Privacy Policy

Last updated: October 01, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal Data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

  • Account means a unique account created for You to access our Service or parts of our Service.
  • Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
  • Application means the software program provided by the Company downloaded by You on any electronic device, named HANA.
  • Business, for the purpose of the CCPA (California Consumer Privacy Act), refers to the Company as the legal entity that collects Consumers' personal information and determines the purposes and means of the processing of Consumers' personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State of California.
  • Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to P DIAMOND S.R.O., Námestie Kossutha 3087/124, 94501 Komarno, Slovakia. For the purpose of the GDPR, the Company is the Data Controller.
  • Commission means a payment the Company may make for a successful referral or similar activity. The Company pays a Commission only to a company, and only after the required company details and EU VAT number have been provided.
  • Consumer, for the purpose of the CCPA (California Consumer Privacy Act), means a natural person who is a California resident. A resident, as defined in the law, includes (1) every individual who is in the USA for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the USA who is outside the USA for a temporary or transitory purpose.
  • Country refers to: Slovakia.
  • Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
  • Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
  • Do Not Track (DNT) is a concept that has been promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites.
  • Personal Data is any information that relates to an identified or identifiable individual. For the purposes of the GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity. For the purposes of the CCPA, Personal Data means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.
  • Sale, for the purpose of the CCPA (California Consumer Privacy Act), means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information to another business or a third party for monetary or other valuable consideration.
  • Service refers to the Application and the website at hanaoils.com.
  • Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used. For the purpose of the GDPR, Service Providers are considered Data Processors.
  • Third-party Social Media Service refers to any website or any social network website through which a User can log in or create an account to use the Service.
  • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
  • You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. Under the GDPR, You can be referred to as the Data Subject or as the User as You are the individual using the Service.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to, the categories below.

Account and profile

  • Email address
  • First name and last name, and any display name shown in the Application
  • Phone number, if You provide one
  • Password, stored in a protected form, if You register with email and password
  • Identifiers received when You sign in with Google or Apple, including an Apple private relay email address where Apple provides one
  • App language
  • Country or store country used to show the subscription price for Your market
  • Account status, registration date, and subscription status (for example free or demo access, monthly, yearly, or Mission Supporter), including whether paid access is currently active
  • Your personal referral code and referral link, which We generate and store for Your account
  • The referral code or link that led to Your registration, where You arrived through someone else's invitation, and whether a paid subscription was later activated on that account

We do not store Your full payment card number. Subscription purchases made in the Application are processed by the Apple App Store or Google Play and their subscription partners.

Company details and EU VAT number

The Company pays a Commission only to a company, not to a private individual. Where a Commission may be paid, the Application asks for the company details customarily used in the European Union, and for an EU VAT number. These details are required before a Commission can be paid. They include:

  • Legal name of the company
  • Legal form, where it is part of the registered name or is otherwise required
  • Registered office address (street, postal code, city, and country)
  • Country of establishment
  • Company registration number
  • EU VAT identification number

We may also ask for the payout details needed to transfer a Commission that is due.

We use these details to confirm that the recipient is a company, to check the EU VAT number, to issue invoices or equivalent accounting documents, to meet tax and accounting duties, and to pay a Commission that is due. Company details and the EU VAT number are not shown to other users.

About you, personality play, and learning

  • Your answers to the one-time "a few questions about you" (whether You have heard of essential oils, whether You have used them, and whether someone around You has recommended them). These answers are stored once and are not offered again.
  • Your answers, current result, and earlier results in "What oil are you?"
  • Quiz and learning-path data: questions answered, whether an answer was correct, accuracy, points (XP), current streak, longest streak, day of the path, items set aside for review, and weekly or end-of-path summaries
  • Oils and blends You mark as already in Your personal collection, and oils and blends You mark as favorites. These lists are private to Your account.

