Privacy Notice

Soul Alchemy Affirmation Cards is operated by Malamapono Hawaiian Healing Hub ("we", "us"). We are the data controller for the personal data described in this notice. For any privacy question, contact us through the details on our About page.

• Account details — your email address, password (stored encrypted), and the optional name you choose to be greeted by. Used to create and secure your account and to provide the service. Legal basis: performance of our contract with you.
• Your content — saved card draws and journal entries you write. Used only to show them back to you in your private sanctuary. Legal basis: performance of our contract.
• Sign-in identifiers — if you sign in with Google, we receive your email address and basic profile identifier. Legal basis: performance of our contract.
• Mailing list — if you submit your email for updates, we use it to send you news about the deck. Legal basis: consent, which you may withdraw at any time.
• Technical and security data — IP address, device and browser information, and access logs. Used to keep the service secure and prevent fraud and abuse. Legal basis: our legitimate interest in a secure service.
• Support messages — anything you send us when you ask for help. Legal basis: legitimate interest in answering you.

We do not see or store your card or bank details. Payment information is collected and processed by Paddle.

• Paddle.com Market Ltd, our Merchant of Record, for the sale of memberships, subscription management, payments, invoicing, and sales-tax compliance.
• Service providers who host the application, database, and authentication on our behalf, under contract and only to run the service.
• Professional advisers such as accountants and lawyers where necessary.
• Authorities where we are required to disclose by law.

We never sell your personal data.

Our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA, transfers are protected by appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

We keep your account, draws, and journal entries for as long as your account exists. If you ask us to delete your account, we delete or anonymise your personal data within 30 days, except records we must keep for legal, tax, or accounting reasons. Mailing-list entries are kept until you unsubscribe.

Depending on where you live, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we rely on consent, you can withdraw it at any time. Contact us and we will respond within one month. If you are in the UK or EEA, you may also complain to your local data protection authority.

We use appropriate technical and organisational measures, including encryption in transit, encrypted password storage, and access controls that restrict your draws and journal to your own account.

We use only essential cookies and local storage needed to keep you signed in and to run checkout. We do not use advertising cookies. You can clear or block them in your browser, though signing in will then not work.