Privacy Notice

1. Who we are

CalmShift is operated by Xcellent Innovators, LLC. For the purposes of applicable data protection law, Xcellent Innovators, LLC is the data controller for the personal data described in this notice.

2. What we collect

• Account data — your email address and login credentials.
• Wellness check-ins — mood and stress scores and any notes you choose to save, plus burnout assessment responses.
• Usage data — which exercises you use and when, so we can show your progress.
• Support messages — if you contact us.
• Technical data — device and browser information and IP address used for security and service operation.

3. How we use it and why

• Creating and managing your account and providing the service (performance of our contract with you).
• Security, fraud prevention, and product improvement (our legitimate interests).
• Customer support (performance of contract and legitimate interests).
• Meeting legal obligations (legal obligation).
• Occasional product updates or marketing, where you have consented; you can withdraw consent at any time.

CalmShift is confidential by design: your check-in scores and notes are visible only to you, and we do not sell your personal data.

4. Who we share it with

• Service providers that help us host and operate CalmShift (cloud hosting, analytics, support tooling), under contracts that protect your data.
• Paddle, the Merchant of Record for our orders, which handles the sale, subscription management, payments, tax compliance, and invoicing. Payment card details are collected and processed by Paddle; we never see or store your full card details.
• Professional advisers (legal, accounting) where necessary.
• Authorities, where required by law.

5. International transfers

Some service providers may process data outside the UK or EEA. Where this happens, we use appropriate safeguards such as adequacy decisions or standard contractual clauses.

6. Retention

We keep your data only as long as needed to provide the service and meet legal obligations. When it is no longer needed, it is deleted or anonymised. You can request deletion of your account at any time.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your data, to object to processing, and to withdraw consent. If you are in the UK or EEA, you also have the right to complain to your supervisory authority; we aim to respond to requests within one month. To exercise any right, email support@calmshift.today.

8. Security

We use appropriate technical and organisational measures — including encryption in transit and at rest, access controls, and row-level isolation of your records — to protect your personal data.

9. Cookies

We use essential cookies needed to keep you signed in and operate the service. We do not use marketing cookies. Any analytics cookies are used only to improve the product, and you can manage cookie preferences through your browser settings.

10. Contact

Privacy questions or requests: support@calmshift.today.