Privacy Policy

Last Updated: April 2, 2026

1. Data Controller

The data controller for this Platform is:

BlankCanvas OÜ

Sepapaja tn 6, 15551 Tallinn, Estonia

VAT: EE102415878

Email: support@drlidiaverhoeven.com

2. Data We Collect

We collect the following categories of personal data:

Account Data

Email address (used for authentication via magic link);
Display name (optional, provided during profile creation);
Date of birth (for age verification);
Account creation date.

Usage Data

Chat messages and interaction history;
Task submissions and proof uploads;
Credit purchase and transaction history;
Session data and protocol progression.

Technical Data

IP address;
Browser type and version;
Device information;
Cookies and similar technologies (see our Cookie Policy).

3. Legal Basis for Processing

We process your data based on the following legal grounds:

Contract performance: Processing necessary to provide the services you requested (account management, credit system, chat functionality);
Legitimate interest: Service improvement, fraud prevention, and security measures;
Legal obligation: Compliance with applicable laws, including age verification requirements and tax obligations;
Consent: Marketing communications and non-essential cookies (where applicable).

4. How We Use Your Data

To provide and maintain the Platform services;
To authenticate your identity and verify your age;
To process credit purchases and manage your account balance;
To deliver AI-generated responses within the chat experience;
To maintain behavioral context within the AI system for continuity of the experience;
To detect, prevent, and address fraud, abuse, or violations;
To comply with legal obligations;
To improve and optimize the Platform.

5. Data Sharing

We do not sell your personal data. We share data with the following categories of third parties, solely for the purposes described:

AI service provider: Chat messages are sent to our AI provider for response generation. Messages are not used to train third-party AI models;
Payment processor: Transaction data necessary for processing credit purchases. We do not store your full payment card details;
Hosting and infrastructure: Cloud service providers that host the Platform and store data;
Email service: Your email address is shared with our email provider for authentication and transactional communications;
Law enforcement: When required by applicable law or valid legal process.

6. Data Retention

We retain your data as follows:

Account data: Retained for the duration of your account plus 30 days after deletion request;
Chat history: Retained for the duration of your account. You may clear your chat history at any time;
Transaction records: Retained for 7 years to comply with Estonian tax law;
Technical logs: Retained for up to 90 days for security and debugging purposes.

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right of access: Request a copy of the personal data we hold about you;
Right to rectification: Request correction of inaccurate personal data;
Right to erasure: Request deletion of your personal data ("right to be forgotten");
Right to restriction: Request restriction of processing of your data;
Right to data portability: Receive your data in a structured, machine-readable format;
Right to object: Object to processing based on legitimate interests;
Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at support@drlidiaverhoeven.com. We will respond within 30 days.

8. Your Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

The right to know what personal information is collected, used, shared, or sold;
The right to delete personal information held by us;
The right to opt out of the sale of personal information — we do not sell personal data;
The right to non-discrimination for exercising your rights.

9. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data in compliance with GDPR.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), encrypted storage, access controls, and regular security assessments. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

The Platform is strictly for users aged 18 and over. We do not knowingly collect data from anyone under 18. If we discover that we have collected data from a minor, we will delete that data immediately and terminate the associated account.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Platform. The "Last Updated" date at the top reflects the most recent revision.

13. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. For Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee.

14. Contact

For any privacy-related inquiries, contact us at support@drlidiaverhoeven.com.

2. Data We Collect

We collect the following categories of personal data:

Account Data

Email address (used for authentication via magic link);
Display name (optional, provided during profile creation);
Date of birth (for age verification);
Account creation date.

Usage Data

Chat messages and interaction history;
Task submissions and proof uploads;
Credit purchase and transaction history;
Session data and protocol progression.

Technical Data

IP address;
Browser type and version;
Device information;
Cookies and similar technologies (see our Cookie Policy).

3. Legal Basis for Processing

We process your data based on the following legal grounds:

Contract performance: Processing necessary to provide the services you requested (account management, credit system, chat functionality);
Legitimate interest: Service improvement, fraud prevention, and security measures;
Legal obligation: Compliance with applicable laws, including age verification requirements and tax obligations;
Consent: Marketing communications and non-essential cookies (where applicable).

4. How We Use Your Data

To provide and maintain the Platform services;

To authenticate your identity and verify your age;

To process credit purchases and manage your account balance;

To deliver AI-generated responses within the chat experience;

To maintain behavioral context within the AI system for continuity of the experience;

To detect, prevent, and address fraud, abuse, or violations;

To comply with legal obligations;

To improve and optimize the Platform.

5. Data Sharing

We do not sell your personal data. We share data with the following categories of third parties, solely for the purposes described:

AI service provider: Chat messages are sent to our AI provider for response generation. Messages are not used to train third-party AI models;
Payment processor: Transaction data necessary for processing credit purchases. We do not store your full payment card details;
Hosting and infrastructure: Cloud service providers that host the Platform and store data;
Email service: Your email address is shared with our email provider for authentication and transactional communications;
Law enforcement: When required by applicable law or valid legal process.

6. Data Retention

We retain your data as follows:

Account data: Retained for the duration of your account plus 30 days after deletion request;
Chat history: Retained for the duration of your account. You may clear your chat history at any time;
Transaction records: Retained for 7 years to comply with Estonian tax law;
Technical logs: Retained for up to 90 days for security and debugging purposes.

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right of access: Request a copy of the personal data we hold about you;
Right to rectification: Request correction of inaccurate personal data;
Right to erasure: Request deletion of your personal data ("right to be forgotten");
Right to restriction: Request restriction of processing of your data;
Right to data portability: Receive your data in a structured, machine-readable format;
Right to object: Object to processing based on legitimate interests;
Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at support@drlidiaverhoeven.com. We will respond within 30 days.

8. Your Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

The right to know what personal information is collected, used, shared, or sold;
The right to delete personal information held by us;
The right to opt out of the sale of personal information — we do not sell personal data;
The right to non-discrimination for exercising your rights.

10. Data Security