FINNELA PRIVACY POLICY

FINNELA LIFE, S.L.U. (a single-member limited liability company under Spanish law), tax ID B93966844, registered office at Av. de la República Argentina 218, 08023 Barcelona, Spain, registered with the Mercantile Registry of Barcelona (sheet B-663682, folio 1, entry 1). For any question about your data, write to us at hello@finnela.com.

We process different data depending on how you use Finnela:

• ·Mailing list: if you subscribe, we process your email address to send you updates.
• ·The Friday letter: if you subscribe, we process your email address to send you a letter every Friday from Adriana, Finnela's founder, about ADHD in women. Because subscribing may indicate an interest in ADHD, which is health data, we process it with your explicit consent, which you give when you subscribe and confirm from the email we send you. We do not track whether you open the letter or which links you click, and we do not sort you by topic. If you reply to a letter, only Adriana reads your message, we use it only to answer you, and we delete it within 30 days at the latest.
• ·The Map and your Corner: if you complete the questionnaire ("the Map") and choose to save your result, we process your email and your answers. Those answers include data about your health (ADHD-related symptoms, mood and hormonal pattern). We use them to generate your result, save it to your Corner and personalize your experience.
• ·Cycle tracking: if you record the date of your last period —a health data point— we use it to show you the approximate window of your cycle. We keep only the latest date; each new one overwrites the previous, and you can edit or delete it anytime.
• ·Access to your Corner: we use your email to send you a sign-in link or a code, both single-use (no passwords), and a technical cookie to keep your session.
• ·Consent record: we keep a record of when and to what you consented (date, version of this policy and the text accepted) so we can demonstrate it.
• ·La Ruta (paid subscription): if you subscribe to La Ruta, your payment is handled by our payment provider, Stripe. Stripe collects the payment details you enter (such as your card details and billing information) directly; we do not receive or store your full card number. We receive from Stripe the information we need to manage your subscription — for example, that your payment succeeded, your subscription status, and a billing identifier — which we use to give you access to La Ruta and keep it active.
• ·The Founding 100: if you join the program, we process your email, your name if you give it to us, your country (and your state, if you live in the U.S.) and the record that you accepted its terms (the text, its version and the date), to give you free access to La Ruta for the period those terms set. To claim a spot we ask you to confirm that you are at least 18 years old; we only keep a record that you stated you are. If you claim a spot and still need to confirm it, we keep your request for up to 7 days; if you don't confirm it, we delete it.
• ·Founding 100 emails: we email you about the program: a welcome, the invitation to tell us in writing how it's going and, before your free access ends, how you can continue, with the option to unsubscribe in every email. We also send you these reminders: if you claimed your spot and haven't signed in yet, two at most (at 24 and 72 hours), each with a new code and a button to tell us you didn't request it, which deletes the request; if you haven't started using the coach yet, one on the third day; and if you haven't signed in for 7 days, an email from Adriana, once each time it happens. For this we only look at whether you have signed in or started and the date you last signed in, never at what you wrote, and these emails contain no information about your health. We do this based on our legitimate interest in helping you make use of your spot, and you can object at any time from the email itself or by writing to hello@finnela.com.
• ·Weekly use by founding members: to learn whether the program works, we count which weeks you use Finnela (only the dates, never the content).
• ·Your Founding 100 answers: if you answer its questions (the weekly question and the written form), which are voluntary, we keep your answers with your account only with your explicit consent, which we ask for separately in your Corner, because they may reveal health data. We use them to learn whether Finnela helps you and to improve it; we don't use them for advertising or share them with anyone for their own purposes. If we share results, it's only the total for all founding members, without your name.
• ·Invite a friend: if you share your invitation link, you send it yourself: we don't write to your friend, and we won't tell you whether she claimed her spot.
• ·Reminder before spots close: if you check the box asking us to email you before the founding member spots close, we process your email to send you two emails at most until October 31, 2026, with your explicit consent, because signing up may suggest an interest in ADHD, which is health information. We only send them to email addresses you have already used to sign in to Finnela, and on November 1, 2026 we delete this permission.
• ·2027 waiting list: if you sign up, we process your email and your language to let you know when La Ruta opens, with your explicit consent, which you confirm from the email we send you. We'll email you three times at most: to confirm your email, a reminder in late December, and the day it opens.
• ·Measuring our ads: if you reach us through one of our ads or links, the link may carry a short label naming only the platform and country of the campaign (for example, "ig-us"), or that you came through another user's invitation, without saying whose, never the topic of the ad or an identifier for you, and we do not store it in your browser. We count these labels in aggregate to learn which channels work and, if you subscribe, we record the label with your purchase at Stripe. We do not combine it with your Map, cycle or coach data, we do not use it to infer anything about you, and we do not share it with any advertising platform. You can object by writing to hello@finnela.com.
• ·Measuring the Map: we anonymously count how far people get through the Map, so we can see where it gets hard and improve it. We only add up the screen number, the language and, if you came from an ad, the label described above: never your answers or your name, with no cookies and no identifier for you. We do not attempt to re-identify anyone from these counts. If your browser sends the Global Privacy Control signal, we count nothing. You can object by writing to hello@finnela.com.
• ·Website speed: on our public pages, including the Map (never in your Corner), your browser sends us how long the page takes to load and respond. We store this together with the page, the type of device and connection, the country and the kind of browser (without its version), without your IP address, without your answers and without linking it to you or your account. We only use it to keep the website fast. You can object by writing to hello@finnela.com.

