Privacy policy.

Effective date: September 10, 2026

Hypnofy LLC, 4730 S. Fort Apache Rd Suite 300, Las Vegas, Nevada 89147, is responsible for the personal information described here. Contact contact@hypnofy.com about privacy, access, correction, deletion, withdrawal of consent or an appeal.

What we collect and why

We use account information, including your name and email address, to provide your account, personalize your audio and contact you about your service. Payment providers process payment information; we retain transaction references and purchase status rather than your full payment-card details.

When you choose personalization, we collect your answers about habits, feelings, triggers, situations, goals, previous experiences, preferred affirmations and gestures. These answers may include information about health. We also process your setup conversations, generated passages, personalized audio and any issue reports you submit. We use this information to create, check, deliver and support your requested sessions.

Provide only what is useful for your goal. Avoid addresses, contact details, identifying numbers and other people's full names in your answers. Using a relationship such as “my partner” is usually sufficient.

We process technical information needed for authentication, fraud prevention, security, delivery and troubleshooting. Infrastructure providers may receive IP addresses, browser/device information and request metadata. Optional usage analytics are not enabled by default. We do not use your personalization answers or audio for advertising, sell them, or automatically turn customer records into development test cases.

Check-ins and customer reviews

After the first completed session in a program, we send guidance for the next few days, a private check-in after three days, and an optional review invitation after a week. You can turn check-in and review invitation emails off in your profile or through the email preference link. Public review invitations also include an unsubscribe link. Necessary account and review confirmation emails remain separate.

Check-in answers and private feedback are available to the Hypnofy team and are not published. If you choose to write a public review, we verify the purchase and ask you to confirm the exact wording and any optional photo using an emailed link. With your explicit permission, we publish your chosen display name, rating, review, program, dates, review reference, and the photo you choose to include. Photos are resized and embedded metadata, including location data, is removed before saving. The original file is not retained. The photo is reviewed with the words and follows the same editing, withdrawal, and retention rules. Permission to publish a review photo does not include separate advertising use. Your email, account identifiers, and private check-in are not part of the public review. Our review policy explains verification and moderation.

You can edit or remove a review from your program's feedback page before publication and for 30 days after it is first published. Choose Edit to change or remove it. Edits do not extend that deadline. This editing period does not limit your privacy, correction, consent withdrawal, or account deletion requests. We retain review revisions and consent records while the account remains active, and remove them with account deletion, subject to any applicable retention obligation. Finished queued email records are scheduled for deletion after 14 days; delivery failures remain available until resolved. Postmark may retain delivery records under its own retention settings. Account access and deletion requests include these records and removal of the public review from Hypnofy. We cannot remove copies someone else has already made of a public review.

Your choices before personalization

We request affirmative consent before collecting personalization answers and separately explain their processing by service providers and authorized reviewers. For information concerning health, we request explicit consent. We record the notice version, your choices and the time of consent. Agreement to the Terms does not replace these separate choices.

You can withdraw personalization consent in your profile or by contacting us. Withdrawal stops new personalization processing after the change takes effect; it cannot undo processing already completed or recall requests already in progress. Declining or withdrawing means we cannot create or revise personalized sessions using that information. You can separately request deletion, including removal of existing sessions.

Where applicable, our legal bases include performing the service you request, consent for personalization and health-related information, necessary security and operational interests, and legal obligations for records such as transactions. We do not treat continued use as consent to a new use of health-related answers.

AI, speech providers and human review

Our service combines an authored audio script with passages adapted to your confirmed answers. AI services assist with conversations, rephrasing and checking; speech services create personalized audio.

Authorized Hypnofy personnel may inspect your answers, personalized passages and relevant audio to check quality, investigate issues and provide support. Some or all sessions may require human approval before delivery. Review does not constitute medical assessment, and automated or human checks do not guarantee error-free content.

Routine review uses case references and omits account names and email addresses. New generation uses a name token during text review, with the spoken name inserted for audio. A reviewer can separately access account identity when needed for support, with that access recorded. Your free-text answers may still contain identifying information. These records are personal information, not anonymous data.

Providers and disclosures

We use these providers for the stated service purposes:

Provider processing is subject to their applicable terms, our arrangements and account settings. We do not promise that providers retain no data. For example, disabling application storage for an AI request is different from eliminating all provider security logs. Provider documentation includes OpenAI's data controls and ElevenLabs' retention controls.

We may disclose information where required by law, to respond to valid legal requests or to protect rights and security. We do not authorize unrelated uses of your health-related answers through this notice. Material changes to providers, purposes or consent requirements will be addressed before the new processing where required.

Storage, access and retention

Information is processed through cloud services and may be stored or processed in the United States and other countries where providers operate. International processing must use the safeguards required for the applicable transfer; consent to personalization is not a blanket waiver of transfer requirements.

We restrict access according to operational need, use authenticated access to private customer content and record administrative review actions. No system can guarantee absolute security. If an incident occurs, we will investigate, take appropriate containment steps and make notifications required by applicable law.

Our retention practices distinguish the service you purchased from temporary working records:

• Account information, confirmed answers and purchased audio are retained while needed to provide your account, ongoing session access and support, unless you request deletion or another retention requirement applies.
• Completed, declined or superseded generation-review records and their attempts are scheduled for deletion after 30 days. Pending reviews remain available until resolved. This does not delete the customer's purchased audio or confirmed answers.
• Temporary generation audio is subject to a one-day storage lifecycle. Prepared personal-data exports are subject to a seven-day storage lifecycle.
• Setup chat history is assigned a one-hour expiry from its last update. Infrastructure expiry processes are asynchronous; expiry is not a guarantee of deletion at the exact minute.
• Administrative audit metadata is assigned a one-year expiry. Completed privacy-request records and resolved review-case references are assigned a 90-day expiry. Pending requests remain available for handling.
• Providers, security logs, backups and records required for legal or accounting purposes may have separate retention periods. We document necessary exceptions when handling deletion requests rather than claiming that every copy vanishes immediately.

Access, correction, withdrawal, deletion and appeals

Use your profile to withdraw personalization consent or submit an authenticated access or deletion request. You can also email contact@hypnofy.com for these requests, corrections, processing restrictions, objections, portability or an appeal of a decision. We may need to verify your identity using proportionate information. Please do not email identity documents unless we specifically request a suitable verification method.

A data export is made available privately in your profile after preparation. Deletion removes your account and personalized sessions, ending access to them. We also address relevant provider-held records and explain any necessary retention exceptions. Deleting an account does not automatically request a refund; contact us about the applicable refund terms.

Rights and deadlines depend on applicable law. We respond within applicable deadlines, explain any permitted extension or refusal, and provide an appeal route where required. You may also complain to the relevant privacy regulator. For a Nevada consumer-health-data appeal, you can contact the Nevada Attorney General if an appeal is declined.

Children, changes and contact

Hypnofy is intended for adults aged 18 and over. We do not knowingly collect personalization information from children. Contact us if you believe a child has provided such information.

We will provide notice of material changes as required and request new consent where necessary. Contact contact@hypnofy.com, Hypnofy LLC, at the address above for privacy questions or requests.