Last updated: Nov 12, 2025
This Privacy Policy explains how Supernovation, Inc. and its subsidiaries and affiliates ("Supernovation," "Umaya," "we," "us," or "our") collect, use, disclose, and protect information about you when you:
Use our mobile applications, websites, and other online products and services (collectively, the "Services"), or
Interact with us in other ways, such as contacting our support team or engaging with us on social media.
Some products or features may have their own privacy notices. If a particular Service links to a different notice, that notice will apply instead of this one for that Service.
Additional information for California residents and for individuals in the EEA, UK, and Switzerland appears at the end of this Privacy Policy.
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above and may provide additional notice as required by law.
1. Information We Collect
A. Information You Provide to Us
We collect information you provide directly to us, such as when you:
Create or update an Umaya account
Use in-app interactive features (for example, ratings, check-ins, or reflections)
Fill out forms or surveys
Enter a promotion, referral program, or contest
Make a purchase or start a subscription
Contact us (by email, in-app support, or social media)
Otherwise communicate or interact with us
This can include:
Contact and account details: Name, email address, login credentials, and any linked social media details.
Payment information: Payment method details used to complete purchases (processed by our payment partners).
Feedback and communications: Messages you send us, survey responses, support requests, and other content you choose to share. Users sometimes describe how they feel or their personal experiences; we do not use these messages to infer clinical or medical characteristics and process them only for the purposes for which they were provided.
Employment or program information: If you access Umaya through an employer, institution, or special initiative, we may receive information related to that program.
Other profile and preference information: Such as language settings, goals, meditation or wellbeing experience, sleep habits, moods, and reflections you record via check-ins or similar features.
B. Information We Collect Automatically
When you use the Services, we automatically collect certain information, such as:
Usage information: Content you view or listen to, sessions you start or complete, features or screens you access, and other in-app actions.
Transactional information: Details about purchases and subscriptions, such as product or plan type, price, renewal and trial dates, and timestamps of transactions.
Log information: Browser or app type and version, IP address, access times and dates, pages viewed, and the page you visited before coming to our site.
Device information: Hardware model, operating system and version, unique device identifiers, and mobile network information.
Communications with us: We may retain records of communications (e.g., email and in-app messages). Where allowed by law and clearly indicated, we may also record support calls for quality and training purposes.
C. Information We Infer or Generate
We may generate or infer additional information, such as:
Internal identifiers: A user ID we associate with your account and activity.
Derived information: For example, approximate location from your IP address, or inferences about your preferences or likelihood of continuing to use the Services.
D. Information from Other Sources
We may receive information about you from third parties, including:
App stores and platforms: Information related to installations, purchases, or subscriptions initiated through third-party stores or platforms.
Calendar integrations: If you connect a third-party calendar, we may access calendar data you choose to share.
Social media: If you sign up or log in via a social media service, we receive information that service shares with us, according to your settings there.
Device health or wellness platforms: With your explicit permission, we may receive data from your device's health or wellness frameworks (such as sleep duration or goals). We use this data only for the purposes you allow and do not use it to infer health diagnoses.
Cookies and similar technologies: Information collected via cookies, pixels, and similar tools on our websites and Services.
Public or third-party sources: Information that is publicly available or provided by third-party research or business-contact providers.
2. How We Use Your Information
We use the information we collect for purposes including:
Providing and maintaining the Services
To operate Umaya, provide core functionality, and debug or fix errors.
Legal basis (where applicable): performance of our contract with you.
Improving and developing the Services
To analyze performance, research and develop new features, and refine user experience.
Legal basis: our legitimate interest in improving and expanding our Services.
Processing transactions
To process payments, manage subscriptions and trials, and handle refunds or billing issues.
Legal basis: performance of our contract with you.
Sending transactional and service messages
Such as purchase confirmations, subscription updates, security alerts, and important service notifications.
Legal basis: our legitimate interest in providing important information about your account and purchases.
Marketing and communications
To send you information about Umaya features, new products, special offers, surveys, or events we think may interest you (where permitted by law). You can opt out of marketing communications at any time.
