Privacy Policy

This policy explains what personal data this site handles, why, who else is involved, how long anything is kept and what rights you have. I keep data to a minimum: the site has no contact form and no shop of its own. You can use the whole site, including my free School, without an account. If you want, you can create a free account to keep your course progress on all your devices and to comment on courses. What that involves is explained under Accounts and comments. I wrote it in plain English so you can read it in a few minutes.

Who is responsible

The controller for this website is Lauri Mukkala, trading as The Esoteric Witch. I am a Finnish sole trader (toiminimi), business ID (Y-tunnus) 3289993-8.

You can reach me about anything in this policy by email at lauri.esotericwitch@gmail.com. I handle privacy questions and requests by email only. More details about the business are on the business information page.

What I collect and why

Here is everything the site processes, with the lawful basis under the EU General Data Protection Regulation (GDPR) next to each item.

Analytics, only with your consent. If you accept analytics in the cookie banner, Google Analytics 4 (measurement ID G-CW8H3ETLDY) counts visits and shows me which pages are popular, roughly where visitors come from (country level) and what kind of device they use. This helps me see which guides are useful. Google signals and advertising features are switched off. If you reject analytics or do nothing, the analytics script is not loaded at all. Lawful basis: your consent (GDPR Art. 6(1)(a)). Storing analytics cookies on your device also needs your consent under the Finnish Act on Electronic Communications Services (917/2014), section 205.
Server logs. When your browser asks for a page, the hosting service records technical details such as your IP address, browser type (user agent), the page requested, the time and the response status. These logs keep the site working and help prevent abuse. Lawful basis: my legitimate interest in running a secure website (Art. 6(1)(f)).
Your cookie choice. Your choice in the cookie banner is stored in your own browser (the storage key tew-consent) with its version, date and a random ID. This record proves and respects your choice. It is never sent to me. Lawful basis: legal obligation to be able to show consent (Art. 6(1)(c) and Art. 7(1)).

School progress. If you use the free School, the lessons you mark as done are saved in your own browser (the storage key tew-progress-v1). If you use the School without an account, your progress and any certificate you make stay in your browser and are never sent to me. If you create an account, your progress, comments and certificate records are stored in Google Firebase (Firestore, europe-north1, Finland) so they follow you across devices. The Accounts section explains what is kept and for how long, and you can export or delete it from your account page at any time. Lawful basis: it is necessary for the service you ask for.
Certificates. If you print a certificate of completion, the name you type stays in your browser while the page is open. It is not stored on any server.
Newsletter. If you subscribe to my newsletter, you do that on Substack, and Substack handles your email address and subscription data. Lawful basis: your consent, with double opt-in.
Emails you send me. If you email me, I receive your email address, your name if you include it and your message, and I use them to reply. Lawful basis: my legitimate interest in answering messages, and a legal obligation when you make a request about your rights.

I use Google Analytics 4 (only with your consent in my cookie banner) and Google AdSense for ads (with consent through Google’s own consent message). I do not use social media trackers or other marketing pixels. I do not sell personal data.

Accounts and comments

An account is optional. You only need one to save your progress to the cloud, to comment and to get a certificate of completion with its own link.

What I keep when you create an account

Your email address and how you sign in (Google or an email link). Google gives me your email and, if you sign in with Google, your Google name and profile picture link. I do not store the picture.
A random user ID that Firebase creates for you.
The display name you choose, and the date you confirmed that you are 16 or older and accepted my community guidelines.
Which courses you have started and which lessons you have finished, with dates.
Your comments, the courses and lessons they belong to, and the dates.
Reports you send me about comments.
Certificates of completion you choose to get: the name you confirm for it, the course, the date and the number of lessons, under a random certificate code.
A note of the time of your last comment, so I can stop flooding (one comment every 30 seconds).

Your email address is kept only in the sign-in system. It is never shown to other readers and it is not stored with your comments.

Saved tarot readings and your Book of Shadows

If you save a reading or write in your Book of Shadows while signed in, I store what you save in your account: the spread, the cards, your question and notes, and your entries with their tags and dates. What you write there can reveal your religious or philosophical beliefs or your health. So before your first save I ask for your explicit consent (GDPR Art. 9(2)(a)), and I store that yes with the date.

