Privacy Policy

1. Who We Are

Altea Alchemy is a holistic wellness practice founded by Ty Stevenson, based in Altea, Marina Baixa, Alicante, Spain. We offer Reiki, private yoga, tarot readings, Ayurveda consultations, breathwork and meditation, fermentation classes, and holistic life coaching to English-speaking expats and retirees on the Costa Blanca.

Contact: hello@alteaalchemy.com · +34 711 07 28 36 · Altea, Alicante, Spain (03590)

2. What Data We Collect

We collect the following personal data when you choose to provide it:

• Contact form: Your name, email address, optional phone number, the service you are interested in, and your message.
• Booking form: Your name, email address, optional phone number, the service, and your preferred date and time slot.
• Analytics (PostHog): Anonymous usage data such as pages visited, device type, browser, and approximate location (city/country level via IP). We do not collect precise location data.
• Cookies: A first-party analytics cookie and, for the site administrator's own visits, an identification cookie. See Section 5.

We do not collect sensitive personal data (health records, racial or ethnic origin, religious beliefs, or biometric data). While our services are wellness-related, the data we collect through our website is limited to contact and booking information.

3. Why We Collect It (Legal Basis)

Under the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD), we process your data on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): You voluntarily provide your name, email, and message when you submit the contact or booking form. You can withdraw consent at any time by requesting deletion of your data.
• Contract (Art. 6(1)(b) GDPR): When you book a session, we process your name, email, and preferred slot to fulfil the booking — sending confirmation emails, creating calendar events, and delivering the service.
• Legitimate interest (Art. 6(1)(f) GDPR): We use analytics to understand how visitors use our site and improve it. This is a legitimate business interest. Analytics data is anonymized and aggregated where possible.

4. Where Your Data Goes

We share your data with the following third-party processors, all acting under GDPR-compliant data processing agreements:

• Resend (email delivery): Used to send you confirmation emails and to notify the practice owner of your inquiry. Resend is hosted on AWS in the EU. Resend privacy policy.
• Google Calendar & Google Meet: Used to create booking events and generate video call links. Google processes this data under its own privacy framework. Google privacy policy.
• Google Sheets (lead tracking): Your name, email, phone, service, and message are stored in a private Google Sheet accessible only to the practice owner. This is used for business administration and follow-up.
• PostHog (analytics): Hosted in the EU (eu.i.posthog.com). PostHog processes anonymous usage data. PostHog is GDPR-compliant. PostHog privacy policy.
• Railway (hosting): Our website is hosted on Railway, a US-based hosting provider. Railway processes server logs that may contain IP addresses. Railway privacy policy.

We do not sell your data to any third party. We do not share your data with any service not listed above.

5. Cookies

Our site uses the following cookies:

• PostHog analytics cookies: Used to distinguish unique visitors and track page views. These are first-party cookies set by our own domain. PostHog does not use third-party tracking cookies.
• ph_identify (admin only): When the site administrator visits from a known IP, a cookie is set to identify their activity in analytics. This cookie is only set for the administrator's own visits and is not set for other visitors.

We do not use advertising cookies, retargeting pixels, or third-party tracking cookies. You can disable cookies in your browser settings without affecting your ability to use our site.

6. How Long We Keep Your Data

• Contact form submissions: Retained in the practice owner's email and Google Sheet for the duration of the business relationship, plus up to 6 years for tax and business record purposes under Spanish law.
• Booking data: Retained in Google Calendar and the Google Sheet for the same period.
• Analytics data: PostHog retains event data for up to 7 years by default, but this can be shortened on request.

7. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

• Right of access (Art. 15): You can request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): You can request correction of inaccurate data.
• Right to erasure (Art. 17): You can request deletion of your data, subject to legal retention obligations.
• Right to restrict processing (Art. 18): You can request that we limit how we use your data.
• Right to data portability (Art. 20): You can request your data in a structured, machine-readable format.
• Right to object (Art. 21): You can object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): You can withdraw consent for data processing at any time.

To exercise any of these rights, email hello@alteaalchemy.com with "Data Request" in the subject line. We will respond within 30 days.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es if you believe we have not handled your data correctly.

8. Security

We take reasonable technical and organizational measures to protect your data, including HTTPS encryption (TLS 1.3), Content-Security-Policy headers, CSRF protection on forms, rate limiting, input validation, and access controls on all data storage. The Google Sheet is accessible only to the practice owner. The service account used for Calendar and Sheets uses Google Workspace Domain-Wide Delegation with scoped permissions.

9. International Data Transfers

Some of our processors (Railway) are based in the United States. Data transferred to the US is protected under Standard Contractual Clauses (SCCs) as approved by the European Commission. PostHog is hosted in the EU and does not transfer data outside the EU. Resend sends email through AWS EU regions.

10. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this page periodically.

11. Contact

For any questions about this privacy policy or your personal data, contact us:

• Email: hello@alteaalchemy.com
• Phone/WhatsApp: +34 711 07 28 36
• Location: Altea, Alicante, Spain (03590)