Privacy Policy
Version 2.0 · Last updated 14 October 2026 · Effective from the date of publication on aikaya.net
This notice explains how Tenchi DWC-LLC processes personal data on aikaya.net. It is written to meet the EU General Data Protection Regulation (GDPR), which applies to us because we offer our services to people in the European Union, and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), which applies to us as a UAE company.
1. Who is responsible
1.1 Controller: Tenchi DWC-LLC, a limited liability company registered in the Dubai South free zone under registration number 12600 (trade licence 13642), Business Centre, Floor 3, Building A3, Business Park, Dubai South, Dubai, United Arab Emirates ("Aikaya", "we"). Privacy contact: privacy@aikaya.net. We have not appointed a data protection officer because the law does not require one for our processing; the privacy contact handles all requests.
1.2 Our representative in the EU (GDPR Art. 27): we are appointing a representative in the EU; their details will be published here and in the Legal Notice once appointed. Until then, contact us directly at privacy@aikaya.net.
1.3 Creators are separate controllers. When you buy from a Creator or give her your e-mail address, that Creator receives your name, e-mail address and purchase details and uses them for her own purposes, under her own responsibility. Where we process data on a Creator's instructions (for example, her audience list), we act as her processor under our Data Processing Agreement. Each Creator's Privacy Notice, linked on her storefront, explains how she uses your data.
1.4 Creators and Stripe are separate controllers. When you buy from a Creator, that Creator receives your name, e-mail address and purchase details and uses them for her own purposes, under her own responsibility and her Privacy Notice. Her Stripe account processes your payment; Stripe acts as the Creator's provider and, for some purposes such as fraud prevention and regulatory compliance, as an independent controller under its own privacy policy (stripe.com/privacy).
2. What we process, why, and on what basis
| Purpose | Data | Lawful basis (GDPR Art. 6) | Kept for |
|---|---|---|---|
| Account and sign-in | E-mail, optional name, locale, time zone; one-time sign-in tokens; session identifiers, IP address, browser user agent | Contract (b) | Tokens until expiry (15 min), purged daily; sessions until expiry (30 days); account until closure |
| Terms acceptance record | Terms version, date and time, wording accepted, IP address | Legitimate interest in proving the contract (f) | Life of the account plus the limitation period; IP removed on account deletion |
| Providing purchased and free Products; the hosting commitment | Entitlements, purchase references (Stripe IDs, amount, currency) | Contract (b) | Access data until access ends; purchase records as in the next row |
| Records of sales made through the Platform | For each sale: order and transaction reference, Product, price, currency, date, and the Buyer's billing country. For each selling Creator: name, postal address, e-mail and, where available, VAT or tax number | Legal obligation (c) where tax law requires platforms to keep such records (for example Article 242a of the EU VAT Directive); otherwise legitimate interest in proving transactions and answering tax authorities (f) | 10 years from the end of the year of the sale, including after the account is closed; then deleted |
| Playback, resume position, audio-only and captions | Watch progress and playback events | Contract (b) | 6 months, then deleted |
| Creator storefront and publishing | Handle, display name, bio, images, country, currency, Content, attestations, team members' e-mails; trader status, legal name, postal address and VAT/tax number | Contract (b) | Account life; then wind-down under the Terms |
| Aikaya's own billing to Creators | Plan, Extra Traffic and invoice records; Stripe customer and subscription IDs | Contract (b); legal obligation (c) — UAE tax and accounting record-keeping | 7 years from the end of the tax period |
| Content screening and notice-and-action | Transcripts and text of Content; reports and reporter contact details; decisions and statements of reasons | Legal obligation under the Digital Services Act (c); legitimate interest in a safe platform and in keeping our payment provider's approval (f) | 3 years |
| Marketing e-mails from a Creator | E-mail, consent wording, time, IP address | Consent (a), collected separately and never a condition of access | Until consent is withdrawn; consent record kept as proof for 3 years after |
| Security, fraud and abuse prevention; rate limiting | IP address, request metadata, audit logs | Legitimate interest (f) | Rate-limit counters minutes to hours; audit logs 2 years; webhook records 90 days |
| Aggregate practice statistics for Creators | Approximate country and time zone derived by our host from the connection, and device type from your browser, only if you accept statistics in the cookie banner. Stored only as anonymous counters; without consent these fields are recorded as "unknown" | Consent (a), and ePrivacy Directive Art. 5(3) | Counters contain no identifier and are kept while the class exists |
| Website audience measurement | Time of the page view, page address and route, referrer, filtered query parameters, approximate location (country, region, city), operating system, browser and device type, via Vercel Web Analytics (no cookies; a hash of the request counts visits) | Consent (a) and ePrivacy Directive Art. 5(3) — loaded only after you accept in the banner | Aggregated; visitor hash discarded after 24 hours |
| Complaints and legal claims | Correspondence | Legal obligation (c); legitimate interest (f) | Limitation period |
2.1 Where we rely on legitimate interest, you may object (section 7). We do not sell personal data, show advertising, or build profiles for marketing.
