Phi-Yo is a wellbeing and self-reflection tool. It is not a medical device, it does not provide therapy, and it does not diagnose. If you are in distress, please contact a qualified professional or your local emergency service.
1. Who we are
Phi-Yo is operated by Firat Ilim, entrepreneur individuel (micro-entreprise), trading as Llull Lab / Studio Llull.
SIREN / SIRET: 988 721 320 / 988 721 320 00014
APE / NAF: 7220Z
VAT: not applicable, franchise en base under Art. 293 B of the French Code general des impots
Account and access data: your email address, a verification code at sign-in, and session tokens.
Your profile: display name, preferred language, and the notes you choose to keep about yourself, including life context and recurring themes.
Your entries: dream entries, conversations with the assistant, wellbeing notes and mood check-ins that you submit.
Usage data: request metadata and error information, used to keep the service reliable.
Some of what you write can reveal how you feel. Treat it as sensitive and share only what you want kept. We ask you not to include other people's identifying details, clinical diagnoses, or financial information in your entries.
3. Why we process it, and on what basis
To sign you in and keep your account working: GDPR Art. 6(1)(b), performance of a contract.
To generate a response to an entry and keep your history available: what you write about dreams, mood and wellbeing can reveal your state of mind, so we treat it as a special category of data. We process it on the basis of your explicit consent, GDPR Art. 9(2)(a), together with Art. 6(1)(a). You give that consent by choosing to submit an entry, and you can withdraw it at any time by deleting your entries or your account, or by writing to us. Withdrawing consent does not affect processing already carried out.
To keep the service reliable and to prevent abuse: Art. 6(1)(f), legitimate interest.
To send the transactional messages the service needs, such as your sign-in code: Art. 6(1)(b).
We do not sell your data. We do not use your entries to train our own models, and we do not authorise our processing providers to train theirs on your content.
4. Where your data is processed
Your account data, your profile and your entries are stored on EU infrastructure. Since 24 July 2026 the model that generates a response to your entry runs in the European Union (Frankfurt region) through our cloud provider, and the search index used to find relevant reference passages is generated in the EU as well. The model vendor does not receive your content from that service.
Two providers are established outside the EU and are covered by Standard Contractual Clauses under GDPR Art. 46: our transactional email provider, which receives your email address and a request identifier but not your entries, and the network that delivers the site and carries requests in transit.
5. Sub-processors
We describe sub-processors by category. A current named list is available on request at contact@llulllab.com.
Managed database provider: account, profile and entry data. EU (Netherlands). US-incorporated entity, SCCs.
Cloud hosting provider: application services and the search index. EU (Germany).
Model inference provider: generating a response to your entry. EU (Frankfurt region).
Email delivery provider: transactional email, address and request identifier only. USA, SCCs.
Site delivery and API transit: serving phi-yo.app and carrying requests to our EU systems. Global network operated from the USA. Transit only, SCCs.
6. How long we keep it
Your account, profile and entries: for as long as your account is active, so that your history stays available to you.
On deletion request: removed from active systems within 30 days of your request.
Encrypted backups: our daily encrypted backups hold copies for up to 14 days and then expire. Backups are kept only for disaster recovery and are never used for ongoing processing; if a backup has to be restored, we delete your record again as part of that restore.
Processing records: the systems that generate your response are configured not to retain a copy of the request after it is answered.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Write to contact@llulllab.com and we will answer within one month. You may lodge a complaint with the French supervisory authority (CNIL, cnil.fr).
8. Security
Data is encrypted in transit over HTTPS/TLS. Account and entry data are held in a managed EU database that encrypts data at rest, and our backups are encrypted. Access is authenticated and session-restricted.
9. Children
Phi-Yo is not intended for people under 16. We do not knowingly create accounts for them; if you believe a child has an account, write to us and we will remove it.
10. Changes
We post material changes on this page and update the date above.