Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how Filled collects, uses, and protects your personal data. We believe you deserve to know exactly what happens with your information — and we keep things plain. If something here feels unclear, please reach out: privacy@joinfilled.com.

This policy applies to everyone who visits joinfilled.com or uses our services, regardless of where you're located. We follow the General Data Protection Regulation (GDPR) by default, because it sets the highest standard.

2. Who we are

Filled is operated by:

For any question about your personal data or to exercise your rights under this policy, contact us at: privacy@joinfilled.com.

We respond to all privacy requests within 30 days.

3. What data we collect

We collect only what we need to make Filled work. Here's the complete list:

3.1 — Account data

• • Email address (for login and account access)
• • Subscription tier (Whisper, Flow, Immersion, or Lifetime)
• • Account creation date and last login timestamps

3.2 — Payment data

• • Billing email, name, and country (for invoicing)
• • Subscription history
• • Payment information (card details) — processed and stored by Stripe, never by us

3.3 — Messaging data (Whisper, Flow, and Immersion plans only)

• • Messages you send to Cassandre as part of your subscription
• • Cassandre's replies
• • Timestamps and quota tracking

3.4 — Communications

• • Records of transactional emails sent to you (welcome emails, magic links)

3.5 — Cookies and similar technologies

We use a small number of cookies and tracking tools — most are optional. You're in control through our cookie banner. For the complete breakdown, see our Cookie Policy.

3.6 — Analytics data (only with your consent)

If you consent through our cookie banner, we may collect:

• • Aggregated visit data (pages viewed, time spent, device type)
• • Interaction with our site (clicks, scroll behavior)
• • Anonymized session recordings (no personal identifiers)

You can withdraw this consent at any time via the “Manage cookies” link in our footer.

4. Why we collect this data

Under GDPR, we must have a legal basis for every kind of data processing. Here's ours, in plain terms:

“Contract performance” means: we need this data to deliver the service you paid for. “Consent” means: you actively opted in, and you can opt out anytime.

5. Who we share your data with

We don't sell your data, ever. But to run Filled, we work with carefully selected service providers (“subprocessors”). Each one has signed a Data Processing Agreement with us and complies with GDPR.

We do not share your data with anyone else. We do not sell it to data brokers. We do not use it for purposes you haven't agreed to.

6. International data transfers

Some of our subprocessors are located in the United States (Resend, Vercel, Cloudflare, Google, Meta, Microsoft). When your data leaves the European Economic Area (EEA), we rely on legally approved safeguards:

• • EU-US Data Privacy Framework (DPF): for transfers to providers certified under this framework.
• • Standard Contractual Clauses (SCCs): pre-approved by the European Commission to ensure your data remains protected.

These mechanisms ensure your data benefits from a level of protection similar to GDPR, even when stored or processed outside the EU.

7. How long we keep your data

We keep your data only as long as we need it, then we delete or anonymize it. Here's our retention schedule:

After these periods, your data is either permanently deleted or irreversibly anonymized.

8. Your rights

Under GDPR, you have eight rights regarding your personal data. We honor all of them.

8.1 — Right of access (Art. 15)

You can request a copy of all the personal data we hold about you.

8.2 — Right to rectification (Art. 16)

If any of your data is inaccurate or incomplete, you can ask us to correct it.

8.3 — Right to erasure / “right to be forgotten” (Art. 17)

You can request deletion of your personal data. We will delete what we can, while keeping what we're legally required to retain (mainly invoices, for 10 years).

8.4 — Right to restriction of processing (Art. 18)

You can ask us to temporarily limit how we use your data, in specific circumstances.

8.5 — Right to data portability (Art. 20)

You can request a copy of your data in a structured, commonly used, machine-readable format (JSON or CSV).

8.6 — Right to object (Art. 21)

You can object to processing based on legitimate interests at any time.

8.7 — Right to withdraw consent (Art. 7.3)

You can withdraw any consent you've given at any time:

• • For cookies: click “Manage cookies” in our footer.
• • For future marketing emails: click the unsubscribe link in any marketing email.

8.8 — Right to lodge a complaint

If you believe we haven't handled your data properly, you have the right to file a complaint with your local data protection authority. In France, that's the CNIL (Commission Nationale de l'Informatique et des Libertés):

8.9 — How to exercise your rights

To exercise any of these rights, email us at privacy@joinfilled.com. We respond within 30 days. We may ask you to verify your identity to protect your data from unauthorized requests.

These rights are free to exercise. We won't charge you for any reasonable request.

9. How we protect your data

We take security seriously. Here are the main measures in place:

• • Encrypted connections: all traffic between your browser and Filled is encrypted with HTTPS (TLS).
• • Encryption at rest: data stored in our databases is encrypted on disk.
• • Password-less authentication: we use magic links (no passwords to steal or leak).
• • Two-factor authentication: enabled on all our administrative accounts (Supabase, Stripe, GitHub, Vercel, Cloudflare).
• • Restricted access: only Cassandre has administrative access to Filled's systems.
• • Industry-standard practices: we follow current security best practices for SaaS platforms.

Despite our efforts, no system is 100% secure. If we ever become aware of a data breach affecting your personal information, we will notify you and the relevant authorities within 72 hours, as required by GDPR.

10. Children's privacy

Filled is designed for adults — wellness practitioners running professional retreats, trainings, and workshops. We do not knowingly collect personal data from anyone under the age of 16.

If you believe a minor has provided us with personal information, please contact us at privacy@joinfilled.com and we will delete the data promptly.

11. Changes to this Privacy Policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• • We update the “Last updated” date at the top of this page.
• • For significant changes, we notify active users by email at least 14 days before the changes take effect.
• • The current version is always available at joinfilled.com/privacy.

By continuing to use Filled after we publish a change, you accept the updated policy.

12. Contact us

For any question about this Privacy Policy, your personal data, or to exercise your rights, we're here:

We respond to all privacy requests within 30 days. Often much sooner.