GDPR

Privacy policy

Last updated: October 23, 2026

Who is responsible?

The data controller for personal data on indigospirit.org is Stig Haglund, Ufsvatnveien 7, 4868 Selåsvatn, Norway. This policy also applies when you arrive via indigospirit.no – that address simply forwards to indigospirit.org. If you have any questions about privacy, e-mail [email protected].

What data do we collect – and why?

Signing up for free distance healing

We store your name, e-mail address, chosen date and time of registration. The legal basis is your consent (GDPR art. 6(1)(a)). The data is used only to manage your registration: you receive one reminder by e-mail before the healing, with an unsubscribe link. Registrations are deleted automatically 90 days after the healing.

Booking personal healing

The message is optional, and you decide how much you want to share – you do not need to write anything about your health in order to book a session. We store your name, e-mail and any message you write, so that Merete can contact you and agree on a time (GDPR art. 6(1)(b) – contract). The request is deleted automatically 90 days after you sent it – whether or not it has been dealt with.

Membership account (My page)

You must be over 18 to create an account with us. If you create an account, we store your name, e-mail address, an encrypted password and your language choice. The legal basis is your consent. We also store what you yourself create and choose along the way:
– your healing journey: how many healings you have taken part in, your check-ins and the reflections you write after a healing (reflections belong to the registration and are deleted with it),
– your favourites in the blog and the Library, your comments, and any posts and replies you have written in the Group,
– links you suggest for the Library,
– your notification choices: e-mail reminders, and push notifications you have enabled per device.

If you add a mobile number (at registration or on My page), it is used for one thing only: a one-time code by SMS if you ask to reset your password and e-mail does not reach you. The number is never used for anything else.

You can download everything we have stored about you at any time, and delete your account yourself on My page – everything is then deleted immediately. If you have suggested links that are published in the Library, the links remain, but with no connection to you.

Donations

Donations happen directly in Vipps or PayPal. Our website never receives or stores any payment details.

If you subscribe to the newsletter, we store your e-mail address – plus your name and language if you provided them – together with the time of your consent. The legal basis is your consent (GDPR art. 6(1)(a)). Every newsletter contains an unsubscribe link, and if you unsubscribe you are removed from the list.

Cookies

The website uses two strictly necessary cookies: a random session ID that keeps you logged in and protects the forms against abuse, and one that remembers your choice of language. Both are purely technical, neither follows you on to other websites, and neither can be read by scripts in your browser. We use no third-party analytics and no marketing cookies, which is also why we do not need a cookie banner. The only form of tracking that exists is the Library's optional reading-tips feature – it is off by default and described in its own section below.

Reading tips in the Library (optional)

The Library has an optional reading-tips feature (“Expand my horizon”). If you activate it, we remember which library links you open, so that we can suggest links that may suit you. The legal basis is your consent (GDPR art. 6(1)(a)): the choice is off by default, and both activation and deactivation are logged as documentation of your choice. Everything happens on our own server, without any new cookies and without third parties. The themes in the Library include faith, belief and spirituality, so such a log can say something about what occupies you. That is precisely why the choice is yours alone, and precisely why it is off by default. The click log is deleted automatically after 180 days, you can switch the feature off in the Library at any time, and if you delete your account everything is deleted with it.

Your rights

You have the right to access, rectification, erasure, data portability and to withdraw your consent at any time. On My page you can download all your data (access/portability) and delete your account yourself. Every e-mail from us contains an unsubscribe link. You can also contact us directly – and you have the right to complain to the Norwegian Data Protection Authority (datatilsynet.no).

Where is the data stored – and who helps us?

All data is stored in our own database with ServeTheWorld AS, our Norwegian hosting provider, on servers in Norway. An encrypted backup is made every night and kept for 14 days – so when you delete something, it disappears from the backups too, within 14 days. We keep a short log of the e-mails and SMS messages we send (recipient, subject and time) so that errors can be found and fixed; the log is deleted automatically after 90 days. One-time codes are masked before they are written there. The server also keeps an operations log of which pages are requested and an error log of technical faults, so that we can find and fix problems. Search terms and one-time links are redacted before anything is written to the operations log.

Three helpers process data on our behalf, governed by data processing agreements (GDPR art. 28):
– Brevo, a European sending service, delivers our e-mails and SMS messages and processes the recipient address/number and the content of the message.
– Cloudflare protects the website against attacks and keeps it fast worldwide, and processes your IP address and technical traffic information when you visit.
– Anthropic translates text into English when we press the translate button in our own admin panel. That covers the texts we write ourselves, and the text in link suggestions members send to the Library – never names, e-mail addresses or other account details.

None of them may use the data for their own purposes. We never sell personal data and never use it for marketing you have not asked for.

Questions?

Feel free to e-mail us at [email protected] – we reply as soon as we can.