Privacy Policy

Your privacy matters to me, and this site is built to collect as little as possible. This policy explains what happens to your information in plain language.

Who is responsible

M. Alejandro Bernal D. is the data administrator for alexspirituality.com. Contact: alex@alexspirituality.com.

The short version

• This website sets no cookies and runs no advertising or third-party tracking.
• I only hold information you deliberately give me: your email if you subscribe, your message if you write to me, and your name and email if you reserve a place at a live gathering.
• I never sell, rent or trade your information. To anyone. Ever.

What I collect, and why

1. When you write to me — your name, email address and message. Why: to answer you. Legal basis: legitimate interest in replying to you. Kept for: up to 2 years after our last exchange. Messages are handled entirely on my own server and are not passed to any outside form service.

2. When you subscribe to the newsletter — your email address, and your name if you give it. Why: to send you the letter you asked for. Legal basis: your consent. Kept for: until you unsubscribe. Every email has an unsubscribe link. Processed by: Kit (ConvertKit), a service in the United States.

3. When you reserve a place at a live gathering — your first name, your email address, and your last name if you choose to give it. Why: to send you your place and to know who is coming. Legal basis: performance of a contract — you asked me for a place and this is how it reaches you. Kept for: 24 months after the gathering, then deleted. Also recorded: the amount donated, the time you signed up, a reference number, and the general region your browser's timezone suggests — never your IP address. If you choose to answer the optional age question afterwards, only the band you tap is kept, never an age; it is genuinely optional and nothing changes if you skip it.

Your join link is sent to you by email and is never published on this website. Your card details are handled entirely by Stripe and never reach my server.

If a payment is later refunded or reversed, the place is released and the join link stops working. The record that a payment was made and reversed is kept, because my accounts have to be accurate.

4. When you donate or buy — the payment provider collects what it needs. I never see or store your card number. Stripe and PayPal act as independent controllers of that information under their own policies. Legal basis: performance of a contract, and legal record-keeping.

5. Visitor statistics — this site counts visits using its own private measurement, built into the website. It records the page viewed, the country suggested by your browser's own timezone setting, your device size, your language, the site that sent you, and how long the page was open. Your IP address is never stored. It is combined with a secret that changes every night and converted into a one-way code, purely so that two visits on the same day are not counted as two different people. The next day that code no longer matches you. Nothing identifies you, nothing follows you to other websites, and no outside analytics company receives anything. Legal basis: legitimate interest in understanding which content is useful.

6. Automatically, by the web server — your IP address, browser type and pages requested, held in standard server logs by my hosting provider. Why: security. Kept for: a short period, then deleted by the host.

Cookies and storage on your device

This website does not use cookies for visitors.

Nothing is stored on your device for advertising, measurement or tracking. The

site owner's own browser may hold one or two small markers so that their own

visits are not counted and so they can preview changes before publishing; these

are never created for a visitor and hold nothing personal.

There is one further small exception, and it is not a cookie: if you use the button to change or switch off the moving background, your browser remembers that choice on your own device using local storage. It is set only when you press the button, it never leaves your device, it contains no personal information, and clearing your browser data removes it. The same applies if you close the small notice about an upcoming gathering: your browser remembers that you closed it, on your own device, so it does not reappear.

One thing happens on my server rather than on your device, and it is worth stating plainly: to stop the same form being submitted hundreds of times a minute, my server briefly keeps a one-way scrambled fingerprint of the connection. It is never the address itself, it cannot be turned back into one, and it is deleted automatically within 24 hours.

When you play a video

The video does not load until you press play. Nothing is sent to YouTube before then. Once you press play, YouTube receives your IP address and device information and may store data on your device under its own privacy policy. I use YouTube's privacy-enhanced mode to reduce this as far as I can.

Who else receives information

Each holds appropriate safeguards for international transfers, including Standard Contractual Clauses where required.

Your rights

Wherever you live, you may ask me to:

• See a copy of what I hold about you
• Correct anything that is wrong
• Delete it
• Stop using it, or restrict how it is used
• Receive it in a portable format
• Withdraw consent at any time, without affecting what came before

Write to alex@alexspirituality.com and I will respond within 30 days. There is no charge.

If you ask me to erase you, I rewrite the record so that your name and email are genuinely gone from it — not hidden from view while the original stays on the disk. What remains is only the fact that a place was paid for and the amount, with no way to trace it to you, because my accounts have to balance.

If you are in the UK or the EU (GDPR): you may complain to your national data protection authority. In Germany this is your Land's data protection commissioner; in the UK it is the Information Commissioner's Office (ico.org.uk).

If you are in Brazil (LGPD): you have the same rights, and you may contact the ANPD.

If you are in Canada (PIPEDA): you may complain to the Office of the Privacy Commissioner of Canada.

If you are in India (DPDP Act 2023): you have rights of access, correction, erasure and grievance redressal; write to the address above.

If you are in Mexico (LFPDPPP): you have the rights of access, rectification, cancellation and objection — the derechos ARCO — and you may exercise them by writing to the address above. You may also complain to the INAI.

If you are in California (CCPA/CPRA): you have the right to know, delete and opt out of the "sale" or "sharing" of personal information. I do not sell or share personal information, and I do not process it for cross-context behavioural advertising.

Children

This website is for adults. I do not knowingly collect information from anyone under 18. If you believe a child has given me information, write to me and I will delete it.

Security

The site runs over an encrypted connection (HTTPS). The administration area is password-protected with modern password hashing, automatic lockout after repeated failed attempts, and protection against cross-site request forgery. No system is perfect, but I take reasonable care.

Changes

If this policy changes, the date at the top will change with it. If a change is significant, I will say so in the newsletter.

Contact

M. Alejandro Bernal D. — alex@alexspirituality.com