1. Introduction
Welcome to youSleep.ai. This Privacy Policy outlines how we collect, use, and protect your personal data in compliance with the General Data Protection Regulation (GDPR). It applies to traffic and activity on the following websites:
https://portal.yousleep.ai
https://api.yousleep.ai
By using these websites, you agree to the terms of this policy.
Last updated: 16 June 2026
Data Controller
The youSleep Project
Email: [email protected]
The youSleep Project is the operating name of the service while the underlying legal entity is being established. youSleep is an ongoing, non-commercial research project, currently provided as a closed, invite-only beta. For any queries regarding this Privacy Policy, please contact us at [email protected].
2. Data Controller
The youSleep Project is the data controller responsible for determining the purposes and means of processing your personal data, as per Article 4(7) of the GDPR.
3. Personal Data We Collect
We may collect and process the following categories of personal data:
3.1 Data Provided During Sign-Up
Email address and password: required to create and authenticate your account.
Account metadata: organization name, role/position (optional), intended use, expected monthly data volume, and invite code - used to evaluate and administer beta access.
We will contact you for service-related matters (account, security, invite administration) or, if you opt in, our newsletter.
3.2 Uploaded Sleep Recordings
Sleep recordings: You may upload sleep recordings (e.g., EDF files). Please anonymize these files to the best of your ability by removing personal identifiers, such as names, age, or any other information from the EDF headers. Uploaded sleep recordings are stored using Cloudflare R2 object storage, hosted within the European Union, and are accessible to your account and to operators of the service. Recordings are not sold or shared with any third party other than our storage provider, and are not used for advertising. You can delete these files at any time via the deletion features of the platform.
3.3 Usage Data
System activity: We collect data about your use of the platform, such as which files you analyze and when. This information is necessary to provide our services and improve the performance of the platform.
Traffic data (via Cloudflare): We use Cloudflare for DNS, DDoS protection, and secure transport. Cloudflare processes incoming request metadata, including IP addresses, approximate location, and access times. We do not actively link or analyze this data against individual accounts, but it may be retained for traffic-pattern analysis, security, and load balancing.
4. Purposes and Legal Basis for Processing
We process your personal data based on the following legal grounds under the GDPR:
4.1 Performance of a Contract (Article 6(1)(b))
Your email, account credentials, and sleep recordings are processed to provide the analysis services you have requested.
4.2 Consent (Article 6(1)(a))
If you subscribe to our newsletter, we will process your email for communication purposes based on your explicit consent.
We will not use your uploaded sleep recordings to train models or algorithms unless you provide explicit consent during upload.
You may withdraw consent at any time by contacting us at [email protected] or, where offered, using the unsubscribe link. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
4.3 Legitimate Interest (Article 6(1)(f))
We process system activity under our legitimate interest in operating, securing, and improving the service.
4.4 Legal Obligation (Article 6(1)(c))
We may process your data where necessary to comply with legal obligations (e.g., regulatory requests, security requirements).
5. Data Storage and Retention
5.1 Storage of Uploaded Data
Your uploaded sleep recordings are stored using Cloudflare R2 object storage, hosted within the European Union (see Section 9). They are never sold, and are not shared with any third party other than the storage provider.
You can delete your uploaded data at any time using the deletion features provided via the API and web frontend.
5.2 Retention of Logs and Analysis Events
Analysis events (e.g., sleep staging output) are retained in pseudonymized form for the lifetime of your account. Aggregated statistics derived from these events (without personal identifiers) may be retained indefinitely for research and service-improvement purposes.
5.3 Retention of Traffic and Security Data
Cloudflare request metadata is retained according to Cloudflare's own retention schedule (typically a short rolling window).
5.4 Account Deletion
When you delete your account, your uploaded sleep recordings and your account record are permanently deleted. Pseudonymised analysis events and aggregated statistics may be retained as outlined above.
6. Data Subject Rights
Under the GDPR, you have the following rights regarding your personal data:
Right to Access (Article 15): You can request access to the personal data we hold about you.
Right to Rectification (Article 16): You can request correction of inaccurate or incomplete personal data.
Right to Erasure (Article 17): You can request deletion of your personal data, including your uploaded recordings, at any time.
Right to Restrict Processing (Article 18): You may request restriction of data processing under certain conditions.
Right to Data Portability (Article 20): You can request to receive your data in a structured, commonly used, machine-readable format. Because the platform does not currently provide in-app file download, we fulfill such requests by email.
Right to Object (Article 21): You can object to certain processing, including processing based on legitimate interest or for direct marketing.
