Source: https://rainbowsanctuary.life/privacy-policy Your information, handled with care # Privacy Policy This policy explains what information the Rainbow Sanctuary website handles, why we use it, and the choices available to you. Effective: 9 August 2026 · Last reviewed: 9 August 2026 **On this page** **Implementation note** This policy reflects the current website enquiry stack, including HubSpot and Vercel. The operating legal entity, registered address, governing law, processing-country details, and final non-image record-retention schedule still require formal confirmation. ## 1. Who is responsible Rainbow Sanctuary (operating legal entity to be confirmed), trading as Rainbow Sanctuary, is responsible for the personal information described here. Registered address: to be confirmed before launch. ## 2. What we collect ### Information you choose to send - your name, email address, and WhatsApp number; - the general reason for your enquiry and the programme or session you select; - the message or application context you choose to provide; - for an adult Private Healing application only, a recent headshot when you give the separate image consent shown on the form; - booking, attendance, payment, or account information only if those services are added and explained before collection; - communications and preferences when you correspond with us. ### Technical information The production host may create limited security and access logs such as IP address, browser type, requested page, date, and time. The current site does not use analytics, advertising pixels, profiling, or automated decision-making. ### Sensitive information Please do not send medical records, diagnoses, government identifiers, financial details, or unnecessary information about a child through the consultation form. A Private Healing headshot is used only to review and, if accepted, support that request; it is not used for medical diagnosis, biometric identification, or identity verification. If other sensitive information is volunteered, we will limit its use to the enquiry, ask for an appropriate basis where required, or securely remove it when it is not needed. ## 3. How and why we use information - to respond to an enquiry and suggest a suitable next step; - to review a Private Healing application for which separate image consent was provided; - to take steps you request before entering an agreement; - to arrange and deliver a confirmed service; - to maintain site security, prevent misuse, and keep necessary records; - to meet legal, safeguarding, accounting, and regulatory duties; - to send marketing only when you have made a clear choice to receive it. Depending on your location and the activity, the legal basis may be consent, steps before or performance of a contract, compliance with law, protection of vital interests, or a legitimate interest that does not override your rights. ## 4. Who receives information We do not sell personal information. We may share only what is necessary with confirmed providers that support hosting, CRM and form delivery, email, scheduling, payment, accounting, or professional advice; with facilitators involved in a service you request; or when disclosure is required by law or needed to protect someone from serious harm. HubSpot supports the enquiry CRM and stores a Private Healing headshot as a private file attached to the applicant's contact record. Vercel hosts the website and its same-origin intake endpoint. Further provider, processing-country, and international-transfer information will be recorded here as the operating legal setup is finalized. The site currently requests fonts from Google Fonts; Google states that its Web Fonts API does not set or log cookies, although the browser sends requests to Google’s font domains. ## 5. Children’s privacy This website is for adults and is not designed to collect information directly from children. A parent or legal guardian must make enquiries about a child. Children should not submit the consultation form or a Private Healing headshot. Information about a child is treated as sensitive and collected only when necessary for a specific program, with age-appropriate explanation and the required parent or guardian authorization. Photos, video, or audio of a child require a separate, specific permission process; participation is not conditioned on publicity consent. ## 6. Retention and security We keep enquiry information only as long as needed to respond, manage any resulting relationship, meet legal duties, and resolve disputes. A Private Healing intake headshot is configured for automatic permanent deletion from HubSpot after 30 days. A longer-lived image would require a new purpose-specific consent and an approved case-record process. Other enquiry and paid-service records may require different operational or legally mandated periods. We use proportionate administrative and technical safeguards and limit access to people who need the information. Private Healing headshots are restricted to private CRM attachments and are not placed in public folders or the general Rainbow CRM payload. No internet transmission or storage system can be guaranteed completely secure. ## 7. Your choices and rights Depending on where you live, you may be entitled to ask for access, correction, deletion, restriction, portability, or an objection to certain processing; withdraw consent without affecting earlier lawful use; and complain to your local data-protection authority. We may need to verify your identity before acting on a request. You can unsubscribe from optional marketing at any time. The current site does not run an email newsletter or behavioral advertising. ## 8. Contact and changes Send privacy questions or requests to [the privacy contact listed before launch](https://rainbowsanctuary.life/apply). We will update this policy when the site’s forms, providers, payments, analytics, or services change and will revise the date above. ## Optional video provider The retreat page connects to Google/YouTube when Hanan’s player enters view, or when you select Play. It loads the YouTube player-control API and attempts playback with sound, then muted playback if audible autoplay is blocked. Reduced-motion and data-saving browser settings disable automatic loading. The provider receives technical connection information, including your IP address and browser details, and may use cookies or similar storage. We do not save your playback choice or send your enquiry details to YouTube. Stop video removes the player and prevents further autoplay on that page visit; the downloaded control script remains until navigation. You can still enquire without watching. Google determines its own processing, retention and international data handling. Removing the player does not erase information already received by Google. See our [video privacy controls](https://rainbowsanctuary.life/cookie-policy#optional-video) and [Google’s Privacy Policy](https://policies.google.com/privacy). Video notice updated: 20 October 2026. ## Story song and Spotify link James’s full song recording and cover artwork are served from this website. The audio player starts only when you choose Play and does not connect to Spotify. If you choose the separate Spotify link, Spotify may receive your IP address and browser details and may use cookies or similar storage under its own policies. We do not send your enquiry details to Spotify or store your listening choice. The retreat enquiry does not require listening. See the [listening notice](https://rainbowsanctuary.life/cookie-policy#optional-spotify) and [Spotify’s Privacy Policy](https://www.spotify.com/legal/privacy-policy/). ## Contact-channel information The enquiry form also requires a WhatsApp number with country code. Rainbow Sanctuary uses it, together with your email address, to review and respond to your request through the contact channel most suitable for direct follow-up. Providing a WhatsApp number for an enquiry does not by itself subscribe you to marketing messages.