This statement explains which data we process, on what basis, which parties are involved, and what choices you have. The principle: your readings, notes, and moments of reflection remain yours. Last updated: 4 May 2026.
I Ching Practice Netherlands
Cimburgalaan 87, 4819 BB Breda, Netherlands.
Contact: consult@i-ching-practice.com.
Account data: email address, hashed password, account status, time of creation and last login.
Reading data: the questions you ask, the cast lines, the resulting hexagrams, and any notes and moments of reflection you record.
Subscription data: subscription status, start date, renewal date and a Stripe customer id (no card details — we don't see those).
Technical data: session token, IP address at login (briefly, for security), browser/device info in server logs.
Performance of the contract (Article 6(1)(b) GDPR): keeping your account working, granting premium access, administering payments, storing and re-showing readings.
Legal obligation (sub c): retention periods for financial data.
Legitimate interest (sub f): debugging, protection against abuse, and improving the service on the basis of aggregated data.
We use no consent cookies for tracking; only functional cookies that are needed to run the service.
We engage the following external parties as processors:
With each processor a data processing agreement is or will be concluded, setting out the GDPR requirements.
Stripe and Google process data partly in the United States. Transfer takes place on the basis of the EU-US Data Privacy Framework or standard contractual clauses (SCCs) approved by the European Commission. Supabase and Netlify host the core data in EU regions.
Account and reading data: kept as long as your account is active. On a deletion request: removed within thirty days, except for data we are legally required to keep.
Financial data (Stripe administration): seven years, in line with the tax retention obligation.
Server logs: at most thirty days, for security and debugging.
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest. Send requests to consult@i-ching-practice.com; we confirm within five business days and handle them within one month.
Do you disagree with how we handle your data? You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.
We place only functional cookies: a session cookie for logged-in access and any preferences (for example the sound setting of the consult). No tracking cookies, no marketing pixels, no third-party analytics cookies. That is why no cookie consent banner is needed.
Access to your account is secured via Supabase Auth (hashed passwords). Communication between your browser and our servers always runs over HTTPS. Access to production data is limited to what is strictly necessary for managing and maintaining the service.
We may amend this privacy statement from time to time, for example for new functionality or a new sub-processor. We announce material changes at least thirty days in advance by email or in the app. The current version is always on this page, with the date of the last update at the top.
