Privacy Policy

Last updated: 2026-04-28

This site is run by Linnea Holst. The plain-English version: I collect the minimum data needed to run the site, deliver what you bought, and (if you ask) send you a newsletter. I do not sell data. I do not run third-party advertising. The full version follows.

1. Data controller

The data controller for personal data collected on this site is the operator of linneaholst.com, contactable at [email protected].

2. What I collect

Newsletter / starter signups

• Email address (required)
• First name (optional)
• Approximate country (derived from IP at signup time)
• Signup source page

Personalized-sequence intake forms

• Email address and first name
• The free-text intake content you submit (intention, life domain, current practice, contraindications, modalities, time available, optional notes)
• Approximate country (derived from IP at submission time)
• Tier selected and order ID once payment completes

Payment

Payments are processed by Stripe. I never see your full card number. Stripe shares with me: order ID, amount, payment status, billing email, billing country, and (where given) name. Stripe's privacy practices govern that data: see stripe.com/privacy.

Email delivery

Newsletter and transactional emails are sent via MailerLite. They handle delivery, open/click tracking (which I rarely look at and which you can opt out of in their footer), and unsubscribe requests. See MailerLite's privacy policy.

Analytics

I use Cloudflare Web Analytics, which is privacy-friendly: no cookies, no fingerprinting, no individual user tracking. It tells me which pages are popular and where readers come from in the aggregate. See Cloudflare's privacy policy.

3. What I don't collect

• I don't run third-party advertising trackers (no Google Ads, no Meta Pixel, no TikTok Pixel).
• I don't sell, lease, or trade any data with anyone.
• I don't track you across other websites.
• I don't know your IP address beyond a country-level approximation, and I don't store full IP addresses.

4. Why I collect what I collect (legal basis under GDPR)

• Contract: order intake, fulfillment, and post-delivery support — I cannot deliver your order without this data.
• Consent: newsletter signups and the free starter — you opt in, and you can opt out anytime.
• Legitimate interest: aggregate site analytics (no individual tracking) and security (preventing abuse of contact and intake forms).
• Legal obligation: tax and accounting record retention for completed sales.

5. How long I keep it

• Newsletter / starter signups: until you unsubscribe, plus a short suppression-list retention to honor the unsubscribe.
• Intake submissions and orders: 7 years for tax / accounting purposes (or as required by applicable law), then anonymized or deleted.
• Magic-link tokens: 90 days post delivery, then expired and pruned.
• Analytics: aggregate retention per Cloudflare's defaults; no per-user records.

6. Your rights

Under GDPR, the UK GDPR, the CCPA, and most other modern privacy laws, you have the right to:

• Access the data I hold about you
• Correct it if it's wrong
• Delete it ("right to be forgotten")
• Export it ("data portability")
• Object to processing
• Withdraw consent at any time
• Lodge a complaint with your local data-protection authority

To exercise any of these rights, email [email protected] and tell me what you want done. I'll respond within thirty days.

7. International transfers

My infrastructure runs on Cloudflare (US-based), MailerLite (Lithuania, EU), and Stripe (US-based). When data leaves your region, it is transferred under standard contractual clauses or equivalent legal mechanisms.

8. Cookies

This site uses essential session cookies only (required for forms and Stripe checkout to work). It does not set tracking, advertising, or social-media cookies. Cloudflare Web Analytics is cookieless.

9. Children

This site is not directed at children under 16. I do not knowingly collect data from anyone under 16. If you believe your child has provided data, contact me and I will delete it.

10. Changes

Material changes to this policy will be announced in the newsletter and reflected in the "Last updated" date.