Last updated: 9 November 2026
We ask for as little information as possible, and we never ask about your mental or physical health. This statement explains in plain language which personal data we use, why we use it, and what your rights are under the EU General Data Protection Regulation (GDPR).
Who we are
Nouralogy is the English name and Nouralogia (نورالوجيا) the Arabic name of one and the same service, at nouralogy.com and nouralogia.com. Both are run from the Netherlands by [[TODO-LAITH: legal name, address, KvK number]]. Under either name, we are the same party responsible for your personal data (the “controller”, in GDPR terms).
You can reach us about anything in this statement at hello@nouralogy.com.
The short version
- We ask only for your email address (and, when you write to us, your message and, if you like, your name).
- We use it only to send what you asked for. If you give it only for a free gift, we delete it after 30 days.
- Joining our emails (newsletter) is always your own, separate choice.
- We use no tracking or advertising cookies, and we don’t use a visitor statistics tool.
- YouTube videos load only when you press play.
- We never sell your data.
- You can unsubscribe, see, correct or delete your data at any time.
What we collect and why
Free gifts
- What: your email address, which gift you asked for and in which language, the website you used (Arabic or English), and the date of your request.
- Why: only to deliver the gift. We send you one email with a button that confirms your address and opens your download page. We don’t use this address for our emails or offers, unless you tick the separate box to join them (see the next section).
- Legal basis: your request: we need your email address to deliver the gift you asked for (GDPR Art. 6(1)(b)).
- Who helps us: Brevo, our email service, sends the confirmation email and stores your address on servers in the EU.
- How long: 30 days after your request. Then our daily automatic clean-up deletes your address. If you ask for another gift, the 30 days start again. If you never confirm, you are not added to our contacts at all. Brevo also keeps a log of the emails it sends for us (such as the confirmation email) for up to one month. If you also joined our emails or the shop waitlist, we keep the details of your last gift request (which gift, its language and the date) with that subscription, for as long as you stay on it.
Our emails (newsletter)
- What: your email address, your language, the website you signed up on, a record of your consent (which wording you agreed to, when, and that you confirmed it by email), and, if you asked for a free gift, which gift you last asked for, in which language and when.
- Why: to send you new meditations, articles and gentle practices, and occasional offers.
- How it works: joining is always your own choice. On our gift forms it is a separate box that starts unticked, and you get the gift either way. We use double opt-in: you are only added after you click the button in the confirmation email we send you.
- Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time through the unsubscribe link in every email, or by writing to us.
- Who helps us: Brevo, our email service, which stores this data on servers in the EU. We also keep a copy of the subscriber list (your email address, your first name if you gave it, your language, the website you signed up on and your consent record) in a Google Sheet in our Google Workspace account, so our small team can see who is subscribed. It is updated every morning, so your details disappear from it the day after you unsubscribe.
- How long: as long as you are subscribed. After you unsubscribe, we keep your contact details and the record of your consent for up to 5 years, so we can show we had your permission and make sure we never email you again by mistake. At least once a year we check for older records and delete them.
Brevo counts whether our emails are opened and whether links in them are clicked, but only anonymously: these counts are not linked to you or your email address.
Shop waitlist
- What: your email address, your language, the product you are interested in, a record of your consent (which wording you agreed to, and when), and, if you asked for a free gift, which gift you last asked for, in which language and when.
- Why: to tell you when the shop, or that product, becomes available.
- Legal basis: your consent (GDPR Art. 6(1)(a)).
- Who helps us: Brevo (EU servers), and the same daily copy in our Google Sheet as for the newsletter.
- How long: until we have sent the opening announcement, and at most 3 months after that, unless you have also joined the newsletter. Sooner if you ask.
Contact form
- What: your email address, your name if you give it, and your message.
- Why: to reply to you.
- Legal basis: your consent, given with the checkbox on the form (GDPR Art. 6(1)(a)), and our legitimate interest in answering people who write to us (Art. 6(1)(f)).
- Who helps us: Brevo, our email service (EU servers), delivers your message to our inbox, and our email provider stores it there.
- How long: up to 12 months after our last exchange, unless we need it longer, for example because it relates to an order.
Please don’t include health details in your message. We don’t need them to reply, and if you do share them, we use them only to answer you and delete them with the message.
Website hosting and security
- What: technical data your browser sends when you visit, such as your IP address, browser type and the pages you request.
- Why: to deliver the website and protect it against attacks, abuse and spam.
- Who helps us: Cloudflare hosts and protects the site. Our forms are protected by Cloudflare Turnstile, which checks technical signals from your browser to tell people from bots, without puzzles. Turnstile only loads when you start using a form. Cloudflare also counts how many forms are sent from the same internet address (IP address) within one minute, so nobody can misuse our forms; this count is not linked to your email address and is kept only briefly.
