iState Privacy Policy
Last updated: 8 November 2026
This policy explains what personal data iState collects, why, how long it is kept, who processes it, and what rights you have. iState is currently an early demo version.
1. Who we are
iState ("we", "us") is operated by iSpace Intelligence Solution (United Arab Emirates, IFZA licence), which is the data controller.
Contact for any privacy question or request: office@istate.life.
2. What iState is — and is not
iState offers short guided self-reflection sessions ("journeys") with an AI mentor called Mira. iState is not medical care, psychotherapy, counselling or an emergency service. Mira is an AI, not a human.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, account ID, interface language, sign-in timestamps | You |
| Onboarding answers | Your short answers on the onboarding screens | You |
| Consent records | Which consents you gave or withdrew, the version of the text and the time | You / the app |
| Wellbeing data | Your self-rated state (1–10), energy level, the words you choose to describe your state before and after a journey, your personal goal for the journey ("Point B") and the journey report | You / generated by the AI from your session |
| Journey conversation | The messages you exchange with Mira during a journey | You / the AI |
| Round Table conversation | Your questions and the replies of the AI characters and Mira | You / the AI |
| Technical data | Device and browser type, IP address in server logs, error codes | Automatically |
| Product analytics (only with your consent) | Which screens you open and which buttons you press, without any texts you write | Automatically |
| News (only with your consent) | Your email address on our mailing list | You |
Your state ratings, goals, reports and journey messages can reveal information about your mental wellbeing. We treat them as special category (health-related) data and process them only with your explicit consent (see section 4).
We do not knowingly collect data from anyone under 18. iState is not intended for children.
4. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create your account and sign you in by email link | Account data | Performance of a contract (Art. 6(1)(b)) |
| Run a journey or the Round Table: send your messages and context to the AI model, keep the session, apply time limits and safety rules | Wellbeing data, journey and Round Table conversations | Your explicit consent (Art. 9(2)(a)) and performance of a contract (Art. 6(1)(b)) |
| Show your report, state history and avatar | Wellbeing data | Your explicit consent (Art. 9(2)(a)) |
| Keep the service secure, prevent abuse, fix errors | Technical data | Legitimate interests (Art. 6(1)(f)) |
| Understand how the product is used, without reading your texts | Product analytics | Your consent (Art. 6(1)(a)) |
| Send you news about iState | Your consent (Art. 6(1)(a)) | |
| Keep proof of your consents | Consent records | Legal obligation (Art. 6(1)(c)) and legitimate interests |
You can withdraw any consent at any time (section 8). Withdrawing does not affect processing before withdrawal. Without the explicit consent for wellbeing data we cannot run a journey.
We do not use your data to train AI models, and we do not sell it. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
5. How long we keep data
| Data | Retention |
|---|---|
| Journey conversation (messages) | Deleted automatically when the journey closes. If a journey is abandoned, deleted no later than 24 hours after it started |
| Round Table conversation | Deleted when you end it, and no later than 24 hours after it started |
| Wellbeing data and reports | Until you delete them or your account |
| Account data and consent records | Until you delete your account; consent records may be kept up to 3 years after that to prove compliance |
| Technical logs | Up to 30 days; logs never contain the texts of your journeys |
| Product analytics | Up to 12 months, or until you withdraw consent |
| Mailing list | Until you unsubscribe |
6. Who processes your data
We use the following service providers (processors). They process data only on our instructions.
| Provider | Role | Data | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting | All data passing through the app | Functions in Frankfurt (EU, fra1); company in the USA |
| Neon | Database | Account, consent, wellbeing data, reports, temporary journey messages | Frankfurt, EU (eu-central-1) |
| Resend | Sign-in emails | Email address | Ireland, EU (eu-west-1); company in the USA |
| OpenRouter, Inc., which forwards each request to the AI model provider (Anthropic, OpenAI or Google) | Generates Mira's replies and the report | Journey messages, Point A, Point B, onboarding answers needed for the journey, Round Table questions and replies | USA. We configure OpenRouter not to store the texts and to use only providers that do not train models on API data; providers may keep requests for a limited time for abuse monitoring under their API terms |
| PostHog (EU Cloud) — only with consent | Product analytics | Usage events without texts | EU |
Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as offered by the provider.
7. Security
Data is encrypted in transit. Access is limited to the people who operate iState. API keys are kept on the server only. Logs and analytics never contain the texts you write.
8. Your rights
You have the right to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to processing, and withdraw consent at any time. To use these rights, write to office@istate.life. We answer within one month.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
9. Cookies and local storage
We use one essential cookie to keep you signed in. Product analytics run only after you agree to them. We do not use advertising cookies.
10. Changes
If we change this policy, we will update the date above and, for significant changes, tell you in the app or by email.
11. Contact
iSpace Intelligence Solution, office@istate.life.