Privacy Policy

Stoneling (“we”, “us”) respects your privacy. This Policy explains what personal data we collect, why, how long we keep it, and your rights under the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA), among other applicable laws.

1. Who we are

Controller: Stoneling (placeholder legal entity — update before launch). Contact: sales@example.com. Replace with your formal company name, registered address, and DPO contact when available.

2. Data we collect

• Order & inquiry data: name, email, country, shipping address, product interest, messages you send.
• Reading inputs: birth date/time/place or hexagram question text you voluntarily submit. Hexagram casting may run entirely in your browser; if you later email us, that content becomes correspondence.
• Technical data: IP address, browser type, device, pages viewed, approximate location (via hosting/CDN logs), cookies or similar technologies if enabled.
• Payment data: processed by third-party payment providers (e.g. Stripe/PayPal) when connected — we do not store full card numbers on our servers.

3. Purposes & legal bases (GDPR)

• Perform a contract (fulfil orders, confirm readings) — Art. 6(1)(b).
• Legitimate interests (secure the site, improve services, prevent abuse) — Art. 6(1)(f).
• Consent (marketing emails, non-essential cookies) — Art. 6(1)(a); withdraw anytime.
• Legal obligation (tax, accounting, consumer claims) — Art. 6(1)(c).

4. Sharing

We share data with hosting providers, email delivery, payment processors, and shipping carriers only as needed to operate. We do not sell personal information as “sale” is commonly understood; if we engage in CCPA “sharing” for cross-context behavioural advertising, we will provide a Do Not Sell/Share mechanism. We do not use sensitive spiritual inquiry content for advertising profiles.

5. International transfers

If data is transferred outside the EU/UK, we use appropriate safeguards (e.g. Standard Contractual Clauses) where required.

6. Retention

Orders and invoices: typically 7 years (tax). Inquiry emails: up to 24 months unless a longer period is needed for disputes. Browser-only hexagram sessions: not stored by us unless you contact us. Server logs: per host retention (often 30–90 days).

7. Your rights

EU/UK: access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority. California: know, delete, correct, and opt out of sale/share; non-discrimination for exercising rights. Email sales@example.com with “Privacy Request”. We may need to verify your identity.

8. Children

Services are directed to adults 18+. We do not knowingly collect data from children under 16 (EU) / 13 (US COPPA).

9. Security

We use HTTPS and reasonable administrative/technical measures. No method of transmission is 100% secure.

10. Changes

We may update this Policy; the “Last updated” date will change. Material changes will be highlighted on the site where practical.