The short version. We collect your email address and what you bought. We never see your card. We do not sell your information. You can ask us to show you everything we hold, correct it, or delete it, and we will do it within a month.
1. Who is responsible for your data
Xenia Vocal Consultant SRL, a company registered in Romania (CUI 42209070), Str. 1 Mai nr. 10, Baia Mare, Maramureș, Romania, is the controller of the personal data described here. You can reach us at contact@xeniavocalhealer.com.
We are established in the European Union, so the General Data Protection Regulation (GDPR) applies to everything we do, including for customers outside Europe. If you live in the United States, the rights your own state gives you apply on top of that — see section 9.
2. What we collect, and why
| What | Where it comes from | Why we have it | Legal basis |
|---|---|---|---|
| Name and email address | You, at checkout or when you join the email list | To deliver what you bought, answer you, and send the emails you asked for | Contract · consent for marketing |
| Order details — product, price, date, order number, country | BuyGoods, our payment processor | To confirm your access, handle refunds, and keep our accounts | Contract · legal obligation |
| Email activity — whether a message was opened or a link clicked | Our email provider | To stop sending to people who never open, and to see which messages are useful | Legitimate interest |
| Technical data — IP address, browser, device, pages visited, referring site | Automatically, when you visit | To keep the site working, prevent fraud, and understand what people read | Legitimate interest · consent where required |
| What you write to us | You, by email or in the private circle | To answer you and keep a record of the conversation | Contract · legitimate interest |
| A testimonial, if you give one | You, explicitly | To publish it on our pages | Consent, which you can withdraw |
Things you may tell us about your health
Some people write to us about how they feel, why they bought, or what they are going through. You are never required to. If you do, that is sensitive personal data under GDPR and under several U.S. state laws. We keep it only to answer you, we do not use it to target advertising, and we never publish it without your explicit written permission.
3. What we never see
Your card number, expiry date, and security code never reach us. They go directly to BuyGoods Inc., 1000 North West St., Suite #1200, Wilmington, DE 19801, USA, which processes the payment. We only learn that a payment succeeded, for which product, and for how much.
4. Cookies and similar technologies
We use cookies and comparable technologies to keep the site working, to remember your choices, and to measure how the pages perform. Where the law requires consent — in the EU, the UK, and in the U.S. states that require it — we ask before setting anything that is not strictly necessary, and you can change your mind at any time.
Most browsers let you refuse or delete cookies. Doing so may break parts of the site. Some browsers and extensions send a Global Privacy Control signal; where the law recognises it, we treat it as a valid opt-out of sale and sharing.
5. Who else touches your data
We do not sell your data. We do share it with the companies that make the business run, and only for that purpose:
| Who | What for | Where |
|---|---|---|
| BuyGoods Inc. | Payment, refunds, fraud prevention | United States |
| Klaviyo, Inc. | Sending and measuring email | United States |
| Cloudflare, Inc. | Hosting this website and the files | United States |
| Telegram | The private circle, if you join it | Outside the EU |
| Meta Platforms, Inc. (Meta Pixel) | Measuring and targeting advertising | United States |
We may also disclose data where the law requires it, to protect our rights, or as part of a merger or sale of the business — in which case you will be told before anything changes.
6. Advertising
We do not sell personal information for money. We do use the Meta Pixel (Meta Platforms, Inc.) to measure whether our advertising works and to show our advertising to people who have visited this site. Through it, Meta receives technical data such as your IP address, browser information, and the pages you viewed, and may match that to a Meta account you hold. Meta’s own privacy policy governs what it does with that data.
Under California law, this activity can count as “sharing” personal information for cross-context behavioral advertising. You can opt out at any time: use the Your Privacy Choices link in the footer, send a Global Privacy Control signal from your browser, or write to us. Opting out does not change the price or the product. We do not knowingly share the personal information of anyone under 16.
Where the law requires your consent before the pixel is set — in the EU and the UK — we ask first, and you can withdraw that consent at any time by writing to us or using the same link.
7. Where your data goes
Some of our providers are in the United States. When we send personal data outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one applies, together with additional safeguards. You can ask us for a copy of the arrangements we rely on.
8. How long we keep things
| Order and accounting records | As long as tax and accounting law requires — generally 5 to 10 years |
|---|---|
| Your account and access to the files | For as long as you have access, plus 12 months |
| Email marketing data | Until you unsubscribe, or after 24 months with no engagement |
| Support conversations | 3 years from the last message |
| Consent for a published testimonial | For as long as it is published, plus 3 years |
9. Your rights
Everyone
- See what we hold about you, and get a copy
- Correct anything wrong
- Delete it, unless we are legally required to keep it
- Take it with you, in a machine-readable file
- Object to processing based on legitimate interest, and restrict processing while a dispute is resolved
- Withdraw consent at any time, which does not undo what was lawful before
- Not be discriminated against for exercising any of these rights — the price and the product stay the same
If you are in California
Under the California Consumer Privacy Act as amended by the CPRA, you also have the right to know the categories of personal information we collect, the sources, the purposes, and the categories of third parties we disclose to — all of which are in sections 2 and 5. You have the right to opt out of sale and sharing, and to limit the use of sensitive personal information. In the twelve months before the date at the top of this page, we collected the categories listed in section 2: identifiers, commercial information, internet activity, and, where you volunteered it, sensitive personal information. We did not sell personal information.
You may use an authorised agent to make a request. We will verify the request against the email address on your order.
If you are in another U.S. state
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and a growing number of other states give their residents rights to access, correct, delete, and port their data, to opt out of targeted advertising and sale, and to appeal a refusal. We apply these rights to every U.S. customer, wherever you live, rather than checking your state first.
Your privacy choices — how to use any of these
Write to contact@xeniavocalhealer.com from the address you used at checkout, and say which right you want to use — including “do not sell or share my personal information”. We answer within 30 days. It is free — unless a request is excessive or repetitive, in which case we will tell you before charging anything.
10. Email you receive from us
You get transactional email — your access, your receipt, answers to what you ask — because you bought something. You get marketing email only if you asked for it. Every marketing message has an unsubscribe link that works with one click, and our postal address, as U.S. law requires. Unsubscribing does not stop the emails you need in order to use what you paid for.
11. Children
The State One is sold to adults. We do not knowingly collect personal data from anyone under 18, and we do not knowingly sell to them. If you believe a child has given us data, write to us and we will delete it.
12. Security
We use encrypted connections, access controls, and providers who maintain their own security programmes. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your rights, we will notify you and the relevant authority as the law requires.
13. Changes to this policy
We update this page when what we do changes. The date at the top always shows the current version. If a change is significant, we will tell customers by email.
14. Contact and complaints
Xenia Vocal Consultant SRL
Str. 1 Mai nr. 10, Baia Mare, Maramureș, Romania
contact@xeniavocalhealer.com
If you are unhappy with how we handled your data, you can complain to your data protection authority. In Romania that is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest. You may also complain to the authority where you live or work.