VISENZA
Legal
Privacy Policy
Last updated: 13 October 2026
This page explains what happens to your data when you visit senses21.visenza.co, join the list, buy Senses 21 or use the app. In short: the sales page sets no cookies and measures nothing. Data is only created when you join the list or buy. In the app, all that is stored is your email address, your settings and what you enter yourself.
1. Who this policy applies to and who is responsible
This policy applies to the address senses21.visenza.co, that is the sales page, the app under /app/ and the emails that result from them. For the website visenza.co, the privacy policy published there applies.
The controller responsible for processing your data is:
Visenza LLC
2165 Van Buren St, Suite 911
Hollywood, FL 33020, United States of America
Represented by Mag. Christina Kirchmayr
Email: christina@visenza.co
Phone: +43 664 5335826 (WhatsApp)
Visenza LLC is based in the USA and has no establishment in the EU. Because Senses 21 is aimed at people in Austria, Germany and Switzerland, the General Data Protection Regulation (GDPR) applies to the processing of your data, Art. 3(2)(a) GDPR.
Representative in the EU (Art. 27 GDPR)
There is no data protection officer because the requirements of Art. 37 GDPR are not met.
2. Visiting the site
When you open senses21.visenza.co, Cloudflare delivers the page. In doing so, Cloudflare processes, as technically necessary, your IP address, the date and time of the request, the page requested, your browser type and your operating system. This is needed so that the page reaches you and is protected against attacks.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a functioning and secure site.
Storage period: Cloudflare keeps this data only as long as needed for delivery and security. We do not store any visit data ourselves. Server error messages end up briefly in a technical log at Cloudflare.
No cookies on the sales page, no tracking: the sales page sets no cookies and uses no analytics tools, pixels or third-party embeds. The fonts are hosted on our own server. Only the app sets a cookie, see section 5.
3. Joining the list
As long as Senses 21 is not yet for sale, you can join the list. The form sends your details to the website visenza.co, which has the same operator as this site. We need your email address; your first name is optional. We also store that you registered for Senses 21 and when.
How it works (double opt-in): After you submit the form, you first receive an email with a confirmation link. The link is valid for seven days. Only when you click it is your entry passed on to Brevo and stored there in the list "Senses 21". If you do not click, nothing happens and your details are not stored anywhere. As proof of your consent, we store the date of your entry and the time of your confirmation.
What happens next: You receive a short confirmation by email. As soon as Senses 21 is for sale, you receive a message from Christina. Nothing more. No regular newsletter, no advertising for anything else, and your address is not passed on.
Legal basis: Your consent, Art. 6(1)(a) GDPR, in conjunction with § 174(3) Telecommunications Act 2021 (TKG 2021, Austria) and § 7(2) no. 2 Act against Unfair Competition (UWG, Germany).
Withdrawal: at any time, without giving reasons, with a short reply to one of our emails or a message to christina@visenza.co. We then delete your entry. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).
Storage period: until you withdraw or until you have received the message about the start, at the latest 24 months after that.
4. Buying via Stripe
When you buy Senses 21, the button "Get access" takes you to the Stripe checkout. Before you get there, you tick a box on our page: that you are at least 18 years old, that Senses 21 should be made available immediately and that you know your right of withdrawal ends as soon as you open it. We pass the time of that tick and its wording to Stripe and store them there in the checkout session, as proof of your consent.
In the checkout you enter your payment details directly with Stripe. We never see your card number. Stripe processes your email address, your name, your payment details, your billing address or country (for VAT) and technical data such as IP address and browser. Stripe also checks the payment for fraud.
We use Stripe Managed Payments. This means Stripe acts as the seller towards you, collects the price, remits the VAT of your country and is also responsible for refunds via Stripe's customer service (Link). In this role Stripe processes your data partly under its own responsibility, according to Stripe's privacy policy (https://stripe.com/privacy).
After the purchase we receive from Stripe: your email address, the amount, the currency, the ID of the checkout session and the language you bought in. With this we create your access and send you the access email. We do not receive payment details.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract you enter into with the purchase); for the proof of your consent and the retention of purchase data Art. 6(1)(c) GDPR (tax and commercial retention obligations).
Storage period: The purchase data (email, amount, currency, ID) stays stored as long as your access exists, but at least as long as we are required to keep it (in Austria seven years, § 132 BAO; in Germany eight or ten years, § 147 AO).
5. Your access and the app
Access without a password. After the purchase you receive an email with a link and a six-digit code. Both are valid for 30 minutes and exactly once. We store link and code only as a hash, not in plain text. If you have Senses 21 on your home screen, you enter the code there, because a link from the email only signs in the browser, not the app. After five wrong codes your address is locked for 30 minutes, then you need a new email. You can request new access at any time with your email address; the reply is always the same, so nobody can check whether an address has bought from us.
One cookie, technically necessary. As soon as you are signed in, the app sets a cookie named lb_session. It contains your email address and your role, signed so that nobody can forge it, and is valid for 400 days. Without this cookie you would have to sign in every time you open the app. It is only sent to senses21.visenza.co, not to third parties, and serves no measurement. Legal basis: Art. 6(1)(b) GDPR; no consent is required because the cookie is strictly necessary for the service you explicitly use (§ 165(3) TKG 2021, § 25(2) no. 2 TDDDG).
