Legal notice & privacy

Last updated: 2 October 2026 · Version: 2026-10-02.1

Anvoria Refract™ is offered by Steven Sabet as a sole proprietor.

Holochergasse 38/10 1150 Vienna Austria

Telephone: +43 677 628 011 76 Contact, privacy and legal notices for Anvoria Refract: info@steven-sabet.eu

Business designation: Steven Sabet – Life & Career Coach – NLP & mBIT Trainer VAT number: ATU71005315 GISA number: 39756183 Registered office: Vienna Commercial register: Not registered.

Trade licence: Life and social counselling, restricted to psychosocial counselling. Membership: Vienna Economic Chamber, professional group for personal counselling and personal care. Business purpose: Life and social counselling, psychosocial counselling.

Applicable rules include the Austrian Trade Regulation Act 1994, section 119 GewO, the Life and Social Counselling Regulation, Federal Law Gazette II No. 116/2022, and the professional and practice rules for life and social counselling, Federal Law Gazette II No. 260/1998, each as amended. They are available through the Austrian Legal Information System.

Further supervisory authority under the Austrian E-Commerce Act: none.

Media owner under section 25 of the Austrian Media Act: Steven Sabet, registered office Vienna. Business purpose: Life and social counselling, psychosocial counselling.

The published business and licence details are also available in the WKO Companies A–Z entry.

Steven Sabet, Holochergasse 38/10, 1150 Vienna, Austria, is the controller for the processing described in this notice. For privacy requests, contact info@steven-sabet.eu.

Depending on how you use Anvoria Refract, we process:

• technical connection data needed to provide and secure the Refract web app and resolve incidents;
• your name, email address, message, language and selected contact channel when you contact us;
• identity and contact details, access records, security events and your language preference for an account;
• for the assessment, your responses, completion status, calculated results and report, together with the questionnaire and scoring version used and information about your report’s release;
• appointment details and notes that you expressly make available for a debrief;
• for a purchase or gift, the order number, package, price and payment status, purchaser name, purchaser email address, billing country, invoice and refund information, and the access-code status. A gift purchaser does not receive the responses or report of the person who activates the code;
• for a cancellation, your name, email address, information to identify the order, the contents of your notice, its date and time, and a receipt. These data are encrypted at rest. We also process limited technical connection data to protect the form from misuse.

Please do not enter information about other people or highly sensitive personal information in free-text fields or notes where it is not needed for your request. Registration or participation is not a general consent to the processing of special categories of personal data.

We process data to provide the Refract web app and your account securely, provide your access, run an assessment, personally review and release a report, arrange an included online debrief and communicate with you about those matters. The legal basis is Article 6(1)(b) GDPR where processing is needed for a contract or steps taken before entering a contract.

We process invoice, payment and statutory evidence data to meet legal obligations under Article 6(1)(c) GDPR. Security safeguards, protection against abusive requests and the handling of specific support or legal requests rely on Article 6(1)(f) GDPR. Our legitimate interest is to operate the service securely, protect access and handle legitimate requests reliably.

The Refract web app does not use advertising pixels, behavioural advertising, analytics SDKs, email open or click tracking, or automatic transmission of your assessment responses to AI services.

An assessment is a personal reflection service. It is not a medical diagnosis and does not replace psychotherapy or medical treatment. Steven Sabet reviews each report personally before releasing it. We keep a record of corrections to a report that has already been released.

We treat data as personal data for as long as it can be linked to you. If we cannot erase particular data immediately after your request, we explain the reason and current status.

Only people and services that need access for a particular purpose receive it:

• Steven Sabet receives the information needed for personal report review, support handling or a booked debrief;
• the application and database run on the EU-based netcup server used for Anvoria Refract;
• Stripe processes website payments as payment service provider. Stripe does not receive assessment responses, reports or debrief notes;
• the email service used for Anvoria Refract delivers service and security messages. world4you processes contact-form data to deliver that form. Those messages do not contain assessment responses, scores or report excerpts;
• Google Calendar and Google Meet are used for online debriefs. They receive only the appointment and contact information required for that purpose;
• bookkeeping receives the financial records it needs, not assessment responses or private debrief notes.

Where a service processes data outside the European Economic Area, we use the required legal basis and safeguards. You can ask our privacy contact for details about a particular recipient or transfer.

We process account data, assessment responses, personal reports and debrief notes only for as long as they are required for access, delivery, administration or a specific legal review. When you request deletion, we tell you which data have been deleted, which are retained by law and which technical limits apply to backups.

Each package has an access period of 18 calendar months from its first personal report release. During this period, you can view its results and PDF report in your participant account. A later report correction does not extend the period. These 18 months are our contractual access rule, not a statutory retention period.

When the access period ends, you can no longer access that package’s results and report. We then review which related data are still needed and erase data that are no longer required without unnecessary delay. Expiry does not trigger automatic erasure. For outstanding services, specific legal claims or statutory retention duties, we retain only the data required for that purpose. These grounds do not justify keeping the entire assessment file. If you need your account for another active package, we keep the account data needed for it.

You can request deletion before the access period ends. We assess your request under the applicable statutory conditions. Copies held by services used, such as calendar or email data, are included in the review according to their purpose.

We retain complete invoices, including the invoice recipient, for ten years from the end of the relevant invoice year. This period does not apply to your assessment file, responses, reports, private notes or debrief records. We retain cancellation and support evidence for as long as it is needed to deal with the matter and establish, exercise or defend specific legal claims.

Deleting an account is neither a cancellation nor a refund, and it is not a waiver of statutory rights. We handle open appointments, payment issues and records that must be retained by law separately.

Subject to the statutory requirements, you can request access, rectification, erasure, restriction of processing and data portability. Where we process data on the basis of legitimate interests, you can object on grounds relating to your particular situation. You can withdraw consent for the future whenever we obtain it for a particular purpose.

Write to info@steven-sabet.eu. We verify entitlement appropriately and answer requests within the statutory time limits. You may also lodge a complaint with the Austrian Data Protection Authority.

The Refract web app does not set advertising or analytics cookies. It uses the following functional cookies:

• anvoria_locale: stores your chosen language for up to 365 days.
• refract_session: supports secure sign-in to your account. It contains a random session identifier and lasts for no more than seven days, ending earlier when you sign out or the session is ended.
• refract_commerce_return_<order-id>: links the payment status to your order after payment through Stripe. It contains a random order reference, not your name, email address or access code, and lasts for up to 30 days.

You can delete or block cookies in your browser. Without the language setting, the default language is used. Without the session cookie, sign-in cannot work.

We update this notice when the functions, data flows or legal requirements actually change. The current version is available on this page.