Privacy notice

Who we are

Natural Healing Hearts is run by Philine Allard, a sole trader in Portugal (VAT / NIF PT326771549). She is the controller of your personal data. You can reach her at philine@naturalhealinghearts.com.

Philine Allard, Courela do Malhão, Troviscais, apt. 2654, 7630-435 São Luís, Portugal

What we collect, and why

• The Beginning, your account: your name, email address and course language. We need these to give you access, send you the link to choose your password and stay in touch about your course (to perform our agreement with you).
• The Beginning, your answers: what you write in the reflection questions, your life area ratings and which days you completed. They are saved so that you can come back to them and so that Your Direction can gather them. Your answers can be very personal, and some may touch on your health or emotional wellbeing: please only write what you feel comfortable with. By writing them you give your explicit consent to us storing them for you, and you can ask us to delete them at any time. We do not read your answers or use them for anything else. Philine can technically reach them as the site's administrator, and only looks at them when you ask for help.
• Payments: when you pay online, PayPal handles your payment details. We receive your name, email address, the email of your PayPal account, the amount and the PayPal order number. When you pay by bank transfer, we see your name, bank account and reference. We keep payment records because the tax rules ask us to (a legal obligation).
• Sessions and calls: when you book through Calendly, Calendly collects your name, email address, phone number and anything you write in the booking form, so that we can hold the session with you.
• Newsletter: if you sign up, we use your name and email address to send you news from Natural Healing Hearts, on the basis of your consent. Every newsletter has a way to unsubscribe, and you can also simply write to us.
• Bookings, applications and waitlists (workshops, stays at the farm, the Open House, the Art Space Residency and similar): the details you fill in, such as your name, contact details, dates and preferences, and the files you upload, such as a payment receipt, a portrait or samples of your work. We use them to handle your booking or application. Uploaded files are kept in private storage that only Philine can open.
• Messages: when you email us or use a form on this site, we use what you send to answer you.
• Your name and email address are needed to give you access to The Beginning or to handle a booking; without them we cannot. Everything else you share is up to you.
• Signing in: you sign in with your email address and a password you choose. We never store your password itself, only a scrambled version of it that cannot be turned back into the password. The emailed link to choose a password holds a one-time code, also stored only in scrambled form. To protect your account we briefly note wrong password attempts per email address and erase them within a day. Once you are signed in, a cookie keeps you signed in. See Cookies below.

Who else receives your data

We do not sell your data and we do not share it for advertising. A few trusted services process it on our behalf, each under its own data protection terms:

• Cloudflare (hosting, database and security of this website, including the bot check on our forms).
• Resend (sending our emails, such as the link to choose your password).
• Telegram (a private message to Philine's phone when a new sign-up or form arrives, with the name and email address in it).
• PayPal (payments). PayPal is also responsible itself for the data it needs to run your PayPal account and to prevent fraud.
• Calendly (booking sessions and calls).
• Google, through YouTube (some course videos). The videos use YouTube's privacy-enhanced mode; when you press play, YouTube receives your IP address and may store information on your device.
• TelemetryDeck and Umami (privacy-friendly visitor statistics, see below).

Some of these services are based in, or use servers in, the United States. Where that happens, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

The song links in the course open Spotify; Spotify only receives data once you open it.

How long we keep it

• Your account and your answers: for as long as you have access to The Beginning (access is for life), or until you ask us to delete them.
• Payment records: 10 years, as Portuguese tax law requires.
• Newsletter: until you unsubscribe.
• Checkouts that were started but never paid: 30 days.
• Sign-in links: they stop working after 30 minutes (or 14 days for the link in your welcome email). Your signed-in session lasts up to 180 days.
• Emails, bookings, applications and uploaded files: as long as needed to help you, and no longer than two years after our last contact. Payment receipts are kept as long as the tax rules ask.

Cookies and visitor statistics

This website uses one cookie of its own: nhh_beginning, which keeps you signed in to The Beginning. It is strictly necessary, holds no information about you beyond a random code, and lasts up to 180 days or until you sign out.

We count visits with TelemetryDeck and Umami. They do not use cookies, store nothing on your device and do not identify you: we only see numbers such as how many people visited a page. We do this, and keep the website secure, on the basis of our legitimate interest in running a website that works well.

PayPal and YouTube may set their own cookies when you use their buttons or press play on a video.

Your rights

You can ask us at any time to see the personal data we hold about you, to correct it, to delete it, to limit how we use it, or to receive it in a common format so you can take it elsewhere. You can object to what we do on the basis of our legitimate interest, and withdraw your consent at any time, without this affecting what happened before. Write to us and we will answer within one month.

If you are not happy with how we handle your data, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or to the authority in the country where you live.

Security

We protect your data with care: the website runs only over a secure connection, passwords, codes and sessions are stored only in scrambled form, and only Philine has access to the administration.

We do not use automated decision-making or profiling: no decision about you is made by a computer alone.

Applications for The Ripple Foundation and its retreats have their own privacy notice on those pages.

Changes

If we change how we handle your data, we update this page and the date at the top. For important changes to The Beginning, we also let members know by email.