Privacy Policy

ActualOS is operated by Constantin Cristian Armeanu, Sole Trader, Oakland Ave, Haslington, Crewe CW1 5PB, United Kingdom. The operator is the controller of personal information processed through ActualOS.

Email: contact@cristianarmeanu.com.

• Account and profile: name, email, verification status, optional image, job title, biography, timezone and preferences.
• Authentication and security: password hashes, session and verification records, login timestamps, IP address, user agent and rate-limit information. We do not store plaintext passwords.
• Your content: projects, objectives, tasks, categories, calendar data, notes, routines, priorities, time sessions, interruptions and reviews.
• Optional wellbeing information: mood, sleep, energy, focus, movement, nutrition and related notes. This may constitute health or other special category personal data.
• Billing: plan and subscription status, Stripe identifiers, selected price, renewal/cancellation state and payment status. Stripe and Link collect payment, billing-address and tax information at Checkout; ActualOS does not receive or store complete card numbers or CVCs.
• Support and technical: support messages, essential cookies, browser preferences, server logs and diagnostics needed to operate and secure the service.
• Bulma: questions, conversation history, generated answers and plans, feedback, usage metadata, and the names and contents of files or images you choose to attach. Bulma may also receive the relevant tasks, projects, calendar commitments, work schedule, productivity statistics and wellbeing context needed to answer your request.

Where wellbeing information constitutes special category personal data, we process it on the basis of your explicit consent under Article 9(2)(a) UK GDPR, alongside the applicable Article 6 lawful basis. Entering data by itself is not treated as explicit consent: ActualOS asks for a separate affirmative consent and records the time and policy version.

You may withdraw wellbeing consent from Wellbeing. Withdrawal blocks new Wellbeing entries unless you consent again; it does not affect processing lawfully carried out before withdrawal and does not automatically erase existing entries. Delete existing wellbeing information using Settings → Data & Privacy.

We disclose only information reasonably necessary to operate the service:

• Hostinger provides deployed application infrastructure and MySQL database hosting.
• Stripe and Link provide Checkout, subscriptions, invoices, fraud prevention and transaction support. For sessions configured with Managed Payments, Link acts as merchant of record and handles applicable indirect-tax calculation and remittance under its terms.
• The configured SMTP provider receives recipient addresses and message content needed for verification, password reset and service email. Its identity depends on the server configuration.
• OpenAI provides the API models used by Bulma and receives the prompts, relevant ActualOS context, attachments and instructions needed to generate the requested response. ActualOS requests do not ask OpenAI to persist responses, and OpenAI states that API inputs and outputs are not used to train its models by default. OpenAI may retain API content in abuse-monitoring logs for up to 30 days unless a different approved retention control or legal requirement applies.

Authentication is implemented within ActualOS using Better Auth and the application database, not a separate external recipient. We do not sell personal information. We may disclose information when required by law, to protect rights/security, or during a genuine business transfer.

See the Stripe Privacy Policy, Link Privacy Policy and OpenAI Privacy Policy.

Some providers may process information outside the UK, although this does not mean every provider makes an international transfer. Where required, we use UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another lawful transfer mechanism.

You may contact us at contact@cristianarmeanu.com for further information about the safeguards applicable to international transfers of your personal data.

• Account content is retained while active or until you delete the relevant record, module or account.
• Bulma conversation text, generated responses and planning metadata are retained in ActualOS until the conversation or account is deleted. Attached file names may be recorded with the conversation; the uploaded file itself is processed for the request and is not stored as a reusable file in ActualOS.
• OpenAI may retain API inputs and outputs in abuse-monitoring logs for up to 30 days under its default API controls, unless legally required to retain them longer.
• Tasks in Trash are automatically purged after 25 days unless restored sooner.
• Sessions and verification/reset records expire according to their configured security purpose.
• Billing records are retained where needed for contracts, disputes and UK tax/accounting duties, commonly up to six years where law requires.
• Security and operational logs are kept only as long as reasonably necessary.

Account deletion removes active application records. Limited access-controlled backups may retain residual copies temporarily until overwritten or deleted in the hosting provider’s ordinary backup lifecycle; the exact schedule depends on that provider.

Subject to applicable conditions and exceptions, you may request access, rectification, erasure, restriction, object, receive portable data, and withdraw consent. Withdrawal does not affect processing lawfully carried out before withdrawal. Export, module deletion and permanent account deletion tools are available in Settings.

You may complain to the UK Information Commissioner’s Office at ico.org.uk. EEA residents may also contact their local supervisory authority.

We use HTTPS, password hashing, authenticated access controls, same-origin protections, restricted server-side secrets and verified Stripe webhooks. No internet service can guarantee absolute security.

ActualOS is not directed to children under 16 and we do not knowingly collect their personal information.

Wellbeing features are optional informational and self-tracking tools. ActualOS is not a medical device, diagnostic service, medical advice, mental-health treatment or an emergency service. Seek appropriate professional or emergency help where needed.

See our Cookie Policy. We may update this policy when the service or legal requirements change and communicate material changes where appropriate.