Privacy notice.

Veskens Ltd · trading as Feneri · Last updated 13 October 2026

This notice explains how Veskens Ltd (“Feneri”, “we”, “us”) processes personal data when you use the website, create an account, or run a check-in. It is written for UK GDPR and, where we offer the service in the EEA, the EU GDPR. It is not a medical privacy notice and not legal advice.

1. Controller
2. Scope
3. Personal data we process
4. Lawful bases
5. Automated analysis and the EU AI Act
6. Your reflection
7. Retention of session media
8. Memory across sittings (optional)
9. Sharing
10. Your step and reminders
11. Your therapist
12. Talking to a coach
13. Account data
14. Website, waitlist and contact
15. Cookies and similar technologies
16. Recipients
17. International transfers
18. Security
19. Your rights
20. Children
21. Changes
22. Contact and complaints

Controller

The data controller is Veskens Ltd (company number 17383038), a private limited company registered in England and Wales, trading as Feneri. We determine the purposes and means of processing personal data for the Interface and this website.

Registered office: 20 Wenlock Road, London, England, N1 7GU.

Privacy enquiries: contact@feneri.xyz. Telephone: +44 7446 365714. Use the email address for access, correction, erasure, restriction, portability, and objection requests.

Companies House record: 17383038.

Developer platform processing under a written customer contract may name a different controller or processor arrangement. This notice applies to the personal Interface and the public website.

Scope

This notice covers:

• The personal Interface at /app (guided video check-in).
• This website, including waitlist and contact forms.
• Authentication at /login and /app.

It does not replace a data processing agreement for API customers. Platform billing and builder logs are described in those contracts when they exist.

Personal data we process

Camera and microphone are requested only when you start a sitting. Until then, we do not capture video or audio.

A sitting may include:

• Session media: video and audio of you answering prompts (face, voice, and whatever is in frame).
• Transcript: speech-to-text of that clip.
• Derived signals: model outputs from face, voice and language together, including affective labels and strengths, sentiment, a balance score, timestamped moments, a short narrative, and related Insights.
• Session metadata: start time, recorded duration, template, language, retention mode at start, and report status.

Derived affective signals can constitute special-category data (including biometric data used to infer emotion). We process that data only to provide the sittings you request and, if you turn on memory, to carry them forward (see Memory across sittings). Distress cues may surface local crisis resources in the Interface. That is a safety prompt, not a diagnosis, and not an emergency service. See Terms of use.

Lawful bases

Where UK or EU data protection law applies, we rely on:

• Contract (UK GDPR Article 6(1)(b)): creating and administering your account, enforcing quotas and the waitlist, and delivering the Interface.
• Consent (Article 6(1)(a); for special-category data, Article 9(2)(a)): starting a sitting, granting camera and microphone access, memory across sittings if you turn it on, optional share links, reminders about a step you picked, sharing with your therapist and, separately, your history with them, asking to talk to a coach, waitlist signup, and the contact form. You may withdraw consent by ending the sitting, changing retention, or emailing us. Withdrawal does not affect processing already completed.
• Legitimate interests (Article 6(1)(f)): security, abuse prevention, debugging, and service reliability. We do not use legitimate interests as the basis for capturing session media or deriving affective signals.
• Legal obligation (Article 6(1)(c)): where we must retain or disclose information.

Automated analysis and the EU AI Act

Analysis is performed by automated models. A reflection is generated for you. It is not a solely automated decision that produces legal or similarly significant effects. You may ignore it, start another sitting, or ask us to delete the account.

Feneri is designed for the EU AI Act as a user-initiated personal wellness tool. We do not offer the Interface for emotion recognition in the workplace, in education, or for public-authority use. It is not a medical device. You are informed, before capture, that the sitting will be analysed by our models.

Your reflection

After a sitting, Feneri writes a short reflection from what you said and how you came across: a few of your own words, what stood out, and one small step you can choose. To write it, the transcript of the sitting and the signals derived from it are sent to the language-model providers named under Recipients. Quotes come only from what you said; other people are described by their role, not their name. The reflection is kept with the sitting and deleted with it.

