This policy explains what personal data this site handles, why, who else is involved, how long anything is kept and what rights you have. I keep data to a minimum: the site has no accounts, no comments, no contact form and no shop of its own. I wrote it in plain English so you can read it in a few minutes.
Who is responsible
The controller for this website is Lauri Mukkala, trading as The Esoteric Witch. I am a Finnish sole trader (toiminimi), business ID (Y-tunnus) 3289993-8.
You can reach me about anything in this policy by email at lauri.esotericwitch@gmail.com. I handle privacy questions and requests by email only. More details about the business are on the business information page.
What I collect and why
Here is everything the site processes, with the lawful basis under the EU General Data Protection Regulation (GDPR) next to each item.
- Analytics, only with your consent. If you accept analytics in the cookie banner, Google Analytics 4 (measurement ID G-CW8H3ETLDY) counts visits and shows me which pages are popular, roughly where visitors come from (country level) and what kind of device they use. This helps me see which guides are useful. Google signals and advertising features are switched off. If you reject analytics or do nothing, the analytics script is not loaded at all. Lawful basis: your consent (GDPR Art. 6(1)(a)). Storing analytics cookies on your device also needs your consent under the Finnish Act on Electronic Communications Services (917/2014), section 205.
- Server logs. When your browser asks for a page, the hosting service records technical details such as your IP address, browser type (user agent), the page requested, the time and the response status. These logs keep the site working and help prevent abuse. Lawful basis: my legitimate interest in running a secure website (Art. 6(1)(f)).
- Your cookie choice. Your choice in the cookie banner is stored in your own browser (the storage key
tew-consent) with its version, date and a random ID. This record proves and respects your choice. It is never sent to me. Lawful basis: legal obligation to be able to show consent (Art. 6(1)(c) and Art. 7(1)). - School progress. If you use the free School, the lessons you mark as done are saved in your own browser (the storage key
tew-progress-v1). It is never sent to me, and I cannot see it. Lawful basis: it is necessary for the service you ask for. - Certificates. If you print a certificate of completion, the name you type stays in your browser while the page is open. It is not stored on any server.
- Newsletter. If you subscribe to my newsletter, you do that on Substack, and Substack handles your email address and subscription data. Lawful basis: your consent, with double opt-in.
- Emails you send me. If you email me, I receive your email address, your name if you include it and your message, and I use them to reply. Lawful basis: my legitimate interest in answering messages, and a legal obligation when you make a request about your rights.
I do not use advertising, marketing pixels, social media trackers or any tracker other than Google Analytics 4. I do not sell personal data.
Consent Mode and the cookie banner
The site uses Google Consent Mode v2 with every signal set to “denied” by default. Until you accept analytics, no Google Analytics script is downloaded, no analytics cookies are set and nothing is sent to Google. Fonts are hosted on this site, so loading a page does not contact a font service.
You can change or withdraw your choice at any time with the “Cookie settings” link at the bottom of every page. Withdrawing is as easy as giving consent. When you withdraw, the site deletes the analytics cookies it can reach and tells Google Analytics to stop. The cookie policy lists every cookie and storage key.
Processors and other services
These companies process data for me (processors) or handle it under their own policies (independent controllers):
- Google Ireland Limited and Google LLC host the site on Google Cloud Run in the europe-north1 region, which is in Finland, and keep the server logs (processor). Google also provides Google Analytics 4, which only runs with your consent (processor).
- Substack Inc. runs the newsletter. Substack is an independent controller for subscriber accounts and applies its own terms and privacy policy, which you see when you sign up.
- Google (Gmail) provides the email account I use to reply to you.
- GitHub Inc. stores the site’s source code. It holds no visitor data.
Links to Etsy (my shop), Amazon and Substack take you to other websites. Anything you do there, such as buying a book or a reading, happens under their own terms and privacy policies, not this one.
Amazon affiliate links
I take part in the Amazon Associates Program, run by Amazon.com Services LLC. As an Amazon Associate I earn from qualifying purchases. Some links to amazon.com, marked “(paid link)”, carry my Associate ID in the web address. The affiliate disclosure lists where they appear.
- On this site. Clicking an affiliate link is an ordinary visit to amazon.com. This site sets no cookie for it and sends Amazon no personal data about you.
- On Amazon. Amazon is an independent controller. It may use cookies and similar technologies on amazon.com to record that you came from my site and to credit a qualifying purchase to me. Amazon handles that under the Amazon.com Privacy Notice and its cookie notice. Amazon shows me only totals, such as the number of clicks and the items ordered, never who bought them.
- Analytics. If you accepted analytics, Google Analytics 4 records an “affiliate_click” event with the book’s Amazon ID (ASIN), where on the page the link was and the page address. This is part of the analytics described above, with the same lawful basis (your consent, GDPR Art. 6(1)(a)). If you did not accept analytics, nothing is recorded.
Google AdSense
I have joined Google AdSense, Google’s advertising program. There are no ads on the site yet, and no Google ad code runs here, so nothing is sent to Google for ads. If I show ads later, Google may use cookies for ads only after you give consent in Google’s own consent message. You can read how Google uses cookies in advertising at policies.google.com/technologies/ads.
International transfers
Hosting is in the EU, but some of these companies are based in the United States, and support or analytics data may be processed there. Those transfers rely on the EU-US Data Privacy Framework (Google LLC is certified) and on the Standard Contractual Clauses approved by the European Commission, which are part of the companies’ data processing terms.
How long I keep data
- Analytics data: 2 months in Google Analytics 4, the shortest setting. Reports may keep totals that no longer identify anyone.
- Server logs: 30 days.
- Your cookie choice: until you change it, clear your browser or 12 months pass, when I ask again.
- School progress: until you reset it or clear your browser.
- Newsletter: until you unsubscribe. If I export my subscriber list, I delete the export within 30 days.
- Emails: 2 years. Emails about your rights: 3 years, so I can show how I handled the request.
Your rights
Under the GDPR you have the right to:
- ask for a copy of the personal data I hold about you (access),
- have wrong data corrected (rectification),
- have data deleted (erasure),
- limit how I use your data (restriction),
- get your data in a usable format (portability),
- object to processing based on my legitimate interest (objection),
- withdraw your consent at any time, without affecting what happened before. For analytics, use “Cookie settings”.
To use any of these rights, email me at lauri.esotericwitch@gmail.com. I reply within one month. If your request is about analytics, your consent record ID (stored in your browser with your cookie choice) can help, but you do not need it.
You can also complain to the supervisory authority, the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto), at tietosuoja.fi. You can contact the authority in the EU country where you live, too.
No automated decisions or profiling
I do not make decisions about you by automated means, and I do not build profiles of visitors.
Children
This site is written for adults. I do not knowingly collect personal data from children under 13, which is the age of consent for online services in Finland. The School and the certificate work without any personal data at all.
Security
The site is served over HTTPS only. I keep as little data as possible, use accounts with only the access they need and turn on two-factor login for every account connected to the site. If a data breach ever puts your rights at risk, I will report it to the Data Protection Ombudsman within 72 hours, as the GDPR requires, and tell the people affected when the risk is high.
Changes to this policy
The version number and effective date are shown at the top of this page. If I change what the site collects, I update this policy first. If I add a new cookie category or service, the cookie banner asks for your choice again.