Privacy
Your details, kept in confidence.
What we collect, why, who helps us, how long we keep it, and the rights you have. In plain words.
In short. We ask only for what we need to prepare your retreat or answer your letter. We never sell or share your details for anyone's marketing. The website sets no cookies and uses no analytics or advertising trackers. Card details are typed on Stripe's own secure page and never reach us.
Who is responsible
The controller of your personal data is Alethia, Attica, Greece. Write to us at letters@alethia-official.com about anything on this page.
What we collect, and why
| When | What | Why, and on what basis |
|---|---|---|
| You book a retreat | Name, email, mobile, country of residence, role and organisation; optionally LinkedIn, what you are building, who introduced you; the booking and payment status | To hold your seat, take payment and prepare your circle (the contract you ask for: GDPR art. 6(1)(b)); to keep accounting records (legal obligation: art. 6(1)(c)) |
| You apply, register interest or join a waiting list | Name, email, optionally telephone, role, country and referral; your message | To reply and, if you wish, arrange a conversation (steps you ask for before a contract: art. 6(1)(b)) |
| You write a letter | Your name, the reply address you give (email or telephone), your letter | To answer you (art. 6(1)(b), or our legitimate interest in replying to correspondence: art. 6(1)(f)) |
| You join the newsletter | Email (and name, if given); when and how you agreed | To send the letters you asked for (your consent: art. 6(1)(a)), confirmed by a link we email you |
| Any form is sent | A one-way, keyed fingerprint of your network address (never the address itself); technical logs without personal content | To protect you and us from abuse, fraud and automated misuse (legitimate interest: art. 6(1)(f)) |
The guided reading on the website runs entirely in your browser: its answers are never sent anywhere.
Who helps us
A few carefully chosen services process data for us, under written data-processing terms, and only to provide their service:
- Stripe — secure payments. You pay on Stripe's own page; Stripe receives the details needed to process the payment and prevent fraud.
- Cloudflare — hosts the website and protects it from attacks; it may also check, privately and without tracking, that a form is sent by a person.
- Railway — hosts our booking server and its database, where your bookings and letters are stored.
- Resend — delivers our emails (confirmations, replies).
- Our own customer records and newsletter run on open-source software (Twenty and listmonk) that we host ourselves, so these records are not shared with a third-party platform.
Where a provider processes data outside the European Economic Area, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Confirmed bookings: for as long as Greek tax and accounting law requires us to keep the records of a sale.
- Bookings never completed: personal details are erased automatically 60 days after the checkout closed.
- Letters and applications: up to two years after our last exchange, then deleted.
- The newsletter: until you leave (one click in every email). We keep the record of your consent as proof.
Cookies and your browser
The website itself sets no cookies. If you start a letter, its draft is kept in your own browser only, for a week at most, so nothing is lost if the page closes; it is never sent until you press “Send”. Cloudflare may use a strictly necessary security check. Stripe's checkout page, a separate site, uses its own cookies for secure payment, described in Stripe's privacy policy.
The music of PanArmonia is played from PanArmonia's own YouTube channel, in YouTube's privacy-enhanced mode (youtube-nocookie.com). Nothing is loaded from YouTube until you press play; from that moment, YouTube's own privacy policy applies to the player.
Your rights
You may ask to see the data we hold about you, to correct it, to have it erased, to restrict or object to its use, and to receive it in a portable form. You may withdraw consent at any time, without affecting what was done before. Simply write to letters@alethia-official.com; we reply within one month.
You may also complain to the Hellenic Data Protection Authority, Kifissias 1–3, 115 23 Athens, www.dpa.gr, or to the authority where you live.
How we protect it
Encrypted connections everywhere; a booking server reachable only through narrow, checked doors; strict limits against automated misuse; card data that never touches our systems; access to records restricted to Loukia and her office; personal details erased on schedule.
Children
Our retreats and services are for adults. We do not knowingly collect data from anyone under 18.