Last updated: 4 June 2026
This website is operated by:
Nicholas Flatt (sole proprietor / Einzelunternehmer)
Vale de lama 1
8300-026 Silves
Portugal
NIF / VAT: PT 323483186 — small-business exemption (Kleinunternehmerregelung); no VAT shown
Email: hello@inkleaf.shop
Phone: +351 920 568 221
This policy explains what data is processed when you use Inkleaf Reading, and on what legal basis. Inkleaf is operated by a private individual in Portugal and is subject to the General Data Protection Regulation (GDPR).
You upload a filled-in page from a planner or journal. The page is sent to an AI model (Anthropic Claude) and you receive a short observational text in return. The image is not stored after processing. No account is required.
Your uploaded image or PDF. The file is transmitted to Anthropic's API for processing and is not stored by Inkleaf after the reading is returned. The content of your page — including handwritten entries — is processed by Anthropic as part of this service.
Not used to train AI models. Your uploaded page is processed only to generate your reading. It is sent through Anthropic's commercial API, which by default does not use inputs or outputs to train its models (see Anthropic's Privacy Policy). Inkleaf does not retain your image, and does not use it for any training, analytics, or profiling purpose.
Your email address (optional). After a reading, you can choose to have the result sent to an email address. This is optional — the reading works fully without it. If you enter an address, it is used once to deliver that email via Resend and is not stored by Inkleaf afterwards. If you additionally opt into the short email series on somatic planning, your address is stored with MailerLite (our newsletter provider) — but only after you confirm via a separate confirmation email (double opt-in). Every series email contains an unsubscribe link; you can also withdraw consent at any time via hello@inkleaf.shop. The legal basis for the series is your consent (Art. 6(1)(a) GDPR); for the one-time delivery it is Art. 6(1)(b) GDPR.
Your IP address. Your IP address is used for rate limiting (maximum 5 readings per hour). This limit resets automatically and is held in temporary memory only — it is not stored in a database and is not logged persistently by Inkleaf.
No cookies. No tracking. This site does not use cookies, analytics tools, tracking pixels, or session recording. Nothing is stored in your browser beyond what is needed to display the page.
Inkleaf Membership — saved readings (optional). If you create a member account (sign-in via an email magic link) and give your explicit consent, the text of your readings is stored so the tool can show you patterns across time. For each saved reading we store the observational reading text generated for you and a numerical embedding of that text (a vector used to compare your readings); we do not store the uploaded image. The free reading path is unaffected and stores nothing. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by deleting your data (see “Your rights” below). Your readings are stored until you delete them. Member sign-in uses an authentication token stored in your browser to keep you signed in.
The reading text is itself personal data. Even though we do not store the uploaded image, the stored reading can describe you — for example recurring exhaustion, sleep difficulties, or mood patterns — and is therefore treated as personal data in its own right.
Patterns over time (profiling). For members, the stored readings are compared over time to surface recurring patterns. This constitutes profiling within the meaning of Art. 4(4) GDPR. It is used solely to present you an observational reflection; there is no automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR.
What this service is — and is not. Inkleaf Reading is an observational reflection tool. This service is not medical, psychological, therapeutic or crisis support. It does not provide diagnoses, treatment recommendations or professional advice.
The legal basis for processing your uploaded image and IP address is Art. 6(1)(b) GDPR — processing is necessary to perform the service you requested (the Reading).
Your data is transmitted to the following third parties as part of providing this service:
Anthropic, Cloudflare, Netlify, Resend, and Voyage AI are based in the United States. Data transfers to the USA take place under Standard Contractual Clauses (SCCs) adopted by the European Commission, as described in each provider's privacy policy linked above. MailerLite (Lithuania) and Supabase (EU region) are based in the EU. For each US-based processor a data processing agreement is concluded and the specific transfer safeguards — including SCCs where applicable — are documented; the existence of SCCs alone is not treated as sufficient.
You have the right to:
Because Inkleaf Reading does not store your image or reading after it is returned, most of these rights apply only to your IP address, which is held temporarily in memory and not retrievable or linked to you individually — and, if you opted into the email series, to your email address stored with MailerLite, which you can have deleted at any time (unsubscribe link in every email, or write to hello@inkleaf.shop).
Members: if you have a member account, you can erase everything yourself at any time — open the “Member” panel on the Reading page and choose “Delete my data”. This permanently removes your stored readings, their embeddings, your member record, and your account. This also withdraws the consent on which the storage was based. You can also request erasure by email at hello@inkleaf.shop without using the button. Operational server logs that may contain technical metadata are retained only briefly, and database backups are overwritten on a rolling basis, so deleted data is removed from backups within the normal backup cycle.
Statutory retention. Where the law requires it — for example accounting and tax retention obligations in connection with payments — we may have to retain certain billing-related records even after a deletion request. Such records are kept only for as long as legally required and are not used for any other purpose. Payment data itself is processed by PayPal, not stored by Inkleaf.
To exercise your rights, contact: hello@inkleaf.shop
The supervisory authority for data protection in Portugal is the
Comissão Nacional de Proteção de Dados (CNPD).
Website: cnpd.pt
You have the right to lodge a complaint with the CNPD if you believe your data has been
processed unlawfully.
If this policy changes materially, the updated version will be published on this page with a revised date. Outside the optional email series, no contact information is collected, so users are not notified individually of changes.
This page was last updated: 4 June 2026