Legal basis: our legitimate interest in promoting our Services, or your consent where required.
Analytics and trend monitoring
To understand how users interact with Umaya, measure engagement, and identify trends and usage patterns.
Legal basis: our legitimate interest in understanding and improving user experience.
Safety, security, and fraud prevention
To detect, investigate, and help prevent fraudulent, abusive, or illegal activities; to protect our rights, property, and safety, and those of our users or others; and to enforce our terms and policies.
Legal basis: our legitimate interest in protecting our business and users; compliance with legal obligations.
Legal compliance and record keeping
To comply with applicable laws and regulations, including tax, accounting, and consumer protection requirements.
Legal basis: compliance with legal obligations.
Aggregated and de-identified data
To create data that no longer identifies individual users, which we may use for research, analytics, or business purposes.
Legal basis: our legitimate interest in using non-identifiable information to improve and promote our Services.
Personalization and advertising
To personalize your in-app experience and, where permitted, to tailor advertising on other platforms based on your interests and activity.
Legal basis: our legitimate interest in providing a relevant experience and marketing our Services, or your consent where required.
Contests, promotions, and surveys
To administer promotions or surveys in which you choose to participate.
Legal basis: our legitimate interest in running voluntary promotional programs.
3. How We Share Information
We may share your information as follows:
Service providers and contractors: With companies that perform services on our behalf, such as payment processors, cloud hosting providers, analytics and advertising partners, customer support tools, email and communication platforms, security and fraud prevention vendors, and logging and error-tracking providers. These parties are contractually required to handle your information only as instructed by us.
Professional advisors: With auditors, lawyers, or similar professionals, subject to confidentiality obligations, when necessary to support our business or legal needs.
For legal and safety reasons: When we believe disclosure is required or appropriate to comply with applicable law, regulation, legal process, or governmental requests, or to protect the rights, property, or safety of Supernovation, Umaya users, or others, or to establish, exercise, or defend legal claims.
Business transfers: In connection with any merger, acquisition, financing, reorganization, or sale of some or all of our assets. Information may be shared during due diligence or transferred as part of the transaction.
Within Supernovation: With our current and future subsidiaries, affiliates, and other companies under common ownership and control, for purposes consistent with this Privacy Policy.
Programs, employers, and plan sponsors: If you receive access to Umaya through an organization (such as an employer or a family/household organizer), we may confirm to them that you have activated or used the access provided.
Partners and promotions: When you redeem an Umaya offer or bundle provided by a partner, we may confirm redemption or basic usage related to that promotion.
With your consent or at your direction: For example, when you choose to share activity via social media or connect Umaya to third-party services.
We may also share aggregated, de-identified, or otherwise non-identifying information with third parties for their own purposes, as this information does not reasonably identify you.
4. Analytics and Advertising
We work with third-party partners that provide analytics and advertising services. These partners may use cookies, pixels, SDKs, device identifiers, and similar technologies to collect information about your use of the Services and other websites or apps, including:
The pages or screens you view
Features you use
Time spent in the app or on our site
Device and browser information
IP address and approximate location
Links you click and actions you take
Conversion information (such as whether you installed the app after seeing an ad)
Supernovation and our partners use this information to:
Analyze and understand how people use Umaya
Measure the performance of content and campaigns
Deliver advertisements that may be more relevant to your interests
Improve our Services and marketing
Some partners allow us to provide a hashed version of your email or other identifier to help show more relevant ads on their platforms.
You may be able to manage your preferences regarding cookies, tracking, and targeted advertising through:
Your browser settings
Your mobile device settings (for example, limiting ad tracking or resetting your advertising ID)
In-app or website privacy or cookie settings where available
Certain industry opt-out tools, depending on your region
5. International Data Transfers
We are based in the United States, and our service providers may process your information in the United States and other countries. Those countries may have data protection rules that are different from those of your home country and may not provide the same level of protection.