Right to Withdraw Consent (Article 7(3)): Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
Right to Lodge a Complaint (Article 77): You have the right to lodge a complaint with a supervisory authority. In Denmark, the authority is the Danish Data Protection Agency (Datatilsynet) - https://www.datatilsynet.dk.
You may exercise these rights by contacting us at [email protected].
7. Data Security
We implement appropriate technical and organizational measures to ensure a high level of security to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These measures include:
Encryption of data in transit (TLS)
Access controls, authentication, and audit logging
Separation of duties between service operators and our storage provider
Use of Cloudflare for DDoS protection and secure transport
Despite these measures, no system is completely secure. If a data breach occurs, we will notify affected users and the relevant supervisory authority in accordance with GDPR requirements.
8. Cookies and Tracking
We use cookies and similar technologies to operate the service and ensure its functionality. The categories in use are:
Essential: authentication, session management, CSRF protection, and security (set by us and by Cloudflare).
No advertising or product-analytics cookies are used.
9. Data Sharing
We do not share your personal data with third parties, except under the following circumstances:
Legal compliance: If required by law, we may disclose your data to government authorities.
Service providers (processors acting on our instructions): We use a small number of external providers strictly to operate the service: Cloudflare (object storage via Cloudflare R2, hosted within the European Union, where your uploaded recordings and analysis artefacts are stored; plus DNS resolution, DDoS protection, and secure transport); SMTP2GO (delivery of transactional emails such as account verification, password resets, and invitations, which involves processing your email address); and, where commercial features are enabled, Stripe (payment processing). These providers may process limited personal data only to provide their part of the service, and do not use it for their own purposes.
We do not sell or rent your personal data to third parties.
10. International Data Transfers
Your uploaded recordings and analysis artefacts are stored within the European Union (Cloudflare R2, EU region). Some of our service providers (Cloudflare, SMTP2GO, and Stripe) are established outside the European Economic Area or operate globally distributed infrastructure; where personal data is processed outside the EEA, we rely on appropriate safeguards under the GDPR, in particular the European Commission's Standard Contractual Clauses (SCCs).
11. Changes to This Privacy Policy
We may update this Privacy Policy periodically. Any changes will be posted on this page with updated "Version" and "Valid from" tags. We encourage you to review this policy regularly for any updates.
12. Contact Us
If you have any questions about this Privacy Policy or your data, please contact us:
The youSleep Project
Email: [email protected]
This section applies to users registering for the youSleep.ai closed BETA program. In addition to the personal data described in the latest main privacy policy, we collect and process additional information for the purpose of evaluating and improving our service during the BETA phase.
1. Additional Data Collected
When registering for the closed BETA program, you will be asked to provide the following additional information:
Research or commercial organization details: The name of the organization you are affiliated with and, if applicable, your position within that organization.
Interest in testing: Information about why you are interested in testing the service, including your expected use cases and how you plan to utilize the service once it goes live.
Feedback and expectations: Any feedback you provide regarding the service during the BETA phase and your expectations for its performance and features.
2. Purpose and Legal Basis for Processing
The additional data collected during closed BETA registration is processed for the following purposes:
2.1 Performance of a Contract (Article 6(1)(b))
The processing of this additional data is necessary to allow us to provide you access to the closed BETA program and evaluate your eligibility for participation.
2.2 Legitimate Interest (Article 6(1)(f))
We process the additional information to improve and refine our service based on feedback from BETA participants, as well as to understand potential user needs and expectations when the service goes live.
2.3 Consent (Article 6(1)(a))
By voluntarily providing information about your research or commercial organization, as well as your interest in the service, you consent to the processing of this information for the purposes outlined above.
3. Data Retention for BETA Program Participants
We will retain the additional information collected during the BETA phase for the duration of the BETA program and for a reasonable period afterward, to ensure we can properly analyze feedback and improve the service. Once the BETA phase is complete, the data will either be deleted or anonymized.
4. Data Sharing
We do not share the additional data collected during the closed BETA registration with third parties, except as required by law or in compliance with the main terms of our privacy policy.
5. Rights of BETA Program Participants
In addition to the rights outlined in our main privacy policy, participants in the closed BETA program have the right to:
Withdraw from the BETA program at any time and request the deletion of any additional data provided during registration.
Request that we anonymize any feedback or input you provided during the program if you choose to discontinue your participation.
To exercise any of these rights, please contact us at [email protected].
6. Changes to This Amendment
This amendment may be updated as the BETA program progresses. Any changes will be communicated to participants directly, and the "Version" & "Valid from" tags will be revised accordingly.