Privacy Policy

This Privacy Policy explains how XQ Ventures Ltd (“Olum”, “we”, “us”) collects, uses, and protects your information when you use https://witholum.com and the Olum application (the “Service”).

Who we are

The data controller is XQ Ventures Ltd (registered in England and Wales, company number 16942722; registered office: [ADDRESS PENDING]). For any privacy question, contact xav@witholum.com.

Information we collect

• Account information: your email address (we use a passwordless magic-link sign-in) and any name you provide.
• Health-related check-in data: information you choose to enter about your tinnitus experience, such as perceived loudness, how much it bothers you, and sleep quality, together with your use of the program and exercises. This relates to a health condition and we treat it with extra care.
• Payment information: your subscription is processed by Stripe. We do not store your full card details; Stripe processes them as a separate controller/processor under its own terms and privacy policy.
• Usage and device information: how you interact with the Service, plus standard technical data (device type, browser, IP address, approximate location, and similar) collected via cookies and similar technologies.

How we use your information

• To provide and personalise the Service (deliver the program, exercises, check-in trends, and soundscapes).
• To manage your account, subscription, and billing.
• To communicate with you about the Service (e.g. sign-in links, service updates, support).
• To improve and secure the Service and understand how it is used.
• To comply with our legal obligations.

Legal bases (UK/EU GDPR)

Where GDPR applies, we rely on: performance of our contract with you (to provide the Service and process your subscription); your consent (for example, for certain analytics/marketing technologies and, where required, for processing your health-related check-in data); our legitimate interests (to secure and improve the Service); and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time.

How we share information

We share information with service providers who process it on our behalf, including: hosting and database infrastructure (Supabase), payment processing (Stripe), email delivery, voice/audio generation (ElevenLabs), and analytics/advertising measurement. These providers act under contract and only process data as needed to provide their service. We may also disclose information where required by law, or in connection with a business transfer. We do not sell your personal information for money.

Cookies, analytics, and advertising

We use cookies and similar technologies for essential functionality, analytics, and advertising measurement (which may include tools such as Google Analytics and the Meta Pixel). Some of these are only used with your consent where required. You can control non-essential cookies through our cookie controls and your browser settings. Because Olum relates to a health condition, we take particular care over what data is shared with advertising tools.

International transfers

We may process information in countries outside your own. Where we transfer personal data internationally, we use appropriate safeguards (such as standard contractual clauses) where required by law.

Data retention

We keep your information for as long as your account is active and as needed to provide the Service, then for any period required to meet legal, accounting, or reporting obligations. You can ask us to delete your account and associated data (see your rights below).

Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your data; to object to or restrict certain processing; and to withdraw consent. If you are in the UK/EU, you may also lodge a complaint with your data protection authority. If you are in California, you have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of “sharing” of personal information, and not to be discriminated against for exercising them. To exercise any right, contact xav@witholum.com.

Security

We use technical and organisational measures designed to protect your information, including access controls and encryption in transit. No system is perfectly secure, but we work to protect your data and to respond appropriately to any incident.

Children

The Service is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 18.

Changes

We may update this policy. We will post the updated version with a new effective date and, where appropriate, notify you.

Contact

XQ Ventures Ltd (registered in England and Wales, company number 16942722; registered office: [ADDRESS PENDING]) — xav@witholum.com.