Privacy Policy

The data controller is:

• Name: Aelia Subbota
• Status: Individual Entrepreneur (Osek Murshe), registered in the State of Israel
• Email: [GUIDE_EMAIL]
• Data Protection Inquiries: [DATA_PROTECTION_FORM]

2.1 Information You Provide Directly

We collect information you voluntarily submit through the Site, including:

• Contact Form: your name, email address, and the content of your message. We use Resend or MailChannels as email delivery providers.
• Booking: when you schedule a session, you provide your name, email address, and any relevant intake information you choose to share.
• Payments: when you make a payment through Stripe, we receive your name, email, and billing address. We never see or store your full credit card number — Stripe handles all payment card data directly as a PCI DSS Level 1 service provider.

Age requirement (18+): sessions may only be booked by individuals aged 18 or older. When you book a session you confirm that you meet this requirement. You do not need to be 18 to create an account or read our content (such as our thoughts).

2.2 Information Collected Automatically

When you browse the Site, we automatically collect certain technical data:

• Technical Data: IP address, browser type and version, operating system, referring URL, pages visited, and timestamps.
• Local Storage: we store your theme preference (dark/light), audio play state, and hearts (liked thought posts) in your browser's localStorage. This data never leaves your device.
• Web Fonts: fonts are served locally from the Site; no external font servers are contacted and no data is transmitted to third parties for font loading.
• Canvas Backgrounds: canvas animations run entirely in your browser; no data is collected or transmitted.
• Music Player: audio files are served locally from the Site; no tracking is involved.

2.3 Information from Third Parties

We may receive data from third-party services you choose to use, such as Stripe or your email provider, in connection with booking or payment transactions you initiate.

We use your personal data only for the following purposes and on the following legal bases:

If you gave us consent for something, you can take it back anytime. Processing that happened before you withdrew consent stays lawful — that's all.

We share your personal data only with the following categories of recipients, and only to the extent necessary for the purposes described above:

• Cloudflare, Inc. — CDN hosting and security (DDoS protection, Web Application Firewall). Cloudflare is a data processor acting on our instructions. Cloudflare Privacy Policy ↗.
• Stripe, Inc. — payment processing. Stripe is an independent data controller for payment card data and a processor for transaction data we provide. Stripe Privacy Policy ↗.
• Resend / MailChannels — transactional email delivery for contact form submissions and appointment notifications.
• Analytics Providers (Optional Future Use): if we deploy privacy-friendly analytics (these tools operate without cookies and without collecting personal data). You will be notified before any analytics are activated.
• Legal Authorities: if required by law, court order, or governmental regulation, we may disclose your data to the extent necessary to comply with such obligations.

We do not sell your personal data to third parties and have no intention of doing so.

Your data may be transferred to and processed in countries outside Israel, including the United States (where Cloudflare, Google, Stripe, and our email providers operate).

Israel is recognized by the European Commission as providing an adequate level of data protection (Adequacy Decision 2011/61/EU). For transfers to the United States, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, or equivalent transfer safeguards where applicable.

Your data may travel to these countries as part of how the site runs — we make sure it's protected everywhere it goes.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:

• Contact Form Inquiries: deleted one (1) year after the last correspondence, unless an ongoing guide-client relationship develops.
• Session Notes: retained for seven (7) years from your last session, or as required by applicable law.
• Payment Records: retained as required by Israeli tax law (usually seven years).
• Analytics Data (If Deployed): anonymized or aggregated; individual user data is not retained in identifiable form.
• Local Storage Data: retained on your device until you clear your browser storage. We have no access to this data.

When data is no longer required, it is securely deleted or anonymized.

Under the Israeli Privacy Protection Act and, where applicable, the GDPR, you have the following rights regarding your personal data:

• Right Of Access: you may request confirmation of whether we process your data and receive a copy of the data we hold.
• Right To Rectification: you may request correction of inaccurate or incomplete data.
• Right To Erasure ("Right To Be Forgotten"): you may request deletion of your data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right To Restriction Of Processing: you may request that we restrict processing of your data while a dispute is being resolved.
• Right To Data Portability: you may request receipt of your data in a structured, commonly used, machine-readable format and have it transmitted to another controller, where technically feasible.
• Right To Object: you may object to processing based on legitimate interests (including direct marketing).
• Right To Withdraw Consent: where processing is based on consent, you may withdraw it at any time.
• Right To Contact Your Data Protection Authority: you may file a complaint with the Israeli Privacy Protection Authority or, if you are in the EU/EEA, with your local data protection supervisory authority.

To exercise any of these rights, please email us at [GUIDE_EMAIL]. We'll respond within 30 days. To protect your data, we'll ask you to confirm who you are before we process your request. We're also setting up a dedicated privacy request form.

8.1 Essential (Functional) Cookies

The Site uses purely functional, non-tracking mechanisms:

• localStorage (not cookies) is used to remember your theme preference (aelia-theme) and hearts (liked-*). This data is stored locally in your browser and is not accessible to us.
• Cloudflare may set strictly necessary cookies for security and CDN functionality (e.g., __cf_bm for bot management). These are essential for the Site to function.

8.2 Analytics Cookies

We do not deploy analytics cookies. We may add privacy-friendly analytics, and if we do, these tools operate without cookies and without collecting personal data. We will update this policy and, where required by law, seek your consent before enabling any cookie-based analytics.

8.3 Managing Cookies

You can manage or clear localStorage at any time through your browser settings. Cloudflare essential cookies can be blocked via browser settings, but this may affect Site functionality. For more information on managing cookies, visit allaboutcookies.org ↗.

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption In Transit: all traffic between your browser and the Site is encrypted using TLS/HTTPS. Cloudflare provides SSL/TLS termination.
• Encryption At Rest: data stored on Cloudflare's infrastructure and by our third-party processors is encrypted at rest.
• No Storage Of Credit Card Numbers: Stripe handles all payment processing. We never receive or store full payment card numbers.
• Access Controls: only the guide (Aelia Subbota) has access to emails, booking records, and session notes. Third-party processors are contractually bound to maintain appropriate security measures.
• Infrastructure Security: we protect the Site with a Web Application Firewall, DDoS protection, and Bot Management features through Cloudflare, our CDN provider.
• Breach Notification: if a data breach occurs that affects your personal data, we will notify you and the relevant authorities as required by applicable law.

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We encourage you to keep your contact information current and use strong passwords for any accounts you create on the Site.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational considerations. Material changes will be notified by:

• Updating the "Effective Date" at the top of this policy.
• Posting a notice on the Site, or by email if you've shared your email with us for that purpose.

If you keep using the Site after changes are posted, we'll take that as a sign the new policy works for you. If it doesn't, feel free to reach out.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy Inquiries: [DATA_PROTECTION_FORM]

If you ever have a concern about your data that we haven't resolved, you can reach out to your local EU/EEA data protection authority or the Israeli Privacy Protection Authority ↗.