Season Beta Privacy Notice
In the Beta, we use your cycle and health data for one purpose only: to make the Season app work for you. We do not sell it, do not use it for advertising and do not train AI with it. Below we explain which data we process, how it is stored and what rights you have.
Key facts at a glance
| Topic | How it works in the Beta |
|---|---|
| Purpose | We use your entries only to make the app work for you: calendar, cycle phases, forecast, reminders and switching between phone and browser. |
| Location | Our servers and backups are located in Frankfurt am Main, Germany. |
| Linking | Your entries are linked to an internal user number, not to your name or email address. Your email address appears only once, in your account record. |
| Encryption | Transmission is encrypted and the database is encrypted at rest. During the Beta, however, your entries are not yet additionally end-to-end encrypted and are therefore technically readable by authorised members of our tech team. |
| Risk | Because the user number is linked to your account, a successful attack on our systems could expose your entries together with your account. How we reduce this risk is described below under “How your data is stored and protected”. |
| Consent | Your consent only covers the use of the app. No sharing with others, no research, no AI training. We would always ask you separately for any of these in the future. |
| Control | You can withdraw your consent in the app, download your data and delete your account at any time. |
Who is responsible?
The controller within the meaning of the General Data Protection Regulation (GDPR) is Season UG (haftungsbeschränkt), Am Bruxbaum 4a, 41748 Viersen, Germany, represented by its managing directors Shanel Chien and Celine Enda Ndakwa. Email for data protection questions: shanel@season.vision
Who this notice applies to
All testers of the Season Beta aged 18 or over who register for the Beta and use the app via TestFlight (iOS), the Google Play testing program (Android) or in the browser. It supplements the Season Beta Terms of Participation. Our separate Privacy Policy applies to visits to our website season.vision.
Which data we process, why and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Beta registration: name, email address, selected testing platform (iOS, Android or web) | Inviting you, assigning you to TestFlight, Google Play or the web app, organising the Beta | Art. 6(1)(a) GDPR | until the Beta ends or you withdraw consent |
| Account data: email address, password (stored only as a hash), internal user number, language, registration date; if you sign in with Apple, Google or Facebook, also your name, email address and the ID of that account | Account, login, switching between devices, service emails such as “reset password” | Art. 6(1)(b) GDPR (contract) | until your account is deleted |
| Cycle and health data: cycle day, period and bleeding, discharge, mood, symptoms, sleep, body temperature, notes | Calendar, cycle phases, forecast, reminders, displaying your entries | Art. 9(2)(a) and Art. 6(1)(a) GDPR (explicit consent) | until you delete it, delete your account or withdraw your consent |
| Calendar entries: appointments, titles, times, notes, guests | Planning in the cycle calendar | Art. 6(1)(b) GDPR | until you delete them or your account |
| Calendar connection (optional): access credentials for Google Calendar or iCloud, synced appointments | Syncing with your Google or iCloud calendar | Art. 6(1)(b) GDPR | until you disconnect it or delete your account |
| Notifications (optional): device or browser identifier for push notifications, your settings | Reminders and notes about your cycle | Art. 6(1)(b) GDPR; for content about your cycle, your consent under Art. 9(2)(a) GDPR | until you turn notifications off or delete your account |
| Record of your consents: time, type of consent, version and language of the texts, IP address, browser or device identifier, user number | Proof that you consented (Art. 7(1) GDPR) | Art. 6(1)(c) GDPR | during use and up to 3 years afterwards |
| Technical data (server logs): IP address, time, device type, operating system, app version | Operation, security, troubleshooting | Art. 6(1)(f) GDPR (legitimate interest in a secure, working app) | 30 days |
| Error reports: pseudonymous user ID, area of the app where the error occurred, technical error details | Finding and fixing errors | Art. 6(1)(f) GDPR | 90 days at most |
| Storage in the browser and on the device: session cookie, “remember me” cookie, settings such as holiday country and last used login email, cached entries | To keep you logged in and make the app work | Section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR | session cookie until logout, “remember me” 7 days, other data until you delete it in your browser or the app |
| Feedback and communication: emails, feedback, bug reports, screenshots, survey answers, interview notes | Evaluating the Beta, answering questions, improving the app | Art. 6(1)(b) and (f) GDPR; invitations to surveys and interviews: Art. 6(1)(a) GDPR | until evaluated, at the latest 12 months after the Beta ends |
We do not use any analytics, tracking or advertising tools in the Beta and do not use third-party cookies.
You are not legally obliged to provide us with data. However, without an email address and password or a sign-in via Apple, Google or Facebook you cannot create an account, and without your consent to the processing of your health data you cannot use the app.
Your consent for health data
Cycle and health data are special categories of personal data under Art. 9 GDPR. We therefore only process them with your explicit consent, which you give in the app before your first entry.
- Scope: Your consent only covers what is necessary for the app to work for you: storing, syncing between your devices, displaying, calculating the forecast and using it for reminders you have switched on.
- Voluntary: Your consent is voluntary. Without it, however, you cannot use the Beta, because processing this data is the core function of the app.
