Privacy governance and retention
Version française : Gouvernance et conservation
This page sets out how Studio Korvi inc. governs the personal information HolaTheo handles: who is responsible, how long each kind of information is kept, how it is destroyed, and how to complain. It complements our Privacy Policy, which describes what we collect and why.
Who is responsible
Privacy Officer (personne responsable de la protection des renseignements personnels): President, Studio Korvi inc. — contact@holatheo.com. This is who to write to with any privacy question, request, or complaint.
Roles and access. Studio Korvi inc. is founder-run. The President is the only person with access to our production systems and to personal information, and is also the Privacy Officer; there are no other employees, contractors, or personnel with access. Our service providers (listed in Section 3 of the Privacy Policy) process information only on our instructions, under their contracts with us.
How long we keep each kind of information
- Practice transcripts, feedback, and the coach's cut; texting threads; coach chat; coaching notes, weekly digests, and progress summaries; custom scenes you write; missions and your reflections on them; drills and practice scores; your intake answers; streaks and level progress; content reports; usage and analytics events — kept for the life of your account and deleted with it.
- Prepared moments ("Prep a real moment") — deleted 30 days after creation.
- Scene previews you never started — discarded after about one day.
- Conversations you began but did not finish — finalized after about 30 days of inactivity (your coaching is generated then); the transcript is kept like any other.
- Photos and voice recordings — never stored. A photo is discarded as soon as its feedback is produced; the "Voice confidence" recording is deleted immediately after analysis; in normal conversations there is no server-side audio at all (transcription happens on your device).
- After you delete your account — the irreversible sign-in hash described in Section 4 of the Privacy Policy is kept indefinitely; the two balance-restoration values are kept for 30 days or until a paid subscription period ends, whichever is later, then erased. Records the law requires us to keep are the only other exception.
Our AI provider (Anthropic) deletes the text we send it from its systems within 30 days under its own terms, longer only where its safety policies require.
Dormant accounts
Accounts with no activity for 24 months may be deleted along with all their content. "Activity" means any use of the App — a conversation, a message to the coach, a drill, a purchase, or an active paid subscription. An account with unused paid credits or an active paid subscription is never treated as dormant. A dormant account is removed exactly as one you delete yourself (see below), with one difference: because you did not ask for the deletion, we do not keep the sign-in hash described in Section 4 of the Privacy Policy — if you ever return, you start fresh.
How we destroy information
When an account is deleted — by you, in the App or by email, or under the dormant-account rule — every database record belonging to it is permanently deleted with a hard SQL delete, in a single transaction, so the account is removed completely or not at all. Time-limited items in the schedule above (prepared moments, un-started previews, the balance-restoration values) are removed by an automated job that runs every hour. We keep no copies of your content outside our database. Our hosting provider's automated database backups age out within the provider's backup window, after which deleted information no longer exists anywhere we control. Photos and voice recordings are never written to storage in the first place.
Complaints
If you believe we have mishandled your personal information, write to the Privacy Officer at contact@holatheo.com. We acknowledge every complaint, look into it, and send you a written response within 30 days. If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), or with the privacy regulator where you live.
Requests about your information
You can ask to access, correct, or delete your information, or withdraw consent, at any time — see Section 4 of the Privacy Policy. Account deletion is available directly in the App (Profile → Delete account) and at our account-deletion page.
Changes
We review this page whenever the App's handling of personal information changes, and post updates with a new effective date.