We don't sell or share your data with anyone for their marketing.

If you have access to La Ruta, through a subscription or a free program such as The Founding 100, you can talk to Finnela, our AI coach. The coach is an artificial intelligence: she is not a person and will never tell you she is. She does not diagnose, does not treat, and is not a substitute for your doctor or your therapist.

What happens to what you write to her. So that the coach can reply to you, what you write is sent to Anthropic, the company whose technology makes the coach work. Anthropic generates the response on our behalf, as our data processor, and does not use your conversations to train its models: its contract with us expressly prohibits it.

What we keep so Finnela can carry on with you.

Finnela keeps a summary memory with the information you have shared that is useful to give continuity to your accompaniment and make it yours. It may include, for example, your goal, your plan, your practices and progress, how you have been doing lately, and relevant aspects of your everyday context, such as your work, your routines or who you live with.

We do not keep a permanent transcript of everything you say. The memory aims to keep only the context that is useful so the coach does not start from scratch in every conversation.

• ·Your most recent messages, for a maximum of 24 hours, so that the coach does not lose the thread within the same day. After that they are deleted.
• ·A summary memory — your goal, your plan, your practices, your wins and how you have been doing lately — for as long as your account remains active (after 24 months of inactivity it is deleted along with the rest of your data, as explained in section 8). You can see it, change it and delete it whenever you want from your Corner, and you can turn the coach off entirely.

If you are a founding member and, when answering what usually happens when a step goes undone, you check the box to have the coach keep it in mind, we save what you chose in her memory: you'll see it there and can delete it anytime.

If your free access ends. If you had La Ruta through The Founding 100 and you don't continue, the coach is no longer available and we keep her memory, unused, until July 31, 2027, in case you come back; we delete it that day, without touching your Map or your Corner. We'll let you know beforehand, and you can delete it yourself anytime.

What the provider keeps, and for how long. We want you to know this precisely, because it is not up to us:

• ·As a general rule, Anthropic automatically deletes inputs and outputs within 30 days.
• ·If its automated safety systems flag content as a possible breach of its usage policy, it may keep that content for up to two years, and keep the scores those systems generate for up to seven years. This happens regardless of what we delete, and we cannot prevent it.

This means that, if you ask us to delete your data, we will immediately delete everything that is in our hands — except the little the law requires us to keep, such as billing information — but we cannot guarantee the immediate deletion of content that has been flagged by the provider's safety systems. We would rather tell you now than later.

