Privacy policy
Last updated: 17 July 2026
This Privacy Policy explains what personal information we collect when you visit thewisdomdream.com, what we do with it, who we share it with, and the rights you have over it. We've written it in plain language. If anything is unclear, please email us at support@thewisdomdream.com and we'll explain it.
Who we are
The Wisdom Dream is a brand of Wisdom Collective B.V., a private limited company registered in the Netherlands. Our identification details are in the Contact information policy below the footer.
For the purposes of the GDPR, Wisdom Collective B.V. is the data controller of your personal information.
What information we collect, and why
We only collect what we need to make your astrology report and deliver it to you.
| Information | Where it comes from | Why we need it |
|---|---|---|
| Your name and email address | Shopify checkout | To deliver your report and contact you about it |
| Billing address | Shopify checkout | To process payment and meet our tax obligations |
| Payment information | Handled by Shopify Payments / Shop Pay | We never see your full card number — Shopify processes the payment on our behalf |
| Your first name (for the report subject) | Birth-data form on the product page | To address you in your report |
| Your birth date | Birth-data form | To calculate your natal chart |
| Your birth time (Full Reading only) | Birth-data form | Required to calculate house placements |
| Your birth place (city) | Birth-data form | To calculate the time zone and coordinates of your chart |
| Latitude, longitude, and time zone of your birth place | Calculated by us locally from your birth city | Required for the chart math |
| IP address and basic device info | Automatically when you visit the site | Standard server logs and fraud protection |
| Cookies | When you accept our cookie banner | See "Cookies" below |
The legal basis for processing your name, email, billing address, and birth data is performance of our contract with you (GDPR Article 6(1)(b)) — we cannot deliver your report without this information. Server logs and security data are processed on the basis of our legitimate interest (GDPR Article 6(1)(f)) in keeping the service safe.
How we use your data with AI
This is the part we want to be especially clear about, because most people don't ask and we think you should know.
Your report is written and quality-checked using large language models (LLMs) from two AI providers: Anthropic, which writes the text of your report, and OpenAI, which independently reviews each report against your chart's astrological data before delivery. (Google is configured as a standby reviewer we can switch to manually; it is not used in normal operation.) However, we do not send your full personal data to these AI providers. Before any AI call, our system removes the following from the chart context:
- Your full name (only your first name is sent, so the report can address you)
- Your birth date
- Your birth time
- Your birth city
- The latitude, longitude, and time zone of your birth place
What the AI providers actually receive is:
- Your first name (so the report can say "Dear [First name]")
- The computed astrological positions of the planets, houses, and aspects in your chart (which are mathematical results, not personal data on their own)
- During quality review, the draft text of your report itself (which contains your first name and the interpretations, but none of the birth details listed above)
The AI providers do not use your data to train their models. We have data-processing agreements with each of them that prohibit this. They retain API data only for a short period for abuse and reliability monitoring under their API data-processing terms, after which it is deleted.
Who else we share your data with
To run the service, we use the following sub-processors. Each one is bound by contract to handle your data securely and only on our instructions.
| Sub-processor | What they do | What we share with them | Where they're based |
|---|---|---|---|
| Shopify International Limited | Powers our online store, checkout, and payment | Name, email, billing address, payment details, order details | EU + US (DPF-certified) |
| Hetzner Online GmbH | Hosts our generation server | All order and report data sits on our server here | Germany (EEA) |
| Anthropic, PBC | Provides the AI models that write report sections | First name + computed astrological positions only | US (DPF-certified) |
| OpenAI | Provides the AI model that independently reviews each report before delivery | First name, computed astrological positions, and the draft report text | US |
| Google LLC | Standby AI reviewer we can switch to manually (not used in normal operation); also receives store analytics events via Shopify's Google integration (see "Cookies and analytics" below) | If ever activated as reviewer: first name, computed astrological positions, and the draft report text. For analytics: page and purchase events, device information | US/EU (DPF-certified) |
| Microsoft Corporation | Website analytics (Microsoft Clarity): how visitors use our pages, so we can fix friction | Page interactions, approximate location, device information, IP address. Form fields containing your birth details are masked and never recorded | US (DPF-certified) |
| Postmark (ActiveCampaign LLC) | Sends the order-confirmation and report-ready emails | Your email address, your first name, your unique download link, and, for our own follow-up emails, a customer reference so we can honor unsubscribes and see whether our emails arrive and get opened | US |
We do not sell your personal information. We do not share your information with advertisers. We do not use your data for marketing without your separate consent.