- Withdrawal: You can withdraw your consent at any time with effect for the future, in the app under Settings > Data & Privacy or by email to shanel@season.vision. We will then delete your health data. As the app cannot work without it, this usually also ends your participation. Processing carried out before the withdrawal remains lawful.
What we do not use your data for
- We do not sell your data.
- We do not use it for advertising and do not use advertising trackers.
- We do not train AI or machine learning models with your data.
- We do not share it with employers, insurers, research institutions or other users.
- We do not make automated decisions with legal effect about you (Art. 22 GDPR). The forecast is a calculated estimate for your planning.
If we offer new options in the future, such as sharing with a partner, anonymised analyses or AI-based forecasts, we will ask you separately first. Without your consent, nothing changes.
How your data is stored and protected
Storage location: Your data is stored on servers of our hosting provider Render in Frankfurt am Main, Germany. The backups are stored there as well. This lets you switch between phone and browser. Entries may also be cached on your device.
Linking via a user number: We store your entries with an internal user number, not with your name or email address. Your email address is only used for login and appears once in your account record. As the user number is linked to your account, your entries are still personal data.
Current status in the Beta: The database is encrypted at rest. Your entries, however, are not yet additionally end-to-end encrypted. Authorised members of our tech team can technically view them. In the event of a successful attack on our systems, they could be exposed together with your account. We reduce this risk with the following measures:
- encrypted transmission between app, browser and server (HTTPS/TLS)
- encryption of the database at rest (AES-256) by our hosting provider
- passwords stored only as a hash
- database access limited to selected people who need it for their role
- two-factor authentication for all admin access to hosting, database, code and app stores
- confidentiality obligations for everyone involved
- backups in Frankfurt that are automatically deleted after 7 days
- data processing agreements with our service providers
We are working on strengthening protection further, for example through additional encryption and more choice over which data leaves your device at all. We will inform you of any significant changes.
You can help too: with a screen lock on your device, a unique password for Season and care when sharing screenshots.
Who has access to your data
Our team: Only people who need access for operations, support or troubleshooting.
Service providers: These service providers process data on our behalf and according to our instructions (processing under Art. 28 GDPR):
| Service provider | Task | Registered office and storage location |
|---|---|---|
| Render Services, Inc. | Hosting of the app, web app, database and backups | Office: USA; servers: Frankfurt am Main, Germany |
| Resend (Plus Five Five, Inc.) | Sending emails such as confirmations, password resets and reminders. Reminder emails may contain information about your cycle phase. | Office and storage: USA |
| Sentry (Functional Software, Inc.) | Error reports | Office: USA |
| Trello (Atlassian) | Handling feedback: email address, text and screenshots, if provided | Storage: USA |
Apple, Google and Meta: If you sign in with your Apple, Google or Facebook account, connect your Google or iCloud calendar or receive push notifications, Apple, Google or Meta are involved. They process data under their own responsibility, and their privacy policies apply. Push notifications are delivered via the Apple Push Notification service or your browser’s push service. They may contain information about your cycle, for example about ovulation, and may be visible on your lock screen. You choose which notifications you receive in the settings.
TestFlight and Google Play: If you use the Beta via TestFlight or Google Play, Apple or Google process their own data under their own responsibility, for example your Apple ID or Google email address, device information, crash reports and feedback you send there. Their privacy policies apply. There we see your name and email address from the invitation, your device model, crash reports and your feedback.
Authorities: Only if we are legally obliged to.
Transfers outside the EU
Your data is stored on servers in Frankfurt am Main, Germany. Some of our service providers are based in the USA (see the table above). Where data is transferred to the USA or access from the USA is possible, we rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), where the provider is certified under it, and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards from us.
Apple, Google and Meta may also process data in the USA. They are responsible for this themselves.
Deletion and what happens after the Beta
Deleting entries: You can delete calendar entries individually and edit daily cycle and symptom entries at any time. If you want individual daily entries removed completely, just email us.
Deleting your account: in the app under Settings > Account or by email to shanel@season.vision. Your account, cycle, health and calendar data will then be deleted from our database immediately and from the backups within 7 days at the latest. We keep the record of your consent for up to 3 years so that we can prove it in the event of a dispute.
After the Beta: When Season officially launches, we will transfer your account and entries to the live version so you do not have to start from scratch. We will inform you by email in advance and present you with the Privacy Policy of the live version for the period after the launch. If you do not want the transfer, you can delete your account before or at any time afterwards.
Your rights
You have the right, at any time and free of charge, to:
- access your stored data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure of your data (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR): you can download your data as a file in the app under Settings > Account
- withdraw your consent with effect for the future (Art. 7(3) GDPR)
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.
To exercise your rights, email shanel@season.vision. We will respond within one month; for complex requests this period may be extended by up to two months, and we will let you know. If we have doubts about your identity, we may ask for proof.
Complaints: You can lodge a complaint with any data protection supervisory authority, for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany, phone +49 211 38424-0, email poststelle@ldi.nrw.de.
Changes to this notice
We update this notice when the app, our service providers or the law change. The current version is always available in the app and on our website season.vision. We will inform you of significant changes by email or in the app. If a change requires new consent, we will obtain it first.