FDOS™ Privacy Policy

Version 3.1 · Last updated: 5 November 2026

1. Introduction

This Privacy Policy explains how Sovereign Performance Systems B.V. ("FDOS", "we", "us") collects, uses and protects personal data when you:

• visit our public website at fdos.systems (the "Website"); or

• create an account and use the FDOS app at fdos.institute (the "Platform").

Together we call these the "Service". Where processing differs between visitors of the Website and registered users of the Platform, this policy says so.

2. Who we are

Sovereign Performance Systems B.V. operates the Service and is the controller of your personal data under the General Data Protection Regulation (GDPR).

• Name: Sovereign Performance Systems B.V.

• Address: Fluweelboomlaan 243, 1185 PS Amstelveen, the Netherlands

• Chamber of Commerce (KvK): 85292524

• Privacy contact: contact@fdos.institute

We have not appointed a Data Protection Officer, as we do not currently meet the GDPR criteria that require one.

3. Website visitors

If you only visit the Website without an account, we process technical data (row 10 in section 4) to deliver the pages securely, and we count page visits in aggregate (row 11). We do not use cookies and do not track individual visitors.

4. What we process, why, and on what legal basis

The table below sets out, for each processing activity, which data we use, for what purpose, on which legal basis, and how long we keep it.

Where we rely on legitimate interest, we have weighed our interest against your rights and interests. You can object to this processing at any time (see section 10).

We do not sell your personal data, and we do not use it for advertising.

5. The AI Guide

In some Systems you can type a free response, for example if a step does not feel right for you or you do not understand an assignment. The AI Guide responds to what you write. It may explain the reasoning behind a step, help you work out an assignment yourself without giving you the answer, or suggest a different System that suits you better.

• No human review: no one at FDOS reads your conversations with the AI Guide or reviews its responses.

• AI providers: the AI Guide runs through our platform provider Lovable Labs Inc., which uses third-party AI providers, including Anthropic, OpenAI and Google. These requests are processed in the United States (see section 8).

• No decisions about you: the AI Guide does not take decisions about you with legal or similarly significant effects. It does not involve automated decision-making within the meaning of Article 22 GDPR.

• Crisis: the AI Guide is instructed to recognise signs that you may be in crisis and to refer you to crisis resources, including our helplines page. It is an AI system and may not recognise every situation. It is not a monitoring or emergency service.

• Session Zero: when you complete the Session Zero assessment, AI reads your answers to recommend your starting point and the Systems that suit you.

• Answer check: when you save an exercise answer, AI checks only whether it is complete, meaningful and relevant to the question. It never judges your answer, gives advice or writes the answer for you.

• Legal basis for Session Zero and the answer check: legitimate interest of Sovereign Performance Systems (Art. 6(1)(f) GDPR): providing the core function of the platform. Where your answers reveal health or other special-category data, we rely on your explicit consent (Art. 9(2)(a)), as set out in section 4, row 4.

AI training: your content and your conversations with the AI Guide are not used to train AI models. Our platform provider has confirmed in writing that data of our users is not used to train its models on any plan, and that its agreements with its AI providers prohibit them from training on content sent through its services.

Session Zero and the answer check always use AI, because they are part of the core service (see the legal basis above). The AI Guide’s free-text help within the Systems is optional: before you first use it, we ask for your explicit consent. You can withdraw your consent at any time; we then delete your AI Guide conversations. Please do not enter detailed health information, diagnoses or information about other people in free-text fields. FDOS is not a medical, psychological or therapeutic service.

6. Cookies and local storage

We do not use cookies. We store two small items in your browser:

• Login token (local storage): keeps you signed in. Strictly necessary for the Platform to work.

• fdos_analytics_tracked (session storage): a technical yes/no flag that prevents the same visit from being counted twice in our aggregate page counts. It contains no identifier and is deleted when you close your browser. This falls under the exception for technical and minimal-impact storage in Article 11.7a of the Dutch Telecommunications Act, so no consent is needed.

We do not use third-party analytics, advertising or tracking tools.

7. Who we share data with

We only share personal data where needed to provide the Service:

• Lovable Labs Inc. (Boston, United States), our platform provider: hosting, database, sign-in, email delivery and AI features. Lovable Labs Inc. uses sub-processors, listed at https://trust.lovable.dev/subprocessors. Lovable also processes certain data for its own purposes, such as technical log data (for example IP address, browser type and usage statistics) for security and to improve its platform. For that processing, Lovable's own privacy policy applies: https://lovable.dev/privacy.

• AI providers used by Lovable Labs Inc. for the AI Guide (see section 5).

• Stripe (Stripe Payments Europe, Limited, Ireland): payment processing. Stripe processes your card details under its own privacy policy.

• Google or Apple, only if you choose to sign in with them. They act under their own privacy policies.

• Your coach, only if you choose to connect, and only your progress (section 4, row 6).

• Professional advisers, such as lawyers and accountants, where necessary.

• Authorities, where the law requires it.

• Business transfers: if our business is sold or merged, your data may transfer under the same protections. We will tell you in advance.

Our processors are bound by a data processing agreement and may only use your personal data on our instructions. This does not apply where a party processes data for its own purposes under its own privacy policy, as described above for Lovable, Stripe, Google and Apple.

8. International transfers

Your data is stored in Europe by our platform provider. Our platform provider, Lovable Labs Inc., is a company in the United States, and requests to the AI Guide are processed by AI providers in the United States. These are transfers outside the European Economic Area. We base them on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.

9. How long we keep data

Retention periods per processing activity are listed in the table in section 4. If you delete your account, we delete or anonymise your personal data within 90 days, except payment records, which we must keep for 7 years under Dutch tax law. Backups are overwritten within 35 days.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;

• correct inaccurate data;

• have your data deleted;

• restrict or object to certain processing, including processing based on legitimate interest;

• receive a copy of your data in a portable format;

• withdraw consent at any time, without affecting processing before the withdrawal;

• complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your EU country.

To use these rights, email contact@fdos.institute. We respond within one month and may ask you to confirm your identity first.

If you are a California resident, you may have additional rights under the CCPA. We do not sell or share personal information as defined in the CCPA. FDOS does not currently meet the CCPA applicability thresholds; we will reassess this as the Service grows.

11. Children

The Service is only for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

12. Security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS), hashed passwords, and access rules so that users can only see their own data. Our staff do not read the content you enter. Authorised personnel may access it only where strictly necessary for technical support or security, or to comply with the law. Our platform provider describes its security measures at https://lovable.dev/security. No system is completely secure. If a data breach is likely to put your rights at risk, we will report it to the Autoriteit Persoonsgegevens within 72 hours and inform you where required.

13. The nature of this Service

FDOS involves reflecting on personal values, beliefs and life circumstances. Please be thoughtful about what you share in free-text fields. The Service is not a substitute for professional medical, psychological or therapeutic care. If you are in crisis, please contact a local emergency number or a crisis line, listed on our helplines page.

14. Changes to this policy

If we make important changes, we will tell you by email and in the app before they take effect, and update the date at the top. If a change affects processing based on your consent, we will ask for your consent again.

15. Contact

Sovereign Performance Systems B.V.

Fluweelboomlaan 243, 1185 PS Amstelveen, the Netherlands

contact@fdos.institute