Privacy Policy

habito is built on a simple rule: your data is yours. This policy explains what we collect, why, where it lives and what you can do about it.

1. Who is responsible

The data controller is Mariano Morera Sánchez, trading as Atomic Products, a sole trader in Spain.

• NIF: 77816986M
• Address: Calle Maiquez 38, 3C, 28009 Madrid, Spain
• Email: hola@atomic-products.com (for anything about privacy)

2. What we collect

• Account: your email address and sign-in details.
• What you log: habits, completions, schedules, areas, and the optional extras you choose to add: notes, part of day, measurements and daily mood check-ins.
• Reflections: the weekly reflections written for you, if you use them.
• Subscription: your plan, its status and renewal date, and Stripe's customer reference. We never receive your full card number.
• Technical: basic logs needed to run and secure the service (for example, sign-in events and errors).

We don't collect your location or contacts, and we don't buy data about you.

3. Why we use it (and the legal basis)

• To provide habito: storing your logs and showing you your progress. Basis: performance of our contract with you.
• To write your reflections: processing your week's data to produce the reflection. Basis: contract.
• Mood check-ins: mood can say something about how you feel, so we only process it because you choose to log it. Basis: your explicit consent, which you can withdraw anytime by turning the mood section off and deleting your mood history.
• Payments and invoicing: Basis: contract and our legal tax obligations.
• Security and abuse prevention: Basis: our legitimate interest in keeping the service safe.

We don't sell your data, use it for advertising, or send re-engagement or marketing messages. Emails are only about your account (for example, sign-in links and billing).

4. How the AI reflection works

• Reflections are written server-side, once a week, after the week closes. Nothing runs on your device, and you never chat with it.
• What is sent to the AI model: numbers computed from your week (for example, how many scheduled days you completed and each habit's current band), your habit names, and short excerpts from that week's notes. Your email, name and account ID are never sent.
• The request goes through the Lovable AI Gateway to Google's Gemini model. We don't allow it to be used to train models where we can control that, and we don't keep the request beyond what's needed to write your reflection.
• The AI describes; it doesn't decide. Your bands, rates and progress are always calculated by habito's own rules, not by the AI.

5. Where your data is stored and who processes it

Your account and logs are stored in the European Union (Lovable Cloud, Europe region). We use a few providers, each bound by a data processing agreement:

• Lovable: hosting, database and authentication.
• Stripe Payments Europe, Ltd. (Ireland): payments. Stripe is also an independent controller for some payment data; see stripe.com/privacy.
• Lovable AI Gateway / Google: writing weekly reflections, as described above.

Where a provider processes data outside the EU, the transfer is protected by the European Commission's Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

• Your account and logs: for as long as you have an account. When you delete your account, we delete your data within 30 days.
• Billing records: as long as Spanish tax and accounting law requires (generally up to six years).
• Technical logs: kept for a short period, then deleted.

7. Your rights

You can access, correct, export or delete your data, object to or restrict some processing, and withdraw consent at any time.

• Export: Settings → Data, any time, free or Premium.
• Delete: delete your account in the app or email us.
• For anything else, email hola@atomic-products.com. We reply within one month.

If you think we've handled your data wrongly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es). We'd appreciate the chance to fix it first.

8. Security

Data is encrypted in transit, access is restricted by row-level security so each account can only read its own rows, and payment details are handled by Stripe.

9. Children

habito is not meant for children under 16, and we don't knowingly collect their data.

10. Cookies and local storage

habito uses only what is strictly necessary to work:

• Sign-in session: keeps you signed in (stored in your browser's local storage).
• Preferences: your theme (light, warm or dark).
• Checkout: when you subscribe, Stripe sets cookies on its checkout to process the payment and prevent fraud.

We use no advertising, tracking or profiling cookies. Because everything above is strictly necessary, we don't show a consent banner. If we ever add anything that isn't strictly necessary, we'll ask for your consent first and update this section.

11. Changes

If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect.

12. Contact

hola@atomic-products.com