Privacy and personal data

Controller and contact

The association identified below is the data controller. Contact it at the email address below for personal data requests.

Microphone and guest use

Microphone permission is requested when you start listening. Audio is analysed on your device: the visualizer does not record or upload recordings. Frequency readings are not diagnoses or health measurements. Without an account, reports and best holds remain in tab memory and disappear on reload or closure. Settings and your privacy preference stay in the browser.

Account and saved reports

We use your email address, account identifier, optional name and preferences to manage your account. Your private history stores each session’s name, date and duration, one classification per second, totals and the tuning and display settings. We also store your best holds. The report contains no audio. We process these data to provide the service you request (GDPR Article 6(1)(b)). You can use the visualizer without an account.

Account emails

Email registration requires an address and a password. Supabase Auth uses the address for messages needed to confirm registration or recover access. When one of these emails is sent through Sender (UAB Sender.lt), Sender processes the recipient’s address, the message including its confirmation or recovery link, and delivery information such as dispatch time and status on behalf of the association. Creating an account does not authorise promotional emails.

Cimatica news and offers

If you are 16 or older, you can ask AVAcanaria to email you Cimatica news and offers at sign-up or in your profile. If you choose the newsletter during sign-up, confirm it in your profile after verifying your email. Until then you are not subscribed. This is optional and separate from statistics. We use your verified address with your consent (GDPR Article 6(1)(a)). With your account we keep your choice, when and where you made it, the language and the version of the wording. You can withdraw in your profile, through the unsubscribe link in promotional emails, or by contacting the controller. You will still receive necessary account emails. If your address changes, you need to subscribe again. The history of your choices is deleted with your account. When campaigns are sent through Sender, it processes your address and delivery information on the association’s behalf.

Google or Facebook sign-in

Google lets you sign in to an existing Cimatica account with the same verified email address. If the Facebook button is available, you can also use it to create an account after declaring that you are at least 14. Choosing a provider takes you to its website. To sign you in, Cimatica and Supabase process the provider’s identifier for you, your email and the profile details it shares, such as your name or a link to your photo. A matching verified email can link your sign-in to an existing account. Sign-in does not send reports or audio to the provider. For Facebook registration, a code derived from the provider’s identifier matches the declaration to the sign-up. It is valid for five minutes. It is deleted when the account is created or, if it expires unused, the next time a code is issued.

Profile photo

Cimatica displays the photo you choose to upload. Supabase avatar storage hosts the file at a public URL. Anyone who knows the link can open it. You can replace or remove the photo in your profile. Avoid uploading confidential images or photos of other people without permission.

Providers, security and transfers

Vercel hosts the website. Supabase provides authentication, database and avatar storage; the project's database is configured in Frankfurt, EU. Providers also receive connection data needed to deliver and protect the service, such as IP address and browser information. Necessary security processing is based on the legitimate interest in protecting the service (Article 6(1)(f)). The controller uses Gmail for its contact mailbox. If you write to us, we receive your address and message to answer your request, including when fulfilling our obligations concerning your rights (GDPR Article 6(1)(c)). Google is also involved if you choose its sign-in or allow Analytics. An EU database location does not guarantee that every provider operation stays in the EEA. For provider information and applicable transfer mechanisms see the references below, or ask the controller for a copy of safeguards applicable to your case.

Optional statistics

Only with your consent (Article 6(1)(a)) do we load Google Analytics 4, which measures page visits, referring websites, approximate location and device/browser type. Google receives connection data and cookie identifiers. We send predefined paths and only the referring website's origin, without queries, fragments, names, emails, audio or report contents; report identifiers are grouped and sign-in pages excluded. Advertising features are disabled. Refusing does not limit the service. Withdraw here or in your profile to stop further collection and remove Analytics cookies. Withdrawal does not undo earlier processing or requests already dispatched.

Retention and export

We keep your profile, age declaration and history while you maintain your account or until you delete individual items. The JSON download in your profile exports reports, holds and browser settings. You can ask the controller for other data. After deletion, information already in daily database backups may remain until those backups expire. This project keeps those backups for seven days. They do not include photo files. Contact the controller about technical log retention.

Your rights

You may request access, correction, erasure, restriction and portability where the GDPR provides them, object to processing based on legitimate interests, and withdraw consent at any time without affecting the lawfulness of earlier processing. Write to the controller; it may request only information necessary to verify your identity. You may complain to Spain's AEPD or the supervisory authority where you habitually live, work or believe an infringement occurred. The visualizer makes no decisions producing legal or similarly significant effects.

Children and requests for help

On entry you choose an age range without giving your date of birth. The visualizer is available to people under 14 too. You can read these notices and exercise your rights without choosing a range. If you have questions about a child’s data or want to request erasure, contact the controller even if you do not have an account.

Wellness

Cimatica does not diagnose, treat, cure or prevent diseases. Frequency and chakra associations are traditional and spiritual concepts, not proven medical effects. Keep volume safe and seek medical advice when your circumstances require it.

How to delete your data

In your profile, choose “Delete account” and confirm to remove your Cimatica sign-in, linked social identities, profile, photos, reports and holds. You can also delete just one report from your history or remove just your photo.

Open your profile

Even without signing in, you can ask the controller to erase your data, including information received through Facebook. Tell us which data to delete and which email address you used for Cimatica, if known. Do not send passwords. If necessary, we will ask only for the information needed to verify your request.

Accounts from age 14

An account requires age 14 or older. We do not ask for your date of birth. If you are under 14, use guest mode without an account. This declaration is separate from consent to statistics. Existing accounts must confirm before using account functions; export, photo removal and account deletion remain available in the profile. We store only the declaration version and date. We do not offer a parental-consent process.

Provider information

• Vercel · DPA
• Supabase · DPA
• Sender (UAB Sender.lt) · GDPR
• Google · Google — cookies · Google — data processing terms
• Facebook (Meta)
• Complain to the AEPD