← Back to the house
Your data · Handled with respect

Privacy Policy

Last updated: 7 August 2026

Short version: we collect the little we need to send you what you bought and — if you asked for it — to stay in touch. We never sell your data. Here’s the full picture.

1Who’s responsible (data controller)

Controller

Seller: Anna Bobroff.

Registered address: available on request at bobroffanna@gmail.com

Privacy contact: bobroffanna@gmail.com — use this address for any data request; a real person answers.

To be completed before publication. Under Article 13 GDPR the controller must be identifiable — a first name and a city is not enough.

We are not required to appoint a Data Protection Officer, and we have not appointed one. All requests go to the address above.

2What we collect

We keep this deliberately small. Depending on what you do, we may collect:

Your nameSo we know who you are and can address you properly.
Your emailTo deliver your product, send your receipt, and — if you asked — send emails.
Purchase dataWhat you bought, when, the amount, and the invoice we are legally required to issue.
Payment infoHandled entirely by Stripe. We see that a payment succeeded and the last digits of the card — never the full card number.
Booking dataIf you book a call: the slot you chose, your time zone, and anything you write in the booking form.
Consent recordsThe date, time and wording of any consent you gave, so we can prove it was freely given (Art. 7(1) GDPR).
Call recordingsOnly with your agreement, asked for at the start of the call. See section 8.
Basic usageAggregate stats about how the site is used, without profiling you or following you across other sites.

That’s it. We don’t ask for anything we don’t actually need, and we don’t collect special-category data (health, beliefs, and so on). If something like that comes up in a conversation, please don’t put it in writing to us.

3Why we use it, and on what legal basis

  • To deliver what you bought — the product, the access link, the call, the receipt and support. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
  • To send marketing emails to new subscribers — the newsletter, product announcements, class invitations. Legal basis: your consent, Art. 6(1)(a) GDPR, given by ticking an unticked box. You can withdraw it at any time, and withdrawing is as easy as giving it.
  • To email existing customers about similar products — a small number of relevant emails after a purchase. Legal basis: legitimate interest, Art. 6(1)(f) GDPR, combined with the soft opt-in in Art. 13(2) of the ePrivacy Directive. Every one of those emails carries a one-click objection and unsubscribe link.
  • To keep invoices and accounting records — because Portuguese tax law requires it for 10 years. Legal basis: legal obligation, Art. 6(1)(c) GDPR.
  • To keep the site working and secure — basic, non-identifying statistics and abuse prevention. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

Giving us your name and email at checkout is necessary to receive what you bought — without it we cannot deliver. Consenting to marketing is entirely optional and never a condition of purchase.

We do not make automated decisions with legal effects about you, and we do not profile you for advertising.

4Who processes it with us

We use a few services to run the studio. Each one is bound by a written data-processing agreement under Art. 28 GDPR, gets only the data it needs, and may not use it for its own purposes.

  • Stripe (Stripe Payments Europe, Ireland, with processing in the USA) — payments, invoices, subscription billing.
  • Email and newsletter provider: [EMAIL PROVIDER + COUNTRY] — sending receipts, product access and newsletters, and storing your subscription status.
  • Scheduling tool: [SCHEDULING TOOL + COUNTRY] — booking calls.
  • Website hosting: [HOSTING PROVIDER + COUNTRY] — serving this site and the download files.
  • Video calls: [VIDEO CALL TOOL + COUNTRY] — running and, where agreed, recording sessions.

We never sell your data. Not to advertisers, not to data brokers, not to anyone. We don’t share it either, except with the processors above, with our accountant for invoicing, or where the law strictly requires it.

5Transfers outside the EU

Some of the services above are based in, or process data in, the United States. When your data goes there, the transfer is made either under the EU–US Data Privacy Framework, where the recipient is certified under it, or under the European Commission’s Standard Contractual Clauses together with supplementary safeguards. You can ask us for a copy of the safeguards that apply to a specific provider and we will send it.

We do not transfer your data to any country outside the EU other than through the providers listed in section 4.

6How long we keep it

Subscribers who never bought24 months from your last interaction with us — then deleted.
CustomersFor the life of the contract, plus the statutory tax retention period.
Invoices and accounting10 years, as required by Portuguese tax law.
Call recordings12 months after your last session, then deleted.
Consent recordsFor as long as the consent lasts, plus 3 years, as proof it was given.
Support emails24 months, unless a dispute makes it necessary to keep them longer.

If you ask us to delete your data sooner, we will do it wherever the law allows — but we cannot delete invoices before the tax period is over.

7Your rights

Under the GDPR and Portuguese law you can:

  • See what data we hold about you and get a copy (Art. 15).
  • Correct anything that’s wrong (Art. 16).
  • Delete your data — “the right to be forgotten” — where the law allows (Art. 17).
  • Restrict how we use it while something is being checked (Art. 18).
  • Take your data with you in a portable, machine-readable format (Art. 20).
  • Object to processing based on legitimate interest, including all direct marketing — we stop immediately, no questions (Art. 21).
  • Withdraw consent at any time; this doesn’t undo processing that already happened lawfully (Art. 7(3)).

Write to bobroffanna@gmail.com and we will answer within one month, free of charge. To unsubscribe from emails you don’t need to write at all — click the unsubscribe link at the bottom of any message and it takes effect at once.

If you think we’ve mishandled your data you can complain to the Portuguese supervisory authority — CNPD, Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, geral@cnpd.pt — or to the authority in your own EU country of residence.

8Calls and recordings

Sessions are recorded only when it helps you, and only with your agreement. Recording starts after we ask at the beginning of the call and you say yes; you may decline, and the session goes ahead unrecorded. Recordings are visible to you and to Anna only, are never published or used in marketing without separate written permission, and are deleted 12 months after your last session. Legal basis: your consent, Art. 6(1)(a) GDPR.

9Cookies

This site uses cookies that are strictly necessary for it to work, and simple traffic statistics that do not identify you and are not used to follow you across the web or build an advertising profile. Those don’t require a consent banner.

If we ever add analytics or advertising tools that do identify you — Meta Pixel, Google Analytics or similar — a consent banner will appear first, with a refuse option as easy as the accept option, and nothing non-essential will load until you choose. You can also block or clear cookies in your browser at any time.

10Children

This site and everything sold here is intended for adults. It is not directed at anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has given us data, write to us and we will delete it.

11Security

We take reasonable, sensible steps to keep your data safe — limited access, strong authentication, encrypted transport — and we work with providers who do the same. No system online is ever 100% secure, but we treat your information the way we’d want ours treated. If a breach ever puts your rights at risk, we will notify the CNPD within 72 hours and tell you directly where the law requires it.

12Changes & contact

If this policy changes, the “last updated” date at the top changes too, and material changes are announced by email to subscribers. For anything about your privacy, write to bobroffanna@gmail.com — we’re happy to help.

This policy describes how we actually handle data and is written to meet the GDPR and Portuguese law as at the date above. It is information, not legal advice, and it does not replace a consultation with a lawyer or data-protection specialist licensed in your own jurisdiction.