Legal basis. We process this data with your explicit consent (Art. 9(2)(a) GDPR), which we ask for in a dedicated checkbox before your first conversation with the coach, covering both the summary memory and sending your messages to its artificial intelligence provider. You can withdraw it at any time from Settings.

International transfer. Anthropic is in the United States. The transfer relies on the European Commission's Standard Contractual Clauses, incorporated into its Data Processing Agreement.

Security. The coach has a safety layer reviewed by health professionals: when it recognizes a situation beyond what Finnela can accompany, it shows you professional resources and steps aside. That layer does not assess your risk, does not grade it, and does not diagnose.

Some of the above is data concerning your health, which the GDPR protects with heightened safeguards (special categories, Art. 9). We only process it with your explicit consent, which we request separately and clearly before you save your Map or record your cycle and, for the Friday letter, when you subscribe. You can withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

We process your data on the basis of your consent (Art. 6(1)(a)) and, for health data, your explicit consent (Art. 9(2)(a)). Access to your Corner also relies on providing the service you request (Art. 6(1)(b)). We keep the consent record to meet our legal obligations (Art. 6(1)(c)). The measurement of our ads, of the Map and of website speed described in section 2 relies on our legitimate interest in knowing which advertising works and in improving the website, without using cookies or tracking pixels (Art. 6(1)(f)); you can object at any time. The Friday letter and Finnela's news emails rely on your consent (Art. 6(1)(a) GDPR and Art. 21(1) of the Spanish LSSI), and we send them without cookies or tracking pixels. Your Founding 100 spot and its emails rely on providing the program you request (Art. 6(1)(b)); its reminders, on our legitimate interest in helping you make use of your spot (Art. 6(1)(f)), and you can object at any time; and your answers to its questions, the reminder before spots close and the 2027 waiting list, on your explicit consent (Art. 9(2)(a)).

To provide the service we work with providers that process data on our behalf:

• ·Supabase — database and sign-in system (United States).
• ·Vercel — website and app hosting (United States).
• ·Resend — email infrastructure (United States). We use it to send sign-in links and other operational communications related to Finnela.
• ·MailerLite — sending the newsletter, the Friday letter, the Founding 100 reminder before spots close and the 2027 waiting list, only if you sign up. It does not track opens or clicks.
• ·Hostinger — our mailbox, where we receive what you write to us (including your replies to the letter).
• ·Stripe — payment processing for La Ruta subscriptions (United States). Stripe acts as merchant of record for your purchase: it processes your payment and billing data to take the payment, collect applicable taxes, and issue your receipt, and it uses that data as an independent controller for its own legal and tax obligations.
• ·Anthropic — generating the responses of Finnela, our AI coach (United States). Involved only if you have access to La Ruta and use the coach. See section 3.

When your data leaves the European Economic Area, the transfer relies on the following safeguards:

• ·Vercel and Resend are certified under the EU-US Data Privacy Framework (DPF).
• ·Supabase and MailerLite rely on the European Commission's Standard Contractual Clauses (SCCs), incorporated into their Data Processing Agreements (Supabase adds the UK Addendum).
• ·Stripe is certified under the EU-US Data Privacy Framework (DPF), and additionally relies on the European Commission’s Standard Contractual Clauses (SCCs) and the UK Addendum incorporated into its Data Processing Agreement.
• ·Anthropic relies on the European Commission's Standard Contractual Clauses (SCCs), incorporated into its Data Processing Agreement.

You can ask us for more information at hello@finnela.com.

