Privacy Notice

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

2. What data we collect and why

When you create an account and use attach., the following data is stored on our servers:

• Email address. Used to send your sign-in link. Stored in our authentication system. No password is ever created or stored.
• Profile information. Your display name and pronouns (optional), which you provide during onboarding. Stored in your account record.
• Assessment results. Your responses to the onboarding assessment and the scores derived from them (attachment style, schema scores, Gottman patterns). These are used to generate your workout plan and personalise the Doctor’s debrief. Stored in your account record.
• Workout plan. The personalised practice plan generated from your assessment results. Stored in your account record.
• Session data. Each completed practice session is saved, including: the character used, the full conversation transcript, the Doctor’s debrief (pattern identified, schema activated, contact score, offline challenge), and the session date. This data is used to track your progress over time and to give the Doctor longitudinal context in future sessions.

We do not run advertising, analytics, or tracking. We do not sell or share your data with third parties for commercial purposes.

3. Legal basis

The legal basis for processing your personal data is Art. 6(1)(b) GDPR — processing necessary to perform the service you have requested. Without your email address we cannot authenticate you. Without your assessment results we cannot generate a plan. Without session data the longitudinal features of the app (progress tracking, Doctor context, graduation) cannot function.

4. Cookies and session management

attach. uses strictly necessary cookies to maintain your login session. These are set by our authentication provider (Supabase) when you sign in and are required for the service to function. No tracking, advertising, or analytics cookies are used.

Under TTDSG § 25(2) Nr. 2, consent is not required for cookies that are strictly necessary to deliver a service explicitly requested by the user.

5. Data processors

We use the following third-party processors to deliver the service. Each processes data on our behalf under a data processing agreement consistent with GDPR Article 28.

• Supabase, Inc. (San Francisco, CA, USA — data hosted in EU region) — authentication, database storage of all account and session data. Standard contractual clauses apply for any international transfers. See supabase.com/privacy.
• Mistral AI SAS. (15 rue des Halles, 75001 Paris, France — EU based) — AI processing of conversation messages and debrief generation. Messages are transmitted to Mistral in real time for processing. See mistral.ai/terms.
• Vercel Inc. (340 Pine Street, Suite 701, San Francisco, CA 94104, USA) — application hosting and server infrastructure. Standard server log data (IP address, timestamp, request path) may be collected for security and operational purposes. Standard contractual clauses apply.

6. Data retention

Your data is retained for as long as your account is active. If you delete your account via Settings, all personal data — including your profile, assessment results, workout plan, and session transcripts — is permanently deleted immediately. There is no recovery after deletion.

You can export a complete copy of your data at any time from Settings before deleting your account.

7. Your rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR) — use the Export function in Settings
• Right to object (Art. 21 GDPR)

You can exercise your right to erasure and data portability directly in the app via Settings → Export / Delete account. For all other requests, contact us at hello@attach.app.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for our location is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

8. Changes to this notice

We may update this privacy notice from time to time. The date at the top of this page indicates when it was last revised. Continued use of the service after changes constitutes acceptance of the updated notice.