Privacy policy

Ivy Veil, theivyveil.com
Version 1.1, 15 September 2026

You tell Ivy things you may not have told anyone else: a name, a date of birth, a question about a marriage, a child you hope for, someone you lost. This page says exactly what Ivy Veil does with that, in plain words. It is written to meet the General Data Protection Regulation (GDPR).

1. Who is responsible

Magnolia Creations B.V., trading as Ivy Veil
Keizersgracht 572, 1017 EM Amsterdam, the Netherlands
Chamber of Commerce (KvK) 94601798
ivy@theivyveil.com

Ivy Veil is the controller of your personal data. Ivy Veil is a small company and does not have a data protection officer; write to the address above for anything about your data, and Ivy answers personally.

2. What is processed

2.1 What you give for a reading or ritual

Your name and date of birth. Your e-mail address. The date, place and occasion you ask about. Your question or intention, in your own words. The language you want your report in.

Names, and sometimes dates of birth, of other people you mention: a partner, an ex-partner, a parent, a friend. These are processed only because you have written them down for your own reading. These people are never contacted, never looked up, and their names are never used for anything except writing for you.

Situations you describe. These may concern relationships, sexuality, health, fertility, pregnancy, grief, or faith. Under the GDPR some of this is "special category" data. It is processed only because you explicitly ask for your reading to be written about it, which is your explicit consent (article 9(2)(a) GDPR). You can withdraw that consent at any time by asking for the reading and your details to be deleted (see section 6). Please share only what your question needs.

Photos, for palm and coffee readings. A photo of your hand or your cup is used to write your reading and is deleted from Ivy Veil's systems within seven days after delivery.

2.2 What comes with your order

Order details, the products you chose, your billing and (for jewellery) shipping address, your customer account, the confirmation you gave at checkout (immediate delivery, 18 or older) with its time stamp, and your correspondence with Ivy Veil.

Payment data. Your payment is handled by Shopify Payments. Ivy Veil never sees your full card number or bank login; what arrives is a confirmation, the payment method and the last digits, and the invoice is kept as tax law requires.

2.3 What is noticed about how you use the e-mails and the site

For e-mails sent to you: whether the e-mail was delivered, opened and which links were clicked. This is used to see whether a reading arrived and to make the letters better, and, with your consent, to send you letters that fit what you read.

On the site: with your consent, cookies and pixels from Pinterest, Meta and Google, as described in the Cookie Policy. Without your consent, only what is needed to make the shop work.

2.4 Reviews

If you write a review, it is published with the name and photo you choose, only with your consent, through the review app. You can ask for it to be changed or removed at any time.

3. Why it is processed, and on what legal basis

To write and deliver your reading, ritual report, jewellery or membership, and to answer your messages: performance of the contract with you (article 6(1)(b) GDPR). For the special categories described above: your explicit consent (article 9(2)(a)).

To write to you on day four, to send you the guide, and to recognise you when you return so that your earlier readings can be looked back on: performance of the contract and Ivy Veil's legitimate interest in giving you the care that is promised (article 6(1)(f)). You can ask for this to stop at any time.

To send you one letter a week and to show you offers or content that fit your reading: your consent (article 6(1)(a)), given through the sign-up form or at checkout. Every letter has an unsubscribe link. If you are a customer, you may also receive letters about similar products under the Dutch soft opt-in rule, and you can object at any time.

To keep the books, invoices and tax records: Ivy Veil's legal obligation (article 6(1)(c)).

To prevent fraud, to handle payment disputes, to keep the site secure, and to notice when a customer is placing the same order again and again so that a report can be written that closes rather than opens: Ivy Veil's legitimate interest (article 6(1)(f)), weighed against your interests.

To place cookies and pixels that are not strictly necessary: your consent (article 6(1)(a) and the Dutch Telecommunications Act).

4. Who sees your data

Only Ivy reads your reading and what you shared. Your data is not sold, and no one buys it.

