Effective 25 August 2026, updated 28 October 2026 · Senda is operated by Folkuslab (Folkuslab Oy, Business ID 3570884-2), Finland, which is the controller of the personal data described here. Contact: hello@walkwithsenda.com
The short version. Your conversations are kept in your Senda record, encrypted on our server in Frankfurt with a key that only our server holds. Nobody at Folkuslab reads them, they are used only to serve your own devices and to compose Senda's replies, and they are never used to train any AI. When you cancel, you choose: keep your record until you come back, or delete it for good. If you pay for Senda, we hold what billing requires, your email address and subscription status, and nothing more. Your conversations are never connected to your payment details. Senda is for adults, 18 and over.
Your conversations. What you write (or dictate) is sent from your browser to our server functions and on to our AI providers to compose each reply. Your conversations are kept in your encrypted record (see Your record, below), so they are there on any device where you sign in; they are never written to our logs. Because you may choose to share personal, emotional, or health-related things in a conversation, we treat all conversation content as if it were sensitive: processed only to give you Senda, on the basis of your explicit consent, given by ticking a box when you first begin. So that we can show that consent was given, we keep a small record of it: the moment, the version of the text you agreed to, the language, and your account. Never your words. You can withdraw that consent at any time with Delete everything in Settings; the record is then marked withdrawn and kept for three years, which is what the law asks of us.
The working picture Senda forms of you. To fit its replies to you, Senda forms a working picture of how you make sense of things. It does this automatically, with the same AI, and only from what you have written: a short note on each conversation, a picture of how you make sense of things drawn from your grounding conversation (a developmental baseline), and, over time, Senda’s view. Some of this you see in your own words on your Path; some stays behind the scenes and only shapes how Senda talks with you. You are never given a score or a label. In GDPR terms this is profiling. It is used only to fit Senda’s replies to you and to show you your Path. It is never used for advertising, never shared or sold, never read by anyone at Folkuslab, and never used to make any decision about you that has legal or similarly significant effects. It is kept in your record and deleted with everything else. You can object to it at any time by writing to us. Because it is how Senda works, if you object we will delete your record and end the service for you.
Voice dictation. If you use the microphone, your audio clip is sent to a transcription provider, converted to text, and returned. The audio is used for that transcription only and is not kept by us. If you switch on talk mode, the microphone is open only between your two taps, nothing is recorded between turns, and what you say is sent to Senda as it was transcribed, without a chance to read it first. A take you cancel is dropped in your browser and never sent.
Billing (paying members). Payments are handled by Stripe. Stripe holds your name, email, and payment details as an independent payment processor. We can see your email address and the status of your subscription, which we keep in order to provide your access. Stripe tells our server when a membership starts, when a trial is about to end, when a payment fails and when a subscription is cancelled, so that your access opens and closes by itself; with that we keep Stripe's reference for your customer record and the language you checked out in, which decides the language of the emails we send you about your membership. Legal basis: performance of our contract with you, and legal obligations (accounting).
Your account. So that you can sign in, we keep a member entry: your email address, the name you gave us, your edition, and whether your membership is open. Each time you sign in, a code is sent to your email; it is kept for ten minutes. Early testers may still hold an access code, kept in our hosting configuration until they move to email sign-in. Legal basis: performance of our contract with you.
Transcripts you choose to send. Senda has a button to send a transcript to Andrés to help improve the product. This happens only when you press it. Transcripts you send, and feedback you type in the app, arrive in a private Slack channel that only Andrés has access to; they are kept confidentially, read by Andrés for product improvement (occasionally, in anonymised form, by trusted advisors who help him improve Senda), and deleted on request. Legal basis: your consent, which you can withdraw at any time.
Running the service. When you sign in, start or leave a conversation, or keep a practice, a short notice reaches the same private Slack channel: the name on your account, the time, which conversation it is, how many turns it had, the tone you chose, and a random tag for your device. Never your words. Andrés uses these notices to keep Senda running and to notice when something breaks. Legal basis: our legitimate interest in running the service. You can object by writing to us.
