Privacy policy

The short version

You are practising something private. We collect only what the program needs, we never sell or share it for advertising, you can download or delete all of it in one tap, and no person at Holdline reads your sessions or your chat with the guide.

Who is responsible

Withyou Inc is the data controller. Contact: support@holdline.care.

What we collect and why

Account: your email address, to sign you in and send you the emails described below. Basis: performing our contract with you.

Onboarding answers: how long you typically last, whether this is lifelong or recent, your goal, whether you train alone or with a partner, and your timezone. Basis: your explicit consent, given when you answer; this is information about your sex life and is treated as special-category data. You can delete it at any time.

Practice records: session times, the number and length of stops, whether you crossed the point of no return, your arousal rating, and any note you write. The plan, progress screens, milestones and guarantee are computed from these. Basis: consent, as above.

Guide conversations: what you write to the guide and its replies, so the conversation can continue and so daily limits can be enforced. Basis: consent, as above.

Billing state: which plan you have, its status and dates, and identifiers from our payment partner. We never receive your card number. Basis: performing our contract; keeping financial records the law requires.

Technical: the session cookie that keeps you signed in, and server logs containing request paths and timings for security and debugging. Logs do not contain the content of your sessions or chats. Basis: our legitimate interest in running a secure service.

What we do not do

We do not sell your data. We do not share it with advertisers or data brokers. We do not use tracking cookies or third-party analytics on the site. We do not use your data to train any model. We do not ask for your name, and you do not have to give one anywhere except, optionally, on a testimonial.

Who processes data for us

Hosting: Vercel (application) and Neon (database), in the United States (AWS us-east-1). Email: Amazon Web Services, to send sign-in links, reminders and account emails. Payments: Dodo Payments, which handles checkout, tax and receipts as merchant of record and receives your email address and the product you bought. The guide: Google Cloud Vertex AI, which receives the text of your conversation together with a summary of your record for the purpose of generating a reply; under Google Cloud's terms this data is not used to train Google's models. Each processor acts only on our instructions.

If you are in the UK or EU, your data is transferred to the United States under standard contractual clauses or an equivalent recognised mechanism.

Emails

Sign-in links and anything about payments, refunds or your account are sent because they are necessary. Reminders, weekly recaps, a nudge if you go quiet and milestone notes are optional; you choose them in Account and every one carries a one-click unsubscribe. All subject lines are neutral: nothing on a locked screen says what the service is.

How long we keep it

While you have an account: everything above. After you cancel or your access ends: your practice records are kept for twelve months so you can come back, then deleted. If you delete your account from Account: everything is deleted immediately, except the financial records the law requires us to keep, which are held without your practice data for the statutory period. Guide conversations are deleted with the account. Testimonials are removed the moment you withdraw them.

Your rights

You can see everything we hold about you by downloading it from Account, correct your onboarding answers by contacting us, delete everything from Account, and withdraw consent at any time by deleting your account. If you are in the UK or EU you also have the right to object, to restrict processing, to portability (the download), and to complain to your supervisory authority. Write to us first; we will answer within one month.

Security

Data is encrypted in transit and at rest. There are no passwords to leak; sign-in is by emailed link that works once. Access to production systems is limited to the people who operate the service, none of whom read member records in the course of that work.

Children

The Service is for adults. We do not knowingly collect data from anyone under 18.

Changes

We will tell you by email before any change that affects how your data is used. Effective 12 February 2026.