Mission Center

If You use the Mission Center, We also store:

  • The number of people You choose as Your invitation goal
  • The sharing channel You select
  • Whether You ask for a weekly reminder
  • The motivation options You select. These stay private and are not shown on a public profile.
  • Your progress, badge level, and notification preferences
  • Events needed to run invitations and any Commission, such as when a share was started, when a referral link was opened, when a registration was attributed to You, and when a referred subscription became paid
  • A flag if a referral looks like self-referral or another abuse pattern, and the record of any admin review of that flag

Badges and progress counters record activity in the Application. They do not, by themselves, create a right to a Commission. A Commission is paid only to a company, and only after the company details and EU VAT number above have been provided.

Community content

If You create or interact with community Solutions, Recipes, or Experiences, We store:

  • Title, ingredients, instructions, and any optional personal story You write
  • For a Solution, the condition You select from the Application's condition list
  • For a Recipe, the category it belongs to
  • Up to two pictures You add from Your camera or photo library
  • The language You wrote in, and translations We generate so other users can read the content in their app language
  • Status of the post (draft, waiting for review, approved, rejected, or hidden after reports), and any rejection reason We send You
  • Your star rating of another user's approved post, and any report You submit (a predefined reason and any optional comment)

Approved community posts are shown to other users without Your name or profile. We still keep the link between the post and Your account so We can moderate it, let You edit or delete it, and contact You about it.

Support and messages

  • Messages You send to HANA Support, and Our replies, in a single conversation thread linked to Your account
  • Push notification token and Your notification settings, if You allow notifications

Website

  • Name and email address if You subscribe to the newsletter on Our website

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the Application version, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.

Information Collected while Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

  • Pictures and other information from Your Device's camera and photo library, when You choose to add images to community content

We use this information to provide features of Our Service, to improve and customize Our Service. The information may be uploaded to the Company's servers and/or a Service Provider's server or it may be simply stored on Your device.

You can enable or disable access to this information at any time, through Your Device settings.

Information that may relate to wellbeing

The Application is an essential-oil guide. It does not diagnose, treat, or monitor a medical condition.

Some features can still include information about wellbeing if You choose to provide it. A community Solution is linked to a condition from Our list, and an optional story may describe a personal experience. "What oil are you?" reflects a current personality and life-situation result for entertainment and education. It is not a health assessment.

We use this information only to operate the feature You asked for: to show, moderate, translate, and improve that content, and to remember Your result. We do not use it to build a medical profile, and We do not sell it.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

  • To provide and maintain our Service, including to monitor the usage of our Service.
  • To manage Your Account: to manage Your registration as a user of the Service, including sign-in with Google or Apple, Your language, Your referral code, and the features available to You as a registered user.
  • To personalize the Service: to remember Your answers, quiz progress, collection, favorites, and Mission Center choices, and to show content that fits them.
  • To run invitations: to generate Your referral code and link, to attribute a new registration to the last referral link opened before sign-up, and to count a successful paid subscription toward the inviter's progress and badges.
  • To pay a Commission: to collect and check company details and an EU VAT number, to decide whether a Commission is payable to that company, to keep accounting records, and to pay the Commission. The Company does not pay a Commission to a private individual on the basis of a personal profile alone.
  • To operate the community: to store, review, approve or reject, translate, display, rate, and report Solutions, Recipes, and Experiences, and to keep drafts private to You until You submit them.
  • For the performance of a contract: the development, compliance and undertaking of the purchase contract for the subscription or other services You have purchased through the Service, and of any Commission arrangement with a company. Subscription billing is handled by the app store.
  • To contact You: to contact You by email, or by push notification if You allow it, about Your account, support replies, content You submitted, a Commission, security updates, and — if You have asked for them — Mission Center reminders. We may also send news and offers unless You have opted not to receive them.
  • To manage Your requests: to attend and manage Your requests to Us, including the in-app support conversation.
  • To keep the Service safe: to detect self-referral and other abuse, to review reports of unsafe or unlawful community content, and to enforce these policies.
  • For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.
  • For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns, and to evaluate and improve our Service, products, services, marketing, and Your experience. Public statistics from onboarding or Mission Center answers are aggregated and are not published with Your name.

Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, We rely on:

  • Contract — to create and run Your account, provide the features You use, perform a subscription You buy, and administer a Commission payable to a company.
  • Legitimate interests — to keep the Service secure, measure how it is used, attribute referrals, moderate community content, and improve the Service, where those interests are not overridden by Your rights.
  • Consent — for optional newsletter email, for camera and photo access, for push notifications where Your device requires consent, and where You choose to submit a story or other content that describes health or wellbeing. You may withdraw consent at any time. Withdrawal does not affect processing that already happened.
  • Legal obligation — where We must keep or disclose information under the law, including tax and accounting rules that apply to a Commission and to an EU VAT number.

Sharing of Your personal information

We may share Your personal information in the following situations:

  • With Service Providers: We may share Your personal information with Service Providers who host the Service, send email, send push notifications, translate community content, operate Our newsletter, connect subscriptions to the app stores, validate an EU VAT number, keep Our accounts, or transfer a Commission. They process data on Our instructions. Our newsletter and lifecycle email use Your email address, display name, app language, and a segment that reflects whether You are newly registered, on a monthly or yearly plan, or no longer have paid access.
  • With app stores: If You buy a subscription, Apple or Google (and their payment partners) process the payment under their own terms. We receive subscription status, not Your full card number.
  • With sign-in providers: If You use Google or Apple to sign in, those providers process the sign-in under their own terms and share with Us the account details needed to create or open Your account.
  • With tax and accounting recipients: We may share company details, the EU VAT number, and Commission records with Our accountants and with tax authorities when the law requires it, and We may check an EU VAT number through the European Union's VAT validation system.
  • For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
  • With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include Our parent company and any other subsidiaries, joint venture partners or other companies that We control or that are under common control with Us.
  • With other users, only what the feature shows:
    • Approved community Solutions, Recipes, and Experiences are visible to other users without Your name or profile.
    • If You share a "What oil are you?" result or a quiz summary, the card can include the result and Your referral link or QR code. You choose when to share it.
    • Other users do not see Your email address, phone number, company details, EU VAT number, payout details, collection, favorites, quiz answers, "a few questions about you" answers, or Mission Center motivation.
  • With Your consent: We may disclose Your personal information for any other purpose with Your consent.

We do not sell Your Personal Data.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Company details, EU VAT numbers, invoices, and Commission records are kept for as long as tax, accounting, and commercial law require, even if You close Your account earlier.

If You delete Your account, We delete or anonymize the Personal Data linked to it, including removing You from marketing segments, except for records We must keep. We may keep a non-identifying record where We need it for accounting, fraud prevention, moderation logs, or so that an invitation already counted does not point at a deleted profile. Community posts You published may remain available in anonymized form, or be removed, depending on the deletion request and whether other users rely on them. Tell Us when You contact Us if You want published posts removed.

You can request account and data deletion without the app on the account deletion page.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

GDPR Privacy

Your Rights under the GDPR

You have the right under this Privacy Policy, and by law if You are within the EU, to:

  • Request access to Your Personal Data
  • Request correction of the Personal Data that We hold about You
  • Object to processing of Your Personal Data
  • Request erasure of Your Personal Data
  • Request the transfer of Your Personal Data
  • Withdraw Your consent

You may exercise these rights by contacting Us at the address below. We may need to confirm Your identity before We act on a request. Some records, including company details and Commission records that the law requires Us to keep, cannot be erased before the legal retention period ends.

Children's Privacy

Our Service is not directed to anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We learn that We have collected Personal Data from anyone under 18, We take steps to remove that information from Our servers.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

Contact Us

If you have any questions about this Privacy Policy, You can contact us:

P DIAMOND S.R.O.

Námestie Kossutha 3087/124

Komarno 94501, Slovakia

EU VAT Number: SK2122270315

D-U-N-S Number: 764383116