This Privacy Policy explains how Elative Solutions OU collects, uses, and protects your personal data when you visit or interact with karolinablaszkiewicz.com and related pages (the "Site") and when you use the Karolina's Activations members app at app.karolinab.com and in the App Store and Google Play versions (the "App"). By using the Site or the App you accept this Policy.

1. Who We Are

Elative Solutions OU is the data controller for personal data collected through this Site. We are registered in Estonia and committed to compliance with the General Data Protection Regulation (GDPR) and applicable data protection law.

• Legal entity: Elative Solutions OU
• Registered address: Ahtri tn 12, Kesklinna linnaosa, Harju maakond, 10151 Tallinn, Estonia
• Contact: love@karolinab.com
• Site: karolinablaszkiewicz.com
• App: app.karolinab.com, also published as "Karolina's Activations" on the App Store and Google Play

The services offered through this Site are spiritual and energetic in nature. They are not medical, psychological, or therapeutic treatment and are not a substitute for professional care.

2. Data We Collect

Information you give us directly

• Contact and form submissions: name, email address, and any message you submit through forms on the Site
• Purchase data: name, email, billing details, and payment reference when you purchase a service or programme
• Communications: messages you send us by email or through contact forms
• App account: your name and email address when you sign in to the App with a one-time email code
• Member content: messages, reactions and your display name in the members circle, and messages you send Karolina inside the App

Data collected automatically

• Analytics data: pages visited, time on site, referral source, device type, browser, and general location (country/region). Collected via web analytics tools.
• Cookie data: see our Cookie Policy for full detail
• Marketing pixel data: if you arrive via a Meta (Facebook/Instagram) ad, the Meta pixel may log that visit for campaign measurement purposes
• App usage: which activations you have played and how far you got (your progress), so the App can show where you left off
• Push notification token: if you turn on notifications in the App, your device gives us a token that lets us deliver them. It is linked to your account and used for nothing else. The App contains no analytics or advertising tools.

3. How We Use Your Data

• To deliver services, programmes, and events you have signed up for or purchased
• To send you event links, reminders and related communications you signed up for
• To run the App: sign you in, show the content your account has access to, save your progress, host the members circle and your messages with Karolina, and send push notifications you have turned on
• To process payments and maintain transaction records
• To respond to enquiries and support requests
• To send marketing emails where you have given consent (you can unsubscribe at any time)
• To improve the Site and understand how it is used
• To measure the performance of paid advertising campaigns
• To comply with legal obligations

Legal bases (GDPR): contractual necessity (delivering services you purchased), consent (marketing emails, non-essential cookies), legitimate interests (site analytics, fraud prevention, improving our services), and legal obligation (accounting and tax records).

4. Third Parties We Share Data With

We do not sell your personal data. We share data with the following service providers acting as data processors under our instruction:

GoHighLevel (GHL)

Our CRM, email, and marketing automation platform. Your contact details and opt-in status are stored in GHL and used to send you communications you have requested. GHL operates servers in the United States; transfers are governed by Standard Contractual Clauses (SCCs) under GDPR.

Supabase

The database and sign-in service behind the App. Your account, access, progress and circle messages are stored with Supabase in the European Union (Ireland).

Vercel

Hosts the App. Vercel processes request data (such as your IP address) to serve the App and may process it in the United States under SCCs.

Brevo

Sends the one-time sign-in code emails and announcement emails for the App. Brevo is based in the European Union.

Apple and Google

Push notifications from the App are delivered through the Apple Push Notification service and Google Firebase Cloud Messaging. They receive the device token and the notification content, under their own privacy policies.

Stripe

Payment processing for programme and service purchases. Stripe handles all card data; we do not store your card number. Stripe is PCI DSS compliant and operates under its own privacy policy. Data may be processed in the United States under SCCs.

Meta Platforms (Facebook Pixel)

If you visit the Site after clicking a Meta (Facebook or Instagram) ad, the Meta pixel records that visit for advertising measurement. Meta may use this data in accordance with its own data policy. You can opt out through your Facebook ad preferences.

Web analytics

We use web analytics tools to understand Site traffic and performance. These tools may set cookies and collect anonymised usage data. See our Cookie Policy for detail.

5. Cookies and Tracking

We use essential, analytics, and marketing cookies. See our Cookie Policy for full detail on what cookies are set, by whom, and how to manage or opt out.

6. International Data Transfers

We are based in the European Union. App data is stored with Supabase in Ireland. Some service providers (GHL, Stripe, Meta, Vercel, Apple, Google) process data in the United States. Transfers outside the European Economic Area are made under Standard Contractual Clauses or other lawful transfer mechanisms as required by GDPR.

7. Data Retention

• Contact and marketing data: retained while you remain subscribed; deleted promptly on unsubscribe or verified deletion request
• Purchase and transaction records: retained for 6 years for legal and accounting compliance
• Analytics data: typically 12 to 26 months depending on the tool
• Support enquiries: 12 months after last contact
• App account data: kept while your account exists. Your push token is removed when you turn notifications off or delete the account.

Deleting your account in the App

You can delete your App account yourself at any time: open Settings in the App and choose "Delete my account". This removes your login, your progress, your access grants, your circle messages and your messages with Karolina. Purchase records held by Stripe and GHL are kept for the legal retention period above. You can also ask us to delete your account by emailing love@karolinab.com.

8. Your Rights Under GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (the right to be forgotten), subject to legal retention requirements
• Restrict processing in certain circumstances
• Data portability in a structured, machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, email love@karolinab.com. We will respond within one month. You also have the right to lodge a complaint with your local data protection authority. In Estonia, the supervisory authority is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) at https://www.aki.ee/en.

9. Children's Privacy

This Site, the App and its services are intended for adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe a child has submitted data through this Site, contact us at love@karolinab.com and we will delete it promptly.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Payment data is handled exclusively by Stripe and is never stored by us.

11. Links to Other Sites

The Site may link to third-party websites. We are not responsible for their privacy practices and recommend reading their privacy policies before providing any personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date at the top reflects the current version. Continued use of the Site after changes constitutes acceptance of the updated Policy.