Privacy Policy

Limitless Feng Shui · limitlessfengshui.com

Last updated: [NEED: date at publish]

This policy explains what personal information [NEED: business legal entity name] ("Limitless Feng Shui", "we", "us") collects through limitlessfengshui.com, our checkout, members' area, emails, texts and the Love Corner Fast-Track Call, why we collect it, who we share it with, and the choices you have.

Controller: [NEED: business legal entity name and registration number], [NEED: registered mailing address, Kuala Lumpur, Malaysia]. Contact: [email protected].

1. What we collect

Information you give us

• Contact details: your name and email address; your phone number if you choose to give it (it is optional).
• Order details: what you bought, prices, dates, and your billing country and postcode where the payment form asks for them. Card details are entered into Stripe's secure form; we never see or store your full card number.
• Survey and form answers: for example, why you bought and what help you want first, in the short survey before first access.
• Home Love Audit uploads: if you buy the audit, the floor plan, photos and details you send (such as birth year and, if the method needs it, gender, used to work out a Kua number). Photos of your home can show personal items, so please leave out anything you don't want us to see.
• Messages: emails, texts, support requests, Q&A posts, and anything you type in a live call chat.

Information collected automatically

• Device and usage data: IP address, browser and device type, pages viewed, links clicked, and the referring page or ad.
• Email and text engagement: whether our emails are opened and links are clicked.
• Call attendance: whether you joined the Fast-Track Call and for how long, so we can send the right follow-up.
• Cookies and similar tech: see section 5.

We don't ask for sensitive information such as health details, and we ask you not to send it. We don't knowingly collect information from anyone under 18.

2. Why we use it, and our legal bases (UK / EU)

3. Who we share it with

We don't sell your personal information for money. We share it only with service providers who help us run the business, under contracts that limit how they can use it:

• GoHighLevel (LeadConnector): our CRM. Hosts our pages, checkout, members' area and contact records, and sends our emails and texts.
• Stripe: processes payments, handles fraud checks and disputes. Stripe acts as an independent controller for some data; see stripe.com/privacy. [NEED: add PayPal if it is connected.]
• Meta Platforms (Facebook / Instagram): the Meta pixel and Conversions API. See section 5.
• Google Fonts: our pages load fonts from Google, which receives your IP address when the font loads.
• [NEED: confirm and keep only what's used: Zoom (the live call), Zapier (connects Zoom attendance to GoHighLevel), a video host, email-sending domain provider.]
• The person who records your Home Love Audit, if you buy one: [NEED: Howie or a named feng shui practitioner partner].
• Professional advisers and authorities: lawyers, accountants, banks, or authorities where the law requires it or to protect our rights (for example in a payment dispute).
• A buyer of our business, if the business is ever sold, under the same protections.

4. Email and text (SMS) marketing

• Email: every marketing email has an unsubscribe link. Use it and we'll stop marketing emails. We'll still send messages about your orders, access, billing, renewals and trial end dates.
• Text messages: we text you only if you tick the text consent box, which is never pre-ticked and isn't required to buy. The wording at sign-up is: "Text me order updates and reminders about the Love Corner Fast-Track Call from Esther Lee. Msg & data rates may apply. Up to [NEED: max messages per week; 6 is a proposed number] msgs/week. Reply STOP to opt out, HELP for help. Consent is not required to buy."
• Reply STOP to any text to stop texts. If you ask us to stop in any other way, we'll stop too. We send marketing texts only between 8am and 8pm in your local time.
• Some of our text replies may come from an automated assistant. [NEED: AI disclosure option per copy/10-sms-v2.md §0.]
• We never sell or share your phone number for other companies' marketing.

