Policy version: 2.0 Last updated: 13 October 2026
1. Who we are and what this policy covers
Pink Lady (WellCycle) is operated by SEVEN SAAS LIMITED, a private limited company registered in England and Wales, company number 16470398. This policy covers our mobile app, web version, account services and related support. We decide how and why your app information is processed and are the data controller where applicable law uses that term.
Our registered address is 31A Brighton Road, Worthing, BN11 3EF, United Kingdom. For privacy questions and requests, contact info@sevensaaslimited.com. Reading this policy, accepting terms, buying a subscription or granting camera access does not itself give permission for every use of your information.
2. Adults only
WellCycle is intended only for people aged 18 years or older in every country where we offer it. Parental permission does not make an under-18 person eligible. The corrected release asks for an adult declaration and checks an already recorded date of birth where available. This is not independent identity or age verification.
If you believe an under-18 person has provided information, contact info@sevensaaslimited.com so we can assess the account, restrict inappropriate processing and address deletion.
3. Information we process
Account information includes email, account and provider identifiers, profile details, preferences, age declarations and any date of birth supplied. Supabase handles our own authentication. Google and Apple provide the identifiers and credentials needed for their sign-in services; we do not receive your Google or Apple password. Authentication sessions and operational preferences may be stored on your device.
Depending on the features you use, we process cycle dates, symptoms, reproductive-health information, mood, energy, vital measurements, workouts, nutrition and food entries, sleep, water intake, goals, notes and journal entries. Health and reproductive information is sensitive, including special-category data where UK or EU data protection law applies.
Food Scan processes the photo you select and nutrition estimates. A photo or scan result may be stored even if you do not save a meal. AI Coach processes submitted messages and responses. Separately enabled health context can include recent cycle dates and lengths, symptom summaries and types of vital measurements recorded.
Reports and sharing records contain the information you choose to include. Community posts, comments and reports can be visible to the feature audience. A nickname or an anonymous-looking profile does not guarantee anonymity or prevent identification from your content.
Purchase records include an app-user identifier, product, receipt or transaction information, subscription status, trial or expiry dates and premium entitlements. Apple and Google handle store payment details; we do not receive your full payment-card number or security code from those purchases.
Our services and hosting providers process technical information needed to operate and secure the app, such as IP addresses, request times, authentication events, device or browser details and errors. Support messages and attachments can contain personal information. Avoid including unnecessary identifying or health details.
4. Why we use information and legal bases
We use information to maintain your account, save records, synchronise devices, display progress, provide requested AI features, generate and share summaries, validate and restore premium access, handle support and protect the service. We do not sell personal health information, use health records for advertising targeting or conduct identifiable-health research simply because you have an account.
Where UK or EU GDPR applies, necessary account administration and purchase validation use performance of our contract; proportionate security and fraud prevention use legitimate interests subject to your rights; legally required records use legal obligations. Sensitive health tracking and personalisation use explicit consent as the applicable Article 9 condition and consent as the Article 6 basis. Optional third-party AI processing requires separate affirmative permission.
You do not have to submit a food photo, use AI Coach, enable additional health context or publish Community content. Declining optional AI does not remove unrelated manual functions. Features that need health-processing permission cannot operate after that permission is withdrawn.
5. Supabase: account, records and files
Supabase provides authentication, our database, file storage and backend functions on our behalf. It processes account information, submitted health and wellness records, food photos, reports, sharing metadata, subscription-access records and service logs. Cloud information is not stored only on your phone.
Our primary Supabase project is in US East (Ohio), United States, region us-east-2. Food photos are stored in a private bucket with account access controls. This primary location does not mean every processor, support operation or copy remains in Ohio.
6. RevenueCat, Apple and Google
RevenueCat validates subscriptions, manages entitlements and purchase restoration, and provides purchase reporting. It receives an app-user identifier linked to your WellCycle account, together with product, transaction, receipt, subscription and entitlement information. Related store information can include currency and locale. A linked identifier is not anonymous.
We do not send cycle records, symptoms, Coach messages or food photos to RevenueCat for subscription management. Apple and Google separately process sign-in and store purchases under their own terms. Deleting a WellCycle account or RevenueCat customer does not erase their independent store records and does not automatically cancel billing. Manage subscriptions in the purchasing store.
For supported native Apple sign-in, our backend can securely retain an Apple refresh token encrypted with account-bound AES-256-GCM. It is not your Apple password and is not sent to OpenAI. It is used to revoke WellCycle authorization for the explicitly confirmed deleting account, not to disable Sign in with Apple for other users.
7. OpenAI and your AI choices
Our backend sends information to the OpenAI API to generate AI Coach answers and analyse food photos. Processing is not entirely on your device. Coach sends your submitted message; separately enabled health context can include recent cycle dates and lengths, symptom summaries and tracked vital types. Food Scan sends a processed copy of the selected image. Messages and images can identify you even without a direct account identifier. Avoid faces, documents and unnecessary identifying details.
The corrected release asks for distinct Coach and Food Scan permission before sending an AI request, records your choice and notice version, and verifies current permission on the server. Additional health context defaults off and requires a separate choice. Camera permission is not permission to send a photo to OpenAI.
AI processing is different from AI training. OpenAI states that API inputs and outputs are not used to train or improve its models unless the API customer explicitly opts in. We do not authorize optional sharing of WellCycle content for model improvement. Optional stored-completion requests are disabled in the application; that setting is not a substitute for the organization data-sharing controls.
