Legal

Privacy policy.

Last updated: 5 March 2026

We treat your privacy with the same care we bring to reading homes. This page explains what personal data we collect, why we collect it, and how you can exercise your rights.

1. Who We Are

Sphelios is an AI-powered home wellness platform operated by KloudGentic B.V. (the “Company,” “we,” “us,” or “our”). We are accessible at sphelios.com. For any privacy-related queries, please contact us at support@sphelios.com.

Data controller

KloudGentic B.V.
KVK (Chamber of Commerce): 42034727
BTW-ID: NL869406735B01
The Netherlands

You can lodge a complaint with the Dutch supervisory authority Autoriteit Persoonsgegevens at any time. To exercise your GDPR rights (access, erasure, rectification), use our data request form.

Sub-processors

We rely on the following processors to deliver Sphelios. Each has been vetted for GDPR compliance via Standard Contractual Clauses (SCCs) where applicable.

Vercel Inc. — hosting + edge network (USA, EU regions)
Neon Inc. — managed Postgres (EU region)
Resend — transactional email delivery
Stripe — payment processing (all regions)
Cloudflare — Turnstile bot detection
Google (Gemini API) — AI analysis (no training on your data; per-request basis only)
Sentry — error tracking (PII redacted)
Umami / Plausible — privacy-friendly analytics (no third-party cookies)

2. What Data We Collect

Account Data

When you create an account, we collect your name, email address, and a hashed version of your password (we never store your plaintext password). If you sign in with Google, we receive your name, email, and profile picture from Google.

Home Analysis Data

To perform a home analysis, we collect floor plan images you upload, compass direction data, room details (dimensions, purpose, occupants), and any notes you provide about your home. This data is core to delivering your analysis report.

Order & Payment Data

For purchases, we collect shipping addresses and store payment references (order IDs, transaction IDs). We never store credit card numbers or full payment details — these are handled exclusively by Stripe, which is PCI DSS compliant.

Usage Data

We may collect information about pages visited, features used, browser type, device type, and approximate geographic location (country/city level) for analytics purposes — only if you have given analytics consent.

Cookie Data

We use cookies and similar tracking technologies. See our Cookie Policy for full details.

3. How We Use Your Data

To provide home analysis and generate personalised recommendations
To process orders and arrange delivery of physical products
To facilitate expert consultations and sacred ritual services
To improve the accuracy of our AI analysis engine (your data is never used to train third-party models)
To send transactional emails such as order confirmations and analysis reports
Marketing emails are sent only with your explicit consent, and you can unsubscribe at any time

4. Legal Basis for Processing (GDPR)

Processing Activity	Legal Basis
Account creation & authentication	Contract performance
Processing orders & payments	Contract performance
Delivering analysis reports	Contract performance
Improving our AI models	Legitimate interest
Analytics & site improvement	Legitimate interest / Consent
Sending marketing emails	Consent
Non-essential cookies	Consent

5. Data Storage & Security

All data is encrypted in transit using TLS 1.2+
Floor plans and uploaded images are stored in encrypted cloud storage (AWS S3 or Vercel Blob) with signed URLs — never served from our public directory
Payment data is handled entirely by Stripe (PCI DSS compliant) — card details never touch our servers
Our database is hosted on PostgreSQL (Neon / Railway) with encrypted connections and access controls
Passwords are hashed using bcrypt with 12 salt rounds
Access to production data is restricted to authorised team members only

6. Data Retention

Data Type	Retention Period
Account data	Until account deletion is requested
Home analysis data	2 years, or until deletion is requested
Order data	7 years (legal and tax requirements)
Analytics data	26 months (GA4 default)
Marketing consent records	Until consent is withdrawn + 3 years

7. Your Rights

Under GDPR and applicable privacy laws, you have the following rights:

Right to access — Request a copy of all personal data we hold about you
Right to rectification — Request correction of inaccurate or incomplete data
Right to erasure(“right to be forgotten”) — Request deletion of your data, subject to legal retention requirements
Right to data portability — Receive your data in a structured, machine-readable format
Right to restrict processing — Ask us to pause processing your data in certain circumstances
Right to withdraw consent — Withdraw consent for marketing or non-essential cookies at any time
Right to lodge a complaint — With your national data protection supervisory authority

8. How to Exercise Your Rights

To exercise any of the above rights, email us at support@sphelios.com with your request. You may also delete your account and all associated data directly from your account settings. We will respond within 30 days. For complex requests, we may take up to 90 days but will inform you within the initial 30-day period.

9. Third-Party Services

We use the following third-party services, each governed by their own privacy policies:

Service	Purpose
Stripe	Payment processing (all regions)
Plausible / Google Analytics	Anonymous site usage analytics
Vercel	Application hosting and edge delivery
Neon / Railway PostgreSQL	Database hosting
Google Gemini API	AI home analysis — data not stored beyond processing
Resend	Transactional email delivery
AWS S3 / Vercel Blob	Encrypted file storage for floor plans

10. International Data Transfers

Your data may be processed in the United States or European Union by our hosting and service providers. Where data is transferred outside your country of residence, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) and adherence to applicable transfer mechanisms. Our primary database is hosted in regions that comply with GDPR requirements.

11. Children's Privacy

Sphelios is not intended for users under the age of 16. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please contact us at support@sphelios.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users. The “Last updated” date at the top of this page will always reflect when the most recent revision was made. Continued use of the service after changes constitutes acceptance of the updated policy.