Privacy Policy
1. Who controls your data
The data controller is:
- DOLSKAIA-MORATANNAGE VIKTORIIA, an individual operating the DMORA MATRIX service
- Country: Sri Lanka
- Contact address: Colombo, Sri Lanka
- Email: support@d-mora.com (general enquiries: hello@d-mora.com — both reach the same mailbox)
For any question about your data, write to support@d-mora.com.
2. Personal data we collect
- Account data: email address, password (stored only as a cryptographic hash), display name if you provide one.
- Diagnostic data: your answers to the 9-life-spheres questionnaire, your 1–10 self-ratings, your calculated Life Resource Index and related metrics.
- Content you create in the service: goals, tasks, habit and tracker entries, journal entries, mood stickers, reviews and feedback, messages you send to the Helios AI assistant.
- Usage data: which meditations you played, which content you accessed, activity dates — used to operate the service and, for paid plans, to handle refund requests and payment disputes.
- Technical data: IP address, device and browser type, session identifiers, push-notification token if you enable notifications.
- Payment data: if you buy a subscription, the payment is processed by our payment provider (see section 5). We receive the fact of payment, the plan, the period and an order identifier. We never receive or store your full card number.
We do not ask you for special categories of data (such as health data). Free-text fields — the journal and chat with the assistant — store whatever you choose to write there; please do not enter information you would not want stored.
3. Purposes and legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Creating an account, calculating and saving results, operating the service | Performance of a contract |
| Processing subscription payments, refunds and disputes | Performance of a contract / legal obligation |
| Informational and marketing emails | Consent (separate, withdrawable) |
| Push notifications and reminders | Consent (you enable them yourself) |
| Security, abuse prevention, service analytics | Legitimate interest |
| Cookies and similar technologies that are not strictly necessary | Consent |
4. Profiling
The service generates personal metrics (the Life Resource Index), recommendations, development paths and personalised meditations based on your answers and activity. This is not an automated decision producing legal or similarly significant effects; recommendations are informational, and final decisions remain yours.
5. Who we share data with
We do not sell personal data. We use the following processors, each under its own terms and data-processing agreement:
| Processor | What it does | What it receives |
|---|---|---|
| Vercel | Hosting of the website and the web app | Technical data, IP address |
| Supabase | Database, file storage, authentication | Account data, diagnostics, your content |
| Resend | Sending emails | Email address, message content |
| Google Firebase (FCM) | Push notifications | Device push token |
| Google Analytics | Visit statistics for the website (only if you accept analytics cookies) | Anonymised technical data: truncated IP address, browser, pages visited |
| Anthropic (Claude) | The Helios AI assistant and generation of meditation scripts | The text of your request and the context needed to answer |
| ElevenLabs | Voice synthesis for meditations | Meditation script text |
| Make.com | Automation of the meditation production pipeline | Meditation script text |
| Dodo Payments | Payment processing; acts as merchant of record and seller of the subscription | Email address, payment and billing data |
We may also disclose data where the law requires it.
6. International data transfers
Your account and content are stored in the European Union (Supabase, Ireland region). Some processors listed above operate from the United States, so certain data — technical data, emails, AI requests — is processed there. For transfers outside the EEA we rely on the safeguards permitted by the GDPR (Standard Contractual Clauses and/or other mechanisms under Art. 44–49 GDPR).
7. Data retention
We retain data while your account is active and your consent is valid. After account deletion or withdrawal of consent, data is deleted or anonymised within 30 days, unless the law requires us to keep it longer — for example, payment records, which are kept for the period required by tax and accounting rules.
8. Your rights (GDPR)
You have the right to access, rectify, erase, restrict and object to the processing of your data; to receive it in a portable format; to withdraw consent at any time; and to lodge a complaint with your local supervisory authority. Requests: support@d-mora.com. We reply within one month.
9. California residents’ rights (CCPA/CPRA)
If you are a California resident, you may request to know, delete and correct your personal information, and opt out of its sale or sharing. We do not sell or share your personal information within the meaning of the CCPA. Exercising your rights will not result in discrimination. Requests: support@d-mora.com.
10. Children
The service is not intended for persons under 16. We do not knowingly collect children’s data. If you believe a child has provided us data, contact us and we will delete it.
11. Security
We use password hashing, encryption in transit (TLS), row-level access controls in the database and regular backups. In the event of a breach that threatens your rights, we notify the relevant supervisory authority and affected users within the legally required timeframes.
12. Cookies and local storage
The website and the app use cookies and browser local storage. Details and consent management are in our Cookie Policy.
13. Changes
We may update this Policy. The new version takes effect when published on this page.
14. Contact
DOLSKAIA-MORATANNAGE VIKTORIIA, Colombo, Sri Lanka · support@d-mora.com
Last updated: 2026-07-31