Last updated: 27 August 2026

1. Who is responsible for your data

Lycaste Ltd, Business ID (Y-tunnus) 2638862-1, Rantapolku 15, 00330 Helsinki, Finland, is the controller of the personal data described here. We operate Win Within and byakku.com.

Questions, or any request about your data: hello@byakku.com

We have not appointed a Data Protection Officer, as we are not required to.

2. What we collect

When you buy or sign up: your name, email address, and the record of what you purchased and when. Payment is handled by our payment provider — we can see that a payment succeeded and the last four digits of the card, never the full card number.

When you use the app: your account details, which practices you have opened or completed, and technical data such as device type and app version.

When you visit our website: IP address, browser and device information, pages viewed, and cookie data.

When you fill in a form or reflection: whatever you choose to write. Our reflection forms and intake questions may invite you to describe how you are feeling physically or emotionally. That is health-related information, and it receives the additional protection described in Section 4.

When you take part in a live session: your participation, and — where a session is recorded and you have been told in advance — your voice, image and contributions.

What we do not collect: we do not buy data about you from third parties, we do not build behavioural profiles, and we make no automated decisions that produce legal or similarly significant effects.

3. Why we use it, and on what legal basis

What we doWhyLegal basisGive you access and run your accountTo deliver what you boughtPerformance of a contractSend service emails about your purchaseTo deliver what you boughtPerformance of a contractKeep accounting and tax recordsBecause Finnish law requires itLegal obligationSend you offers and content by emailTo tell you about related workYour consent, or our legitimate interest as an existing customerUnderstand which practices are usedTo improve the contentLegitimate interestAssess whether a practice is safe for youFor your safetyYour explicit consentRecord live sessionsSo participants can revisit themYour consentWebsite analytics and marketing cookiesTo measure and improveYour consent

You can withdraw consent at any time. Every marketing email carries an unsubscribe link, and unsubscribing is honoured immediately.

4. Health-related information

Some of what you may share with us — in a health screening, an intake form, a reflection, or a conversation — is health information. Under GDPR this is a special category of personal data with stronger protection.

We handle it as follows:

• We collect it only with your explicit consent, given separately and for a stated purpose.

• We use it only to assess whether a practice is suitable for you and to adapt it safely — never for marketing, never for profiling.

• We do not share it with any third party unless you ask us to, or the law requires it.

• We keep it for the duration of our work together plus twelve months, then delete it.

• You may withdraw your consent at any time, and we will delete it.

You are never obliged to share health information with us. If you prefer not to, tell us — and please speak with your own doctor instead about whether these practices are right for you.

5. Children and young people

Our services are sold to adults. Where a person under 18 uses Win Within, the account is held by a parent or legal guardian, who provides all consents on the young person's behalf and remains responsible for the account.

We do not knowingly collect personal data directly from a child without that parental consent. If you believe we hold data about a young person without it, contact us at hello@byakku.com and we will delete it.

6. Who else handles your data

We use carefully chosen service providers who process data on our instructions, under written data processing agreements:

ProviderWhat it doesSysteme.ioOrder forms, email list, email deliveryStripePayment processingZapierAutomated transfer of your purchase to your app accessPassion.ioThe app, your account, content deliveryVimeoAudio and video hostingGoogleForms and emailSquarespaceOur website

Full details of each provider, including its legal entity and location, are available on request at hello@byakku.com.

We do not sell your personal data. We do not share it with advertisers.

We may disclose data where the law requires it, or where necessary to establish or defend a legal claim.

7. Data outside the EU/EEA

Some of our providers process data in the United States. Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses and/or the provider's certification under the EU–US Data Privacy Framework, as set out in our agreement with each provider.

You may request details of the safeguards that apply by emailing hello@byakku.com.

8. How long we keep things

• Account and access data: while your access is active, plus 12 months.

• Purchase and accounting records: up to ten years, as Finnish accounting and tax law requires.

• Marketing list: until you unsubscribe.

• Health-related information: the duration of our work together plus 12 months.

• Session recordings: for as long as participants have access to that programme.

• Website and cookie data: up to 12 months, or until you clear or change your cookie settings.

9. How we protect it

Access to your data is limited to those who need it. Our providers are chosen for their security practices and bound by written agreements. We use strong authentication on our accounts and encrypted connections throughout.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the Finnish Data Protection Ombudsman within 72 hours and inform you where required.

10. Cookies

Our website uses cookies. Some are strictly necessary for the site to function. Others — analytics and marketing cookies — help us understand how the site is used, and these are set only with your consent.

You can accept or decline non-essential cookies when you first visit, and change your choice at any time through your browser settings. Declining does not prevent you using the site.

11. Your rights

Under GDPR you have the right to:

• access the personal data we hold about you;

• correct anything inaccurate;

• erase your data, subject to records we must keep by law;

• restrict or object to our processing;

• portability — receive your data in a machine-readable form;

• withdraw consent at any time, without affecting what came before;

• complain to a supervisory authority.

To exercise any of these, email hello@byakku.com. We will respond within one month.

If you are unhappy with how we have handled your data, you may contact the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland — tietosuoja.fi. If you live in another EU/EEA country, you may complain to your own national authority instead.

12. Changes to this policy

We may update this policy. The current version is always on this page with its date. Where a change materially affects you, we will tell you by email or in-app.

13. Contact

Lycaste Ltd
Business ID (Y-tunnus): 2638862-1
VAT: FI26388621
Rantapolku 15, 00330 Helsinki, Finland
hello@byakku.com