Privacy Policy

Origin Collective Limited (company number 16566341, ICO registration number ZC240259, registered office 124-128 City Road, London EC1V 2NX, United Kingdom) ("we," "us," "our") operates LifeNavia. This policy explains what personal data we collect, why, and how we protect it, in line with the UK GDPR and Data Protection Act 2018.

1. What data we collect

Account data: name, email address, password (encrypted — we never store your password in plain text), and profile photo if you add one.

Content you create: habits, budget entries, goals, reading progress, workout logs, and travel plans you enter into the Service. This may include sensitive-adjacent information such as financial figures you choose to log — we treat this data with the same care as account data and never sell it.

Usage data: basic technical data such as IP address, browser type, and pages visited, used to keep the Service secure and to understand how features are used.

Payment data: if you subscribe to Pro, our payment processor collects your payment details directly. We do not store your full card number.

2. How we use your data

We use your data to:

• Provide and operate the Service (e.g. saving your habits and displaying your dashboard);
• Process Pro subscription payments;
• Send you service-related emails (e.g. password resets, billing receipts, and — if you're on Pro — your weekly digest email);
• Improve and maintain the Service;
• Respond to support requests;
• Comply with legal obligations.

We do not sell your personal data to third parties, and we do not share your habit, budget, goal, or personal tracking data with advertisers.

3. Legal basis for processing (UK GDPR)

We process your data on the following bases:

• Contract — to provide the Service you've signed up for;
• Legitimate interests — to maintain and improve the Service, and to keep it secure;
• Consent — where you've opted in to optional communications (e.g. marketing emails, if offered);
• Legal obligation — where we're required to retain or disclose data by law.

4. Data storage and security

Your data is stored using Supabase, our database provider, with industry-standard security practices including encryption in transit (HTTPS/TLS).

We take reasonable technical and organizational measures to protect your data, but no system is 100% secure, and we cannot guarantee absolute security.

5. Data retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we're required to retain it for legal or accounting purposes (e.g. billing records for Pro subscribers).

6. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion of your data;
• Export your data in a portable format (you can do this anytime via the "Export" feature in your account);
• Object to or restrict certain processing;
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at privacy@origincollective.group. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled.

7. Third-party service providers

We use trusted third-party providers to operate the Service, including:

• Supabase — database and authentication hosting
• Stripe — subscription billing and payment processing
• Lovable — application hosting and transactional email delivery

These providers process data on our behalf under their own security and privacy commitments, and only for the purposes described in this policy.

8. Guest / demo accounts

The "Try as Guest — Live Demo" feature signs you into a single, shared demonstration account that is used by every visitor. Do not enter real personal, financial, or sensitive information into the demo.

• Shared in real time. Multiple visitors can be signed into the same demo account at the same time. Anything you add, edit, or delete can be seen and changed by another visitor using the demo simultaneously.
• Persistent until the next reset. Demo data is not automatically deleted when you close the page or end your session. It stays in the shared account until the next visitor starts a new demo, at which point the demo is reset to its original sample data.
• Not private. Data entered during a demo may be visible to later visitors until the next reset. Treat anything you type into the demo as public to other demo users.

9. Cookies

We use essential cookies to keep you logged in and to remember your preferences. We do not use third-party advertising or tracking cookies.

10. International data transfers

Our service providers may process data outside the UK/EEA. Where this happens, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) as required by UK GDPR.

11. Children's privacy

LifeNavia is not intended for use by anyone under 16. We do not knowingly collect data from children under 16.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or an in-app notice before the changes take effect.

13. Contact us