Sending data outside the EEA
Some of our sub-processors are based in the United States. When we transfer your data to them, we rely on:
- The EU-US Data Privacy Framework adequacy decision adopted by the European Commission on 10 July 2023, where the recipient is DPF-certified, AND
- Standard Contractual Clauses (Module 2 — Controller-to-Processor) adopted under Commission Decision 2021/914, as a fallback safeguard.
You can request a copy of the safeguards we have in place by emailing support@thewisdomdream.com.
How long we keep your data
| Data | Retention period |
|---|---|
| Your name, birth data, and report | 30 days after delivery, then automatically erased from our active systems |
| Your download link | 14 days after delivery, then deactivated |
| Order records (for tax) | 7 years (Dutch tax law requires this) |
| Referral programme transaction records (only if you earn a store credit) | At least 7 years from the date the credit is issued, as Dutch tax law requires. If your link never leads to an order, your referral enrolment is deleted after 30 days without activity. See the Referral programme section below for details. |
| Customer reviews (only if you submit one) | Kept for as long as your customer relationship with us exists, unless you request deletion sooner. See the Customer reviews section below for details. |
| Email address (after the 30-day window) | Stripped from our systems unless you've opted in to marketing |
| Server access logs | Rolling logs, capped by size; typically kept for days up to a few weeks depending on traffic |
| Encrypted database backups | 7 days, then deleted |
After 30 days, your name, birth data, and report are automatically wiped from our active database. We keep a minimal audit record of the deletion itself: which categories of data were erased for which internal order reference, and when. It contains no name, email address, or birth data.
Where your data is stored
Your data is stored on servers operated by Hetzner Online GmbH in Germany (EU). Database backups are encrypted with GPG (a strong asymmetric encryption standard) and stored on the same server. We are working toward off-server backup storage as the business grows.
How your report is generated, and your rights around it
We want you to know that your report is generated by AI, working from the planetary positions calculated for the moment of your birth. A human astrologer does not write each report from scratch.
Under GDPR Article 22, you have the right to a human review of any decision made solely by automated means. If you believe your report contains a clear technical error — for example, a corrupted PDF, the wrong birth data interpreted, or a generation failure — please email support@thewisdomdream.com within 14 days of delivery, and we will review the report. We may regenerate it once at our reasonable discretion.
Astrology is interpretive. We can't guarantee a specific reading will land for you, and the human-review path is for technical errors, not for dissatisfaction with what the report says about you.
Your rights under the GDPR
If you live in the European Economic Area or the UK, you have the following rights:
- Right of access — ask us for a copy of the personal data we hold about you
- Right to rectification — ask us to correct anything inaccurate
- Right to erasure ("right to be forgotten") — ask us to delete your data
- Right to data portability — ask us to send you a structured copy of your data
- Right to restrict processing — ask us to stop using your data while we sort something out
- Right to object — object to processing based on our legitimate interests
- Right to withdraw consent — where we process data on the basis of your consent (e.g. marketing emails), you can withdraw it at any time
To exercise any of these rights, email support@thewisdomdream.com. We will respond within one month, as required by GDPR Article 12(3).
You also have the right to lodge a complaint with your local data protection authority. In the Netherlands, that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Cookies and analytics
Our store uses Shopify's built-in cookie banner. When you arrive on the site, you can accept or reject non-essential cookies. Strictly necessary cookies (for example, the cookie that keeps your shopping cart working) are always enabled — they don't require consent under EU law.
With your consent, we also use two analytics tools:
- Microsoft Clarity, which helps us understand how visitors use our pages (clicks, scrolling, where people get stuck). Form fields that contain your birth details are masked and never recorded.
- Shopify's Google integration, which reports page views and purchases to Google so our products can appear correctly in Google services and so we can measure whether the store works.
Neither tool is used to build advertising profiles of you, and we do not run retargeting campaigns. We do not use third-party advertising cookies.
