Privacy statement

1. What data I process

• Contact details: your name and email address, entered at purchase or sign-up.
• Content answers: what you fill in inside the archetype workbook and the intake questionnaires.
• Generated content: the strategy, audio and notes created for you on the basis of your answers.
• Voice recording: only when you take The Mirror Session and consciously record an audio.
• Payment details: processed by Plug & Pay and their payment partners. I never see or store credit card or bank details myself.
• Technical data: standard logs (IP address, browser) for security and troubleshooting.

2. What I use your data for

• Writing and delivering your personal strategy and audio.
• Granting access to your dashboard via a secure magic-link login.
• Sending service emails (login links, delivery emails, guarantee period) and — if you opt in — content updates.
• Complying with legal obligations (e.g. tax retention).

3. Legal basis

I process your data on the basis of the contract (your purchase), your consent (e.g. for the voice recording) or a legitimate interest (e.g. fraud and incident detection).

4. Who I share data with

• Supabase (EU region) — for storing your account, answers and content.
• Anthropic — for generating your strategy (your answers are processed for this purpose, not used for model training under our contract).
• ElevenLabs — for producing The Mirror Session and Embodiment Series.
• Plug & Pay and their payment partners — for processing payments and invoicing.
• MailBlue / email provider — for sending service and marketing emails.

All parties operate under a data processing agreement (or equivalent). I never sell your data to third parties.

5. Voice recordings

When you take The Mirror Session, you consciously record a short piece of text. This recording is used to create a temporary voice clone that produces only your personal audio. The source demo file is deleted immediately after successful production. The final audio stays in your dashboard until you delete it yourself.

6. How long I keep data

• Account & content: for as long as your dashboard is active. You can request deletion at any time.
• Voice recording (source): deleted immediately after production.
• Invoices: 7 years (tax retention requirement).
• Service emails & logs: 12 months by default, anonymised after that.

7. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability and objection to processing. Email hello@irisijzerman.nl and I’ll handle it within one working week.

Complaint? You can always contact the Dutch Data Protection Authority via autoriteitpersoonsgegevens.nl.

8. Security

Access to your dashboard goes through a passwordless magic link (valid for 15 minutes). Data is stored and transmitted in encrypted form. Storage buckets with personal content are private and only accessible through your own session.

9. Changes

If this statement changes materially, you'll read about it here and — for substantive changes — receive an email.