Privacy Policy

SleepShift is operated by MK Solutions LLC, a company registered in the Republic of Cyprus ("SleepShift", "we", "us"). We are the data controller responsible for your personal data.

For privacy matters, contact us at mk.solutions@mksolution.biz.

When you use SleepShift, we collect the following categories of data:

We use your data to:

• Deliver the CBT-I program — calculate your sleep window, generate adjustments, track your progress
• Calculate your sleep efficiency score each morning from your diary entries
• Generate personalized cognitive restructuring guidance (via AI processing — see Section 5)
• Send program-related communications (e.g., weekly check-in reminders)
• Measure the effectiveness of our advertising — only with your consent (see Section 6)
• Improve the program based on aggregate, anonymized outcome data

We do not sell your data, and we do not use your sleep or health data for advertising.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your data on the following legal bases:

• Contract performance (Art. 6(1)(b)): account management, payment processing, delivering the program you purchased
• Legitimate interests (Art. 6(1)(f)): improving the service, preventing fraud, technical security
• Consent (Art. 6(1)(a)): marketing emails and advertising/analytics cookies (Section 11)
• Explicit consent (Art. 9(2)(a)) — health-related data: your sleep diary entries, insomnia assessment responses, and cognitive session content relate to your health and are special category data. We process them — including the AI processing in Section 5 — only with your explicit consent, given when you create your account. Withdrawing this consent means we can no longer provide the program, and you may then delete your account.

You may withdraw any consent at any time from your account settings or by emailing us. Withdrawal does not affect the lawfulness of processing before withdrawal.

Your sleep diary data and program context are sent to the OpenAI API to generate personalized cognitive restructuring guidance in the weekly reflect sessions. Specifically:

• Your recent sleep diary entries (efficiency, quality ratings)
• Your current program phase
• Your session responses in the reflect module

Important: Per OpenAI's API usage policies, data submitted via the API is not used to train OpenAI's models. Your sleep data is not used to train any AI model. OpenAI's data retention policies apply to API data (currently: data may be stored up to 30 days for abuse monitoring).

Separately, the support chat on our public website is processed by the Groq API (USA) solely to generate responses to your questions. Website chat messages are not connected to your sleep diary or program data.

Service providers that run SleepShift:

With your consent only, we also use the following advertising and analytics services on our marketing pages:

These services never receive your sleep diary, assessment answers, or any program content, and they do not run on the assessment, onboarding, or in-app pages. Where an email is shared for conversion measurement it is first hashed (SHA-256). You can refuse or withdraw consent at any time, and these services will not load.

We do not sell your personal data. California residents: the advertising services above may constitute "sharing" under the CCPA/CPRA. You can opt out via the "Do Not Sell or Share My Personal Information" link in our footer. We honor Global Privacy Control (GPC) signals.

We are established in the Republic of Cyprus (EU), and we serve customers in both Europe and the United States. Several of our service providers — including Supabase, OpenAI, Vercel, and Stripe — are based in the United States, so your personal data is transferred outside the EEA to the US. Where required, we rely on the EU–US Data Privacy Framework (for certified providers) and/or the European Commission's Standard Contractual Clauses in our data processing agreements. You may request a copy of the relevant safeguards by contacting us.

• Active account data is retained while your account is active.
• If you delete your account, we delete your personal data within 30 days.
• Anonymized, aggregated outcome data (no personal identifiers) may be retained indefinitely for program improvement purposes.
• Payment transaction records are retained for 7 years for legal and accounting compliance.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you
• Correction: request correction of inaccurate data
• Deletion: request deletion of your account and personal data
• Portability: request your data in a portable, machine-readable format
• Objection: object to processing based on legitimate interests
• Restriction: request that we restrict processing while a dispute is resolved
• Withdraw consent: withdraw any consent (including for health-data processing, AI processing, or cookies) at any time

California residents (CCPA/CPRA): you additionally have the right to know what personal information we collect, to opt out of "sharing" for cross-context behavioral advertising (Section 6 and the footer link), and to not be discriminated against for exercising your privacy rights.

EEA/UK residents: you may lodge a complaint with your local data protection supervisory authority, or with our lead authority — the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy).

To exercise any of these rights, contact us at mk.solutions@mksolution.biz. We will respond within 30 days (45 days for CCPA requests where permitted) and will verify your identity before acting on a request.

All data is stored on Supabase, which uses AES-256 encryption at rest and TLS 1.2+ in transit. We use row-level security (RLS) to ensure users can only access their own data. Authentication is handled via Supabase Auth.

Essential (always on): authentication session tokens, security, and preference storage. The site cannot function without these.

Advertising & analytics (only with your consent):

On your first visit we ask for your consent before loading any non-essential cookies or scripts. You can change your choice at any time in the footer. Refusing has no effect on your use of SleepShift.

SleepShift is for adults 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

We may update this Privacy Policy. We will notify you of material changes by email. The "last updated" date at the top of this page indicates when the most recent changes were made.

For privacy-related questions, contact us at: mk.solutions@mksolution.biz