2.2 You must give the data marked as needed for an account or a purchase; without it we cannot provide that service. Everything else is optional.
3. Wellness content and health information
3.1 Most classes on Aikaya (general yoga, meditation, breathing, movement) say nothing about anyone's health, and we treat purchase and watch data for them as ordinary personal data. We do not ask for health information, do not infer it, and do not profile anyone on it. We keep individual watch data for six months only, never show it to Creators, and give Creators only anonymous totals.
3.2 Please do not send health information to us or to Creators through the Platform. Creators may not collect it through Aikaya.
3.3 Health-related classes. Some classes are named for a general health or wellbeing state, for example pregnancy, sleep or back pain (Content Policy §4.3); they remain general practice, not treatment. Buying or watching one could suggest information about your health. We use purchase and viewing data only to supply the Product, keep your access and keep the records the law requires; we never use it for advertising or profiling, and we share it only with the Creator who sold the Product and with Stripe, which processes the payment.
4. Automated processing
4.1 We check Content text and machine transcripts automatically for words and claims our Content Policy restricts. A person reviews every flag before any measure is taken. No decision producing legal or similarly significant effects on you is made solely by automated means.
4.2 Captions and translations are produced by speech-recognition and translation models. A Creator's voice recording is processed for this purpose.
5. Who receives data
5.1 Creators — as described in 1.3 and in the Terms (Part C §C9).
5.2 Stripe — processes payments for Creators' sales as described in 1.4, and processes the billing of Aikaya Plans and Extra Traffic for us.
5.3 Service providers (processors) acting on our instructions under written agreements: Vercel (hosting, file storage, analytics), Neon (database), BunnyWay (video and audio hosting and delivery), Cloudflare (speech-to-text and translation), Resend (e-mail delivery) and Upstash (rate limiting). The current list, with locations, is in the Data Processing Agreement, Annex 3.
5.4 Our EU representative, once appointed, where needed to answer you or an authority.
5.5 Authorities, where the law requires, including under Digital Services Act Art. 18.
5.6 A buyer of our business or a company in our group, if the Platform is transferred; you will be told in advance.
5.7 Our professional advisers — accountants and lawyers, under a duty of confidentiality, where needed for accounting, tax or legal advice.
6. Where your data is, and transfers
6.1 Our database and application functions run in EU data centres (Frankfurt, Germany). Your data is stored there.
6.2 We are established outside the EEA. Tenchi DWC-LLC is a company in the United Arab Emirates, a country for which the European Commission has not adopted an adequacy decision. When you give data to us directly, you give it to a controller outside the EEA. When our EU-hosted providers make your data available to us, including when we sign in from the UAE to run the Platform, that transfer is covered by the European Commission's Standard Contractual Clauses between the provider and us. We keep data in the EU and do not copy it to systems in the UAE.
6.3 Some of our providers (Vercel, Neon, Cloudflare, Resend, Upstash) are US companies or give support from the United States, and Stripe is an Irish company with group companies in the US. Those transfers rely on an adequacy decision (the EU–US Data Privacy Framework for certified US providers) or on the Standard Contractual Clauses in the provider's data processing agreement.
6.4 You may ask us for a copy of the safeguards at privacy@aikaya.net.
7. Your rights
7.1 You have the right of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and to withdraw consent at any time without affecting earlier processing.
7.2 You can download your data and delete your account yourself in account settings. Deletion deactivates the account at once and anonymises it after 30 days, during which you can restore it. Records we must keep by law are retained, linked only to the anonymised account.
7.3 For anything else, write to privacy@aikaya.net or, once appointed, to our EU representative (1.2). We reply within one month; this may be extended by two months for complex requests, in which case we tell you why.
7.4 You may lodge a complaint with the data protection supervisory authority of the EU or EEA country where you live, work, or where you think an infringement took place. A list is at edpb.europa.eu.
8. Security
8.1 We use encryption in transit, operator-only access with two-factor authentication, signed and expiring playback links, rate limiting, logging with personal data redacted, and regular dependency and security reviews. If a personal data breach is likely to result in a risk to you, we notify the competent supervisory authorities within 72 hours and, where the risk is high, tell you without undue delay.
9. Age
9.1 Accounts are for people aged 18 or over. You must be 18 or older to create an account or use the Platform. If we learn we hold data of a person under 18, we delete it.
10. Cookies
10.1 See the Cookie Policy.
11. Changes
11.1 We will post changes here and, for material changes, notify account holders by e-mail before they apply.