This Privacy Policy explains how Anya Kaur ("we", "us") collects, uses, and protects personal data when you visit our website, book a service, sign up for our newsletter, or otherwise interact with us. We aim to collect only what we need, to be transparent about it, and to give you meaningful control.
1. Data We Collect
Account & contact data. Name, email address, and any message body you submit through forms (contact, booking, inquiries).
Payment data. When you book or purchase, payment is processed by Stripe, Inc. We never see or store your full card number. Stripe shares limited transaction metadata (amount, currency, last four digits, country) with us so we can fulfill your order.
Usage data. Standard server logs (IP address, user-agent, timestamps, referring URL, requested path). We use these for security, debugging, and abuse prevention.
Cookies & local storage. Strictly necessary session cookies for authentication and CSRF protection. We do not set advertising or cross-site tracking cookies by default. If product analytics are enabled (e.g., PostHog), they run only with your consent and respect Do-Not-Track signals where supported.
2. Legal Bases (GDPR / UK GDPR)
We process your data on the following bases: consent (for the newsletter and any optional analytics), contract (to fulfill bookings and respond to inquiries you initiate), legitimate interest (security, fraud prevention, basic site operation), and legal obligation (tax, accounting, regulatory compliance).
3. How We Use Data
We use personal data to: respond to inquiries and bookings, deliver the products and services you request, send transactional emails (booking confirmations, receipts), send the newsletter to subscribers, secure the Service against abuse, comply with legal obligations, and improve the Service. We do not sell your personal information.
4. Sharing & Sub-Processors
We share data only with vetted service providers acting as data processors under contract:
- Stripe, Inc. — payment processing
- Resend — transactional and newsletter email delivery
- Cloudflare, Inc. — content delivery, edge security, image hosting
- Supabase, Inc. — database, authentication, file storage
- PostHog (optional) — product analytics, only if you have consented
We may disclose data when required by law, subpoena, or to protect the rights, property, or safety of Anya Kaur, our users, or others.
5. International Transfers
Some processors are based outside your country. Where required, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses or equivalent.
6. Retention
We keep contact-form messages for up to 24 months. Booking and transaction records are kept for the period required by tax and accounting law (typically 7 years). Newsletter subscriptions are kept until you unsubscribe. Server logs are kept for up to 90 days.
7. Your Rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct inaccurate data, delete your data, port your data to another service, object to or restrict certain processing, and withdraw consent at any time.
EU/UK residents may lodge a complaint with their local data protection authority. California residents have additional rights under the CCPA/CPRA, including the right to know what categories of personal information we have collected, the right to delete, the right to correct, and the right to opt out of any "sale" or "share" of personal information (we do not sell or share for cross-context behavioral advertising).
To exercise any right, write to press@anyakaur.com. We will respond within the time required by applicable law.
8. Children
The Service is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect data from children. If you believe a child has provided us data, please contact us and we will delete it.
9. Security
We use industry-standard safeguards including TLS in transit, encryption at rest for stored content, role-based access control, and least-privilege credentials. No system is perfectly secure; we encourage you to use strong, unique passwords and to report suspected vulnerabilities to press@anyakaur.com.
10. Changes
We may update this Policy from time to time. Material changes will be announced through the Service or by email. The "effective" date at the top of the page reflects the most recent revision.
11. Contact
Privacy questions, requests, or concerns: press@anyakaur.com.