Where required by law, we use appropriate safeguards to protect your information when it is transferred internationally, such as:
Standard contractual clauses approved by relevant authorities
Other lawful transfer mechanisms
Obtaining your consent where appropriate
You can contact us at [email protected] if you have questions about how your information is protected in the context of international transfers.
6. Your Rights
Depending on your location and applicable law, you may have some or all of the following rights with respect to your personal information:
Access: Request a copy of the personal information we hold about you.
Correction: Request that we correct inaccurate or incomplete information.
Deletion: Request that we delete your personal information, subject to certain exceptions.
Portability: Request a copy of your information in a structured, commonly used format.
Objection: Object to our processing of your information for certain purposes.
Restriction: Request that we limit how we use your information.
Withdraw consent: Where we rely on your consent, you may withdraw it at any time.
Opt out of marketing: Unsubscribe from marketing emails or push notifications at any time.
To exercise these rights, please contact us at [email protected]. We will respond to your request in accordance with applicable law.
You also have the right to lodge a complaint with a data protection authority in your jurisdiction.
7. Data Retention
We retain your personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.
When determining retention periods, we consider:
The nature and sensitivity of the information
The purposes for which we process it
Legal and regulatory requirements
Whether you have an active account with us
After you close your account or request deletion, we may retain certain information as required by law or for legitimate business purposes, such as fraud prevention and safety.
8. Security
We implement reasonable technical, administrative, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction.
However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.
You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.
9. Children's Privacy
The Services are not intended for children under 16 years of age, and we do not knowingly collect personal information from children under 16.
If we learn that we have collected personal information from a child under 16 without parental consent, we will take steps to delete that information as soon as possible.
If you believe we have collected information from a child under 16, please contact us at [email protected].
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
When we make changes:
We will update the "Last updated" date at the top of this Privacy Policy
We may notify you via email, in-app notification, or other means
Your continued use of the Services after changes take effect constitutes acceptance of the updated Privacy Policy
We encourage you to review this Privacy Policy periodically.
11. Additional Information for California Residents
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and other California privacy laws.
Categories of Personal Information
We collect the following categories of personal information:
Identifiers (name, email, account ID)
Commercial information (purchase history, subscription details)
Internet or network activity (usage data, device information)
Geolocation data (approximate location from IP address)
Audio or visual information (if you contact us by phone or video)
Inferences (preferences, characteristics, behavior)
Your California Privacy Rights
You have the right to:
Know: Request information about the categories and specific pieces of personal information we have collected, the sources, purposes, and third parties with whom we share it.
Delete: Request deletion of your personal information, subject to certain exceptions.
Opt out of sale/sharing: We do not sell personal information in the traditional sense, but we may share information for targeted advertising purposes. You can opt out by adjusting your device or browser settings.
Correct: Request correction of inaccurate personal information.
Limit use of sensitive information: Request that we limit use of sensitive personal information.
Non-discrimination: We will not discriminate against you for exercising your privacy rights.
To exercise these rights, contact us at [email protected].
Shine the Light
California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, contact us at [email protected].
12. Additional Information for EEA, UK, and Swiss Residents
If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent laws.
Legal Basis for Processing
We process your personal information based on the following legal grounds:
Contract performance: To provide the Services you have requested
Legitimate interests: To improve our Services, prevent fraud, and market our products
Legal compliance: To comply with applicable laws and regulations
Consent: Where you have given explicit consent for specific processing activities
Your Rights
Under GDPR, you have the right to:
Access your personal data
Rectify inaccurate data
Erase your data ("right to be forgotten")
Restrict processing
Data portability
Object to processing based on legitimate interests
Withdraw consent at any time
Lodge a complaint with your local supervisory authority
Data Protection Officer
For questions about how we process your personal data, you can contact our Data Protection Officer at [email protected].
International Transfers
When we transfer your data outside the EEA, UK, or Switzerland, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:
Supernovation, Inc.
Email: [email protected]
For data protection inquiries from EEA, UK, or Swiss residents, you may also contact our Data Protection Officer at the email address above.