Privacy Policy
Last updated: 27 October 2026
This policy explains how personal data is processed when you use guidedmindhypnosis.com (the "Shop").
1. Controller
The controller of your personal data is Mateusz Sury, a sole trader, ul. Biedronki 8/2, 52-200 Wysoka, Poland, NIP 8961670846, REGON 545313843 ("we").
Contact for all privacy matters: [email protected] or the postal address above. We have not appointed a Data Protection Officer.
2. What we process, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) | How long |
|---|---|---|---|
| Creating and running your Account, Library and wish list | e-mail, name (optional), password hash, purchases, wish list, settings | Art. 6(1)(b) – contract | Until you delete the Account |
| Signing in with Google (optional) | Google account ID, e-mail, name, profile picture | Art. 6(1)(b) – contract | Until you delete the Account or unlink Google |
| Selling Recordings, delivering access and sending order e-mails | e-mail, name, order contents, amounts, payment status, download-link token | Art. 6(1)(b) – contract | For the duration of the contract and until claims expire |
| Accounting and tax records | order and payment data | Art. 6(1)(c) – legal obligation | 5 years from the end of the year in which the tax obligation arose |
| Recording your acceptance of the Terms and your request for immediate access to digital content | timestamp, document version, IP address, browser user agent | Art. 6(1)(c) and (f) – proving compliance | 6 years after the contract ends (limitation period) |
| Handling complaints, withdrawals and messages | data you give us in the message | Art. 6(1)(b), (c) and (f) | Until the matter is closed and claims expire |
| Reviews you publish | display name, review text and rating | Art. 6(1)(f) – showing genuine customer feedback | Until you or we remove the review |
| Security: preventing fraud, abuse and spam (rate limits, login logs, Cloudflare Turnstile) | IP address, device and request data | Art. 6(1)(f) – protecting the Shop and users | Logs: up to 90 days |
| Product analytics with PostHog and Google Analytics | pseudonymous identifiers, pages viewed, device and approximate location | Art. 6(1)(a) – your consent (cookie banner) | Up to 14 months; you can withdraw consent at any time |
Providing data is voluntary, but without the data marked as required we cannot create an Account or complete an order. We do not use automated decision-making or profiling that has legal effects on you. We do not send marketing e-mails.
3. Who receives your data
We use the following providers, who process data on our behalf under data processing agreements or, where stated, as independent controllers:
- Stripe Payments Europe, Ltd. (Ireland) – card payments; also an independent controller for payment fraud prevention and its own legal obligations.
- Brevo (Sendinblue SAS) (France) – sending transactional e-mails.
- Cloudflare, Inc. – DNS, content delivery and protection of the Shop, Turnstile anti-bot checks, and forwarding of e-mails sent to [email protected].
- Google Ireland Ltd. / Google LLC – Google Sign-In (if you use it) and Google Analytics (only with your consent).
- PostHog Inc. (data stored in the EU) – product analytics (only with your consent), loaded through our own domain.
- Our accountant or accounting office, when legally required, and public authorities when the law obliges us to disclose data.
The Shop and its database run on our own server in Poland.
4. Transfers outside the European Economic Area
Some providers (Cloudflare, Google, Stripe, PostHog) are based in or may access data from the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
5. Your rights
You have the right to access your data, to receive a copy, to rectification, erasure, restriction of processing, data portability, and to object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting earlier processing – for analytics, use "Cookie settings" in the footer.
To exercise your rights, write to [email protected]. We reply within one month.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
6. Cookies and similar technologies
| Name | Provider | Purpose | Type | Lifetime |
|---|---|---|---|---|
session_id |
GuidedMind Hypnosis | Keeps you signed in | Necessary | 7 days without activity, at most 30 days |
csrf_anon |
GuidedMind Hypnosis | Protects forms against forgery before you sign in | Necessary | 30 days |
guest_session_id |
GuidedMind Hypnosis | Remembers a guest's cart | Necessary | 30 days |
oauth_session |
GuidedMind Hypnosis | Completes a Google sign-in securely | Necessary | 14 days |
cookie_consent |
GuidedMind Hypnosis | Stores your cookie choices | Necessary | 12 months |
cf_clearance, __cf_bm |
Cloudflare | Bot protection and security | Necessary | Up to 12 months |
ph_* |
PostHog | Product analytics | Analytics (consent) | 12 months |
_ga, _ga_* |
Google Analytics | Website statistics | Analytics (consent) | 14 months |
Analytics cookies are set only after you accept them in the cookie banner. You can change your choice at any time via "Cookie settings" or by deleting cookies in your browser.
7. Security
We protect your data with encrypted connections (HTTPS), hashed passwords, access control to purchased files, regular updates and backups. Payment card data never reaches our server.
8. Children
The Shop is not directed at children under 16, and we do not knowingly collect their data.
9. Changes
We will publish any changes to this policy here and, if they are significant, inform Account holders by e-mail.