Privacy Policy (Custala / Breath Studios)

1. Who we are

This Privacy Policy explains how Breath Studios (“Breath Studios”, “we”, “us” or “our”) collects, uses and protects personal data when you visit the Custala website, create an account, contact us, or use the Custala platform.

Company / operator: Breath Studios · Website: https://breathstudios.net/ · Product site: Custala · Contact email: info@breathstudios.net.

This policy covers website and account activity. If your organisation uses the Custala platform, our Product Privacy Statement and Data Processing Agreement may also apply.

2. What this policy covers

This Privacy Policy covers personal data we collect when you visit our website, sign up or create a Custala account, manage a workspace, purchase or manage a subscription, contact us by form or email, or use the Custala platform.

If you use Custala through your employer or organisation, your organisation is usually the Data Controller and Breath Studios acts as the Data Processor. In that case, your organisation decides why and how your personal data is used, and we process it on their behalf.

3. Personal data we may collect

Depending on how you interact with us, we may collect: name; work email address; company / workspace name; role (for example owner or manager); messages or support enquiries you send us; billing and subscription information processed via our payment provider; account login and platform usage data; IP address and device/browser information; cookie and language-preference data; and team and segment configuration you set up in the product.

We may also use aggregated or anonymised data to understand trends, improve Custala, and develop features. That data is not intended to identify any individual.

4. How we collect personal data

We collect personal data when you provide it directly (registration, settings, billing, support) and automatically through cookies and similar technologies when you use our website or platform.

5. How we use your personal data

We use personal data to provide and operate Custala; create and manage accounts and workspaces; process subscriptions and payments; respond to enquiries and support; improve the product and user experience; generate insights and recommendations inside the platform (including Ala AI coaching on anonymised context); maintain security and prevent misuse; and comply with legal obligations.

We do not sell personal data to third parties.

6. Marketing emails

If you opt in to product updates or contact us asking to hear from us, we may send relevant emails about Custala. You can unsubscribe by contacting info@breathstudios.net.

7. Cookies and analytics

We use cookies and similar technologies so the website and platform work properly, keep users securely logged in, and remember language preferences. See our Cookie Policy for details.

8. Lawful bases for processing

We only use personal data where we have a lawful basis under applicable data protection law (including, where relevant, GDPR and Türkiye’s KVKK). Depending on the situation we may rely on: contractual necessity (to provide Custala, manage your account, or process billing); consent (for optional marketing or non-essential cookies, where required); legitimate interests (to improve Custala, respond to enquiries, maintain security, and develop the product, where your rights do not override those interests); and legal obligation (tax, accounting, or regulatory requirements).

9. Custala platform users

When an organisation uses Custala, that organisation is usually the Data Controller and Breath Studios acts as the Data Processor. We may process manager / admin identifiers (name, email, role), usage and activity data (logins and interactions), team, segment and access-scope configuration, and technical logs as needed for security and operations.

Questions about how your organisation uses your data inside Custala should go to your organisation first.

10. Anonymous feedback

Custala is designed to support anonymous feedback and team-level insight: scores are aggregated before managers see them; reports are withheld until a minimum response threshold is met; individual responses are not intended to be visible to managers.

Absolute anonymity cannot be guaranteed in every situation, especially in very small groups. Custala is meant for team-level insight, not to monitor or evaluate named individuals. Organisations remain responsible for using insights appropriately.

11. AI and automated insights

Custala uses automated processing and AI-powered features (Ala, powered by Google Gemini) to generate insights and coaching based on pulse and platform data. These insights support human decision-making; they do not replace it.

Custala does not make solely automated decisions that produce legal or similarly significant effects on individuals. Managers remain responsible for reviewing recommendations before acting.

12. Who we share data with

We may share personal data with trusted service providers who help us operate Custala, including: Hostinger (cloud hosting and infrastructure); Lemon Squeezy (payment processing); Resend (transactional email); Google Gemini (Ala AI coaching); and professional advisers where needed.

We put appropriate agreements in place with providers where required. We may also share data where required by law or to protect our rights, users, or business.

13. International transfers

Some providers may process personal data outside Türkiye or the EEA. Where transfers occur, we take steps to use appropriate safeguards required by applicable law.

14. How long we keep personal data

We keep personal data only as long as needed for the purposes in this policy, including while you have an active Custala account or subscription, and for legal, tax, security, or dispute-resolution needs.

When a customer organisation terminates Custala, we will delete or return personal data within 90 days of termination at the controller’s choice, unless law requires longer retention. Deletion requests: info@breathstudios.net.

15. Security

We take appropriate technical and organisational measures to protect personal data, including role-based access controls, encryption in transit where appropriate, secure hosting via Hostinger, and confidentiality expectations for personnel. No system is completely secure; we take reasonable steps to protect data and the platform.

16. Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to certain processing, request portability, or withdraw consent where we rely on consent. If you use Custala through your organisation, contact your organisation first. You may also email info@breathstudios.net.

17. Complaints

Please contact us first at info@breathstudios.net. You may also complain to your local data protection authority where applicable.

18. Children

Custala is intended for business and workplace use. You must be at least 18 years old to use the platform. We do not knowingly collect personal data from children.

19. Links to other websites

Our site or emails may link to third-party sites (including Lemon Squeezy checkout). We are not responsible for their privacy practices.

20. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will be available on the Custala website. Where changes are material, we will take reasonable steps to notify users.

21. Contact us

Email: info@breathstudios.net · Parent company: https://breathstudios.net/