Privacy Policy
Version 1.0 — 12 April 2026
VeilHex Ltd · cognae.org
VeilHex Ltd operates cognae.org ("COGNÂE", "we", "us"). This policy explains what data we collect, why, and what you can do about it. Plain English. No theatre.
1. Who we are
Data controller: VeilHex Ltd Address: 61 Bridge Street, Kington HR5 3DJ Contact: bgpcipher@proton.me
2. What we collect and why
We do not sell your data, share it with advertisers, or use it for anything beyond running COGNÂE.
| Data | Why | Lawful basis |
|---|---|---|
| Email address | To create your account and send updates you asked for | Contract / Consent |
| Journal entries | To save your Gap log and reflections | Contract |
| Breath session data | To track your practice | Contract |
| Protocol completions | To show your progress | Contract |
| Subscription status | To know what you have access to | Contract |
| Payment data | Processed by Stripe — we never see your card details | Contract |
| Merch order details | To fulfil your order via Printful | Contract |
| IP address / device type | Security and fraud prevention | Legitimate interest |
3. Your journal entries
Your journal entries are private. They are stored in our database (Supabase) and are only accessible to you. We do not read them. We do not analyse them. They are yours.
4. Who we share data with
We share only what each processor needs to do their job. Nothing more. All processors are GDPR-compliant.
| Processor | Purpose |
|---|---|
| Supabase | Database and authentication |
| Stripe | Payment processing |
| Vercel | Hosting and delivery |
| Printful | Print on demand fulfilment |
5. How long we keep your data
| Data | Kept until |
|---|---|
| Account and practice data | Until you delete your account |
| Journal entries | Until you delete them or your account |
| Payment records | 7 years (legal requirement) |
| Server logs | 30 days |
6. Your rights
To exercise any of these: bgpcipher@proton.me
If you are not satisfied with our response, you have the right to complain to the ICO (ico.org.uk).
- —Access — request a copy of all data we hold about you
- —Correction — ask us to fix anything inaccurate
- —Deletion — delete your account and all data from account settings, or contact us
- —Export — download your journal entries and practice data
- —Restriction — ask us to stop processing your data in certain ways
- —Objection — object to processing based on legitimate interest
7. Cookies
We use only essential cookies required to keep you logged in. No tracking cookies. No advertising cookies. See our Cookie Policy for details.
8. Changes to this policy
We will notify you of material changes by email. The date at the top of this page shows when it was last updated.