Privacy notice

English information for the Relationship Compass, Clarity Letter and newsletter. Prepared on 15 September 2026 from the relevant sections and technical addendum of our German privacy policy. The broader German policy also covers our counselling practice, events and other online services; this page is not a word-for-word translation of those unrelated sections.

1. Who is responsible?

The controller is Elisabeth Rieder, Eßlinggasse 18/1b, 1010 Vienna, Austria. You can contact her at willkommen@elisabethrieder.life or +43 680 153 40 58. Business details are in the legal notice.

2. What information is processed?

Depending on the features you choose, the Relationship Compass processes questionnaire answers, the resulting relationship tendencies, areas of tension and goals, session and progress information, optional display names and intentions in the pair feature, sharing codes or links, contact and consent details, feedback and technical events.

The Clarity Letter additionally involves your responses to the open reflection questions, order and payment-status information, an internally generated AI draft, the final text reviewed by Elisabeth Rieder, and model and review metadata. A direct Clarity Letter does not require a Compass profile; existing profiles are included only when you use the corresponding Compass-based flow.

Free text and relationship statements can contain special categories of personal data under Article 9 GDPR, such as information about physical or mental health or sex life. For the Clarity Letter, these are processed only on the basis of your explicit consent under Article 9(2)(a). Please include only information necessary for your request and avoid unnecessary identifying details about other people.

3. Purposes and legal bases

• Providing and evaluating the Compass, pair comparison, preparing and delivering the Clarity Letter, and handling orders: Article 6(1)(b) GDPR, for steps before entering a contract and performing the contract.
• Optional features, newsletter subscriptions and other consent-based processing: Article 6(1)(a) GDPR. Explicit consent applies to the sensitive information described above.
• Statutory documentation and retention obligations: Article 6(1)(c) GDPR.
• Secure, reliable provision of the services, preventing misuse and investigating technical errors: Article 6(1)(f) GDPR. These are our legitimate interests.

The Compass provides a momentary reflection, not a diagnosis. Its evaluation is deterministic and does not call Claude. A Clarity Letter draft is reviewed and edited by Elisabeth before release; there is no solely automated decision about you.

4. Pair sharing and private answers

Anyone who receives a pair-sharing code or link can access the display names, intentions and results shared through it. Treat the code or link as confidential and share it only with the intended person.

A shared Clarity Letter requires one person to order and pay, but both people must independently give explicit consent to the processing of their own information. A second email address or account is not required. Each person answers the three questions separately on their own device. Neither person can view or edit the other person’s raw answers on their screen, although both sets of answers inform the shared letter.

The shared letter is securely delivered only to the person who placed the order. Any raw-answer appendix shown there contains that person’s own answers, not the other participant’s raw answers. You can also order a personal Clarity Letter from a pair comparison.

5. Storage periods

• Anonymous questionnaire, analytics and feedback data: generally 30 days.
• Consented contact and waiting-list data: until consent is withdrawn, the purpose no longer applies, or 365 days have elapsed, whichever is earlier.
• Records documenting completed erasure requests: 730 days.
• Clarity Letter profiles, open answers, derived content, drafts and reviewed final texts: 180 days from creation of the order. Viewing or delivering the letter again does not automatically extend this period.

Order, payment, invoice and legally required tax records are treated separately from sensitive answers and letter content. They remain subject to applicable statutory retention and documentation duties. Other information is kept only as long as needed for its purpose or as required by law.

6. Hosting and database

Cloudflare

The main website and our Cloudflare staging website use Cloudflare for hosting, content delivery and security. Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, may process IP addresses, requested URLs, timestamps, referrer, browser and device information and security logs. The legal basis is our legitimate interest in a secure, reliable website under Article 6(1)(f) GDPR. International transfers are subject to the applicable contractual safeguards, including standard contractual clauses where required. See Cloudflare’s privacy policy and data processing addendum.

Vercel

The live Relationship Compass and Clarity Letter application is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel may process IP addresses, URLs, the time and duration of access, referrer, browser, device and operating-system information and security logs. Information entered into the service passes through its infrastructure to process the request. The legal bases are Article 6(1)(f), and Article 6(1)(b) where necessary to provide the requested service. Vercel identifies the EU–US Data Privacy Framework and standard contractual clauses among its international-transfer safeguards. See Vercel’s privacy notice.

Supabase

We use Supabase for the live product’s database and backend. The contractual provider is SUPABASE PTE. LTD., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. The project is configured in Europe (Frankfurt); Supabase states that project data is stored and primarily processed in the selected project region. Where Supabase or subprocessors process data outside the European Economic Area, safeguards such as standard contractual clauses apply. See Supabase’s privacy policy and data processing addendum.

7. AI-assisted Clarity Letter preparation

We use Claude through Amazon Bedrock on the server to prepare an internal draft of a commissioned Clarity Letter. Claude is developed by Anthropic; the service is provided through Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Google Cloud Vertex AI is not used for this purpose.

The model receives the relevant reflection answers, non-numerical summaries and, when the Compass-based flow is used, the relevant Compass profile. A shared letter uses both participants’ information only after both have expressly consented. Name, email address, phone number, payment details and session identifier are not sent as separate model-input fields. Free text may nevertheless include personal or sensitive information that you choose to enter.

Only the selected geographic EU inference profile for Claude Opus 4.6 is used. There is no automatic switch to another model or a global profile. Requests use the AWS Europe (Frankfurt) endpoint, but the geographic EU profile can process them within its designated group of AWS regions in Germany, Sweden, Italy, Spain, Ireland or France. This is EU processing, not a promise of processing exclusively in Frankfurt.