• ·Your mailing-list email: until you unsubscribe or withdraw consent.
• ·Your replies to the letter: we delete them after answering you and within 30 days at the latest.
• ·Your Map and Corner: while your account is active. After 24 months of inactivity we will notify you and delete your data.
• ·Your cycle: only the latest date; it is overwritten and you can delete it.
• ·The consent record: while your account exists and as long as needed to demonstrate it.
• ·Your subscription and billing information: for as long as your subscription is active and afterwards for as long as we must keep it to meet legal, accounting, and tax obligations — typically 4 to 6 years, as required by Spanish tax and commercial law.
• ·Your unconfirmed Founding 100 spot request: 7 days at most; then we delete it.
• ·Your answers to The Founding 100 questions: until July 31, 2027; then we delete them and only counts with no data about you remain. Sooner if you withdraw your permission or delete your account.
• ·The coach's memory of a founding member who doesn't continue: unused, until July 31, 2027; we delete it that day.
• ·Your permission for the reminder before spots close: we delete it on November 1, 2026.
• ·Your email on the 2027 waiting list: until one month after La Ruta opens (if it opens in January, January 31, 2027), or sooner, if you unsubscribe.

You can exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to hello@finnela.com; we will respond within 30 days. You can also unsubscribe from the newsletter using the link in every email. Inside your Corner you can rectify and delete your cycle data yourself. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

We apply measures to protect your data: access restricted to our servers, encryption in transit (HTTPS), passwordless access via single-use links or codes, isolated email, and minimization of what we store (for example, your cycle is shown in windows, never as a specific day, and we keep no history).

We use only technical cookies needed to keep your session, and local storage in your browser to remember which step of your Map you were on. We do not use advertising or tracking cookies, so we do not show a cookie consent banner.

Finnela is not directed at minors. To use your Corner you must confirm that you are at least 18 years old. If we detect an account belonging to a minor, we will delete it. To claim a Founding 100 spot we ask you to confirm that you are at least 18 years old; we only keep a record that you stated you are. The Friday letter is not directed at minors either: if we learn that a minor receives it, we will unsubscribe them and delete their email.

We may update this policy; the current version and its date appear at the top. We will post the updated version here with its date; if the change is significant, we will notify you by email.

This section applies if you are a resident of the United States. It supplements the information above and describes rights that may be available to you under U.S. state privacy laws, including the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), and the comprehensive privacy laws of Colorado, Connecticut, and other states. The rights available to you depend on the law of your state.

Categories of information we collect. As described in section 2, we collect identifiers (such as your email address) and data about your health (your answers to the Map — ADHD-related symptoms, mood and hormonal pattern —; if you record it, the date of your last period; and, if you use the coach, what you write to her and the summary memory she keeps). If you join The Founding 100, we also collect your country and state, the record that you accepted its terms, whether you have signed in or started using the coach, the date you last signed in and which weeks you use Finnela, and, with your permission, your answers to its questions. We collect this information directly from you, and we use it only for the purposes described in this policy: to generate and save your Map, show you your cycle window, keep you signed in, provide and personalize the coach if you use it, give you your Founding 100 spot and send you its emails and reminders, and, if you subscribe, send you our newsletter.

Sensitive personal information. Under the CPRA and similar laws, data about your health is "sensitive personal information." We use your sensitive personal information only to provide the service you ask us for. We do not use it to infer characteristics about you, to build advertising profiles, or to make automated decisions that produce legal or similarly significant effects about you. You may ask us to limit the use of your sensitive personal information; because we already use it solely to provide the service, this limitation has little practical effect on how we treat your data.

We do not sell or share your information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws. Because we do not engage in these practices, we do not offer a "Do Not Sell or Share My Personal Information" option — there is nothing to opt out of.

Your rights. Depending on your state, you may have the right to know what personal information we hold about you and access it, to correct it, to delete it, and to obtain a portable copy. You may exercise these rights by writing to hello@finnela.com; we will respond within the time your state law requires. Before we act on your request, we may need to verify your identity. We will not discriminate against you for exercising your rights. If your state provides an appeals process and we decline your request, we will tell you how to appeal.

HIPAA does not apply. Based on our current activities, HIPAA does not apply to Finnela. We are not a healthcare provider, a health plan, or a healthcare clearinghouse, and we do not act as a "business associate" of any such entity, so the U.S. Health Insurance Portability and Accountability Act (HIPAA) does not apply to the data we process. The protections for your health data come from the explicit consent and the safeguards described in this policy.

