Privacy Policy
Last updated: 27 August 2026
1. Who we are
Circulta is operated by NeuroHappy, Inc, a Delaware corporation (EIN 30-1338445), 651 N Broad St, Suite 201, Middletown, DE 19709, USA. Contact: support@circulta.com.
2. What we collect
When you create an account: email address, password (stored hashed), and optionally your name or creator/business name.
When you buy: order details, chosen configuration, price, and payment status. Card details go directly to Stripe and never reach us. Stripe collects billing address and tax information.
Your content: the files and text you upload, plus technical metadata (file type, size, dimensions, duration).
When someone opens your loop: we count openings per loop per day, plus aggregate bytes served and error events, we do not store a per-visit record or any identifier. We do not collect or store IP addresses ourselves, and we do not identify who opened your loop. Our infrastructure providers do see the IP address that every web request carries, as any web server does: Vercel serves the page and Supabase serves the images and audio files directly to the visitor's device. Their handling of that is governed by their own policies, not ours. We do not run analytics on this page: Google Analytics, Meta Pixel, and Vercel Analytics are all excluded from it entirely.
Site visitors: we use Google Analytics and Meta Pixel to understand traffic and campaign performance on our marketing site. These load only after you accept non-essential cookies (see Cookies, below).
Messages: if someone uses a "message the owner" form, we pass the message to you and retain it as part of your loop's content, following the same retention as your loop content (section 5).
3. Why, and on what basis
| What | Why | Legal basis |
|---|---|---|
| Account details | To run your account | Contract |
| Purchase details | To take payment and meet tax obligations | Contract, legal obligation |
| Your content | To deliver the service | Contract |
| Opening counts | To bill Momentum correctly, keep things reliable | Contract, legitimate interest |
| Service emails | To tell you about your orders, Momentum and renewals | Contract |
| Marketing emails | To tell you about products and offers | Consent |
| Site analytics | To understand traffic and improve the site | Consent (EU/UK visitors) |
| Error logs | To find and fix faults | Legitimate interest |
Emails necessary to deliver the service (such as order confirmations, renewal notices, and Momentum alerts) cannot be opted out of while you hold an account, since we need them to run your account correctly. Marketing emails and analytics cookies are separate, optional, and never a condition of anything, and are never disguised as necessary service emails.
4. Who we share it with
- Supabase: hosting, database and file storage. Note: images and audio are served directly from Supabase to your visitors' devices, so Supabase sees their IP address directly, not just yours.
- Vercel: application hosting
- Stripe: payments and tax. Card details go directly to Stripe's own checkout page; we never see them. Stripe also processes some data for its own fraud-prevention, tax and compliance obligations, separately from acting on our instructions.
- Resend: sending email
- Substack: two separate things. Our newsletter content is fetched by our own server, with no visitor exposure. The subscribe form on our Join page is Substack's own embedded code running in your browser, which can see your IP address and set its own cookies, governed by Substack's own policy, not ours.
- Vercel Analytics and Speed Insights: cookieless traffic and performance measurement on our marketing site and account dashboard only. These do not run on the public loop page your visitors scan.
- Google Analytics and Meta Pixel: site analytics and campaign measurement, only after consent (EU/UK visitors)
Most of these providers act as processors under contract, handling data solely on our instructions. Some (for example, payment processing and related tax functions) may act as independent controllers for the specific data they need to meet their own legal obligations.
Some processors operate outside the EU. Where they do, we rely on the transfer mechanism that applies to that specific provider, such as Standard Contractual Clauses or an adequacy decision.
5. How long we keep it
- Account details: while your account exists, then 90 days
- Loop content: 6 months after your loop ends (includes a 1-month grace period)
- Deleted loops: removed immediately, no grace period
- Archived loops: the same 6 months, measured from whichever came first, your coverage ending or the day you archived
- Unused library files: deleted after 14 days
- Purchase and accounting records: as required by applicable tax law
- Support messages: 24 months from your last message on that ticket
6. Your rights
Everyone may ask us to give you a copy of your data, correct it, or delete it, including deleting your entire account, subject to any legal or accounting retention obligations we must still meet (see section 5). Write to the email address in section 1; we respond within a reasonable time.
If you are in the EU or UK, you additionally have the right to restrict how we use your data, receive it in a portable format, object to processing based on legitimate interest, and withdraw marketing consent at any time. You may complain to your national data protection authority.
7. Cookies and local storage
Circulta sets no cookies. To keep you logged in, your browser stores your session locally on your own device, along with a short-lived note of what you were doing if you started something before creating an account. Both stay on your device, are not sent to us or anyone else, and clear when you sign out or clear your browser data.
Non-essential, only after you accept: Google Analytics and Meta Pixel, used to understand site traffic and measure outreach. You'll see a cookie banner on your first visit; these tools only load if you accept, and they do set their own cookies once active.
8. Security
Content is stored privately and served through signed, expiring links. Database access is restricted per account. Secrets are held in managed environment stores, never in code. No system is perfectly secure, but we take this seriously and will tell you promptly if something goes wrong that affects you.
9. Beta period
During our beta period, a limited number of authorized staff may view account content, solely to provide support and verify the service is working correctly. This access is logged, restricted to designated staff, and never used to edit your content. It ends when the beta period closes.
10. Children
The service is not intended for under-18s and we do not knowingly collect their data.
11. Changes
We will post updates here and email you about material ones.