Ivy Veil uses these processors, each under a data processing agreement:

Shopify International Ltd (Ireland; parent in Canada and the US): the shop, your account, your orders, and e-mail sending where Shopify's e-mail tools are used. Shopify Payments (Shopify's own payment service): payments by card, Apple Pay, Google Pay, Shop Pay and the other methods shown at checkout. The e-mail provider (Shopify Email or Klaviyo, Inc., US): sending the letters and recording delivery, opens and clicks. Writing and administration software (providers in the EU and the US, each under a data processing agreement): the name, date and question you provide are processed there to write and administer your reading, and are not kept by the provider beyond what the agreement allows. The order administration lives within Shopify and Ivy Veil's own secured tools in the European Union; your reading, your details and the notes live there, and nowhere else. PostNL N.V. (the Netherlands) and its partner carriers abroad: shipping of jewellery. They receive your name, address and, for customs, the contents and value of the parcel. Judge.me: collecting and showing reviews. Trustpilot A/S (Denmark) and Google: reviews you choose to write there, under their own privacy terms. Seal Subscriptions (Slovenia): membership billing for The Weekly Circle, once offered. The accountant: invoices and payment records, never the content of readings.

Where a processor is outside the European Economic Area (Shopify in the US and Canada, Klaviyo, Meta, Google, Pinterest, the writing and administration software), Ivy Veil relies on the European Commission's adequacy decisions, including the EU-US Data Privacy Framework for certified companies, and otherwise on the Commission's Standard Contractual Clauses with extra safeguards. You may ask for a copy of the clauses that apply.

Data is shared with authorities only when the law obliges it.

5. How long it is kept

Your readings, ritual reports, the details you gave for them, and the notes: 24 months after delivery, then deleted automatically. You may ask for them to be deleted earlier at any time (section 6). If you order again within those 24 months, the clock starts again from your latest reading, so that Ivy can look back at what she wrote for you.

Photos for palm and coffee readings: deleted within seven days after delivery.

Your intention as a member of The Weekly Circle: the same 24 months after your membership ends.

Order, invoice and payment records: seven years, as Dutch tax law requires. These records do not contain the content of your reading.

Your customer account and e-mail subscription: until you close the account or unsubscribe, and then, for the account, 24 months after your last order.

E-mail correspondence: 24 months after the last message.

Consent records (checkout confirmation, cookie choice): as long as they are needed to show that consent was given, at most seven years.

No dossiers are kept outside these systems: no folders on laptops, no notes in private e-mail, no cloud drives. When something is deleted from the systems, it is gone.

6. Your rights

You have the right to see what Ivy Veil holds about you, to have it corrected, to have it deleted, to receive a copy in a common format, to restrict or object to processing, and to withdraw consent at any time without affecting what happened before. Where processing relies on legitimate interest, you may object and it stops unless there are compelling grounds, which for marketing there never are.

Write to ivy@theivyveil.com from the e-mail address on your order, or from your account. You receive an answer within a month, usually much sooner, and there is no charge for it. If you ask for your reading to be deleted, the report, your details and the notes are deleted; the invoice stays for the tax office, without the content.

You also have the right to complain to a supervisory authority. Ivy Veil's is the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, the Netherlands, autoriteitpersoonsgegevens.nl. You may also complain to the authority in the country where you live or work. Ivy would be grateful for the chance to put things right first.

7. Children

Ivy Veil's services are for adults. You must be 18 or older to order, and data about anyone under 18 is not knowingly processed. Readings are not written about minors. If you believe a child's data has reached Ivy Veil, say so and it is deleted.

8. Security

Ivy Veil's systems use encrypted connections, access restricted to the people who write for you, two-factor authentication on all accounts, and logging of who opened what. Perfect security cannot be promised, by anyone, but what you share is treated as the confidence it is. If a breach ever affects you, you are told without delay, as the law requires.

9. Changes

This policy is updated when the processing changes, and the date at the top changes with it. For changes that matter, you are told by e-mail or on the site.