Privacy Policy
Last updated: October 12, 2026
This Privacy Policy explains how Exara collects, uses, shares and protects personal data when you use the Exara website, app and services (the “Service”), and the choices and rights you have. It applies to everyone who uses Exara, whether or not they have an account.
Who is responsible for your data
Exara (“Exara”, “we”, “us” or “our”) is responsible for your personal data. You can find the operator’s details in the Legal notice (Impressum) at the end of our Terms. For any question about this policy or your personal data, or to exercise your rights, write to us at [email protected].
Personal data we collect
We collect the following categories of personal data:
Account data. The information you give us when you sign up or update your profile, such as your email address, your name, your preferred language and, if you choose to give it, how you describe your gender.
User Content. What you write and submit in Exara, such as your answers to our questions, your journal entries, your notes, and your corrections and other feedback on your results. If you answer our first questions before creating an account, we collect those answers too.
Content we generate for you. The reflections, summaries, reports, Portrait and other content Exara generates from your User Content.
Communication data. Your messages to us.
Usage information. Information about how you use the Service, such as the features you use, the steps you complete and when you complete them.
Technical data. Information your device and browser send when you use the Service, such as your IP address, your browser and device type, and the date and time of your requests. We use it to deliver the Service and keep it secure.
Cookies and similar technologies. Our Cookies Policy explains these.
You decide what you write in Exara. Please do not include personal data about other people unless you are allowed to share it.
How we use personal data
We use personal data to:
(a) create and manage your account, sign you in and keep your account secure;
(b) provide the Service, including processing your responses;
(c) send you the emails the Service needs, such as sign-in codes, notices about your account (for example a warning before an inactive account is deleted) and notifications about your results;
(d) understand how the Service is used, fix problems and improve Exara;
(e) protect the Service and our users, prevent fraud and abuse, and enforce our Terms of Service and Acceptable Use Policy;
(f) respond to your requests and messages; and
(g) comply with our legal obligations, and establish, exercise or defend legal claims.
Our legal bases
Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:
Contract (Article 6(1)(b)). Most of our processing is necessary to provide the Service you ask for under our Terms of Service, or to take steps at your request before you sign up: creating your account, signing you in, processing your responses and sending you the emails the Service needs.
Legitimate interests (Article 6(1)(f)). We process personal data where it is necessary for our legitimate interests and those interests are not overridden by your rights and interests: keeping the Service secure and preventing abuse, understanding how the Service is used and improving it, deleting inactive accounts after a warning, and establishing, exercising or defending legal claims.
Legal obligation (Article 6(1)(c)). We process personal data where the law requires it, for example to keep records of how we handle your data and to respond to your requests.
Consent (Article 6(1)(a)). Where we ask for your consent, you can withdraw it at any time by writing to [email protected]. Withdrawing consent does not affect processing that took place before.
Do you have to give us your data?
You need to give us your email address to create an account, and Exara can only analyse what you choose to write. Without them, we cannot provide the Service. Everything else, such as optional profile details, is up to you.
International transfers
We store your account and User Content primarily in the European Union. Some of our service providers may process personal data outside the European Economic Area. When they do, we protect it with appropriate safeguards, such as an adequacy decision of the European Commission or the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards, including a copy of them, at [email protected].
How long we keep personal data
We keep personal data for as long as reasonably necessary for the purposes described in this policy: in general, for as long as your account exists, and afterwards only as long as needed to comply with the law, resolve disputes, keep the Service secure or enforce our agreements. How long we keep a given piece of data depends on what it is, why we hold it and our legal obligations. Some periods that matter to you:
Deleting your account. When you delete your account, it is deactivated straight away. You can restore it by signing back in within 90 days; after that, it is permanently erased.
Inactive accounts. If you have not signed in for 2 years, we email you a warning 30 days before we delete your account. Signing in, or using Exara while you are signed in, cancels the deletion. If you do not sign in, the account is deleted in the same way and can still be restored by signing back in within 90 days.
Usage information. We keep information about how you use the Service for up to 25 months, then delete it.
Security records. We keep security records for up to 12 months.
Records of your consents. We keep them while your account exists and delete them with it.
Answers before sign-up. If you answer our first questions but do not create an account, we delete your answers after a short period.
Erasure on request. You can ask us at any time to permanently erase your account and your personal data by writing to [email protected], subject to the exceptions the law allows. Copies in our backups are deleted as those backups expire on their regular cycle.
Your rights
Under the GDPR, and subject to the conditions and exceptions it sets out, you have the right to:
(a) access your personal data and receive a copy of it;
(b) correct inaccurate personal data;
(c) have your personal data erased;
(d) restrict how we process your personal data;
(e) object to processing based on our legitimate interests, and object at any time to direct marketing;
(f) receive the personal data you gave us in a structured, commonly used and machine-readable format, and have it transmitted to another controller;
(g) withdraw any consent you have given, at any time; and
(h) not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.
In your profile, you can download a copy of what you wrote in Exara, correct your details and delete your account. For anything else, write to [email protected]. We may need to verify your identity before we respond. We respond within one month; the GDPR allows us to extend this by two further months for complex or numerous requests, and if we do, we will tell you why.
You also have the right to lodge a complaint with a data protection supervisory authority.
Security
We use reasonable technical and organisational measures to protect personal data, such as encryption in transit, access controls and monitoring for abuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your sign-in secure, and tell us at [email protected] if you suspect that someone has accessed your account without permission.
Children
Exara is only for people aged 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that someone under 18 has created an account, we will delete it. If you believe this has happened, please contact [email protected].
Emails we send
We send you the emails you need to use Exara: sign-in codes, important notices about your account, such as a warning before an inactive account is deleted, and notifications about your results, such as when your Portrait is ready. We do not send marketing emails.
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will tell you in advance, by email or in the Service, before they take effect. The date at the top shows when this policy was last updated.
Language
This Privacy Policy is written in English. Translations are provided for convenience only. If there is any conflict between the English version and a translation, the English version prevails, to the extent permitted by law.
Contact
Anything about your personal data: [email protected]. Everything else: [email protected].