If you arrive on our site through a friend's referral link, we set one additional strictly-necessary first-party cookie called wd_ref. It contains a signed token identifying which customer's link you followed, lives for 30 days from your latest visit (your browser may also keep a local copy that refreshes it when you return), and is used solely to credit your friend if you go on to buy. It is never used for marketing, profiling, or third-party tracking. Per Autoriteit Persoonsgegevens guidance, this cookie is exempt from consent requirements because it is strictly necessary to deliver a service you (or your friend) explicitly requested. See the Referral programme section below for the full mechanics.
One more thing worth knowing: if you open the optional map under the birth-place field, your browser loads the map images directly from OpenStreetMap, a UK-based non-profit. OpenStreetMap then receives your IP address and the area of the map you are viewing, like any website you visit directly. We don't send them anything else, and the map only loads if you choose to open it.
Security
We take reasonable technical and organisational measures to protect your data, including TLS encryption in transit, GPG encryption of database backups, server-side firewalls, fail2ban brute-force protection, and tightly scoped sub-processor agreements. No security measure is perfect, and we don't claim otherwise — but we have designed the system so that your full birth details are processed only on our EU server and, as part of your order data, by Shopify's checkout, and are never shared with the AI providers that write your report.
Children
The Wisdom Dream is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
Marketing emails
There are three ways you might end up receiving marketing emails from us, and we want to be clear about each.
1. You opted in at checkout. When you place an order, you'll see a "Email me with news and offers" option. If you tick it (or, depending on your region, leave a pre-selected option in place), you give us your explicit consent to email you about our reports, new releases, and occasional content.
2. You purchased from us, even without ticking. Even if you didn't tick the marketing option at checkout, we may still email you occasionally about similar astrology reports — for example, the Full Reading if you bought the Essential, or our future seasonal and Year Ahead reports. This is permitted under Dutch ePrivacy law (Telecommunicatiewet art. 11.7 lid 3) and the equivalent EU rule, which allows merchants to email existing customers about similar products. Every email itself contains a one-click unsubscribe.
3. You signed up through our newsletter form. If you sign up via the footer signup form, we treat that as consent to receive occasional updates including content that goes beyond product recommendations.
In every case, the moment you unsubscribe — by clicking the link in any email — we stop emailing you for marketing purposes, permanently and across all of our marketing channels. If you'd like us to delete your email entirely from our marketing list (stronger than just unsubscribing), email support@thewisdomdream.com.
We do not share your email with anyone for their marketing purposes. We do not sell our email list. We do not use your data to target you with ads on Facebook, Instagram, or anywhere else.
Referral programme
If you've bought a reading from us, you can share a personal link with friends. If a friend buys via your link, they get $5 off their first order and you get $10 in Wisdom Dream store credit after a 14-day refund window. Here's how that works on the data side — because the design has some deliberate choices we want to be transparent about.
We never email your friends on your behalf. Under Dutch ePrivacy law (Telecommunicatiewet art. 11.7), it would not be lawful for us to reward you for letting us email someone else. So we don't. You share your link yourself, through whatever channel you choose (WhatsApp, iMessage, Instagram DM, copy-paste, etc.), and the only message your friend ever gets from us is the standard transactional order confirmation after they themselves decide to buy.
We don't store your email address for the referral programme. When we need to send you a credit-earned notification, we fetch your email address directly from Shopify (where it already lives as part of your customer record), use it once, and discard it. Your email never sits in a separate referral database on our side.
What we do store, and for how long:
| Data | When we collect it | How long we keep it |
|---|---|---|
| Your Shopify customer ID + the timestamp of the first relevant event (the first time your link is clicked) | Only when a click actually happens — we never pre-enrol you | 30 days from the last event if no credit is ever issued; 7 years once any credit is issued (Dutch tax law) |
| Your friend's order ID, order date, order amount, and the discount code they used | When your friend completes an order via your link | 7 years (Dutch tax law) |
| Click records: a keyed (salted) hash of the IP address that clicked your link, plus the browser's technical identifier (user-agent string) | On the click | 90 days, then deleted automatically. Used for fraud prevention and for attributing your friend's order to your link. The IP address is never stored in readable form. Every click record is tied to your link (that is how attribution works); a visitor who never buys is not linked to their own name, email, or customer record. |
| Issued store credit records (amount, currency, date, your customer ID) | When a credit is actually issued | 7 years from the date of issuance (Dutch tax law) |
Legal basis (GDPR Article 6):
- Performance of contract (Art. 6(1)(b)) — you enter the Referral programme contract by sharing your link in a way that results in a click. We process your data to deliver the programme to you.
