Privacy Policy

Introduction

Coyotes and Candles ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or book a service with us.

Information We Collect

Personal Information

When you book a service or contact us, we may collect:

• Name and email address
• Payment information (processed securely through Stripe - we never see or store your card details)
• Booking details (date, time, service type, session notes)
• Any information you voluntarily share in messages or session notes

Automatically Collected Information

When you visit our website, we may automatically collect:

• Browser type and version
• IP address
• Pages visited and time spent on pages
• Referring website

We keep our own simple, cookieless visitor statistics (which pages are viewed and roughly how many people visit). These stats store no personal data: instead of an identifier, we record a one-way, salted code derived from your IP address and browser that changes every day and cannot be traced back to you. We use this only to understand overall traffic, never to identify or track individual visitors, and we automatically delete these statistics after 18 months.

How We Use Your Information

We use the information we collect to:

• Process and confirm your bookings
• Send booking confirmations and session reminders
• Respond to your questions and messages
• Send marketing communications - only if you opt in, and you can withdraw consent at any time in Account Settings
• Operate our optional community Discord and keep your server roles in sync - only if you choose to link your account
• Improve our website and services
• Prevent fraud and enhance security
• Comply with legal obligations

Information Sharing

We do not sell or rent your personal information to third parties. We may share your information with:

• Service Providers (data processors): We rely on a small number of providers who process personal data on our behalf, only as necessary to deliver our services:
  • Stripe - payment processing (card details go directly to Stripe; we never see or store them)
  • Supabase - database, file storage, and account authentication (stores your account details, bookings, uploaded files, and session/chat data)
  • Agora - live audio and video for your sessions (transmits the call in real time; we do not record or store the audio or video)
  • Resend - transactional email (booking confirmations, reminders, and notifications)
  • UpCloud (hosting) and Cloudflare (content delivery and security) - operate the website infrastructure
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, sale, or acquisition (you would be notified)

Some of these providers may process data outside the EU/EEA; where they do, they rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Community Discord and “Daffy” Bot

We run an optional community server on Discord, along with a bot named Daffy (Daffodil the Coyote). Joining the Discord is entirely voluntary and separate from booking a service - you do not need a Discord account to use our website or sessions.

• Discord is a third party. The server runs on Discord's platform, and your use of it is governed by Discord's Privacy Policy and Terms. We do not control how Discord collects or processes your data.
• What Daffy does. Daffy reads messages only to respond to commands (for example !roll, !help, or !daffy) and detects when a member joins so it can post a welcome. Where those features are enabled, Daffy also keeps your community roles in sync and may send you notifications and reminders - including direct messages - about sessions you have booked, and may respond to commands about your games.
• Account linking (optional). If you choose to connect Discord in Account Settings, we use Discord's “identify” permission to read your Discord user ID and username, and we store a link record - your Discord user ID, username, the email on your account, and the date you linked - so Daffy can keep your community roles (such as verified member, customer, and campaign player) aligned with your account status. We never post on your behalf or read your private messages.
• Community roles and channels. Based on your linked account, Daffy assigns community roles (such as verified member, customer, and campaign player), and for each campaign you join she maintains a private channel and a campaign role so you can reach your group. Roles are added and removed automatically as your bookings and subscriptions change.
• Permissions Daffy uses. To provide these features, Daffy needs permission on the server to read and send messages, manage roles, manage channels, and send direct messages for reminders. You can leave the server or block the bot at any time.
• What Daffy does not store. Other than the optional link record above, Daffy does not store your Discord messages, profile, or activity on our systems - messages are processed momentarily to reply and then discarded.
• Your control and rights. Linking is opt-in. You can disconnect Discord any time in Account Settings, which deletes the link record and removes the roles Daffy assigned. Your Discord link is included in your data export (Export My Data), and deleting your account also deletes the link and removes those roles.

If you would like a welcome message or other content about you removed from the server, contact us or a server moderator and we will remove it.

Data Security

We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Your Rights (GDPR)

As we are based in Finland (EU), you have certain rights under GDPR:

• Access & Portability: Download a copy of all personal data we hold - available instantly from Account Settings → Export My Data.
• Rectification: Update your name, email, or pronouns directly in Account Settings.
• Erasure: Permanently delete your account and anonymise your data - available in Account Settings → Delete Account. This also removes your chat messages and anonymises any reviews you submitted while logged in. Booking records are anonymised rather than deleted to meet our accounting obligations.
• Withdraw consent: Turn off marketing emails any time in Account Settings; withdrawing is as easy as opting in.
• Restriction / Objection: Contact us directly at the address below.

For any rights not covered by the self-service tools above, please contact us at the email address below. We will respond within 30 days as required by GDPR.

Children's Privacy

Our services are intended for individuals 18 years of age and older. We do not knowingly collect personal information from minors.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have questions about this privacy policy or wish to exercise your rights, please contact us at:

Email: coyotesandcandles@gmail.com

Data controller: Caitlyn Carmabella Nayeli (yksityinen elinkeinonharjoittaja)
Trading as: Coyotes and Candles
Y-tunnus: 3572436-7
Opastinsilta 1 B 48
00520 Helsinki, Finland