Privacy Policy
How we collect, use, and protect your personal data
GDPR Compliant
Your Rights Protected
1 Introduction
Conscious Innovation Lab OÜ (“we”, “our”, or “us”) is committed to protecting your personal data and
respecting your privacy. This Privacy Policy outlines how we collect, use, and protect your personal
data in compliance with the General Data Protection Regulation (GDPR).
Data Controller
Conscious Innovation Lab OÜ
Tööstuse tn 48, 10416 Tallinn, Estonia
Email: info@mypalmleaf.com
Data Protection Officer (DPO): Marilis Puusepp
Email: info@mypalmleaf.com
2 Data We Collect
We collect the following personal data to provide our services:
| Data Type | Purpose |
|---|---|
| Name | Order fulfillment & communication |
| Billing address | Invoice & legal compliance |
| Email address | Order confirmation, service updates |
| Phone number | Service coordination |
| Payment details | Secure payment processing |
| Thumbprint | Locating your unique palm leaf |
| Gender & country of birth | Locating your unique palm leaf |
| Session recordings (audio/video) | Giving you your recording in your client portal; service quality review and AI-assisted quality analysis |
3 Purpose of Data Processing
We process your personal data for the following purposes:
- Order Fulfillment: To process and deliver orders made via our website.
- Finding Your Palm Leaf: Thumbprints, gender, and country of birth are collected
solely to locate your specific palm leaf. - Newsletters: To send newsletters and updates — only with your explicit consent.
- Analytics and Website Improvement: To improve the website and user experience
using tools like Google Analytics and Facebook Pixel. - Session Quality Monitoring: To review and improve the quality of palm leaf reading sessions. Recordings may be analyzed using AI-assisted tools to evaluate service delivery by our team members.
- Legal Compliance: To comply with applicable tax and financial regulations.
4 Legal Basis for Processing
We process your data based on the following legal grounds:
- Consent: For newsletters, marketing communications, and the recording and AI-assisted quality analysis of palm leaf reading sessions.
- Contractual Necessity: To deliver the services you book — searching for your palm leaf, holding your sessions, and delivering what you ordered.
- Legitimate Interests: To analyze website performance and ensure its
functionality. - Legal Obligations: For compliance with tax reporting and other legal
requirements.
5 Third-Party Services
We use third-party service providers to process your data securely and efficiently. Each of these providers complies with GDPR and ensures data protection through appropriate safeguards.
| Category | Service Providers |
|---|---|
| Hosting Providers | AWS, Google Cloud, BunnyCDN (BunnyWay d.o.o., Slovenia, EU) — delivers the shop’s images, CSS and JavaScript |
| Email Marketing | Mailchimp |
| Payment Processors | PayPal, Stripe |
| Analytics & Tracking | Google Analytics, Facebook Pixel |
| Client Portal & File Storage | Backblaze B2 — stores your recordings, transcripts and documents, which you access in your client portal at me.mypalmleaf.com |
| Video Sessions | Zoom — hosts your reading, and is where recordings originate |
| Appointment Scheduling | Calendly |
| AI Assistant (client portal) | Anthropic (Claude) — answers questions you ask the portal guide. Only your question and a short summary of your reading and remedies is sent, and only at the moment you ask |
| Automation & Service Emails | n8n, Google Workspace (Gmail) |
6 International Data Transfers
To locate your palm leaf, we transfer personal data (thumbprint, gender, country of birth) — without your name — to our partner readers in India.
India does not have an EU adequacy decision. We are putting the European Commission’s Standard Contractual Clauses in place with every partner reader and library in India. Until they are signed, this transfer is based on it being necessary to provide the reading you ordered (Art. 49(1)(b) GDPR), and we send only what is needed to find your leaf — never your name. You can ask us at any time which partners received your data and whether their clauses are signed.
Several of the service providers listed in section 5 — including Backblaze B2, Zoom and Anthropic — process personal data in the United States. For these providers, the transfer is governed by each provider’s own data processing terms, which incorporate the European Commission’s Standard Contractual Clauses and take effect automatically when we accept that provider’s terms of service.
7 Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your user experience:
- Google Analytics: For analyzing website traffic and user behavior.
- Facebook Pixel: For personalized marketing and tracking conversions.
You can manage cookie preferences through our cookie consent banner or adjust settings in your browser at any time.
8 Data Retention
We retain personal data only as long as necessary for the purposes for which it was collected:
| Data Type | Retention Period |
|---|---|
| Thumbprints (used for locating palm leaves) | Deleted 14 days after your general reading. If another session is already booked at that point, we delete it once that session has taken place. |
| Session recordings (audio/video), remedy documents and other files in your client portal | For as long as you have a client account with us, so you can return to them. You can ask us to delete them at any time. |
| Client account and booking history (name, email, appointments, orders) | For as long as you have a client account with us, or until you ask us to delete it. |
| Invoices and accounting records (name, billing address, payments) | 7 years, as Estonian law requires. |
| Backups | Kept for 35 days. |
Data is deleted or anonymized once it is no longer required for the purposes stated above.
When you ask us to delete your data, we do so within 30 days; it then disappears from our backups within 35 days.
9 Your Rights Under the GDPR
As a data subject under the GDPR, you have the following rights regarding your personal data. To
exercise any of these rights, please contact us at info@mypalmleaf.com.
purposes.
10 Automated Decision-Making and Profiling
We use AI-assisted tools to analyze session recordings for the purpose of evaluating and improving our service delivery. This analysis helps our team assess session quality but does not result in automated decisions that produce legal or similarly significant effects on you as a client. All decisions that affect you are made by humans with appropriate oversight.
11 Data Security
We take appropriate organisational and technical measures to handle your personal data securely.
Access to personal data is restricted to authorised personnel only, and we share your data
exclusively with trusted third-party providers who are contractually bound to protect it.
We continuously review and improve our security practices to ensure your data is handled with the
care it deserves. If you have any concerns about the security of your data, please contact us at info@mypalmleaf.com.
12 Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in legal or operational
requirements. Any updates will be posted on this page, and where appropriate, we will notify you
directly.
We encourage you to review this page periodically to stay informed about how we are protecting your
information.
Conscious Innovation Lab OÜ
Tööstuse tn 48, 10416 Tallinn, Estonia
Email: info@mypalmleaf.com
DPO: Marilis Puusepp — info@mypalmleaf.com