Privacy Policy
What this site collects, why, who else can see it, and the rights you hold over it.
Last updated 26 July 2026.
This policy explains what personal data this website collects, why, who else can see it, and what rights you hold over it. It is written to be read, not to be impenetrable.
Who is responsible
Catherine Regan, of Rua de Figueiras de São João 755, 3240-706 Torre de Vale de Todos, Ansião, Portugal, is the controller of personal data collected through this site. Contact: info@mysticindigo.ch.
What this site does not do
There is no analytics on this site. No Google Analytics, no advertising pixels, no tracking or profiling of visitors, and no cookie banner because there is nothing to consent to. Your personal data is never sold.
Visitors are not given cookies. The only cookie this site sets is a session cookie for the site owner’s own administrative login.
What is collected, and why
Newsletter sign-up. If you enter your email address in the sign-up form, that address, and your name if you give one, is sent to Catherine by email so she can add you to her mailing list. The legal basis is your consent, which you can withdraw at any time by writing to the address above.
Enquiries and booking notes. If you send a message through the contact page, the name, email address, and message you write are sent to Catherine by email so she can reply. The legal basis is taking steps at your request before entering a contract, and her legitimate interest in answering enquiries.
Booking a session. Scheduling is handled by Calendly, embedded on the contact page. When you book, the details you enter go to Calendly and on to Catherine. Calendly’s own privacy notice governs what it collects while you use it.
Session information. What you share in a session, including a birth date, time, and place for an astrological reading, is kept only as far as needed to do the work and is treated as confidential.
Server logs. The hosting provider records ordinary technical information about requests, including IP addresses, to keep the site running and secure. The legal basis is legitimate interest in the security and reliability of the site.
Failed administrative logins. IP addresses of failed login attempts to the site’s own admin area are recorded for fifteen minutes to slow down brute-force attempts. This applies to the site owner’s login, not to visitors.
Some of what you may choose to share, for example something about your health or beliefs, is a special category of data under the GDPR. It is only ever collected because you volunteer it in the course of a session or an enquiry, and it is handled confidentially and not shared.
Who else processes it
- Vercel hosts the site and processes request logs.
- Turso stores the site’s own content, such as pages and essays. It holds no visitor personal data.
- Resend delivers the emails generated by the sign-up and enquiry forms.
- Calendly runs the scheduling calendar and collects booking details directly.
- Upstash caches the access token for the Instagram feed. It holds no visitor personal data.
- Substack hosts the newsletter itself, once you are subscribed to it.
Two things worth knowing about your browser
Fonts. This site loads its typefaces from Google Fonts. That means your browser makes a request to Google, and Google receives your IP address, when a page loads.
Instagram images. The Instagram feed on the writing page shows thumbnails served from Instagram’s own network, so your browser requests those images from Meta and Meta receives your IP address.
Neither is used by this practice to track you, but both are transfers to third parties and you should know they happen.
Transfers outside the EU
Several of the services above are based in the United States, so some personal data is transferred outside the European Economic Area. Those transfers rely on the safeguards those providers offer, such as the EU standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
How long it is kept
Enquiry and booking correspondence is kept for as long as needed to answer you and to keep a record of the work, and then deleted. Newsletter subscriptions are kept until you unsubscribe. Server logs are kept for the short period the hosting provider retains them. Failed-login records are kept for fifteen minutes.
Your rights
Under the GDPR you may ask for a copy of the personal data held about you, ask for it to be corrected or deleted, ask that its use be restricted or object to it, ask to receive it in a portable form, and withdraw consent at any time where consent is the basis for using it.
To exercise any of these, write to info@mysticindigo.ch. You also have the right to complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority where you live.
Children
This site and this work are intended for adults. Personal data is not knowingly collected from children under 16. If you believe a child has provided data, please write and it will be deleted.
Changes
This policy may change. The date at the top shows when it last did.
See also the Terms and Conditions.