Privacy policy

1. Who is responsible

Lighthouse Lab SRL operates Neurosomatic Education and is the controller of the personal data described here.

Privacy and account requests: help@feldenkrais-education.com

2. Information we process

We process the information needed to provide, secure, support and improve the member platform.

• Account and profile details, such as your email address, display name, preferred language and profile photo.
• If you choose Google or Apple sign-in, the provider's account identifier, verified email address (including an Apple private-relay address if you choose Hide My Email), and the name the provider makes available. We use these details to create or authenticate your account, or connect the provider to your existing account.
• Optional onboarding and practice preferences, including wellbeing, back, recovery or nervous-system goals that you choose to provide.
• Membership and payment status, Stripe customer or subscription references, invoices and transaction records. We do not receive full card numbers.
• Your learning activity and content, including progress, playback, favourites, playlists, notes, journals and attendance.
• Content you share with us or other members, including community posts, replies, photos or documents, direct messages, feedback and support requests.
• Technical and security data such as IP address, browser or app information, timestamps, audit events, diagnostics and native push tokens.

3. Why we use it

We use account, membership and activity data to perform our contract with you and deliver the service. We use optional preferences and device notifications based on your choices or consent. We use limited technical, security, moderation and support data for our legitimate interests in keeping the platform reliable, preventing abuse and helping members. Billing and other records may also be processed to meet legal obligations.

We do not sell personal data and do not use it for third-party advertising or cross-app tracking.

4. Community visibility

Community posts, replies, profile details and shared files are visible to the members who can access the relevant space. Direct messages are visible to the conversation participants and may be accessed by authorised staff when needed for a report, safety review, legal duty or technical support. Please avoid sharing information you do not want other permitted participants to see.

5. Service providers and transfers

We share only the data needed with contracted providers that help us run hosting, object storage, email, monitoring, support and payments. Stripe processes payments. Apple Push Notification service and Firebase Cloud Messaging deliver notifications when you enable them.

When you choose Google or Apple sign-in, that provider processes the sign-in request under its own privacy policy. We request only basic identity, profile and email information. We do not request access to your mail, contacts, calendar or stored files, and we do not send your learning activity, journals or community messages to these providers as part of sign-in.

If you allow community translation, we send the text of new community posts and replies you publish to Groq, an external AI translation service, to make them available in French or English. Text you include in a post, such as names or mentions, is part of that request. We do not send private messages, attachments or separate account details for this translation. Automatic translations may contain mistakes.

Where a provider processes data outside the European Economic Area, we rely on the safeguards available for that service, such as an adequacy decision or standard contractual clauses.

6. Notifications and your choices

Native notifications are off until you enable them in the app and grant device permission. You can change message and reminder preferences in Settings, mute a community space, disable a registered device, or block notifications in your phone settings. Private journal activity is not sent to a device lock screen. Signing out revokes that app installation's push registration.

Google and Apple sign-in are optional. In Settings → Account → Sign-in options, you can disconnect a provider when another sign-in method is available. You can also manage the app's access in your Google or Apple account settings.

Community translation is optional. We ask before sending your first eligible post for translation, and you can post without allowing it. You can change your choice in Settings → Privacy → Community translation. Allowing translation does not send older posts retroactively. Turning it off prevents future translation requests and stops waiting jobs; it cannot recall a request already in progress. Translations already created remain visible with their posts.

7. Retention and deletion

Account content is normally kept while your account is active. Operational logs are retained according to their security or support purpose. Deleted material may remain for a limited period in protected backups. Some billing, fraud-prevention, dispute, audit and legal records may need to be retained for a longer statutory period.

A connected provider's account identifier is kept until you disconnect it or your account is deleted. For Apple, we also retain an encrypted authorization token so we can revoke the connection before removing it. Disconnecting removes the provider connection; your Neurosomatic account, profile and learning history remain until you request their deletion.

You can initiate deletion in Settings → Privacy → Delete account. We aim to complete a verified request within 30 days and will explain if a legal retention duty applies. You can also use the public account-deletion page if you no longer have access to the app.

Open the account-deletion page

8. Your rights

Depending on applicable law, you may ask to access, correct, export, restrict or erase your data, or object to certain processing. You may withdraw consent without affecting earlier lawful processing. Contact us to exercise these rights. You may also complain to the Belgian Data Protection Authority or your local supervisory authority.

9. Security, children and changes

We use access controls, encrypted connections, restricted secrets, auditing and backups appropriate to the service. No online system can promise absolute security, so please use a unique password and contact us if you suspect misuse.

The platform is intended for adults and is not directed to children. We may update this policy when the product or providers change. Material changes will be communicated through the platform or the contact details associated with your account.