- Legal obligation (Art. 6(1)(c)) — once a credit is issued, Dutch tax law (Art. 52 AWR, Art. 2:10 BW) requires us to retain the transaction record for 7 years.
- Legitimate interest (Art. 6(1)(f)) — IP hashing for fraud detection, balanced against your privacy by storing only the hash and only for 90 days.
Third parties: the Referral programme is operated entirely in-house. We do not share your data with any third-party loyalty, referral, or affiliate platform (no Smile.io, no Friendbuy, no Rivo, no ReferralCandy). The only third parties involved are the sub-processors already listed in the "Who else we share your data with" table above (Shopify, Postmark, Hetzner).
Your rights: the same GDPR rights listed earlier in this policy apply to your referral data. You can request access, correction, or deletion at any time by emailing support@thewisdomdream.com. Two things to know:
- If you ask us to delete your data while you have an unredeemed store credit, the credit becomes inaccessible — we cannot pay it out to a deleted identity.
- Once a credit has been issued to you, the 7-year tax retention applies. In that case, on request we will pseudonymise the email address linked to the transaction record (replace it with a hash) while keeping the financial record on file, as the law requires.
You can stop participating in the programme at any time — email us with subject line "Stop referral programme" and we'll revoke your referral link. Past credits stay valid; no new ones will accrue.
Gift recipients and the share page. If someone gives you a reading and shares its cards page with you, you can claim that reading's referral link as your own. To do that you enter your email address on the share page and confirm a one-time code we email you. When you confirm, we match or create a customer record for you in our Shopify store so the referral link can be attributed to you. The one-time codes expire after ten minutes, and we store only keyed (salted) hashes of the email address, code, IP address, and browser type used during the claim — never the readable values. If you never complete the claim, the request data is cleaned up automatically.
Customer reviews
After we deliver your reading, we may invite you (about a week later) to share a short review via a personal link in your email. Submitting a review is entirely optional — and here's exactly what happens with your data when you do.
What data we process:
- Your rating (1-5 stars)
- Up to two optional text answers: what you would tell a friend who asked whether the reading was worth it (or, if you were disappointed, what didn't land), and one specific thing the reading got right
- The display name you choose to write, if any. The field starts empty; if you leave it blank, or tick the anonymous option, you are credited as "Anonymous"
- The order ID and Shopify customer ID associated with your review
- The timestamp of your submission
What data we do not process:
- We do not contact other people on your behalf based on your review.
- We do not store your email address as part of the review record — your email lives in your Shopify customer record only.
- We do not share your review with any third-party review platform (no Judge.me, no Trustpilot, no Yotpo). All reviews are stored in-house on our Hetzner-hosted database in Germany.
Legal basis (GDPR Article 6): consent (Art. 6(1)(a)) — you opt in by clicking the review link in our day-7 follow-up email and submitting the form. Submitting the form is the consent action; you can withdraw consent at any time (see "Your rights" below, or under the general "Your rights under the GDPR" section earlier in this policy).
What may become public:
- Only the parts we explicitly select for display as testimonials on thewisdomdream.com — typically the one-sentence quote you write and your display name (or "Anonymous" if you chose that).
- Your full submission — the longer text answers, your rating, your Shopify customer ID, the timestamp — never appears publicly. We use those internally to decide whether and how to feature your review.
Retention: we keep your review for as long as your customer relationship with us exists, unless you request deletion sooner. If you email support@thewisdomdream.com asking us to delete it, we hard-delete your review row from the database. If your review was featured as a testimonial on the storefront, we also remove the testimonial from the storefront.
Your rights: the same GDPR rights listed earlier in this policy apply to your review data. You can request access, correction, or deletion at any time by emailing support@thewisdomdream.com. You can also change your display name (or switch to "Anonymous") by emailing support@thewisdomdream.com — we update the record manually.
Third parties: this review system is operated entirely in-house. The only third parties involved are the sub-processors already listed in the "Who else we share your data with" table above — Postmark (which sends the day-7 invitation email and the operator-notification email) and Hetzner (which hosts our database). We do not share review submissions with any third-party review platform.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example when we change a sub-processor or when laws change. We will post the updated version here with a new "Last updated" date.
How to contact us
For any privacy question, request, or complaint: email support@thewisdomdream.com. Our full company details are in the Contact information page.