Hey Feelings™ Privacy Policy

Last updated: 5 October 2026

1. Controller and scope

The controller of your personal data is Tales Labs sp. z o.o., the company behind Hey Feelings™, with its registered office at Nowolipie 2B/9, 00-150 Warsaw, Poland, tax identification number (NIP): 5252939328. For privacy matters and rights requests, email kontakt@heyfeelings.com or write to that postal address.

This policy covers heyfeelings.com, the user account area, courses, the game at play.heyfeelings.com, forms, newsletters, orders and communications with us. The data involved depends on the features you use.

2. Data we receive and its sources

Account: email, first and last name, role, settings, email verification information and session identifiers and dates. For password sign-in, we store a protected password hash, not a readable password.
Google, Facebook or Apple: the provider's account identifier, email, available first name and, where supplied, email verification information. Apple may provide a forwarding address instead of your usual email. We do not obtain friends lists, private messages or posts. Choosing this sign-in method does not consent to newsletters or advertising.
Access and licences: code activations, entitlements, licence and institution assignments, user seats and invitation history. A licence manager may provide your email to invite you. We may also receive an institution representative's contact details from the institution or the partner handling an order. We provide source information when first contacting or inviting you.
Courses: progress, playback position, percentage watched, quiz results and answers, open responses and your notes. Certificates contain the participant's name, course title, completion date, number and status.
Game: session identifier, time and configuration, world and language, counts of dice rolls, moves, cards, dialogues, diamonds and boosters, and completion. For signed-in users, statistics are linked to the adult's account and, where relevant, a licence and institution. Saved games and some settings also remain in browser storage. The demo stores a session identifier, roll count, timing and end reason, and token and IP hashes to prevent abuse. An IP hash or session identifier does not make data anonymous.
Orders and bookings: offer, buyer or institution representative contact details, organisation name, required invoice details, amount, currency, payment, subscription and fulfilment identifiers and statuses. Training bookings may include the institution, date, participant count, contact person and phone number. For Stripe payments, you supply payment instrument details to Stripe; we do not store full card numbers or CVC codes.
Training funding applications: name, email, institution details entered in the form, offer, document content, assigned representative, consent and contact information, and generation and delivery status. Download tokens protect documents; IP hashes help prevent abuse.
Contact, newsletters and activation survey: contact information, messages, requests and replies, newsletter preferences and consent change dates and sources. The survey covers use of similar tools and how you heard about the brand. Older accounts may retain a previously supplied number of children in a group, not a list of children.
Technical data and privacy choices: IP address, browser, device, requests, errors and access times. Cookie choice records may include a browser identifier, domain, chosen purposes, consent or withdrawal date, policy version, IP and browser information. With the appropriate consent, measurement and advertising tools also receive the data described in section 5.

3. Purposes and legal bases

Services and steps before a contract — Article 6(1)(b) GDPR: accounts, sign-in, product delivery, access, courses, progress, notes, quizzes and certificates, orders and bookings. Also documents or offers requested by you and necessary service messages, such as email verification and password resets.
Legal obligations — Article 6(1)(c) GDPR: tax and accounting obligations, consumer rights and complaints obligations, and controller obligations under the GDPR.
Legitimate interests — Article 6(1)(f) GDPR: security, abuse prevention and demo limits, diagnostics, correspondence, establishing or defending claims, contacting institution representatives and managing staff access to licences. Game statistics linked to an adult's account help assess product operation and use. The activation survey helps us understand user needs and acquisition sources. Our interests are operating a safe service and managing customer relationships, taking users' rights into account. This basis does not replace consent for optional tracking tools.
Consent — Article 6(1)(a) GDPR: newsletters, marketing contact within the consent given, including offer-related contact following a funding application, and optional measurement and advertising. We also apply the relevant Polish Electronic Communications Law requirements for commercial communications and access to device storage.

Acknowledging this policy does not consent to every activity described. Newsletter, measurement and marketing consents are separate. You may withdraw them; this does not affect earlier lawful processing or access to purchased services.

4. Children, emotions and written content

Hey Feelings™ materials and games are used with children. Accounts, purchases and access management are intended for adults: parents, teachers, therapists and institution representatives. Children play under their supervision. Game statistics do not record conversations, voices or children's answers to card questions. They do not assess or diagnose a child's emotional condition. Optional Clarity interface interaction playback is described separately in section 5.

Course notes, open responses and messages are sent to the server. Do not enter identifiable information about children, health, diagnoses, therapy or other special category data. Medical records or an emotional diary are not needed to provide our services. Entering such information does not constitute the explicit consent required by Article 9 GDPR. If you send it accidentally, contact us so we can restrict further processing and assess deletion. We do not use it for advertising or diagnosing users.

Institutions and therapists are responsible for their own processing of children's data during activities. This policy does not replace their privacy notices or legal bases.

5. Cookies, measurement, session playback and advertising

Cookies and browser storage support sign-in, security, privacy choices, settings and saved games. Optional tools start after consent to the relevant category. Cookie settings in the footer allow you to refuse or change your choice. On our service domains, the choice covers the website and game.

Google Analytics 4 — measurement: browser identifiers, pages, traffic sources, device information, approximate location and events such as registration, sign-in, starting checkout or submitting a form. We use these to analyse service use.
Microsoft Clarity — measurement: clicks, scrolling, pointer movements, device and page information, and representations of the interface and its changes. It enables interaction playback and click maps on the website and in the game. It does not record your camera or microphone. Masking limits visibility of sensitive content but does not make the entire session anonymous. See the Microsoft Privacy Statement for Microsoft's processing.
Meta Pixel — marketing: advertising and browser identifiers, device information, pages and events such as viewing an offer, registering or submitting a form. Meta may associate these with Facebook or Instagram accounts, measure advertising and tailor audiences. This is separate from Facebook sign-in.