OpenAI may retain content and metadata in abuse-monitoring logs, normally for up to 30 days, with legal and safety exceptions and feature-specific rules. We do not promise zero retention or immediate deletion from every provider system. These API rules are separate from the rules for an individual ChatGPT account.
8. Email, diagnostics and other disclosures
Resend delivers transactional messages such as deletion confirmations and support email. It processes recipient addresses, supplied names, message content and delivery information. Support attachments can contain personal information.
The corrected iOS privacy release disables the Sentry client SDK, tracing and session replay, even if a build environment supplies a Sentry DSN. Backend providers still maintain operational and security logs. The hosted web version may also receive hosting-level analytics or operational scripts; disabling Sentry in the app does not disable every hosting-provider script or log.
We share reports with a healthcare provider or another person when you direct us to do so. Community content is visible to its feature audience. We may disclose limited information where required by law or valid legal process, or where necessary and lawful to protect rights, investigate fraud or respond to a security incident. Our providers may use authorized subprocessors.
9. Choices, withdrawal and version transition
In the corrected release, Privacy & Security lets you save or withdraw separate health-record and AI permissions. Withdrawal stops future processing controlled by that permission; it does not automatically erase existing records or recall information already transmitted to providers. You can also request account deletion.
Older Android and web versions are being transitioned to these controls without automatically treating their users as having accepted the new notice. During that transition, accounts that have not made the new choices retain their existing access; this is not a grant of the new consent. Once you make these choices, they apply to your account across devices, including older versions. If an older version cannot display the new controls, use the updated app or contact info@sevensaaslimited.com for help with withdrawal or deletion.
Camera access is used when you choose to take a photo; a system picker selects an existing image. Selecting one image does not authorize access to the entire library. You can manage device permissions in operating-system settings. Removing the app does not delete cloud information or cancel subscriptions.
10. International processing and security
Our providers may process information in the United States and other countries where they or their authorized subprocessors operate. Where applicable law requires safeguards for a restricted transfer, the relevant provider processing terms and legally required transfer arrangements apply, which may include Standard Contractual Clauses and a UK Addendum. Contact us for information about the arrangements applicable to your data and how to obtain a copy. We do not claim that all information stays in your country or that every provider has a particular certification.
We use HTTPS/TLS, authentication and access controls for communications and account access, together with infrastructure measures supplied by our providers. These are not end-to-end encryption preventing us and relevant processors from accessing information. We do not claim HIPAA certification, medical certification or independent security audits unless separately documented. No internet service or storage system is completely secure.
11. Retention and account deletion
We keep account information, saved health records, reports and photos for the period needed to maintain your account and requested features, unless removed or account deletion is completed. Files and scan results can be stored separately from a meal. A scan-recovery expiry or signed-link expiry is not a physical file-deletion deadline.
Operational logs and support records are retained according to what is needed for service security, troubleshooting, resolving requests and applicable obligations. Purchase records may remain where needed for validation, fraud prevention, tax, accounting or law. Keeping a transaction record does not justify indefinitely keeping unrelated sensitive health content.
Initiate deletion on the app’s Data Deletion page or contact info@sevensaaslimited.com. The corrected deletion flow verifies the account, sends a confirmation link and requires a final affirmative confirmation; opening the link alone does not delete anything. Confirmed deletion blocks account processing and revokes shared links. Cleanup covers related database records, actual account-owned files, the relevant RevenueCat customer and authentication account. Failed cleanup is not reported as complete and can be retried.
Where a usable protected Apple token exists, we also request per-account Apple authorization revocation. A temporary Apple failure can leave that step pending with encrypted retry material after app-data deletion completes. For older Apple-linked accounts without a usable token, our data deletion still proceeds and we explain how to stop using WellCycle in Apple Account settings; that manual step is not a condition for deleting app data.
Minimal deletion-confirmation, provider-outcome and restoration-suppression records can remain as needed to finish pending work, prevent deleted accounts being reinstated from a backup, resolve disputes and meet applicable obligations. Pending token material is kept only for the associated provider step, subject to necessary review and lawful exceptions. We do not promise a fixed automatic retry or physical-erasure deadline that our operations do not support.
We use scheduled daily Supabase database backups; Point-in-Time Recovery is not enabled. Deleted records may remain in protected historical backups until they expire under the applicable project and provider retention schedule. Database backups do not include uploaded file contents. A backup-access window is not a guarantee of physical erasure by that date. OpenAI, Apple and Google have their own retention rules and obligations.
We process privacy requests within applicable legal time limits and explain any lawful exception or extension. Deleting your WellCycle account, deleting a RevenueCat customer or uninstalling the app does not necessarily cancel an Apple or Google subscription. Manage or cancel billing through the relevant store; deletion does not require waiting for subscription expiry.
12. Your rights, changes and health limitations
Depending on applicable law, you may access or obtain a copy of your information, correct it, request deletion, restrict processing, obtain a portable copy of eligible data, withdraw consent or object to legitimate-interest processing and direct marketing where applicable. Contact info@sevensaaslimited.com. Proportionate identity verification and lawful conditions or exceptions can apply. You may complain to the UK Information Commissioner’s Office or the relevant authority where you live, work or believe an infringement occurred.
AI responses, nutrition estimates, cycle predictions and summaries may be incomplete or inaccurate. A shared report is a summary, not a verified clinical diagnosis. WellCycle provides educational wellness support and does not replace professional diagnosis, treatment or emergency care.
We update this policy as the service or processing changes, provide appropriate notice of material changes and obtain any required new permission before the relevant new activity. Contact SEVEN SAAS LIMITED at info@sevensaaslimited.com or 31A Brighton Road, Worthing, BN11 3EF, United Kingdom.