How Senda is used. To improve Senda, we count how it is used: that a conversation started or ended, how many turns it had and roughly how long it took, whether it was typed or spoken, the tone and voice chosen, which parts of the app are opened, which language and settings are in use, whether the grounding conversation was started or finished, and, if you answer them, the short questions Senda may ask at the end of a conversation (whether something shifted, a score from one to five, whether Senda understood you). These are counts, kept per day under a short tag derived from your account, never your name or email, and never a word you wrote or said. Where you are is counted only at country level, from the network address of the request, and is not stored against you. We use these counts to see what helps and what does not. Legal basis: our legitimate interest in understanding and improving the service, limited to counts.
Your own words, in two places. Two things you may type are kept as text, because counts cannot carry them: a question you type to Senda before your first conversation, and the optional line in your own words after you rate a conversation. Each is kept with the date and the app language only, never with your name, email or account, and is read only to improve Senda. Nothing else you write or say is kept this way. Legal basis: our legitimate interest in improving the service; both are optional, and you can leave them blank.
On your device and in your record. Conversation history, Senda’s notes, your Path material, and the name you may set in Settings are stored in your browser and in your record (below). The name you type when you first set up Senda is sent to the AI once, so it can pick out what you would like to be called. After that, the AI never receives your email address, and receives your first name only if you switch on “Use my name in conversations” in Settings (it is off unless you do).
Reminders (optional). If you switch on phone or email reminders under Practice, we store what a reminder needs and nothing more: for the phone, the browser's push subscription (an address the browser gives us, no content); for email, the address you type; and, for each practice, an identifier and the moment its next check-in is due. By default the reminder names the practice it is about, so its short title travels with the reminder; you can switch this off under Settings, Reminders, and the reminder then says only that a check-in is waiting. Your words about the practice never leave your device. Email reminders are sent through Resend (EU and US servers). Switching the channel off, or deleting your information, removes all of it at once.
Your record. Senda keeps a copy of the material above on our server so that it is there on any device where you sign in with your email, and so that nothing is lost if you clear a browser. The record is encrypted on the server with a key that lives only in our hosting environment at Vercel; the storage provider holds ciphertext it cannot read. Our server decrypts a record only to send it to a device signed in to that account; no person at Folkuslab reads records, and there is no administrative function that displays them. Composing a reply still sends your words in flight, as described above. The encrypted record is stored with Upstash (Redis) in Frankfurt, Germany. "Delete everything" in Settings removes it from the server immediately. When you cancel your membership in the app, you choose what happens to your record: keep it on our server until you decide to come back (you will find everything as you left it when you subscribe again), or delete everything at once, for good. If your membership ends without that choice (for example, if you cancel directly with Stripe or a payment fails), we keep your record for three years and then delete it. While your membership is closed you can no longer sign in, so to have a kept record deleted, write to us and we will delete it. Reminders stop as soon as a membership ends. Legal basis: performance of the service you asked for; you can end it at any time by deleting everything.
Some of these providers process data outside the EU. Where they do, transfers rest on recognized safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.
No third-party analytics tools (the usage counts above are ours alone and hold no words), no tracking across other sites or apps, no advertising, no cookies beyond what the app strictly needs to function, no selling or sharing of your data, and no use of your words to train AI models. We built Senda this way on purpose.
What is in your browser stays there until you clear it or choose Delete everything.
Under the GDPR you can ask us for access to, correction of, or deletion of the personal data we hold about you (your member entry, your encrypted record, and any transcript you sent; your record you can also delete yourself, at any time, with Delete everything in Settings). You can also object to or restrict processing, ask for portability, and withdraw consent at any time. Write to hello@walkwithsenda.com and we will respond promptly. You also have the right to complain to a supervisory authority; in Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).
If this policy changes in any way that matters, we will tell you in the app before the change takes effect, in plain language.