Retention of session media

Raw media is uploaded so the engine can analyse that sitting. It is not published. We keep recordings. You choose one of three replay modes in the Interface. The mode controls how long you can replay a recording; it does not remove the file from our storage. The mode in force when you begin is recorded on that session.

To have your recordings deleted, email contact@feneri.xyz from the address on your account. We will delete them, or your whole account if you ask for that.

The written reflection (scores, transcript, the reflection and its narrative, Insights) and any step you picked remain in the account so recent sittings can be shown. Deleting media does not by itself erase that record. A share link, if you create one, expires after 24 hours. A downloaded PDF is under your control once it leaves our systems.

• Account: until you request deletion, or we close it for abuse or legal hold.
• Waitlist and correspondence: until the purpose is complete or you ask us to erase it.
• Logs and error reports: for as long as required to operate and secure the service, then aged out.

Memory across sittings (optional)

If you turn on memory, Feneri keeps a short written summary of each sitting: the topics you talked about, how you sounded when you talked about them, and things you said you were planning, worried about or wondering. It uses this to open your next sitting and to ask about what you said before.

• Paraphrased, not copied. Summaries are written in our own words. We don’t copy your words into memory, and we refer to other people by their role, not their name.
• Off until you say yes. We ask once, in the Interface. Nothing is remembered before you agree. When you agree, Feneri also reads your most recent sittings (up to 20) so that it has something to pick up from.
• Yours to see and change. In You → Memory you can see what is remembered, ask Feneri not to bring something up, delete all of it, or turn memory off. Turning memory off deletes it.
• Shared only as you choose. Memory is shown only to you, in the Interface. It is in a downloaded PDF only if you tick “Include in my PDF”, and your therapist sees it only if you turn on “Share history with my therapist” (see Your therapist). It is never in a share link or in the developer API.
• How it is written. To write a summary, the transcript of that sitting is sent to the language-model providers named under Recipients. They return the summary; we keep the summary, not a second copy of your words.

Lawful basis: your explicit consent (UK GDPR Article 9(2)(a)). Kept until you delete it, turn memory off, or we delete your account.

Sharing

A share link shows your reflection without your words unless you choose “Include my words” when you create it. Without your words, the link also leaves out your quotes, the transcript, and the note and recap written from them. Links last 24 hours. Memory and the step you picked are never in a share link.

Your step and reminders

If you pick a step after a sitting, we store it with that sitting. If you ask for a reminder, we send one, at the time you chose, in your own timezone, and never between 22:00 and 07:00. Push notifications show your step, so anyone who can see your phone’s lock screen can read it, and the text of a notification passes through Google’s Cloud Messaging and your device’s own push service. You can hide notification text on the lock screen in your phone’s settings. After a sitting where your reflection offered support resources, the notification only says it’s time for the thing you planned. Emails include your step, a link to your reflection, and a link to stop these emails, which works without signing in. The Today screen shows the step you picked most recently, for a week. Nothing asks you whether you did it.

If memory is on, the step is remembered too, and your next sitting may ask how it went. How it went is kept in memory only, so turning memory off deletes it. Lawful basis: your consent; you can change or stop the reminder, and stop the emails, at any time.

Your therapist

If you add a therapist’s email, they get a private link to each reflection, including your words. They see your earlier sittings (Before & now, from memory) only if you also turn on “Share history with my therapist”, which is off until you turn it on. You can turn either off at any time in You → Share with my therapist, and their links stop working at once. Changing the email does the same, and turns history off again. Each link lasts 24 hours. What your therapist reads is a summary and suggestions, not a diagnosis. Lawful basis: your explicit consent (UK GDPR Article 9(2)(a)).

Talking to a coach

If you ask to talk to a coach, you send a request with what it is about (work, life, or not sure), an optional note, and the email on your account. We keep it so our team can arrange a conversation. Your reflection goes with it only if you tick “Share this reflection with the coach”, and then it includes your words; if you leave the box unticked, no part of your reflection is shared. Our team reads the request and assigns a coach from our partners, who then contacts you by email. The coach is an independent partner, not Feneri, and a conversation with a coach is not emergency help: if you are in danger, use the support resources.

We keep the request until you ask us to delete it or we delete your account. If you withdraw it in the Interface, your note and your sharing choice are deleted at once, and a short record stays (that you asked, when, what it was about, and your email) until you ask us to delete it. Lawful basis: your consent (UK GDPR Article 6(1)(a)), and your explicit consent (Article 9(2)(a)) for anything sensitive your note says.