What the app stores. In the app, only the data you create yourself is stored: your start day, your time zone and language, your settings for the evening reminder (on or off, time), your answers to the three questions on day 1, 7, 14 and 21 (optional, numbers from one to ten) and your lines in the evening (optional, at most 2000 characters per day). Your lines are for you. Nobody analyses them, there is no profiling and no automated decision-making. Technically, Christina as the operator can access the database; she does not read your lines and does not pass them on.
Legal basis: Art. 6(1)(b) GDPR, because all of this is part of Senses 21, which you bought.
Where it is stored. The database runs at Supabase in the Frankfurt am Main data center (region eu-central-1). The videos, audios and images of the 21 days are stored at Cloudflare R2 and are only delivered to signed-in users, with one exception: the short invitation audio for the person next to you can be accessed without signing in, so that it plays for them.
Deleting. In the app menu, "Delete" removes your lines, your answers to the three questions and your start day. Your access stays, you can start again. If you want your access and your email address deleted as well, write to christina@visenza.co. Purchase data we are required to keep (section 4) remains stored, restricted, until the end of the retention period.
Storage period. Your app data stays as long as your access exists, or until you delete it.
6. Emails from us
Via Brevo we only send you emails that belong to Senses 21: the access email after the purchase, a new access email when you request one, and, if you leave it switched on, the evening reminder at your time (one email per day, only on the 21 days). You switch the reminder on or off in the app. No advertising, no newsletter, no passing on of your address.
Legal basis: Art. 6(1)(b) GDPR. The reminder is part of the program, not advertising; you can switch it off at any time.
7. When you write to us
If you write to christina@visenza.co or message +43 664 5335826 on WhatsApp, we process your address or phone number and the content in order to reply to you. The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR. We delete the correspondence once the matter is settled and no retention obligation applies. On WhatsApp, WhatsApp Ireland Limited additionally processes your data under its own rules, which we have no influence over.
8. Who receives your data
We do not pass on your data, except to the service providers without whom Senses 21 does not run:
| Service provider | Purpose | Location and place of processing | Safeguards |
|---|---|---|---|
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States of America | Delivery of site and app, protection against attacks, operation of the server (Workers), storage for videos, audios and images (R2) | USA and global network, including data centers in the EU | Data processing agreement with EU Standard Contractual Clauses (Decision (EU) 2021/914); Cloudflare is certified under the EU-US Data Privacy Framework |
| Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, and Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, United States of America | Checkout, payment processing, fraud checks, VAT, refunds (Managed Payments) | Ireland and USA | Partly an independent controller for payment processing; transfer to the USA via EU Standard Contractual Clauses, Stripe, Inc. is certified under the EU-US Data Privacy Framework |
| Supabase Pte. Ltd., 65 Chulia Street, #38-02/03 OCBC Centre, Singapore 049513 | Database for access, settings, answers and lines | Data center Frankfurt am Main, Germany (region eu-central-1, at Amazon Web Services) | Data processing agreement under Art. 28 GDPR with EU Standard Contractual Clauses, part of the Supabase terms of service |
| Brevo, operated by Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France (Paris Trade and Companies Register 498 019 298) | Sending of access emails and the evening reminder, interest list | France, Germany and Belgium (data centers in the EU) | Data processing agreement under Art. 28 GDPR, part of the Brevo terms of use |
Cloudflare, Supabase and Brevo act as processors on our instructions. Stripe acts partly under its own responsibility for the payment, see section 4.
9. Data outside the EU
There are three things you should know:
First, Cloudflare delivers the page through a global network, including from the USA, and Stripe, Inc. processes payment data in the USA. These transfers are safeguarded by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework (Art. 45 and 46 GDPR). The Data Privacy Framework is currently valid (adequacy decision of the EU Commission of 10 July 2023, upheld by the General Court of the EU on 3 September 2025). If it were to lapse, the Standard Contractual Clauses remain as the basis.
Second, your app data stays in Frankfurt (Supabase) and your emails in the EU (Brevo).
Third, Visenza LLC is itself a US company, and Christina works from Thailand. When Christina creates your access or writes to you, she accesses your data from a country outside the EU. There is no adequacy decision of the EU Commission for Thailand. We safeguard this as follows: the data stays stored with the service providers in the EU, access is limited to Christina, password-protected and secured with a second factor, and we process only the few data points needed for Senses 21.
10. Your rights
Under the GDPR you have the right to
- access to the data we hold about you (Art. 15),
- rectification of incorrect data (Art. 16),
- erasure (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interests (Art. 21),
- withdraw consent, at any time and without giving reasons (Art. 7(3)).
An email to christina@visenza.co is enough. We reply within one month.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority where you live. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at. In Germany, the state data protection commissioners are responsible.
You do not have to give us any data. Without an email address we simply cannot send you access. There is no automated decision-making or profiling.
11. How we protect your data
We use technical and organizational measures to protect your data against loss, alteration and unauthorized access (Art. 32 GDPR): site and app are delivered over an encrypted connection only (HTTPS), the session cookie is signed and readable only via HTTPS and not by scripts, access links and codes exist only as hashes and expire after 30 minutes, wrong codes are limited, videos and audios can only be accessed when signed in, payment data is seen only by Stripe, and access to all service providers is password-protected and secured with a second factor.
12. Children and minors
Senses 21 is aimed at adults. When buying, you confirm that you are at least 18 years old. If we learn that an access belongs to a minor, we delete it.
13. Changes
We update this policy when something changes in the processing, for example when a new service is added. The version published here applies. The date at the top shows when it was last updated.