Your information.
Your choices.

1. Who is responsible

BYOR, Build Your Own Routine, is led by Fabien Combe. For questions about your information, contact fabien@byor.net.

To confirm: the full legal name and contact address of the business acting as data controller, and whether this is Fabien Combe personally or a registered company.

This notice covers byor.net, the free BYOR Check, and information you provide when requesting an assessment, coaching or support.

2. What we collect

• Contact details: your name and email address when you request a Check result or contact BYOR.
• Check responses: your age range, gender, goals and answers about stress, sleep, recovery, energy and attention, including any written information you choose to add.
• Your results: scores, a personal profile and written interpretations generated from your responses.
• Support information: messages and additional information you choose to share for an assessment or coaching.
• Payment information: purchase and payment confirmation details. Card payments are handled by Stripe rather than entered into the BYOR Check.
• Technical information: information needed to deliver and secure the website, such as connection and server logs. Campaign tags in a link may also be recorded with a Check submission.
• Your choices: analytics preferences and any separate email marketing opt-in.

The current Check requires a name and email address to continue and asks for responses needed to produce a profile. Taking the Check is voluntary. Avoid including unnecessary medical details or information about other people in written answers.

3. Why we use your information

Health-related information

Answers about stress, sleep and wellbeing can reveal information about your health. A general service agreement or acceptance of this policy does not, by itself, authorise processing of health data under the GDPR.

Before publication: confirm the applicable Article 9 condition for health-related responses and implement any required explicit, recorded consent before collection. The current optional analytics choice is not consent to process health data.

Providing your email to receive your result does not automatically subscribe you to promotional emails. Where you have opted in to marketing, you can unsubscribe using the link in an email or contact BYOR.

4. How your personal profile is created

The Check uses your answers to calculate scores and describe patterns across regulation, recovery, and focus & control. This is automated profiling for wellbeing information. It is a starting point, not a medical diagnosis or a decision about your employment, insurance or access to essential services.

Fabien or an authorised BYOR specialist may review information when delivering an assessment, coaching or requested support. Your information is not represented as visible only to you. You can ask us about your results or request a correction to inaccurate information.

To verify: which information the server sends to an AI provider, whether the free Check uses AI-generated interpretation, and the provider's retention and model-training settings. This draft does not promise that no AI provider receives your responses.

5. Who may process your information

BYOR uses providers to operate the website and deliver services. Existing BYOR materials and the Check integration identify:

• Netlify: website hosting and server-side processing.
• Brevo: result emails and communications.
• Formspree: form submissions, including the optional marketing opt-in.
• Anthropic (Claude): report interpretation where enabled in the server workflow.
• Stripe: payments for services you purchase.
• Meta: website and conversion events when optional analytics is allowed. The Check's tracking code does not intentionally include your answers or personal results in those events.

External links and services you choose to use have their own privacy notices. Information may also need to be disclosed where required by law.

International processing

Some providers may process information outside the European Economic Area. The applicable countries, recipients and transfer arrangements depend on the actual service configuration.

Before publication: verify the active provider list, the information each receives, data-processing agreements and international transfer safeguards. In particular, confirm any server-side archiving to Formspree and the AI workflow. Provide the applicable adequacy decision or safeguards, such as standard contractual clauses, and how people can obtain a copy.

6. Cookies, analytics and your choices

The Check saves your analytics choice in your browser's local storage under byor_analytics_consent. This remembers whether you allowed optional tracking on that browser.

If you allow analytics, the Check loads Meta Pixel. Meta can receive events such as page visits, progress, completion and interest in paid services, along with technical information and identifiers its tracking technology collects. This can support conversion measurement and advertising measurement.

You can choose Start without analytics and still use the Check. To change your choice, use Analytics settings in the Check. Changes apply to that browser; they do not undo events already sent. Cookie and site-data controls are also available in your browser.

This privacy page does not load analytics, advertising scripts or external fonts.

To verify: tracking on other BYOR pages, Meta's configured cookie lifetimes and event settings, and whether any automatic matching or additional measurement tools are enabled. The statement about Check events above is based on its inspected front-end code, not a server-side audit.

7. How long we keep information

Retention should be limited to the time needed to provide your result, deliver requested services, handle support and meet legal obligations. Different rules may apply to assessment responses, coaching records, transaction records, consent records and backups.

Before publication: confirm actual retention periods or precise retention criteria for each category, including copies held by providers and backup deletion schedules. The earlier draft's 24-month Check retention and 10-year purchase-record retention have not been independently confirmed and are not adopted here.

Unsubscribing stops promotional emails. It does not automatically remove information held for a requested service or records that must legally be retained. To request deletion of your Check or other records, contact us.

8. Protecting your information

Access to personal information should be limited to people and providers who need it for the relevant service. No website or email service can guarantee complete security. If you believe your information has been exposed or misused, contact BYOR promptly.

9. Your rights

Under applicable data-protection law, you may request access, correction, deletion, restriction of processing or a portable copy of your information. You may object to processing based on legitimate interests, and object to direct marketing at any time. Some rights depend on the circumstances.

Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal. We may need limited information to verify your identity before responding to a request.

Write to fabien@byor.net. Under the GDPR, the usual response period is one month; a permitted extension may apply for complex or numerous requests, and we will explain it within that first month.

You can also complain to the data-protection authority in the country where you live or work, or where an alleged infringement occurred. In Malta, this is the Information and Data Protection Commissioner.

10. Contact and updates

For privacy questions or requests, email fabien@byor.net. If the way BYOR handles information changes, this notice will be updated. Material changes may also need a direct notification or a fresh consent request.

Reference: General Data Protection Regulation, including Articles 9, 12 and 13. This draft must reflect actual operating practices before it is published.