Privacy Policy

The REWIRED app (“the Service”) is operated by Rewired Global AB, a company registered in Sweden with organisation number 559122-0768 (VAT SE559122076801) and registered address Telefonvägen 30, 126 26 Hägersten, Sverige (“we”, “us”). We are the data controller for the personal data described in this policy under the EU General Data Protection Regulation (GDPR).

Privacy questions and requests: support@rewiredglobal.com.

• Account data: your email address, and your first name if you choose to share it.
• Membership and billing status: whether your subscription is active, and identifiers linking your account to our payment provider. Card details are handled entirely by Stripe; we never see or store your card number.
• Program progress: which missions and lessons you have marked complete, so the app can show your progress and your coach can meet you where you are.
• Runa conversations: the messages you exchange with Runa, our AI coach, are stored so your conversation has continuity.
• Technical data: standard server logs, including IP address, used for security, abuse prevention and rate limiting.

We do not collect analytics profiles, advertising identifiers or location data.

Runa is an AI coach. When you send Runa a message, that message, recent conversation history and limited account context (such as your first name and program progress) are transmitted to Anthropic, the provider of the Claude AI model, via their API, so that Runa can respond. Anthropic processes this data as our processor under a data processing agreement. Under Anthropic’s commercial API terms, inputs and outputs are not used to train their models.

Please treat Runa like a coach, not a vault: do not share information you do not want processed this way, such as health details about other people. Runa is not a medical, psychological or therapeutic service.

• To provide the Service (account, membership, programs, Runa): performance of our contract with you, Article 6(1)(b) GDPR.
• Security, abuse prevention and service integrity (logs, rate limiting): our legitimate interest, Article 6(1)(f) GDPR.
• Legal obligations (bookkeeping and tax records connected to payments): Article 6(1)(c) GDPR.

We use a small set of processors, each under a data processing agreement:

• Anthropic (USA): AI processing for Runa conversations.
• Stripe (payments): subscription billing. Stripe also acts as an independent controller for some payment data under its own privacy policy.
• Resend (USA): delivery of login and service emails.
• Vercel (hosting): runs the application. Our compute region is in the EU (Frankfurt).
• Neon (PostgreSQL, EU region Frankfurt): stores the data described above in an EU region.
• Wistia (video hosting): hosts the lesson videos in program content. When you watch a lesson, Wistia receives viewing data and your IP address.

Where a processor is located outside the EU/EEA, transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. We do not sell personal data, ever.

• Account and progress data: kept while your account exists. If you ask us to erase your account, we honor that request within 30 days.
• Runa conversation data: kept while your membership is active, and for 12 months after it ends, then deleted. You can also ask us to delete your conversation history sooner (see Section 7).
• Billing records: kept as long as Swedish bookkeeping law requires (currently seven years), even after account deletion.
• Server and security logs: kept for a short rolling window, at most 90 days.

Under the GDPR you can ask us to:

• access a copy of the personal data we hold about you,
• correct inaccurate data,
• erase your data (delete your account, progress and Runa conversations),
• export your data in a portable format,
• restrict or object to certain processing.

To exercise any of these rights, email support@rewiredglobal.com from the address on your account. We respond within one month.

You also have the right to complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), imy.se, or to the supervisory authority in your own EU country.

The Service uses a single strictly necessary cookie: a randomly generated, non-identifying session token stored in a secure cookie that keeps you signed in. No analytics cookies, no advertising cookies, no third-party trackers. Because the session cookie is strictly necessary for the Service to function, no cookie consent banner is required for it.

If we change this policy in a way that matters, we will notify you by email or in the app before the change takes effect. The date at the top shows when it was last revised.