5. Cookies, the Meta pixel and the Conversions API

We use cookies and similar technology:

• Essential: to run checkout, keep you logged in to the members' area, remember your cart and prevent fraud. These can't be switched off.
• Advertising and measurement: the Meta pixel places cookies in your browser and tells Meta which of our pages you visit and what you do there (for example, viewing the sales page, starting checkout, or buying). The Meta Conversions API sends similar event information from our servers (GoHighLevel) directly to Meta, which can include your email address and phone number in a hashed (scrambled) form, your IP address and browser details. Meta uses this to match visits to its users, measure our ads, and show our ads to people more likely to be interested. Meta may also use it under its own terms; see facebook.com/privacy/policy.

Your choices:

• UK and EU visitors: we only load advertising cookies, and only send Conversions API events about you, after you agree in our cookie banner. [NEED: install a consent banner that blocks the pixel and the Conversions API until consent, and confirm GoHighLevel's server events respect that choice.] You can change your choice any time at [NEED: cookie settings link].
• Everyone: you can block or delete cookies in your browser, change your ad settings in your Facebook and Instagram accounts, and use the opt-out in section 7 if you're in the US.
• We honour the Global Privacy Control signal as an opt-out of "sharing" for advertising where the law requires. [NEED: confirm the banner/tool supports GPC.]

6. Where your data is stored

We are based in Malaysia, and our service providers mainly store data in the United States and other countries. When we transfer UK or EU personal data outside the UK / EU, we rely on the providers' standard contractual clauses (and the UK addendum) or another lawful transfer mechanism. Ask us for details.

[NEED: UK and EU representative under Article 27 GDPR / UK GDPR, if required for a non-EU business that targets UK/EU buyers. Name and address here.]

7. Your rights

UK and EU: you can ask to access, correct, delete, or get a copy of your data; to restrict or object to how we use it (including any time for direct marketing); and to withdraw consent at any time (it doesn't affect what happened before). You can complain to your data protection authority (in the UK, the ICO at ico.org.uk), but we'd like the chance to help first.

United States (including California): depending on your state, you can ask to know what personal information we've collected, see a copy, correct it, delete it, and opt out of the "sale" or "sharing" of your information for cross-context behavioural advertising, and of targeted advertising. We don't sell personal information for money, but using the Meta pixel and Conversions API may count as "sharing" for advertising under California law. To opt out, email [email protected] with the subject "Do not sell or share", or use [NEED: "Your Privacy Choices" link]. We won't treat you differently for using your rights. An authorised agent can make a request for you with your signed permission.

Categories we collected in the last 12 months (CCPA): identifiers (name, email, phone, IP address); commercial information (purchases); internet activity (pages, clicks, email engagement); and, for audit buyers, photos and floor plans you upload. Sources and purposes are in sections 1 and 2; recipients in section 3.

Malaysia: under the Personal Data Protection Act 2010 you can ask to access and correct your data and limit how we process it. [NEED: lawyer to confirm PDPA notice requirements, including the Malay-language notice where needed.]

How to ask: email [email protected] from the email you used with us. We may need to confirm it's you. We reply within one month (UK / EU) or 45 days (US), and tell you if we need longer.

8. How long we keep it

• Order, billing and tax records: [NEED: retention period, e.g. 7 years, per Malaysian tax rules].
• Contact and marketing records: until you unsubscribe or ask us to delete them, then a minimal suppression record so we don't contact you again.
• Home Love Audit uploads: [NEED: e.g. 12 months after delivery, then deleted].
• Members' area accounts: while your membership is active and [NEED: N months] after.
• Cookies: see the cookie banner for each cookie's lifetime.

9. Security

We use reputable providers with encryption in transit, and we limit who on our team can see your information. No method is completely secure, so please use a strong password for the members' area and tell us right away if you think your account has been accessed without permission.

10. Changes

We may update this policy. The date at the top shows the latest version. If a change is significant, we'll tell you by email or on the site.

11. Contact

[NEED: business legal entity name and registration number]
[NEED: registered mailing address, Kuala Lumpur, Malaysia]
Email: [email protected]

© Limitless Feng Shui · [email protected]