Privacy

Pleroma collects only what it needs to deliver the teachings, the products, and the Inner Circle — and nothing else. This page tells you exactly what we collect, why, where it goes, how long we keep it, and how to make us delete it.

Pleroma is operated by Stefans Alkimia, a natural person based in Bulgaria, as data controller under GDPR. There is no registered company behind the site — it is a solo operator's personal project that sells digital teachings. For anything data-related, write to pleroma@stefansalkimia.com and you reach the only person with the keys.

Each row below lists one category of data, where it comes from, why we process it, and the legal basis under Art. 6(1) GDPR.

We do NOT collect your real name, postal address, phone number, payment card data, location, social-media data, or any special-category data (Art. 9 GDPR — health, religion in the strict sense, etc.).

We use a small, deliberate stack. Each of these is a data processor under Art. 28 GDPR and each has a Data Processing Agreement in place. Transfers outside the EU rely on the EU-US Data Privacy Framework; if any processor loses DPF adequacy we fall back to Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914.

• •Stripe, Inc. — payment processing (US, EU-US DPF).
• •Resend — email delivery (US, EU-US DPF).
• •Supabase Inc. — database for subscribers and purchase records.
• •Vercel Inc. — hosting and CDN (US, EU-US DPF for logs).
• •Google LLC — Google Analytics 4, only loaded after you consent (US, EU-US DPF).

• •Active subscriber: until you unsubscribe, then 30 days for audit, then hard-deleted.
• •Unsubscribed subscriber: 30 days, then deleted.
• •Purchase records: 10 years from purchase (Bulgarian accounting law, Zakon za Schetovodstvoto Art. 12).
• •Rate-limiting IP hash: 24 hours.
• •Analytics data: Google 14 months, Vercel rolling 30 days.
• •Email delivery logs: 12 months.

Under GDPR you have, at any time, the right to:

• •Access the data we hold about you (Art. 15).
• •Correct anything inaccurate (Art. 16).
• •Erase it entirely (Art. 17).
• •Restrict how we process it (Art. 18).
• •Port it somewhere else in a common format (Art. 20).
• •Object to processing based on legitimate interest (Art. 21).
• •Withdraw consent at any time, without affecting the lawfulness of processing already done (Art. 7(3)).
• •Complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни) at www.cpdp.bg.

To exercise any of these rights, email pleroma@stefansalkimia.com. We answer within 30 days, as Art. 12(3) GDPR requires.

None. Nothing on Pleroma makes a decision about you automatically.

Pleroma is not intended for anyone under 16. We do not knowingly collect data from anyone under that age. If you believe we have, write to the address above and we will delete it.

If we change this policy we'll date it at the top. For any material change affecting the newsletter, we'll email subscribers before the change takes effect.

For any privacy-related question or data request, write to pleroma@stefansalkimia.com.