This section is our Consumer Health Data Privacy Policy for the purposes of laws such as Washington's My Health My Data Act (MHMDA), Nevada's Consumer Health Data Privacy Law (SB 370), and the consumer health data provisions of Connecticut's privacy law. It applies to "consumer health data" — information that identifies your past, present, or future physical or mental health status. For Finnela, consumer health data includes the health data in your Map (ADHD-related symptoms and mood), your menstrual-cycle information (the date of your last period and the cycle window we derive from it), and, if you have access to La Ruta and choose to use Finnela, our AI coach, what you write in your conversations with the coach and the summary memory we keep for you; and, if you subscribe to the Friday letter, your subscription and anything you write to us when you reply to it. If you join The Founding 100, it also includes the fact that you claimed a spot, whether you have signed in or started using the coach, the date you last signed in, which weeks you use Finnela and, with your permission, your answers to the program's questions; and, if you sign up, your sign-up for the reminder before spots close or for the 2027 waiting list.

What we collect and how. We collect consumer health data directly from you: when you complete and save your Map, when you record the date of your last period, and, if you have access to La Ruta and use the coach, when you write to her; if you subscribe to the Friday letter, when you subscribe or reply to us; and, if you join The Founding 100, when you claim your spot, use Finnela, or answer its questions. We do not collect it from other sources, and we do not use tracking technologies to infer it. The ad label described in section 2 is not combined with your consumer health data.

Why we use it. We use your consumer health data only to provide the service you request: to generate and save your Map result, to show you the approximate window of your cycle, to personalize your experience within your Corner and, if you activate the coach, to personalize your accompaniment, including your weekly note. The email we use to deliver it does not include information that reveals your health status. If you join The Founding 100, we also use it to give you your spot, send you the program's reminders, and learn whether the program works. We do not use it for advertising.

Consent. We collect, use, and share your consumer health data only with your separate, explicit consent, which you give before you save your Map, before you record your cycle, and, if you use the coach, before your first conversation with her; for the Friday letter, when you subscribe; and, in The Founding 100, before we keep your answers and when you sign up for the reminder before spots close or for the 2027 waiting list. What we need to provide the spot you requested, such as the program's reminders, we use only for that. You may withdraw your consent at any time by writing to hello@finnela.com, and you can delete your cycle data yourself from within your Corner.

We do not sell your consumer health data. We do not sell your consumer health data, and we will not do so.

Who we share it with. We share your consumer health data only with the service providers listed in section 6, who process it on our behalf under contract and only to help us provide the service. We do not share it with third parties for their own purposes.

The coach and our AI provider. If you use the coach, what you write is sent to Anthropic, our service provider, which generates the reply on our behalf under contract and is contractually prohibited from training its models on it. We ask for your separate, explicit consent for this before your first conversation. We keep your most recent messages for at most 24 hours and your summary memory for as long as your account remains active (see Retention and deletion below); you can withdraw your consent and delete that memory yourself from Settings, and turn the coach off entirely. Anthropic deletes inputs and outputs within 30 days; if its automated safety systems flag content, it may retain it for up to two years and the resulting classification scores for up to seven years, which is outside our control.

Retention and deletion. We keep your consumer health data only while your account is active. Your letter subscription, until you unsubscribe; your replies, 30 days at most. In The Founding 100, your answers are kept until July 31, 2027, and the coach's memory of a member who doesn't continue, unused, until that same date; your permission for the reminder before spots close, until November 1, 2026; and your sign-up for the 2027 waiting list, until one month after La Ruta opens. You can delete your cycle data yourself at any time from your Corner, and you can ask us to delete the rest by writing to hello@finnela.com. After 24 months of inactivity, we notify you and then delete your data. Whenever we delete your consumer health data, we instruct our service providers to do the same.

Your rights. You have the right to withdraw your consent, to access the consumer health data we hold about you, and to have it deleted. To exercise these rights, write to hello@finnela.com; we may need to verify your identity first.