Privacy Policy

The data controller is Rose Ankh Publishing Ltd, a company registered in England and Wales (company registration and registered office details are available on request), trading as Alexandrian Witchcraft. For any privacy question or to exercise the rights in Section 11, contact us at info@alexandrianwitchcraft.org.

Account data

name, email address and password (handled by Supabase Auth), and your Discord ID if you link a Discord account.

Membership and payment data

your subscription plan and status, and a billing reference from PayPal or Stripe. We never see or store your full card number; that is held by PayPal/Stripe under their own security standards.

Contribution data

the name, email address, description, approximate date, location and any files you submit through the contribution form, together with your rights confirmation.

Contact and enquiry data

name, email and message content submitted through the contact form.

Event data

name and email for anyone booking a ticket or registering for an event, and attendance records for our own administration.

Community data

your Discord ID and username, where you choose to link your account.

Technical and usage data

IP address, device and browser type, pages visited and referring pages, collected automatically via cookies and analytics tools (Section 7).

Marketing preferences

whether you have opted in to newsletter or marketing email, held in Klaviyo.

Under UK and EU GDPR we must have a lawful basis for each use of your data. Here is how that applies:

Running your account and the Inner Circle

necessary to perform our contract with you (providing the membership you signed up for).

Processing payments and preventing fraud

necessary to perform our contract with you, and our legitimate interest in being paid correctly and safely.

Sending transactional email (welcome, billing, payment-failed, event confirmations) via Resend

necessary to perform our contract with you.

Reviewing and publishing contributions

necessary to perform our contract with you as a Contributor, and our legitimate interest in maintaining an accurate archive.

Responding to contact form enquiries

our legitimate interest in answering questions you have raised with us.

Administering events, including in-person events

necessary to perform our contract with you and, for entry/safety records, our legitimate interest in running the event safely.

Marketing email via Klaviyo

your consent, given when you opt in; you can withdraw it at any time.

Analytics (Google Analytics/GA4, Meta Pixel) to understand and improve the Site

your consent for non-essential cookies (Section 7), or our legitimate interest for aggregated, privacy-respecting measurement where permitted.

Granting or revoking your Discord community role

necessary to perform our contract with you as an Inner Circle member.

Keeping records for tax, accounting and legal compliance

necessary to comply with our legal obligations.

We share personal data only with the service providers who help us run the Site (our “processors”), and only to the extent each needs it to do its job:

Supabase

stores account, contribution and archive data, and authenticates logins.

Vercel

hosts the Site and processes technical/server logs.

PayPal and Stripe

process membership and event payments; they act as independent data controllers for the payment details you give them directly.

Mux / Vimeo

host and stream gated video; they receive playback requests for members’ library sessions.

Resend

sends transactional emails on our behalf.

Klaviyo

sends marketing emails to those who have opted in.

Google (Analytics/GA4) and Meta (Pixel)

receive pseudonymised usage/advertising data where you have consented to analytics or marketing cookies.

Discord

receives your Discord ID to grant your community role, under Discord’s own privacy policy.

We do not sell your personal data. We may disclose it where required by law, to protect our rights, or in connection with a merger, sale or transfer of the business, in which case we will tell you.

Several of our providers (including Google, Meta, and, depending on configuration, Supabase, Stripe and PayPal) may process data outside the UK and EEA, including in the United States. Where they do, we rely on safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses, or the provider’s own certified data-protection framework, to ensure your data continues to receive an equivalent level of protection.

We use a small number of essential cookies needed to keep you logged in and to remember your cookie choice. With your consent, given through the cookie banner shown on your first visit, we also set analytics cookies (Google Analytics/GA4) and advertising cookies (Meta Pixel) to understand how the Site is used and measure campaign performance. Neither loads until you accept that category.

You can change your choice at any time via “Cookie preferences” in the footer of every page. You can also block or delete cookies through your browser settings; doing so may affect some features, such as staying logged in.

• Account data: for as long as your account is open, and for a reasonable period afterwards in case you return, then deleted or anonymised on request.
• Payment and billing records: for as long as required by UK tax law (currently up to six years).
• Contribution submissions: retained as part of the Archive record, or, if declined or removed at your request, deleted within a reasonable period unless we have an overriding legal reason to keep them.
• Contact form and event enquiries: typically up to two years, unless we need them for an ongoing matter.
• Marketing preferences: until you unsubscribe or ask us to delete them.

We use industry-standard providers (Supabase, Vercel, PayPal, Stripe) with their own security certifications, encrypt data in transit, and restrict internal access to what each team member needs. No system is completely secure, but we take reasonable technical and organisational steps to protect your data and will notify affected individuals and the ICO of any serious breach as required by law.

The Site is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

We do not use your personal data for any decision that produces a legal or similarly significant effect on you based solely on automated processing.

If you are in the UK, EU or EEA, data protection law gives you the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, where there is no overriding reason for us to keep it;
• restrict or object to certain processing, including direct marketing;
• receive your data in a portable format, where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, where processing relies on your consent;
• lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk).

To exercise any of these rights, email info@alexandrianwitchcraft.org. We may need to verify your identity before acting on a request, and will respond within one month.

If you are outside the UK/EEA, we extend the same rights to you as a matter of policy, so please contact us in the same way.

We only send marketing email (via Klaviyo) to people who have opted in, for example by signing up through the newsletter prompt on the Site, or by registering for the Inner Circle waiting list. Every marketing email includes an unsubscribe link, and you can also ask us directly at info@alexandrianwitchcraft.org. Transactional emails about your account, billing or a booked event (via Resend) are sent regardless of marketing preference, as they are necessary to the service.

For ticketed and in-person events, we collect the minimum information needed to run the event, typically your name and email, and, for in-person gatherings, a record of attendance. We do not share attendee lists with anyone outside the small team organising the event, other than the ticketing/payment provider used to process the booking.

We may update this policy as our services change, for example when we add a new provider. We will post the updated version here with a new “last updated” date, and, for significant changes, will make reasonable efforts to notify registered members by email.

Questions about this policy or your data: info@alexandrianwitchcraft.org.