Privacy policy

Version dated 3 November 2026. This information covers the website and Create your own oracle deck. The 21-day app provides its own additional information.

Controller and contact

Owner: Alejandra Salama Monsalve · Trading name: Vuelve la Luz · Spanish tax ID (NIF): 50754724A.

Business address: Pº Gral. Martínez Campos 15, 28010 Madrid, Spain. Email: asalamamonsalve@gmail.com. Published contact telephone: +34 669 716 413.

Data, purposes and legal bases

  • Account and access: email address, identifier, credentials managed by the authentication system, sessions and technical timestamps. These are used to provide the service you request and protect your account. This does not, in itself, mean they are used to send advertising.
  • Projects and files: cards, images, writing, versions and design choices you save. These are used to provide the workshop and let you continue and export your work. The free first card is composed in your browser and does not have to be uploaded to your account.
  • Course and workbook: access, progress and exercises you choose to save, to develop and retain your work within the course. You can complete exercises on paper. Avoid entering diagnoses, health data or other particularly sensitive information, or private information about other people; none is needed to create a deck.
  • Orders, payments and invoicing: chosen option, identity and billing tax details where requested, amounts, payment references, refunds and purchased access. These are used to fulfil your purchase, address issues and comply with tax and record-keeping obligations. Stripe processes payments; the workshop does not store your full card number.
  • Collaboration: profile, invitation and acceptance, codes, attributed purchases without revealing private content, commissions and supporting documents. These are used to manage the relationship and its record-keeping obligations. Personal notes and messages shared with administration are separate spaces.
  • Contact: name, email address and message to respond to the enquiry you send. The form requests specific permission for this purpose. Do not use it to send clinical or particularly sensitive information.
  • Newsletter: email address and preferences to send you “A letter for you” when you voluntarily subscribe. You can unsubscribe through the messages or by writing to us. Buying, entering the course or accepting an invitation does not automatically subscribe you.
  • Analytics and campaigns: only with the corresponding choice, technical browsing data and minimal measurement of the source of purchases. Details appear in the cookie policy. Declining does not prevent you from using the workshop or buying.

Accounts, projects and purchases are based on performing the service requested; invoicing and record retention are based on legal obligations. Technical protection of the service relies on the legitimate interest in preventing abuse, limited to the data necessary. The newsletter, analytics and optional measurement rely on your specific choice, which you may withdraw.

Who is involved and what they can see

Supabase provides authentication and the database for courses, payments and collaboration; Sites and its Cloudflare infrastructure host the workshop, projects and files. The commercial website uses GitHub Pages. Stripe is involved in payments and invoicing and, if you choose a method such as Klarna, its provider is also involved under its own terms. The contact form sends your message through FormSubmit to the support email address; Brevo manages voluntary subscriptions. Google is involved in Analytics if you allow it and in Google Forms if you open the external survey.

Providers may act as processors or independent controllers depending on the service. Your projects, images and exercises are not given to collaborators because a sale is attributed to them, nor used to create advertising audiences. Administration manages accounts, permissions and payments; exceptional technical access for support must be limited to what is needed to address the issue.

Optional AI

If image generation is enabled and you choose to use it, the project description and visual guide will be sent to the OpenAI API, together with a pseudonymised safety identifier. You must confirm this transfer before generation. Do not enter sensitive or private data in these fields. Generation is not included in the course price and does not authorise sharing your entire workbook. Read the feature information before using it.

Providers outside the European Economic Area

Some providers or their subcontractors may process data outside the EEA. Before new integrations or purposes are introduced, the applicable entities, contracts, safeguards and transfers must be reviewed. Having a base in Europe does not mean all support access or processing is limited to Europe. You may request information about providers and the safeguards applicable to the particular processing through the contact email. General consent is not used as unlimited authorisation for transfers.

Retention, withdrawal and deletion

Accounts, projects and exercises are retained while you maintain the service and do not request deletion, with any separation required by record-keeping obligations or claims. Moving a project to the bin allows restoration and does not mean all its files or versions have been deleted. You may request export or deletion through the contact details. Invoices, charges, refunds and payouts are retained for applicable statutory periods with restricted access; withdrawing a measurement choice does not delete an invoice.

The newsletter continues until you unsubscribe; the minimum information necessary to respect that choice may be retained. Enquiries are retained to respond and manage follow-up; if they lead to a contractual relationship or claim, the relevant retention criteria apply. Measurement preferences and their technical periods are described in the cookie policy. Backups follow their technical cycles; a request must also consider backups and access restrictions, without promising instant deletion from every medium.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to asalamamonsalve@gmail.com. We will request only the identity verification needed. Requests will be handled within statutory time limits. You may also complain to the Spanish Data Protection Agency.

Children

Purchasing the workshop is intended for adults. Do not provide children's data in projects or forms. If you notice registration or content involving a child that requires intervention, contact the controller.

Further information

The specific terms and information for each feature supplement this policy. Updating this text does not authorise a new purpose: where required, a specific choice will be requested before processing begins.