Privacy policy

Last updated: [TO CONFIRM: date of publication] Version: Draft 0.1 (17 October 2026)

1. Who we are

This Privacy Policy explains how House of Seraphim ("House of Seraphim", "we", "us", "our") collects and uses personal data when you use our websites, contact us, join our waitlist or community, or become a member.

It applies to:

• our jewellery website at houseofseraphim.co, including member accounts, the community and the shop (the "Jewellery Site"); and
• our Sacred Egypt travel website, currently at house-of-seraphim.vercel.app and [TO CONFIRM: whether travel.houseofseraphim.co is also used] (the "Travel Site"),

together, the "Websites".

The controller responsible for your personal data is:

• Name: [TO CONFIRM: controller]
• Registered address: [TO CONFIRM: registered address]
• Company or registration number: [TO CONFIRM: if applicable]
• VAT number: [TO CONFIRM: if applicable]
• Email: [TO CONFIRM: contact email]

[TO CONFIRM: whether a Data Protection Officer or an EU/UK representative is required, and their contact details if so.]

2. The personal data we collect

We only collect what we need for the purposes described in section 3.

2.1 Data you give us

• Waitlist and register-interest forms (Travel Site). Your name and email address (required), and, if you choose to give them, your phone or WhatsApp number, country, who you are travelling with, party size, which journey option you prefer, how you heard about us, and anything you tell us about what draws you to the journey.
• Enquiry and contact forms. Your name, email address, any phone number you give, and the content of your message.
• Guided conversation (Travel Site). [TO CONFIRM: whether the "guide" chat is live on the public site.] If you use it, the messages you type and any details you share in the conversation, such as your name, contact details and travel preferences.
• Member accounts (Jewellery Site). Your email address, used to sign you in, and any profile information you add. [TO CONFIRM: exactly which details a member account holds, for example a display name, a date of birth or other details used for Seraphim angel-number features, and any profile photo.]
• Community. Anything you post or share in the community, such as comments, messages and images. [TO CONFIRM: what community features exist and who can see posts (members only, or public).]
• Shop orders (when available). Your name, delivery and billing address, email, phone number and order history. Card payments will be handled by our payment processor, [TO CONFIRM: payment processor], and we will not see or store your full card details.
• Tour bookings (when available). The details needed to arrange your journey, which may include passport details, date of birth, emergency contact, travel insurance details, and dietary or medical needs. [TO CONFIRM: what is collected at booking, and through which system.]
• Marketing preferences. Whether you have agreed to receive news from us.

2.2 Sensitive information

Some information you choose to share may be "special category" data under the GDPR, for example:

• health information, such as allergies, dietary needs or mobility needs for a tour; and
• information that may reveal your religious, spiritual or philosophical beliefs, for example in what you tell us about why a journey is calling you, or in community posts.

Please only share this kind of information if you are comfortable doing so. Where we need it (for example, so our chefs can cook around an allergy), we will process it only with your explicit consent or where another legal condition applies, and only for that purpose. You can withdraw your consent at any time (see section 9).

2.3 Data collected automatically

• Technical data. When you visit the Websites, our hosting provider receives technical information such as your IP address, browser type, device type, the pages you request and the date and time. We use IP addresses for a short time to protect our forms and services from abuse (for example, to limit repeated submissions).
• Cookies and similar technologies. See section 7.

2.4 Data from others

• If someone books or registers on your behalf (for example, a travel companion), they may give us your name and contact details. They should tell you about this policy.
• [TO CONFIRM: any other sources, for example social media platforms or event partners.]

3. How we use your data and our legal basis

Where we rely on legitimate interests, we have considered your rights and expectations and believe they are not overridden. You can ask us for more detail about this.

We do not sell your personal data. We do not use your data for automated decision-making that has legal or similarly significant effects on you.

4. Who we share your data with

We share personal data only where necessary, with:

• Hosting: Vercel Inc., which hosts the Websites.
• Database and sign-in: Supabase Inc., which stores form submissions, member accounts and site content, and provides email sign-in. Our data is stored in [TO CONFIRM: Supabase project region, for example EU (Frankfurt) or EU (Ireland)].
• Email: [TO CONFIRM: email provider, for example Google (Gmail now; Google Workspace planned)], used when we correspond with you.
• Guided conversation: [TO CONFIRM: if the guide chat is live, the AI service provider that processes the conversation text (the current code uses Google's Gemini API), and the data-use terms that apply.]
• Payments: [TO CONFIRM: payment processor], once payments are set up.
• Analytics and cookies: [TO CONFIRM: analytics/cookie tools in use, if any].
• Tour partners: the people and businesses who help deliver a tour you have booked, such as our Egyptologist and ritual guide, boat operators, hotels, local transport and airlines, but only the details they need to provide their part of the journey. [TO CONFIRM: list of tour partner categories and whether any act as independent controllers.]
• Delivery companies: [TO CONFIRM: courier(s), once the shop is live.]
• Professional advisers, such as lawyers and accountants, where needed.
• Authorities, where the law requires it.

