Privacy and Cookies

The data controller is Pivo7 OÜ (registry code 16069608, VAT EE102300873), Kotkapoja tn 2a-10, 10615 Tallinn, Estonia. For any privacy question or request, write to team@1hprotocols.com.

• Account: your email, an optional first name, your password (stored only as a one-way hash), your language and your time zone.
• Program data: your answers to program questions, your progress, your protocol, your check-in answers, ratings and notes. Some answers, for example about your sleep, drinking or weight, can relate to your health.
• Free part: before you create an account, your answers stay in your own browser.
• Purchases: what you bought, the amount, the currency and the payment status. Card details are handled by Stripe and never reach us.
• Emails: a record of the emails we send you (for example check-ins) and whether they were delivered.
• Waitlists: your email, the program, the language you used and your optional note.
• Reviews and ratings: your stars, ratings, comment and first name, and whether you agreed to have your comment shown.
• Bug reports: your message, the program, the screen you were on, your optional email and your browser type.
• Company plans: if your employer gives you program credits, your membership of that plan and the credits you received and used. If you ask us for a quote: your name, work email, company, company size and message.
• Invites: your personal invite code. If you arrived through someone's invite link, we keep that code in a cookie for 60 days. If you then buy, we record that you were invited by that person, so we can give them their free program. We never tell them who you are or what you bought.
• Technical data: to show you prices in the right currency, we read the country your connection comes from. We use it at that moment and don't store it with anything about you. We also keep anonymous counts of how many visits reach each step of a program (for example, opening it or finishing the free part), grouped by country, device type, system, browser and the site or post that brought you. These counts contain no IP address, name or cookie, and can't identify you. Our hosting provider keeps short-lived server logs for security.

• To provide the programs and build your protocol (contract, GDPR art. 6(1)(b)). Because some answers can relate to your health, we process them only with your explicit consent, which you give when you create your account (art. 9(2)(a)). You can withdraw it at any time, but we then can't build or show your protocol.
• Check-in emails after you finish a program (contract and our legitimate interest in following up on the service you bought). You can stop them with one click.
• Improving the programs with de-identified answers, only if you opted in (consent). You can change this in your account at any time.
• Payments, invoices and accounting (contract and legal obligation: Estonian accounting law requires us to keep accounting records).
• Publishing a review, only if you agreed to it (consent).
• Answering quotes, support requests and bug reports (legitimate interest, or steps before a contract).
• Security and preventing abuse (legitimate interest).
• Running the invite programme (contract with the person who invited you, and our legitimate interest in rewarding recommendations).

We never sell your data and never use it for advertising.

• Service providers who process data for us: Stripe (payments), Resend (sending email) and Vercel (hosting) and Supabase (database). They may only use your data to provide their service to us.
• Google (Google Analytics), only if you accept analytics cookies: how you found and used the site (pages viewed, device, browser, approximate location, the site or campaign that brought you). Google never receives your program answers, your protocol or your check-ins. We use it to understand how people use the site and to reach more people through Google's services.
• LinkedIn (LinkedIn Insight Tag), only if you accept analytics cookies: the pages you view, your browser and device, and, if you are signed in to LinkedIn, that a LinkedIn member visited, so LinkedIn can measure our campaigns and show our ads to similar people. LinkedIn shows us only grouped, anonymous figures, never who you are. It never receives your program answers, your protocol or your check-ins.
• Meta (Meta Pixel, for Facebook and Instagram), only if you accept analytics cookies: the pages you view, your browser and device, and Meta's cookie identifiers, so Meta can measure our campaigns and show our ads, on Facebook and Instagram, to you and to similar people. Meta shows us only grouped, anonymous figures, never who you are. It never receives your program answers, your protocol or your check-ins.
• Your employer, if you joined through a company plan: only that you joined, the credits you received and used, and anonymous totals for groups of five people or more. Never which programs you take, or your answers, progress or protocol.
• Authorities, only when the law requires it.

Some of our service providers are based outside the European Economic Area, for example in the United States. Where they are, the transfer is protected by the European Commission's adequacy decisions (such as the EU-US Data Privacy Framework) or by Standard Contractual Clauses.

• Account and program data: until you delete your account. After deletion we erase it, except where the law requires us to keep something.
• Purchase and accounting records: for the period required by Estonian accounting law (currently 7 years).
• Waitlist entries: until the program opens and we have told you, or until you ask us to remove you.
• Reviews: until you ask us to remove them, or delete your account.
• Emails, bug reports and quote requests: only as long as we need them to deliver the service and answer you, and we review them regularly.
• Invites: the record that you were invited is kept while either account exists, and at most as long as the purchase records.

You can ask to see, correct, delete, restrict or receive a copy of your data, and object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time. You can download all your data or delete your account yourself from your account page; for anything else, write to team@1hprotocols.com. We answer within one month.

You also have the right to complain to a supervisory authority: in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee); in the UK, the Information Commissioner's Office (ico.org.uk); or the authority in the country where you live.

You must be at least 13 to create an account. Children aged 6 to 12 can use the sleep program only together with a parent or carer, through the adult's account, so no account is created for the child.

We use encrypted connections (HTTPS), store passwords only as one-way hashes, limit who can access data, and keep data with providers that meet recognized security standards. No system is perfectly secure; if a breach affects your data, we will tell you and the authority as the law requires.

The site needs these to work:

• A sign-in cookie keeps you logged in. It is strictly necessary.
• A language cookie remembers the language you chose.
• Browser storage: the program player saves your progress in your browser, so you don't lose your place.
• An invite cookie, only if you open someone's invite link. It holds their invite code for 60 days, so your first purchase counts for them.

Analytics cookies, only with your consent. If you tap Accept, Google Analytics, the LinkedIn Insight Tag and the Meta Pixel set cookies that count visits and show how people find and use the site, including to build audiences for promoting 1h Protocols on Google's services, on LinkedIn, and on Facebook and Instagram. Google's script is on every page, but it sets no cookies and sends no measurements until you accept, and pages with private links (check-ins, password resets) are never measured. You can change your choice at any time with the "Cookie settings" button below. Our own page counts stay cookie-free, and fonts are served from our own site.

If we change this policy in a way that matters to you, we will tell you by email or on the site before the change takes effect.

Pivo7 OÜ · Kotkapoja tn 2a-10, 10615 Tallinn, Estonia · team@1hprotocols.com