Account data

When you register we store:

• Email, and display name and photo if supplied by the identity provider (email and password, or Google).
• Workspace identifier, locale, last seen time, and retention preference.
• Plan (free or pro). Free is one sitting per UTC day. Pro is not offered for purchase on this site.
• Access state (waitlist or active). New public accounts remain waitlisted until admitted.
• A session cookie so the Interface can call our API. The cookie is HttpOnly, Secure, SameSite=Lax, and lasts 14 days unless you sign out.

There is no in-app account deletion control yet. Email contact@feneri.xyz from the address on the account. We will delete or anonymise the profile, sittings and media we hold, except where we must retain a record (fraud, abuse, or a legal hold).

Website, waitlist and contact

If you join the waitlist we store the email (and name, if provided), time, and source page, solely to contact you about access. We do not sell that list.

If you write via /contact or email, we process the message, your email, and any name you provide, so we can reply. A copy may be retained as correspondence.

Cookies and similar technologies

• Strictly necessary: Firebase Auth session storage and the Interface session cookie, required to sign in and run a sitting.
• Analytics: Firebase Analytics (Google Analytics 4) records page views and a small set of events (for example a primary-button click or waitlist submit). We use this to understand site performance, not to build an advertising profile of check-ins.
• Diagnostics: Sentry receives crash reports. A report may include a URL, browser version, and technical details of a failed request. We do not send raw session video to Sentry.

You may block analytics in the browser. The Interface still requires the session cookie while you are signed in. Sign out to clear that cookie on this device. If your jurisdiction requires consent for analytics, treat analytics as optional until a finer control ships.

Recipients

We do not sell personal data. We do not rent the waitlist. Processors receive only what their function requires.

We may disclose personal data where required by law, to protect a person from serious harm, or in connection with a corporate transaction, subject to appropriate safeguards. Authorised personnel may access account records as required to operate and secure the service. Review of private session media is not a product feature. Marketing screenshots use fixture copy and an invented name.

International transfers

Veskens Ltd is established in the United Kingdom. The processors named above typically operate in the United States. If you are in the UK, EEA or Switzerland, that is a transfer of personal data to a third country. We rely on the processors’ transfer mechanisms, including Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum. If you do not want session media processed in the United States, do not start a sitting.

Security

Authentication uses Firebase Auth. Interface API calls use the session cookie. Media uploads use short-lived signed URLs to Cloud Storage. Inference runs on our engine, not in the browser. No control is perfect. If we become aware of a personal-data breach affecting your check-ins, we will notify you at the account email and, where required, the competent authority, in line with UK GDPR.

Your rights

Subject to the law that applies to you, you may request access, rectification, erasure, restriction, data portability, and objection, and you may withdraw consent. These rights are not absolute.

We do not sell personal information as defined under the CCPA, and we do not share it for cross-context behavioural advertising.

To exercise rights, email contact@feneri.xyz from the address on the account. We may need to verify your identity. We will not charge a fee unless a request is manifestly unfounded or excessive, and we will say so first.

In the Interface today you can choose how long you can replay recordings, turn memory on or off and see or delete what it remembers, download a PDF of a reflection, create a 24-hour share link with or without your words, choose or stop reminders about a step and the emails that carry them, share reflections with a therapist and turn their view of your history on or off, ask to talk to a coach and withdraw the request, and sign out. Structured export and self-serve deletion are not yet in the product; email us.

Children

The Interface is for people aged 18 or over. We do not knowingly collect check-ins from children. If you believe a person under 18 has an account, contact us and we will delete it.

Changes

We will update the date at the top when this notice changes. If a change materially affects how we process check-ins, we will notify you in the product or by email, except where the law requires a different timeline. The live page is the current version.

Contact and complaints

Controller: Veskens Ltd (company number 17383038), trading as Feneri.
Registered office: 20 Wenlock Road, London, England, N1 7GU.
Privacy: contact@feneri.xyz · +44 7446 365714 · Contact form

You may lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk. If you are in the EEA, you may also complain to your local supervisory authority.

Related: Terms of use.