Cookie and provider details are available in settings and our Cookie Policy. Withdrawal stops further use of optional tools; it does not automatically erase data already received by providers. You can contact us about its deletion.

6. Recipients

We disclose data as needed for the relevant task:

Vercel, including Vercel Blob, and Neon: hosting, file delivery and databases.
Brevo: transactional email, contacts and newsletters. Account contact details and consent status may also be synchronised to manage preferences; sending newsletters requires consent.
Stripe and banks: payments, subscriptions, refunds and settlements. Payment providers also act as independent controllers for some purposes, including their own legal obligations.
Google, Meta and Apple: your chosen sign-in method; Google, Microsoft and Meta also provide measurement or advertising under section 5 and your choices. Providers may act as independent controllers for their own services.
Request and training support: authorised staff, contractors, assigned sales representatives and fulfilment partners. Notifications may include contact details and message content and go to work email and the team's Slack communication tool.
Institution licence managers: information needed for invitations, memberships, seats and assigned product access.
Certificate verification link holders: participant name, course, completion date, certificate number and validity. The link or QR code allows verification without signing in; share it thoughtfully.
Advisers, accountants and authorised authorities: information necessary for legal obligations or a specific matter, on an appropriate legal basis.

We do not sell personal data databases. Providers acting on our instructions receive data under appropriate terms; independent controllers also have their own privacy responsibilities.

7. Transfers outside the EEA

International providers may process or access data outside the European Economic Area, particularly in the US. An EU server does not rule out access from outside the EEA. Transfers require a Chapter V GDPR mechanism: a European Commission adequacy decision or standard contractual clauses and, where needed, additional safeguards. The EU–US Data Privacy Framework covers only participating recipients and eligible transfers. Cookie consent does not replace these safeguards. Contact us for the mechanism applying to a particular recipient and a copy of safeguards, subject to protecting confidential information and others' data.

8. Retention

Accounts, access, progress, notes and linked statistics: while you use the account and feature. When deleting an account, we delete its usage data; only information needed for legal obligations or a specific claim is retained. You can also delete notes separately.
Training applications: PDFs have a 12-month retention period from generation. Application contact data is scheduled for deletion or anonymisation 12 months after generation or last contact, whichever is later. Consent withdrawal ends further marketing contact but does not delete the document. You can request erasure separately.
Newsletters: until withdrawal or the end of mailing. A minimal unsubscribe record may remain to respect your choice, and consent evidence for the time needed to demonstrate compliance and defend mailing-related claims.
Correspondence, offers and bookings: until the matter or service is completed, then only what is needed for settlements or until the limitation period for a claim from that matter expires. The period depends on the claim's type, due date and any interruption or suspension.
Tax and accounting documents: as required by law, usually five years. For tax records this generally runs from the end of the year in which payment was due, and for accounting evidence under the Accounting Act. Disputes or suspended limitation periods may extend retention.
Logs, demo safeguards and privacy choice history: as needed to investigate a security event, enforce a demo limit or demonstrate choices. Data concerning a specific incident or dispute may remain until it is resolved and the applicable claims period expires, with restricted scope and access.
Clarity: Microsoft's documentation specifies 30 days for ordinary session playback and nine months for click maps and labelled or favourited sessions. Analytics retention differs from cookie expiry. Contact us for retention periods and settings of other measurement and advertising tools.
Browser storage: until an entry expires, is replaced or you clear site data. Clearing your browser does not delete server data.

Backups follow the provider's retention cycle and support service recovery. When you request erasure, we explain any data that must be retained and why. Pseudonymisation, such as replacing an email with an identifier, does not automatically anonymise data.

9. Your rights

Subject to GDPR conditions, you have rights to access and a copy, rectification, erasure and restriction. Portability applies to data you supplied that is processed automatically on consent or contract. You may withdraw consent and complain to the President of Poland's Personal Data Protection Office.

You may object to direct marketing at any time. For legitimate interest processing, you may object on grounds relating to your particular situation; we assess it under the GDPR.

Email kontakt@heyfeelings.com. Unsubscribe through the email link or account preferences. Withdraw application-related contact consent through the link in the email, and change measurement and advertising choices in cookie settings. See Data deletion for account deletion, or contact us directly.

We respond without undue delay, within one month. Where the GDPR permits, we may extend by two months, explaining why within the first month. Requests are generally free. If we reasonably doubt your identity, we may ask for information necessary to confirm it. Disconnecting Google, Meta or Apple sign-in does not automatically delete your Hey Feelings™ account or data the provider processes for its own purposes.

10. Providing data

Providing data is voluntary, but required fields are needed for the feature: without email we cannot create an account or send a document; without required buyer details we cannot handle an order or invoice. The code activation form also requires answers about similar tools and how you heard about the brand, and the platform if you select social media. You cannot complete that form without these answers. Newsletter registration and measurement and advertising consents are optional. The funding application form currently requires a checkbox covering consent to contact about the offer and application; this is not consent to a general newsletter. Refusing optional measurement or marketing does not block basic services.

11. Profiling and automated decisions

We automatically calculate quiz results, progress and course completion conditions and check purchase and licence entitlements. These are service features. Advertising tools may tailor ads and audiences using section 5 activity. We do not make solely automated decisions about you that produce legal or similarly significant effects within Article 22 GDPR.

12. Protection and updates

We use connection security, access controls and permissions appropriate to the data. Protect passwords, document links and sessions on shared devices; sign out after activities. We update this policy when services or processing change, stating the new version date. Changes requiring separate notice or new consent are communicated before that processing begins. Publishing a policy does not replace required consent.