Our service providers act on our instructions under written agreements and must keep your data secure.

5. International transfers

Some of our providers (including Vercel and Supabase) are based in, or may access data from, the United States or other countries outside the European Economic Area (EEA). Tours take place in Egypt, so tour booking details will need to be shared with partners in Egypt.

Where personal data is transferred outside the EEA, we rely on an appropriate safeguard, such as:

• an adequacy decision (for example, the EU-US Data Privacy Framework, where the provider is certified);
• the European Commission's Standard Contractual Clauses; or
• where no other safeguard is available, a transfer that is necessary to perform a contract with you (for example, giving your booking details to a hotel in Egypt that you will stay in).

[TO CONFIRM: transfer mechanism for each provider, once the entity and the Supabase region are confirmed.] You can ask us for a copy of the relevant safeguards.

6. How long we keep your data

We keep personal data only for as long as we need it:

• Waitlist and enquiry details: [TO CONFIRM: retention period, for example until the end of the journey you registered for plus a set period, or until you ask us to delete them.]
• Marketing list: until you unsubscribe or withdraw consent. [TO CONFIRM: whether inactive contacts are removed after a set period.]
• Member accounts and community content: while your account is open, and for [TO CONFIRM: period] after it is closed.
• Order and booking records: [TO CONFIRM: period required by tax and accounting law in the governing jurisdiction.]
• Health and dietary information for a tour: [TO CONFIRM: period, for example deleted a set time after the tour ends.]
• Technical and security logs: [TO CONFIRM: period, including the hosting provider's log retention.]

When data is no longer needed, we delete it or make it anonymous.

7. Cookies and similar technologies

We use a small number of cookies and browser storage items. On the Travel Site, these currently include:

• Strictly necessary: a sign-in cookie for the private editing studio (used only by authorised House of Seraphim staff); and, where the guided conversation is used, a session identifier cookie (gm_sid, kept for up to 24 hours) used to limit usage and prevent abuse.
• Preferences: browser storage that remembers your motion setting (reduced motion) and the room you last reached in the journey, so you can carry on where you left off. This stays on your device.
• Member sign-in (Jewellery Site): cookies or browser storage used to keep you signed in. [TO CONFIRM: exact items used by the member sign-in.]
• Analytics or marketing: [TO CONFIRM: analytics/cookie tools in use. If none, state "We do not use analytics or advertising cookies."]

Strictly necessary items do not need your consent. If we introduce analytics, advertising or other non-essential cookies, we will ask for your consent first and you will be able to change your choice at any time. [TO CONFIRM: cookie banner or consent tool, if non-essential cookies are used.]

You can also block or delete cookies in your browser settings, but parts of the Websites may then not work.

8. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls so that only authorised people can see submissions, database security rules that block public access to stored submissions, and limits on repeated form submissions. No method of transmission or storage is completely secure, but we work to protect your data and will act promptly if something goes wrong, including telling you and the relevant authority where the law requires it.

9. Your rights

Under data protection law you have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• delete your data in certain circumstances;
• restrict how we use your data in certain circumstances;
• object to our use of your data where we rely on legitimate interests, and to direct marketing at any time;
• data portability, meaning to receive data you gave us in a commonly used format, or have it sent to another organisation; and
• withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

To use any of these rights, email us at [TO CONFIRM: contact email]. We may need to confirm your identity. We will reply within one month, which can be extended in some cases, as the law allows. There is normally no charge.

You can unsubscribe from our news at any time using the link in any email or by contacting us.

Complaints. If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to a data protection authority, in particular in the EU country where you live, work or where you believe the problem happened. [TO CONFIRM: lead supervisory authority, for example the Information and Data Protection Commissioner (IDPC) in Malta, once the entity's location is confirmed.]

10. Children

The Websites and our services are intended for adults. We do not knowingly collect personal data from anyone under 18 [TO CONFIRM: minimum age, and how children travelling with a parent or guardian on a tour will be handled]. If you believe a child has given us personal data, please contact us and we will delete it.

11. Links to other websites

The Websites may link to other sites, such as social media. We are not responsible for how those sites handle your data; please read their privacy policies.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on the Websites with a new "last updated" date and, where the changes are significant, we will tell you by email or on the Websites.

13. Contact us

For any question about this policy or your personal data:

• Email: [TO CONFIRM: contact email]
• Post: [TO CONFIRM: postal address]