ltd — advertising measurement (only after you accept advertising cookies). Terms: snap.com/terms/business-tools-terms.
• AI providers used to generate your analysis and report, acting on our instructions only.

Joint controllership

For the measurement of advertising events, we and Meta Platforms Ireland Ltd act as joint controllers for the collection and transmission of those events, under Meta's Controller Addendum. Meta's own further use of the data is governed by Meta's privacy policy.

International transfers

Our database and file storage are hosted inside the EU. Where a provider is located outside the EU/EEA — Rebilly and Resend (United States), and Stripe and Meta where they transfer data to US entities — transfers are covered by the European Commission's Standard Contractual Clauses, supplemented where applicable by the EU–US Data Privacy Framework for certified recipients.

How long we keep it

• Photos: kept while your account is active, and deleted within 30 days of a deletion request.
• Quiz answers and reports: kept while your account is active, then deleted within 12 months of the account becoming inactive.
• Billing and accounting records: kept for 7 years, as required by Swedish accounting law.
• Marketing contact data: kept until you unsubscribe or object.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten").
• Receive your data in a portable, machine-readable format.
• Restrict or object to certain processing, including direct marketing.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se) or your local supervisory authority.

Security

Photos and journal entries are stored in private, access-controlled storage. They are never shown publicly, never used for advertising and never sold.

Contact

To exercise any right, email support@looxmaxxing.me. We respond within 30 days.