- Legal basis: our legitimate interest in a safe and working website (GDPR Art. 6(1)(f)).
- How long: Cloudflare keeps security data for a limited time under its own policies. Cloudflare also keeps a short-lived technical log for us of requests that our server code handles, such as sending a form or asking for a page that doesn’t exist (for example the time, the web address (URL) requested and any error message). We use it only to find and fix problems, and it is deleted automatically after at most 7 days.
Our fonts are served from our own domain, so your browser does not contact Google Fonts when you visit.
Visitor statistics
We don’t use any visitor statistics tool at the moment. If we start, we will use one that works without cookies, such as Cloudflare Web Analytics, and update this statement first.
YouTube videos
On our pages you first see a still image that we host ourselves. Nothing is loaded from YouTube until you press play. When you do, the video loads from YouTube in its privacy-enhanced mode (youtube-nocookie.com), and Google may set cookies and use data such as your IP address under its own privacy policy, possibly outside the EU. From that moment, Google is responsible for that data. The legal basis is your choice to press play (consent). The “Watch on YouTube” link takes you to YouTube itself.
Shop (when it opens)
Our shop is not open yet. When it opens:
- What: your name, email address, billing country, what you bought and the payment status. Your card details go directly to our payment provider; we never see your full card number.
- Why: to process your order, send your receipt and download links, and keep the records the law requires.
- Who helps us: Stripe processes payments, and also uses some data under its own privacy policy, for example to prevent fraud. Resend sends our order emails.
- Legal basis: performing our agreement with you (GDPR Art. 6(1)(b)), and our legal obligation to keep tax records (Art. 6(1)(c)).
- How long: order and invoice records for 7 years, as Dutch tax law requires.
If we later offer printed products, we will share your shipping address with our print partner, and we will update this statement first.
Who receives your data
| Provider | What for | Where |
|---|---|---|
| Brevo | Free gift emails, our emails (newsletter), waitlist, contact form messages | EU |
| Cloudflare | Hosting, security, spam protection, short-lived technical logs | Global network, including outside the EU |
| Google (Google Workspace) | Our inbox (contact form messages and emails you send us), and a copy of the newsletter and waitlist subscriber lists | Possibly outside the EU, including the US |
| Google (YouTube) | Video playback, only after you press play | Possibly outside the EU, including the US |
| Stripe (when the shop opens) | Payments | EU and US |
| Resend (when the shop opens) | Order emails | Possibly outside the EU, including the US |
Providers that handle data on our behalf do so under a data processing agreement. We don’t share your data with anyone else, unless the law requires us to.
Data outside the EU
Some of these providers are based in the United States or may handle data outside the EU. When that happens, the transfer is protected by safeguards the EU recognises, such as an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework) or the Commission’s standard contractual clauses.
Your rights
You have the right to:
- access the personal data we hold about you
- correct it if it is wrong or incomplete
- delete it
- restrict how we use it
- object to uses based on our legitimate interest
- receive your data in a common format, or have it sent to another organisation (portability)
- withdraw your consent at any time. This does not affect what we did with your data before you withdrew it.
To use any of these rights, email hello@nouralogy.com. We will reply within one month. We may ask you to confirm that the request is really yours, but we will never ask for more information than we need.
You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the data protection authority in the EU country where you live. We would be grateful for the chance to put things right first, so please feel free to write to us.
We don’t collect health information
We never ask about your mental or physical health, and none of our forms has a field for it. You can watch every meditation, read every article and download every free gift without telling us anything about how you feel.
Children
Our content is created for adults. If you are under 16, please don’t ask for a free gift or sign up for our emails or waitlist without permission from a parent or guardian. If we learn that someone under 16 has given us their email address without that permission, we will delete their data.
No selling, no profiling
We don’t sell or rent your data. We don’t use advertising pixels, and we don’t make automated decisions or build profiles about you.
Security
We protect your data with reasonable technical and organisational measures, such as encrypted connections (HTTPS), limiting who can access data, and strong passwords with two-step login on our accounts where available. If a data breach is likely to affect you, we will inform you and the Autoriteit Persoonsgegevens as the law requires.
Do you have to give us your data?
No. You can read, watch and browse without sharing any personal data. We only need your email address if you want a free gift, our emails, a waitlist message or a reply to your message.
Changes to this statement
We will update this statement when our practices change, for example when the shop opens, and change the date at the top. If a change is significant, we will also let subscribers know by email.
Questions
Write to us at hello@nouralogy.com. You can also read our cookie statement.