Privacy Notice

This page is maintained by Stepsup LLC ("we", "us", "our", or the "Controller"), the operator of the Alafiani Collective website and services ("Alafiani", the "Service"). It describes how we collect, use, share, and protect personal data about our users.

1. Personal data we collect

We may collect the following categories of personal data:

• Identity and contact data: name, email address, phone number, and any other information you provide when creating an account or contacting us.
• Account and authentication data: login credentials, user IDs, and session information used to secure your account.
• Profile and wellness data: journal entries, Circle posts, preferences, and any information you choose to share through the Service.
• Usage and telemetry data: pages visited, features used, device type, operating system, browser, IP address, and timestamps.
• Support data: messages, feedback, and other communications you send to us.

2. How we use your personal data

We use personal data for the following purposes and legal bases:

• To provide the Service — account creation, authentication, and access to Journal, Circles, and Ayo (legal basis: contract performance).
• To maintain and improve the Service — debugging, analytics, feature development, and user experience research (legal basis: legitimate interests, or consent where required).
• To ensure security and prevent fraud — monitoring for abuse, unauthorized access, and suspicious activity (legal basis: legitimate interests and legal obligation).
• To provide customer support — responding to your questions and resolving issues (legal basis: contract performance and legitimate interests).
• To send service communications — account notifications, billing reminders, security alerts, and policy updates (legal basis: contract performance and legitimate interests).
• To send marketing communications — only where you have opted in, and you can unsubscribe at any time (legal basis: consent).

3. Who we share personal data with

We share personal data only as needed to operate the Service:

• Service providers and subprocessors: Lovable Cloud (hosting, database, authentication, and edge-function infrastructure), email delivery providers, analytics providers, and customer support tools.
• Professional advisers: lawyers, accountants, and auditors where necessary to protect our rights or comply with legal obligations.
• Authorities: law enforcement, regulators, or courts when required by law or to protect our rights, users, or the public.

4. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, maintain your session, and remember your preferences. If we use analytics or marketing cookies, we will describe them in our cookie preference settings and obtain any consent required by law. You can manage cookie preferences through your browser settings.

5. Data retention

We keep personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it. If you delete your account, we will remove or anonymize your personal data within a reasonable time, except where we must retain it for legal or security reasons.

6. Your rights

Depending on your location, you may have rights regarding your personal data, including:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data.
• Request restriction of processing or object to processing.
• Request a copy of your data in a portable format.
• Withdraw consent where processing is based on consent.
• Complain to a supervisory authority if you believe your rights have been violated.

We will respond to privacy requests within the timeframes required by applicable law. To exercise your rights, contact us through the Service or by email at the address shown on our contact page.

7. International transfers

Personal data may be transferred to, stored in, or processed from countries outside of your country of residence, including the United States, where our service providers and infrastructure operate. When required by law, we use appropriate safeguards such as standard contractual clauses or adequacy decisions to protect your data.

8. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, and regular review of our security practices. No online service is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

The Service is not intended for children under 13, and we do not knowingly collect personal data from children under 13. If you believe we have collected data from a child under 13, please contact us and we will delete it.

10. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. If we make material changes, we will post the updated version in the Service and update the "Last updated" date. Your continued use of the Service after changes become effective means you accept the revised Privacy Notice.

11. Contact us

If you have questions or concerns about this Privacy Notice or our data practices, please contact us through the Service or by email at the address shown on our contact page.

12. Platform and shared responsibility

The Service is built on and hosted by Lovable Cloud, which provides underlying infrastructure such as database, authentication, and edge-function capabilities. Stepsup LLC is responsible for the app-level content, access controls, and data practices described in this notice. Lovable platform capabilities are described factually based on the features we have enabled, and are not a certification, audit, or guarantee of compliance.