Last updated: September 2026. This is not legal advice; review it with a qualified professional before relying on it.
TraumaFlow is an emotional-wellness app operated by THE EMADKO HOUSE, a business name registered with the Corporate Affairs Commission of Nigeria under number BN 9814925. A business name is not a separate legal entity, so the data controller is the proprietor trading as THE EMADKO HOUSE. In this policy "we", "us", "our" and "TraumaFlow" mean that proprietor, and "you" means the person using the app. For privacy questions, contact hello@traumaflow.com. TraumaFlow is for adults; you must be 18 or over.
TraumaFlow is available in more than one country, so we apply one standard globally, set at the level of the strictest law that reaches us.
| Where you are | The law we apply |
|---|---|
| United Kingdom | UK GDPR and Data Protection Act 2018 |
| European Economic Area | EU GDPR |
| Nigeria | Nigeria Data Protection Act 2023, our home registration |
| California | CCPA as amended by CPRA |
| Other US states with privacy laws | the rights in the United States section below |
| Canada, Brazil, Australia | PIPEDA and Quebec Law 25, LGPD, Privacy Act 1988 |
| Elsewhere | this policy in full, plus any local law that applies |
TraumaFlow is registered as a business name in Nigeria and is operated from the United Kingdom. That means we have a UK establishment, so UK GDPR applies to us directly under Article 3(1) and the Information Commissioner's Office (ICO) is our lead supervisory authority. We have no establishment in the European Economic Area; because we offer TraumaFlow to people there, EU GDPR reaches us under Article 3(2), and EEA users can contact us at hello@traumaflow.com.
| Data | Why | Legal basis |
|---|---|---|
| Email address | Create your account and sign you in | Performance of a contract |
| Password, stored hashed; we never see it | Secure your account | Performance of a contract |
| Date of birth | Check you are 18 or over | Legal obligation, and our legitimate interest in keeping minors off a mental-wellness service |
| Content you create: journal entries, mood check-ins, saved affirmations, and belief reframes | Provide the app and sync it across your devices | Your explicit consent (see below) |
| Usage and basic device information | Fix problems and improve the app | Legitimate interest |
| Subscription status from the App Store or Google Play | Give you the right access. We never see your card details | Performance of a contract |
Your date of birth is stored so that only you can read it. It is never shown to anyone else, and you cannot change it after signup; if it is genuinely wrong, contact us.
Some of what you choose to record (mood check-ins, journal entries, and trauma-related reflections) can reveal information about your mental health. Data-protection law treats this as special-category (sensitive) data under UK and EU GDPR Article 9, sensitive personal data under the NDPA, and sensitive personal information under CPRA, and it needs extra protection.
We process it only with your explicit consent, which you give by choosing to create this content, and that explicit consent is our lawful basis. We use it only to provide the app to you: storing it, syncing it across your devices, and showing it back to you. You can withdraw consent at any time by deleting the content or your account. We never use it for advertising, profiling, or training a model, and we never share it except with the infrastructure provider named below.
| Who | What they do | Where |
|---|---|---|
| Supabase | Hosts our database, file storage, and sign-in | European Union |
| Cloudflare | Hosts and serves the TraumaFlow website | Global edge network |
| Apple and Google | App distribution, push notifications, and subscription payments | Per their own policies |
Your account and content are stored in the European Union. None of these providers is permitted to use your data for their own purposes.
Your data is stored in the European Union, protected in transit and at rest. Because we operate from the United Kingdom, your data may be accessed from the UK to run and support the service. Where the law requires a transfer safeguard we use one: UK to the EEA is covered by the UK adequacy regulations; any transfer to the United States uses the EU Standard Contractual Clauses with the UK Addendum; and transfers from Nigeria rely on the mechanisms recognised under the NDPA.
| What | How long |
|---|---|
| Your account and profile | Until you delete it |
| Your content: journal, check-ins, affirmations, reframes | Until you delete it or your account |
| Date of birth | Until you delete your account |
| Subscription status | Until you delete your account |
| Usage and device logs | Only as long as needed to run and secure the service |
When you delete your account, your content is removed from our systems within 30 days, except anything the law requires us to keep.
Everyone, everywhere. Wherever you live, you can ask us to access, correct, export, or delete your data, and withdraw consent at any time, by emailing hello@traumaflow.com. We respond within 30 days, free of charge, and we will never treat you worse for exercising a right.
United Kingdom and European Economic Area. Under UK and EU GDPR you may also object to processing based on legitimate interests, restrict processing while a dispute is resolved, and object to decisions made solely by automated means. We make no solely-automated decisions that have a legal or similarly significant effect on you. You can complain to your supervisory authority: in the UK, the ICO (ico.org.uk); in the EEA, the authority where you live.
United States. Depending on your state you may have rights to know, delete, correct, obtain a portable copy, opt out of sale, sharing, or targeted advertising, and limit the use of sensitive personal information. We do not sell or share personal information and do not run targeted advertising, so there is nothing to opt out of, and we use sensitive information only for the purposes described here.
Canada and Nigeria. In Canada you may access and correct your information and complain to the Office of the Privacy Commissioner (in Quebec, the Commission d'acces a l'information). In Nigeria you may complain to the Nigeria Data Protection Commission (NDPC).
Your content is stored in private storage, and access controls mean the database returns only your own data. Passwords are hashed by our sign-in provider and we cannot see them. We never hold your card details. No system is perfectly secure; if we have a breach that risks your rights, we will notify the relevant regulators within the time their law allows, which is 72 hours in the UK and EEA, and tell you without undue delay.
TraumaFlow is strictly for adults. We check your date of birth at signup and refuse accounts that do not meet the age requirement. If we learn that someone under 18 is using TraumaFlow, we remove the account and delete the data.
If we change this policy in a way that materially affects you, we will tell you in the app before it takes effect. The date at the top always reflects the current version.
THE EMADKO HOUSE
Business name registration BN 9814925, Corporate Affairs Commission, Nigeria.
Operated from the United Kingdom. Registered address available on request.
hello@traumaflow.com
EU representative (GDPR Article 27): to be appointed; in the meantime, EEA users can contact us at hello@traumaflow.com.