Privacy Notice

This Privacy Notice explains how Areteos LLC, a limited liability company organized under the laws of the State of Minnesota, United States ("we", "us"), collects, uses, shares, and protects personal data when you use ShiftStep. Areteos LLC is the data controller for the personal data described here. You can reach us at hello@areteos.io.

1. Personal data we collect

• Account data: your email address, hashed password, account status, and confirmation records.
• Profile and planning data: the lifestyle context you choose to share (free hours per day, environments, energy profile), your goal, generated milestones, daily tasks, completion history, and start-date and reminder preferences.
• Guest preview data: the goal text you enter in the no-account preview, the daily quotas we enforce against abuse, and an email address if you choose to save a preview.
• Notification data: your push and email reminder settings, device push tokens, and unsubscribe or snooze choices.
• Usage and device data: pages and features you use, timestamps, IP address, browser and device identifiers, and approximate network information used for abuse prevention.
• Support data: messages you send us, including emails about your account or billing.
• Payment data: payments are processed by Paddle.com as Merchant of Record; Paddle collects and processes checkout and billing information under its own privacy policy. We receive limited subscription records (plan, status, billing period) needed to provide Premium access.

2. How we use personal data

• To provide the service (contract performance): creating your account, generating and recalibrating your plan, tracking tasks, delivering reminders you asked for, and providing Premium access tied to your subscription.
• To keep the service safe (legitimate interests): abuse and fraud prevention, quota enforcement on free previews, security monitoring, and enforcing our Terms.
• To support you (contract performance or legitimate interests): answering emails about your account, plans, or billing.
• To improve ShiftStep (legitimate interests): understanding which features help people follow through, and fixing problems.
• To send optional communications (consent): reminder emails and push notifications you opt into, which you can stop at any time from settings or the unsubscribe link.

3. How we share data

• Service providers: companies that host our application and database, deliver email, process AI requests used to generate plans, and support app analytics — each processing data only on our instructions.
• Paddle.com (Merchant of Record): for the sale of subscriptions, subscription management, payments, tax compliance, and invoicing. Paddle acts as a controller for the checkout and billing data it collects.
• Professional advisers: legal, accounting, and audit professionals, under confidentiality obligations.
• Authorities: where required by law, legal process, or to protect rights, safety, and security.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice as required by law.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

4. Data retention

We keep account and planning data while your account is active. When you delete your account, we erase your goals, tasks, plans, notification preferences, and profile — normally within 30 days of the deletion request, allowing a short recovery window for mistakes. Guest preview data is kept for a short period (up to 7 days) and then deleted. Billing and transaction records are retained by Paddle for as long as required for tax and accounting purposes. We delete or anonymize data when it is no longer needed for the purposes above.

5. Your rights and choices

Depending on where you live, you have rights over your personal data, which may include: access to a copy, correction, deletion, portability, restriction or objection to certain processing, withdrawal of consent, and the right not to receive targeted advertising. To exercise a right, email hello@areteos.io or use the account settings in ShiftStep. You can stop reminder emails with the unsubscribe link in any email or from notification preferences, and you can turn off push notifications in your browser or device settings. If you have a concern you cannot resolve with us, you may also have the right to complain to your local consumer protection or data protection authority. We respond to rights requests within the timeframe required by applicable law (no more than one month for rights under the GDPR, where applicable).

6. Security

We use appropriate technical and organizational measures to protect personal data, including encryption of data in transit, access controls, and scoped database permissions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Cookies and local storage

ShiftStep uses only essential browser storage: an authentication session so you stay signed in, your notification and display preferences, and security-related storage such as the signed identifier used to enforce free-preview limits. We do not use third-party advertising or cross-site tracking cookies.

8. International data transfers

Our infrastructure and service providers may process data in the United States and other countries. Where data is transferred internationally, we rely on the safeguards required by applicable law, such as standard contractual clauses or an adequacy decision.

9. Children

ShiftStep is not directed at children under 13 (or under 16 where a higher age applies), and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this notice

We may update this Privacy Notice as the service evolves. When changes are material, we will notify you by email or in the service before they take effect.