The data is kept in Firebase (Google), in the same place as your profile. Only you can see it through the site. There is no admin view, and I do not use it for anything else. As the owner of the Firebase project, I could technically reach the database, but I do not read it. You can withdraw your consent at any time on My readings or in your Book of Shadows. After that I save nothing new until you agree again, and what you saved stays so that you can download or delete it. It is included when you download your data, deleted right away when you delete your account, and deleted after 3 years without a sign-in, like the rest of your account.

What is public

Published comments are public. Anyone can read them, signed in or not. A comment shows your display name, the date and the text. The comment record also holds your random user ID, so someone with technical skills can see that two comments came from the same account. It does not reveal your email or name.

A certificate is public to anyone who has its link or code: they see the name on it, the course, the number of lessons, the date and whether it is valid. The public record holds nothing else about you: no email and no account ID. The link between your account and your certificate is kept privately and only you and I can see it.

Why (legal basis)

To provide the account, progress saving and comments you asked for: the contract between us (GDPR Article 6(1)(b)).
To keep the comments safe, handle reports, act on illegal content and stop abuse and bots: my legitimate interest in running a safe service, and my duties under the EU Digital Services Act (Article 6(1)(f) and 6(1)(c)).

Who processes it

I use Google Firebase, run by Google Ireland Limited, as my processor under Google’s data processing terms for Firebase and Google Cloud.

Your progress, comments, reports and profile are stored in Cloud Firestore in the europe-north1 region (Hamina, Finland).
Sign-in (Firebase Authentication) is a global Google service. Your email and sign-in data can be processed outside the EU, including in the United States. Google is certified under the EU-US Data Privacy Framework, and the transfer is also covered by the EU Standard Contractual Clauses in Google’s terms.
To keep bots out, the account pages use Firebase App Check with Google reCAPTCHA Enterprise. It looks at signals from your browser and device to tell people from bots. It runs only on the account pages and when you post, not on the rest of the site.

I do not use Firebase Analytics, I do not sell data and I do not use your account data for advertising.

When it loads

The Firebase code does not load on ordinary pages. It loads only on the account pages, after you click to show or write comments, or on School pages after you have signed in on this browser. Reading comments without an account does not set anything in your browser.

How long I keep it

Your account, profile and progress: until you delete your account. If you do not sign in or use your account for 3 years, I delete it and everything in it, including your comments. My replies to them go too.
Your comments: until you delete them, I remove them, or you delete your account.
Your certificates: while your account exists. They are deleted with your account, including when I delete an inactive account in my monthly clean-up, and their links then stop working. If I revoke a certificate that was not earned fairly, I keep it marked as revoked so the verification page can say so.
Comments I have hidden: 6 months after I hid them, so you can appeal, then I delete them with my replies to them.
Reports: 6 months after I have handled them. A report about a comment that no longer exists: 6 months after it was sent.
A posting ban: for as long as the ban lasts, and at most 3 years.
Google keeps short technical sign-in and security logs for its own set periods.

I run the clean-up for these periods myself about once a month, so something can stay up to a month longer than the period above.

Deleting and downloading your data

In your account you can download everything I hold about you as a file, and you can delete your account. Deleting removes your profile, progress, certificates, comments, the reports you sent and the sign-in record straight away. If your account had a posting ban, I keep the note of the ban for as long as it lasts so it cannot be dodged by signing up again with the same account. My replies to your comments stop showing too. For safety, you need to have signed in within the last few minutes before you can delete. If anything goes wrong, email me at lauri.esotericwitch@gmail.com and I will delete it by hand within 30 days.

Age

Accounts are only for people who are 16 or older. If I learn that an account belongs to someone younger, I delete it.

The site uses Google Consent Mode v2 with every signal set to “denied” by default. Until you accept analytics, no Google Analytics script is downloaded, no analytics cookies are set and nothing is sent to Google. Fonts are hosted on this site, so loading a page does not contact a font service.

You can change or withdraw your choice at any time with the “Cookie settings” link at the bottom of every page. Withdrawing is as easy as giving consent. When you withdraw, the site deletes the analytics cookies it can reach and tells Google Analytics to stop. The cookie policy lists every cookie and storage key.

Processors and other services

These companies process data for me (processors) or handle it under their own policies (independent controllers):

Google Ireland Limited and Google LLC host the site on Google Cloud Run in the europe-north1 region, which is in Finland, and keep the server logs (processor). Google also provides Google Analytics 4, which only runs with your consent (processor).
Substack Inc. runs the newsletter. Substack is an independent controller for subscriber accounts and applies its own terms and privacy policy, which you see when you sign up.
Google (Gmail) provides the email account I use to reply to you.
GitHub Inc. stores the site’s source code. It holds no visitor data.

