Privacy policy
This policy explains what we do with your personal information. It is written to be read, not to be survived.
Updated 13 October 2026: we now use the Meta Pixel and Meta's Conversions API to measure our advertising. What that means for you, and how to opt out, is in sections 4, 7 and 8.
1. Who is responsible for your data
Xenia Vocal Consultant SRL, registered in Romania under number 42209070, with its registered office at Str. 1 Mai nr. 10, Baia Mare, Maramureș 610126, Romania, trading as The Frequencies by Xenia Vocal Healer.
We are the data controller. For anything in this policy, write to contact@xeniavocalhealer.com.
Because we are established in the European Union, we handle everyone's data to the GDPR standard — including yours if you live in the United States. Where your own state or country gives you additional rights, those apply too.
2. What we collect, and why
When you buy
Your name, email address, billing address and order details. We need them to take your order, deliver your files, issue your invoice and answer you if something goes wrong. The legal basis is performance of our contract with you, and our legal obligation to keep accounting records.
We never see your card number. Payments are processed by Shopify Payments and PayPal, who receive your card details directly. We only learn that a payment succeeded, the last four digits, and the card type.
When you order the Personalized Frequency
This is the most personal thing we handle, so we are specific about it.
- Your photograph. Xenia works from it to compose your frequency.
- Your date and place of birth.
- What you tell us about what you are going through and what you would like to change.
- Your email address and phone number, for delivery and for questions about your order.
The legal basis is performance of the contract: without these, the product cannot be made.
Some people write to us about health, grief or other difficult things. We did not ask for it, we do not need it, and we do not build anything on it — but when you send it, we hold it in confidence and delete it with the rest of your order file.
We do not use your photograph for facial recognition, identification, or any biometric analysis. We do not run it through any automated system. Xenia looks at it, and composes.
Your photograph and your details are never published, never sold, and never used in marketing — not with your name removed, not as an example, not anywhere.
When you join our list
Your email address, and your first name if you give it. We use it to send you the free guided meditation and, afterwards, occasional emails about our work. The legal basis is your consent, which you can withdraw at any time using the unsubscribe link at the foot of every email, or by writing to us.
When you simply visit
Our shop runs on Shopify, which records standard technical information: your IP address, browser and device, the pages you view, and how you arrived. We use it to keep the shop working and to understand which pages are read. The legal basis is our legitimate interest in running and improving the shop.
We also measure our advertising with the Meta Pixel. That is described in section 4.
3. The audio we create for you
Your finished Personalized Frequency is kept in our archive so we can send it to you again if you lose it, and so Xenia can refer back to it if you ever order a follow-up.
It is not shared, not licensed to anyone, and not reused for another customer. It could not be — it was composed for one person.
If you want it deleted, say so and we delete it. You will then have no way to recover the file from us, so keep your own copy first.
4. Who else touches your data
We do not sell your personal information for money. We do share some of it with Meta to measure and improve our advertising, as described below. We use these service providers, and only these:
- Shopify Inc. (Canada) — the shop platform: hosting, orders, customer accounts, email delivery of your files, and the shop's own analytics.
- Shopify Payments and PayPal — payment processing. They are independent controllers of the payment data they collect.
- Google Workspace (email) — our support inbox, which is where your messages to us live.
- Meta Platforms (Ireland and the United States) — advertising measurement, through the Meta Pixel and Meta's Conversions API (see below).
- Microsoft (United States) — Microsoft Clarity, which records how our sales pages are used: scrolling, clicks, which sections are read. It runs on our sales pages, not in this shop, and it masks anything typed into fields.
- Cloudflare (United States) — hosting of our sales pages and of your download library.
- Our accountant, in Romania, for invoices and tax records, as the law requires.
We may also disclose information where we are legally obliged to — for example to a tax authority or in response to a lawful order.
Advertising: the Meta Pixel and Conversions API
This shop uses the Meta Pixel, through Shopify's Facebook & Instagram app, and Meta's Conversions API, which sends the same events from Shopify's servers. Our sales pages use the Meta Pixel too. We do not use Google Ads, TikTok or any other advertising pixel.
Meta receives the pages and products you view, and when you add something to your cart, start checkout or complete a purchase, together with technical data such as your IP address, your browser and a cookie identifier. When you buy, Meta also receives the order value and your contact details — such as your email address, phone number, name and address — in hashed form, so that it can match the purchase to an ad you saw. We use this to see which of our ads work and to show our ads to people likely to be interested. Meta's own privacy policy governs what Meta does with this data.
Under some US state laws, this counts as "sharing" personal information for cross-context behavioural advertising. You can opt out at any time — see section 7.
5. Data leaving the European Union
Shopify, Google, Meta, Microsoft and Cloudflare process data outside the EU, including in the United States and Canada. Those transfers rely on the European Commission's Standard Contractual Clauses, and on the EU–US Data Privacy Framework where the provider is certified under it.
6. How long we keep things
- Order and invoice records — 10 years, as Romanian accounting law requires. We cannot shorten this.
- Your photograph and the details you sent for a Personalized Frequency — 12 months after delivery, then deleted. Sooner if you ask.
- The finished audio — kept in our archive so we can re-send it, until you ask us to delete it.
- Support emails — 3 years.
- Marketing list — until you unsubscribe, and for a short period afterwards to make sure we do not email you again by mistake.
7. Your rights
Wherever you live, you can ask us to:
- tell you what we hold about you, and give you a copy
- correct anything that is wrong
- delete it — except records we are legally required to keep
- send your data to you or to someone else in a portable format
- stop using it for marketing, immediately and without explanation
- restrict or object to a particular use
Write to contact@xeniavocalhealer.com. We answer within 30 days, and usually within one business day. We do not charge for this, and we will not treat you differently for asking.
If you live in the EU or the EEA, you may also complain to your national data protection authority, or to the Romanian one (ANSPDCP, dataprotection.ro).
If you live in California, or in another US state with a comprehensive privacy law, you have the rights listed above, plus the right to know what categories of personal information we collect and disclose. We have set out both above. We do not sell personal information for money. We do share it with Meta for cross-context behavioural advertising, as described in section 4, and you can opt out of that sharing at any time on our Privacy Choices page, or by turning on Global Privacy Control in your browser — we treat that signal as an opt-out request. We do not process sensitive personal information for the purpose of inferring characteristics about you. You may use an authorised agent to make a request on your behalf.
If you live in the United Kingdom, you may complain to the Information Commissioner's Office (ico.org.uk).
8. Cookies
The shop uses cookies that are necessary for it to work — keeping your cart, keeping you signed in, security — and Shopify's own analytics cookies, which tell us how many people read a page.
It also uses advertising cookies set by the Meta Pixel (for example _fbp), which let us measure whether our ads work.
You can refuse or clear cookies in your browser, and you can opt out of advertising sharing on our Privacy Choices page. The necessary cookies cannot be turned off without breaking the checkout.
9. Security
The site runs over HTTPS. Access to orders and to customer files is limited to Xenia and to the person who helps her run the shop, each with their own account and two-factor authentication.
No system is perfectly secure. If a breach ever affects your data, we will notify you and the relevant authority as the law requires.
10. Children
This shop is not for children. We do not knowingly collect information from anyone under 18. If you believe a child has sent us data, write to us and we will delete it.
11. Automated decisions
We do not make any decision about you by automated means. Meta uses the advertising data described in section 4 to decide which ads to show, under its own policies; you can opt out as described in section 7.
12. Changes
If we change this policy in a way that matters, we will say so at the top of this page and, where the change is significant, email the people on our list. The date below is when it was last changed.
Last updated: 13 October 2026.
