Privacy Policy

Spine Store B.V., trading as The Longevity Series, is the controller for the personal data described in this policy. This means we decide why and how that information is used.

Privacy questions and requests can be sent to hello@longevity-series.com. Put “Privacy request” in the subject and use the email address connected to your account where possible.

• Account data: name where provided, email address, authentication identifiers and account status.
• Purchases and access: product, plan, payment status, Stripe customer and transaction references, invoices and course entitlements. We do not receive your complete card number.
• Check and report data: answers and progress stored locally in your browser; when submitted, this may include a completion reference, overall score, lowest domain, selected goal and information used to create a personal starting point or report.
• Course activity: unlocked content, lesson progress and account-linked feedback or reviews.
• Communications: support messages, marketing consent, email engagement, Nora chat messages you choose to send and unsubscribe status.
• Referral and security data: referral code, referring page, cookie identifiers, logs, approximate technical information, timestamps and information needed to prevent misuse.
• Campaign performance: campaign source, campaign and creative labels, completed commercial steps, purchase value and owner-entered campaign costs. This reporting layer does not contain Check answers, scores, symptoms, birth year, name or email address.

Some Longevity Check answers, scores or goals can reveal information about health and may qualify as special-category personal data under the GDPR. We use this information only for the educational check, requested report, course recommendations and related member care—not for diagnosis, insurance or employment decisions.

Where explicit consent is legally required, we rely on that consent. You may withdraw consent for future processing by contacting us. Withdrawal does not affect processing that was lawful before withdrawal, and some information may still be retained where another legal obligation applies.

• Contract: create accounts, process purchases, unlock content, provide reports, maintain subscriptions and answer service requests.
• Consent: send optional marketing, process health-related information where explicit consent is required, and use non-essential technologies if introduced.
• Legitimate interests: secure and improve the platform, diagnose faults, understand aggregate use, prevent fraud, moderate reviews and operate a limited referral programme, where those interests do not override your rights.
• Legal obligations: keep required financial records, respond to lawful requests and establish or defend legal claims.

The Longevity Check applies predefined scoring logic to your answers and may recommend domains or courses. These results are educational and do not produce a legal, medical, insurance, employment or similarly significant decision about you.

Nora and content-support features may use automated or AI-assisted processing. Do not enter information you would not want processed for that conversation. Important medical and financial decisions should never be based on an automated response from the platform.

We share only what is reasonably needed with providers that help us deliver the service. They act under their own terms and/or data-processing obligations.

• Supabase for authentication, database and protected member records.
• Stripe for checkout, payments, subscriptions, invoices and billing controls.
• Vercel for website hosting, delivery, security, technical logs and—only after analytics consent—privacy-filtered Web Analytics on approved public pages.
• Resend and email infrastructure for transactional and consented marketing email.
• Google Analytics, only after analytics consent, for aggregate website usage such as approved page groups, device category and approximate location.
• Professional advisers, authorities or another business party where legally required or necessary for a legitimate corporate transaction with appropriate safeguards.

Some providers may process information outside the European Economic Area. Where required, we use an adequacy decision, the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism, together with appropriate supplementary safeguards.

You can contact us for more information about the safeguards relevant to your data.

We use strictly necessary authentication cookies to keep members securely signed in. A referral cookie may remember a referral for up to 30 days. When you arrive through an eligible Meta campaign, a functional offer cookie remembers that campaign price for up to seven days so it is not lost when you sign in or move between pages. After analytics consent, a campaign-attribution cookie may retain a limited set of UTM values, advertising click identifiers and the referring host for up to 30 days and may attach that attribution to a checkout record. Browser local storage may remember Check answers and progress, course position, interface preferences and an anonymous completion reference on that device.

Google Analytics is loaded only after you allow analytics. It may use a first-party identifier to distinguish visits and reports aggregate information such as approved page groups, device category and approximate location. Pageview URLs exclude query strings and fragments, detailed health-content URLs are grouped into non-identifying route families, and automatic Enhanced Measurement is disabled. We keep advertising storage, advertising user data and advertising personalisation disabled, and we do not send Longevity Check answers to Analytics.

After you allow analytics, Vercel Web Analytics may measure aggregate public-page use, device and browser category, and approximate geolocation such as country, region or city. Our configuration excludes account, admin, authentication, checkout, Check-result, report, reader and member-lesson routes; groups detailed health-content URLs; removes all URL query parameters and fragments; accepts only the canonical public domain; and sends no Vercel custom conversion events or Longevity Check answers.

You can refuse analytics without losing access to the website. You can change your choice here at any time; the floating privacy control disappears after you have made a choice. Strictly necessary authentication and security storage remain separate.
Change analytics preference

We keep information only for as long as reasonably necessary for the purpose collected, an active account or access entitlement, required financial administration, dispute handling and security. Marketing data is suppressed or removed after withdrawal, subject to keeping a minimal suppression record so we do not email you again.

Nora conversation content is available only to the platform owner for service quality and requested follow-up and is automatically deleted after no more than 90 days. It is not used to create advertising audiences. Aggregate routing events may be kept separately without the conversation text.

We use access controls, protected authentication, encrypted connections and restricted administrative access. No online system is perfectly secure; contact us promptly if you suspect unauthorised use of your account.

Depending on the circumstances, the GDPR gives you the following rights:

• Access your personal data and obtain information about its use.
• Correct inaccurate or incomplete information.
• Request deletion or restriction where the legal conditions are met.
• Receive portable data where processing is automated and based on consent or contract.
• Object to processing based on legitimate interests and object at any time to direct marketing.
• Withdraw consent at any time for future consent-based processing.
• Complain to the Dutch Autoriteit Persoonsgegevens or another competent EEA supervisory authority.

The platform is designed primarily for adults and we do not knowingly create paid accounts for children without appropriate parent or guardian involvement. Contact us if you believe a child supplied personal data without proper permission.

We may update this policy as the platform, providers or law changes. Material changes will be communicated in an appropriate way, and the date at the top identifies the current version.