Links to Etsy (my shop), Amazon and Substack take you to other websites. Anything you do there, such as buying a book or a reading, happens under their own terms and privacy policies, not this one.

Amazon affiliate links

I take part in the Amazon Associates Program, run by Amazon.com Services LLC. As an Amazon Associate I earn from qualifying purchases. Some links to amazon.com, marked “(paid link)”, carry my Associate ID in the web address. The affiliate disclosure lists where they appear.

On this site. Clicking an affiliate link is an ordinary visit to amazon.com. This site sets no cookie for it and sends Amazon no personal data about you.
On Amazon. Amazon is an independent controller. It may use cookies and similar technologies on amazon.com to record that you came from my site and to credit a qualifying purchase to me. Amazon handles that under the Amazon.com Privacy Notice and its cookie notice. Amazon shows me only totals, such as the number of clicks and the items ordered, never who bought them.
Analytics. If you accepted analytics, Google Analytics 4 records an “affiliate_click” event with the book’s Amazon ID (ASIN), where on the page the link was and the page address. This is part of the analytics described above, with the same lawful basis (your consent, GDPR Art. 6(1)(a)). If you did not accept analytics, nothing is recorded.

This site uses Google AdSense, Google’s advertising program, to show ads. Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this site or other sites on the Internet. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites.

You can opt out of personalised advertising by visiting Google Ads Settings and, for participating companies, www.aboutads.info. How Google uses data when you use partners’ sites or apps is explained on Google’s partner sites page. You can also read how Google uses cookies in advertising.

Consent for advertising cookies is asked in Google’s own consent message (Funding Choices / Privacy & messaging) when you are in a region that requires it. My own cookie banner only asks about analytics. Until you agree, Consent Mode keeps ad storage and ad personalisation denied. Lawful basis for AdSense cookies: your consent (GDPR Art. 6(1)(a) and the Finnish Act on Electronic Communications Services (917/2014), section 205).

International transfers

Hosting is in the EU, but some of these companies are based in the United States, and support or analytics data may be processed there. Those transfers rely on the EU-US Data Privacy Framework (Google LLC is certified) and on the Standard Contractual Clauses approved by the European Commission, which are part of the companies’ data processing terms.

How long I keep data

Analytics data: 2 months in Google Analytics 4, the shortest setting. Reports may keep totals that no longer identify anyone.
Server logs: 30 days.
Your cookie choice: until you change it, clear your browser or 12 months pass, when I ask again.
School progress: until you reset it or clear your browser.
Newsletter: until you unsubscribe. If I export my subscriber list, I delete the export within 30 days.
Emails: 2 years. Emails about your rights: 3 years, so I can show how I handled the request.

Your rights

Under the GDPR you have the right to:

ask for a copy of the personal data I hold about you (access),
have wrong data corrected (rectification),
have data deleted (erasure),
limit how I use your data (restriction),
get your data in a usable format (portability),
object to processing based on my legitimate interest (objection),
withdraw your consent at any time, without affecting what happened before. For analytics, use “Cookie settings”. For personalised ads, use Google’s consent message again or adssettings.google.com.

To use any of these rights, email me at lauri.esotericwitch@gmail.com. I reply within one month. If your request is about analytics, your consent record ID (stored in your browser with your cookie choice) can help, but you do not need it.

You can also complain to the supervisory authority, the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto), at tietosuoja.fi. You can contact the authority in the EU country where you live, too.

No automated decisions or profiling

I do not make decisions about you by automated means, and I do not build profiles of visitors.

Children

My site is written for adults. Accounts and comments are only for people who are 16 or older, and I do not knowingly collect personal data from anyone younger. If you think a child under 16 has made an account, email me at lauri.esotericwitch@gmail.com and I will delete it.

Security

The site is served over HTTPS only. I keep as little data as possible, use accounts with only the access they need and turn on two-factor login for every account connected to the site. If a data breach ever puts your rights at risk, I will report it to the Data Protection Ombudsman within 72 hours, as the GDPR requires, and tell the people affected when the risk is high.

Changes to this policy

The version number and effective date are shown at the top of this page. If I change what the site collects, I update this policy first. If I add a new cookie category or service, the cookie banner asks for your choice again.