Personal data, stated plainly.
TwentyThird processes sensitive information about your inner life. This policy says what is processed, by whom, where, for how long, and how to stop it. Nothing is sold. Nothing is used for advertising.
Who is responsible
WelloWork AB (org. nr. 559472‑9997), Uppsala, Sweden, is the controller for all personal data processed through TwentyThird: on this website, in your account, and in email.
Some members receive TwentyThird as a benefit from their employer. The employer pays for access and nothing else. Employers never receive your data, your answers, your usage, or any analytics about you or about their staff as a group.
Data protection contact: privacy@day-23.com. We answer within 30 days.
What we process, and why
Account. Email address, name, year of birth, gender, language and how you sign in. Used to run your account. Legal basis: contract (Art. 6(1)(b) GDPR).
Health information. Your intake answers about mood, family, relationships, work, sleep, dreams and wellbeing; your weekly catchups; your consulting-session conversations; and the readings and reports produced from them. This is special-category data (Art. 9). Legal basis: your explicit consent (Art. 9(2)(a) and Art. 6(1)(a)), given separately at sign-up and withdrawable at any time in Settings → Consent.
AI processing. To write readings, catchup summaries, session replies and reports, the part of that information each task needs is sent to an AI model. Legal basis: your separate consent to AI processing and to the transfer outside the EEA.
Your circle. If you invite someone, you give us their first name and email address so we can send the invite. If they answer, their answers inform your readings. See “People you invite” below.
Payment. Subscription status and history. Card details are handled by Stripe and never reach us. Legal basis: contract.
Technical data. IP address, browser, device and timestamps, to keep the service secure and limit abuse. Where we store an IP address, we store a salted hash, not the address. Legal basis: legitimate interest (Art. 6(1)(f)).
Analytics. Google Analytics runs only on the public marketing pages, and only after you accept it. Never inside your account. Legal basis: consent.
We do not ask about race, ethnicity, political opinion or religion. If something you write reveals it, it is processed only as part of your own reading.
Automated decisions and safety
Every piece of free text you write is checked by an AI model for signs that you may be at risk of harm. When the risk is rated high, the analyst does not reply; you see crisis resources for your country instead, and a safety flag is recorded in your account, where you can see it.
Readings, summaries and reports are AI-generated interpretations. They are not diagnoses, and no decision with legal or similarly significant effect is made from them.
You can ask a person at WelloWork to review any safety classification or reading: privacy@day-23.com. We tell you the outcome.
Who processes it, and where
These companies process data on our instructions under data processing agreements. Where data leaves the EEA, the transfer basis is stated.
| Processor | Purpose | Where | Transfer basis |
|---|---|---|---|
| Supabase | Database, sign-in, file storage | Ireland (EU) | EU hosting; Standard Contractual Clauses for support access |
| Vercel | Hosting and servers | Stockholm (EU); worldwide network for static files | Standard Contractual Clauses |
| OpenRouter | Gateway that passes each AI request to the model | United States | Standard Contractual Clauses |
| Google Cloud (Vertex AI), through OpenRouter | AI models (Gemini). Prompts are not stored or used for training | Google data centres, not limited to the EU | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Stripe | Payments and subscriptions | Ireland (EU) and United States | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Resend | Email we send you, and invites | United States | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Google Analytics | Visits to public pages, only with your consent | Google data centres, including the United States | EU–US Data Privacy Framework; Standard Contractual Clauses |
AI providers are only used if they neither store prompts nor train on them. We do not sell or license your data and do not use it for advertising.
People you invite
When a member invites you, they give us your first name and email address. We use them only to send the invite and to show the member whether you answered.
If you answer the relationship questions, your answers and one AI-written paragraph based on them inform that member's readings, sessions and reports. The member never sees your answers or the paragraph. You consent to this before the questions start.
Your answers are deleted 30 days after the connection ends, or at once when you use the deletion link in your invite email. Invites that are declined or expire are deleted 30 days after they expire. You have the same rights as members; write to the address below.
Who sees it
Within WelloWork AB: A small number of staff who maintain the service, with access limited by role. We look at your content only to answer a request from you, review a safety flag you ask us to review, or fix a fault.
Not your employer. No employer, clinic or other organisation has access to member data or to analytics about members.
Your psychologist, if you have one: Beyond your supervision request, you choose item by item what your psychologist sees, and you can change each choice at any time.
Legal obligation: We disclose data to competent authorities only when required by law, and only to the extent required.
Retention
How long each kind of data is kept. An automatic daily job enforces these periods.
| Data | Kept for |
|---|---|
| Account, intake answers (every version), readings, catchups, session conversations, reports, consent records | As long as your account exists |
| All of the above, after you delete your account | Erased 30 days after the request, except the bookkeeping records below. Signing in before then cancels it |
| Safety flags | Severity and category with your account; the quoted text is removed after 90 days |
| AI processing log (task, model, timing — never content) | 90 days |
| Records of emails sent to you | 30 days after sending |
| Answers from people you invited | While the connection is active; 30 days after it ends, or at once when they ask |
| Declined or expired invites | 30 days after expiry |
| Messages sent through the contact form | 24 months |
| Abuse-prevention counters (hashed) | 1–2 days |
| Supervision with a psychologist: your request, the supervision, its care plans and your consent to share | As long as your account and your psychologist’s account exist. Your psychologist sees them only while the supervision runs and your consent stands |
| Supervision requests that were declined, withdrawn or expired | 12 months after the decision |
| Handoffs to your psychologist | 24 months after they close or the supervision ends; at once if the supervision is deleted |
| In-app notifications | 12 months |
| Paid visits and payouts to psychologists (amount, date, payment reference) | 7 years after the end of the year of payment, as the Swedish Bookkeeping Act requires. Your name, notes and links are removed when your account is erased |
| Database backups | Rolling backups on a short cycle; deleted data leaves them as they expire |
| Payment records at Stripe | As financial law requires |
Processors keep operational logs under their own terms, listed above.
Your rights
You can access and export your data (Settings → Data), correct it (Settings and your intake), delete your account (Settings → Danger zone), withdraw consent (Settings → Consent), restrict or object to processing, and receive your data in a portable format. Withdrawing consent stops future processing; it does not undo what was done before.
For anything else, or if you cannot sign in: privacy@day-23.com. We respond within 30 days. You can also complain to Integritetsskyddsmyndigheten (IMY), Sweden's data protection authority.
Security
Data is encrypted in transit and at rest. Every table is protected by row-level security, so an account can read only its own records, and what the service writes cannot be changed from a browser. Card data never touches our servers.
Age
TwentyThird is for adults. You must be 18 or older to create an account. If we learn that someone under 18 has an account, we delete it.
Changes
When this policy changes materially, we tell you in the product before the change applies and ask for your consent again where it is needed. The version date is below.
Effective: 18 October 2026 · Governing law: Swedish law and the GDPR