According to AWS, inputs and outputs are not used to train AWS or third-party foundation models, and model providers cannot access Bedrock logs, prompts or outputs. Data transferred between participating regions is encrypted over the AWS network. Relevant contractual safeguards apply where international transfers are necessary. See Bedrock data protection, cross-region inference and AWS GDPR information.

8. Payment through Stripe

The free Compass does not use Stripe. Paid Clarity Letter checkout takes place on a Stripe-hosted payment page. We transmit the email address, internal order reference, product description, amount and currency. Stripe collects payment and billing information and technical fraud-prevention data directly. We retain only status and reference information needed for orders, delivery, accounting and support, not full card or bank details.

For European customers the provider named in our policy is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The legal basis is performance of the contract under Article 6(1)(b), with statutory accounting duties under Article 6(1)(c). International-transfer safeguards and Stripe’s own processing are described in Stripe’s privacy policy.

9. Newsletter and email

The newsletter contains relationship reflections, new offers and event updates. Signing up is voluntary and separate from using or buying the other services. We use Brevo to manage contact details and send newsletter and transactional emails. The provider is Brevo GmbH (formerly Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany. See Brevo’s privacy policy.

For a newsletter subscription we process your email address, optional first name, signup source, chosen language and consent/confirmation records. Newsletter recipients may be organised in lists to send relevant content. An English signup is assigned to a separate English newsletter list; it does not automatically enrol you in a German newsletter or the German Compass email journey.

We use double opt-in: after signup, you receive an email asking you to confirm. You are added to the confirmed newsletter list only after that confirmation. The legal basis for newsletter delivery is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time through the unsubscribe link in a newsletter or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal. Necessary consent and suppression records may be retained to document compliance and respect your unsubscribe request.

If you subscribe through the Compass to receive your result as a designed PDF, Supabase temporarily stores your email address, optional first name, a reference to the individual or pair result, a confirmation proof that is not stored in plain text, and delivery and expiry times. Your answers and result content are not transferred to Brevo. After confirmation, a second email contains a personal download link valid for seven days. The temporary delivery record is deleted no later than one day after that link expires. The complete result remains visible on screen without a newsletter subscription.

Brevo states that its service databases operate within the European Union, with hosting locations in France, Germany and Belgium. Existing contacts were imported from the former Wix newsletter, but import alone does not constitute consent. Before sending to an existing contact, we check for a documented lawful basis. New subscriptions are not sent to Wix.

Brevo may process technical delivery and interaction information where the relevant email feature is enabled. Our German policy explains Brevo’s broader email functionality. No relationship answers or Compass results are included in newsletter signup requests.

For business correspondence we use Google Workspace, including Gmail, from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This can involve sender and recipient addresses, names, subject lines, message content, attachments, timestamps and delivery logs. The legal bases are Article 6(1)(b) for pre-contractual and contractual correspondence and Article 6(1)(f) for reliable, secure business communication. See Google’s privacy policy and the Google Workspace data processing addendum.

10. Browser storage, consent and technical events

A started Compass may temporarily store its session identifier, context, pair display names and answers in your browser’s local storage for up to 24 hours, with removal on expiry or completion. Clarity Letter free text is held in session storage during entry and removed after submission or, at the latest, when the tab session ends.

The protected beta uses a necessary cookie named bk_zugang. It contains cryptographic proof of access, not the password, and is marked HttpOnly, Secure and SameSite=Lax. It expires after 30 days.

On clarity.elisabethrieder.life, optional advertising and third-party analytics scripts are not loaded. The Cloudflare review pages also do not load these optional services. Necessary browser storage and first-party technical events described in this notice remain in use.

If you use the German product at sofortsupport.elisabethrieder.life, Clickskeks by Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany manages consent. It processes a pseudonymous consent ID, the time and type of your choice, language and settings and technical information. The provider describes a maximum 24-hour rollover for IP-address logs. Your choice is stored as ccm_consent in local storage for up to one year. Consent management relies on Article 6(1)(f); optional services require consent under Article 6(1)(a). See Clickskeks privacy information. The German product’s optional, consent-gated Google Ads purchase-conversion integration reports a validated purchase amount, currency and opaque transaction reference, not names, email addresses, relationship answers or results. Enhanced Conversions are not enabled. Cookie settings on the German product let you change your choice.

An IP address may be processed temporarily for rate limiting and abuse prevention. A non-reversible hash may be retained as part of consent evidence. First-party technical events support security, error analysis and improvement of the service.

11. External links and security

Ordinary links to social networks do not connect your browser to those networks until you follow them. The external provider then processes information under its own policy. The English product pages contain no embedded social-media widgets and serve their fonts and images locally.

We use HTTPS and technical and organisational safeguards to protect information against unauthorised access. We work with service providers under the applicable data-processing arrangements. Processing outside the EEA requires an applicable GDPR transfer mechanism; an EU hosting region alone does not mean that every service provider operates exclusively within the EEA.

12. Your rights

Subject to the conditions in the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your situation, and you may object to direct marketing at any time. Where processing relies on consent, you can withdraw that consent at any time.

Contact Elisabeth using the details above to exercise these rights. You also have the right to complain to a supervisory authority, in particular in the country of your habitual residence, workplace or the alleged infringement. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, telephone +43 1 52 152-0.

The full legal text is available in English on EUR-Lex: General Data Protection Regulation.