Privacy policy

Draft — to be reviewed by a lawyer before launch.

This policy explains how we handle your personal data when you use bioritam.eu, the Rhythm Map, the newsletter, the guide “Fasting by the body clock” and the BioRitam 21 program. We apply the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection (ZZPL).

Who the controller is

The controller of your data is:

• Cortex LLC
• 75 E 3rd St, Sheridan, WY 82801, United States
• Privacy contact: kontakt@bioritam.eu

The controller is registered in the United States. Because we offer services to people in the EU and Serbia, the GDPR and the ZZPL apply to us.

What data we process and why

Visiting the site

• Data: IP address, device and browser type, pages visited, time of visit.
• Purpose: delivering the site, security and abuse prevention (Cloudflare, Turnstile), aggregate visit statistics without cookies (Cloudflare Web Analytics).
• Legal basis: legitimate interest in running a secure site (Art. 6(1)(f) GDPR, Art. 12(1)(6) ZZPL).

Rhythm Map (quiz)

• Data: your answers (wake and sleep times, chronotype, type of work, when you get hungry, coffee, training, goal) and the result, your 24-hour map.
• Purpose: to calculate and show your map. If you create an account, the map is linked to it.
• Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR, Art. 12(1)(2) ZZPL).
• The optional question about your cycle or perimenopause is health data. We process it only with your explicit consent (Art. 9(2)(a) GDPR, Art. 17 ZZPL). You can skip it and still get your map.

The map is built from fixed, documented rules. This is automated processing, but it has no legal or similarly significant effect on you: you get suggestions, not a decision.

Newsletter and the PDF map

• Data: email address, language, time, page and IP address of signup and confirmation (double opt-in), opens and clicks. If you sign up through the Rhythm Map, also the map code (wake and sleep times), your goal and your chronotype, so the tips in our emails fit you.
• Purpose: sending the PDF map, a series of emails about rhythm, eating and sleep, and occasional product news.
• Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 12(1)(1) ZZPL). Every email has a one-click unsubscribe link.

Account and login

• Data: email address, language, time zone, wake time, notification settings; if you sign in with Google or Apple, the name and email that service passes to us.
• Purpose: login with a one-time code, access to what you bought, showing lessons at the right time.
• Legal basis: contract (Art. 6(1)(b) GDPR, Art. 12(1)(2) ZZPL).

Purchases

• Data we receive from Stripe: name, email, country, product, amount, currency, payment status and any refunds. We never see or store card details.
• Purpose: giving you access, sending confirmation and handling complaints.
• Legal basis: contract; for sales to customers in Bosnia and Herzegovina, Montenegro and North Macedonia, also a legal obligation (Art. 6(1)(c) GDPR, Art. 12(1)(3) ZZPL).

BioRitam 21 check-ins (health data)

• Data: energy (1–5), sleep quality (1–5), hours slept, time of first and last meal.
• Purpose: letting you track your own progress and see a weekly chart.
• Legal basis: your separate, explicit consent (Art. 9(2)(a) GDPR, Art. 17(2)(1) ZZPL), which we ask for before your first entry and apart from any other consent. The consent box is never pre-ticked.

We do not use this data for marketing, we do not send it to Meta, Microsoft Clarity or our email system, and we do not sell it. You can withdraw consent in your account at any time, and we then delete all check-in entries.

Participant questions and contact

• Data: your question or message and your email address.
• Purpose: answering you. Program questions are answered in a weekly recorded lesson that all participants see, without your name or anything that could identify you.
• Legal basis: contract (program questions) or legitimate interest in replying (contact).

Analytics and advertising (only with consent)

• Microsoft Clarity: how the site is used (clicks, scrolling, session recordings with inputs masked).
• Meta Pixel and Conversions API: measuring Facebook and Instagram ads and showing ads to people who visited the site. The Conversions API sends purchase data from our server to Meta (for example a hashed email, amount and product), and only if you consented.
• Legal basis: your consent through our cookie banner (Art. 6(1)(a) GDPR, Art. 12(1)(1) ZZPL). Without consent these tools do not load.

We do not load Clarity or the Meta Pixel on account, lesson or check-in pages. Details are in the Cookie policy.

Payments: Stripe and Link

You pay on Stripe’s checkout page. For customers in the EU, Serbia, the UK, Switzerland and Norway the merchant of record is Link, a Stripe brand, and the purchase is shown as “Sold through Link”. Stripe and Link process payment data as independent controllers under their own privacy policies: link.com/privacy and stripe.com/privacy. Payments in Europe are processed by Stripe Technology Europe, Limited (Ireland) or another Stripe entity.

If you ask Link to delete your data, Stripe deletes it from all Link transactions, cancels any subscriptions and notifies us.

Who we share data with (processors)

For the Meta Pixel, following EU Court of Justice case law, we are a joint controller with Meta for collecting and transmitting data from our site. Meta handles any further processing as an independent controller under its own privacy policy.

Google and Apple receive data only if you choose to sign in with their account. They act as independent controllers.

We do not sell data. We give it to public authorities only when the law requires it.

Transfers outside the EU and Serbia

Some providers are in the US. Transfers rely on the European Commission’s decision on the EU-US Data Privacy Framework for certified companies, or on Standard Contractual Clauses. For transfers from Serbia we apply the safeguards the ZZPL requires. You can ask for a copy of the safeguards by email.

How long we keep data

Stripe, Link, Microsoft and Meta set their own retention periods.

Your rights

You have the right to:

• find out whether we process your data and get a copy (access),
• have inaccurate data corrected,
• have your data deleted,
• restrict processing,
• receive your data in a machine-readable format (portability),
• object to processing based on legitimate interest and to direct marketing,
• withdraw consent at any time, without affecting processing before the withdrawal.

How to exercise them

• In your account: data export, account deletion, withdrawing check-in consent, notification settings.
• In every email: an unsubscribe link.
• On the site: the “Cookie settings” link in the footer changes your choice.
• By email: kontakt@bioritam.eu. We reply within 30 days. In exceptional cases this can be extended by another 60 days, and we will tell you. We may ask you to confirm your identity.

Right to complain

If you believe we process your data unlawfully, you can lodge a complaint:

• in the EU: with the supervisory authority of the member state where you live, work or where the infringement took place. The European Data Protection Board lists them at edpb.europa.eu,
• in Serbia: with the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11120 Belgrade, office@poverenik.rs, poverenik.rs.

You are welcome to write to us first, and we will try to fix the problem.

Minors

The site and products are meant for adults. We do not knowingly collect data from anyone under 18.

Security

Database access is restricted by row-level security (RLS), so each user sees only their own data. Connections are encrypted (HTTPS), and PDF guides are downloaded through short-lived signed links. If a data breach occurs, we notify the authorities and you where the law requires it.

Changes

We announce material changes to this policy on the site and email account holders. The date of the last change is at the top of this page.