Information we may receive
For the Weekly Veil, we store the normalized email address, optional first name, exact consent wording and version, signup source, subscription status, consent and account timestamps, and a random one-click unsubscribe token. We do not request or store a date of birth. Earlier signups could include an optional birthstone month; that personalization was retired, is no longer collected, and is cleared when a record is deactivated. We also process a pseudonymous hash derived from the Internet Protocol (IP) address and request time to limit automated abuse; the raw address is not stored in the signup tables. When someone leaves a voicemail on the separate Google Voice line, Google Voice stores the voicemail audio and a machine-generated transcript. It also shows a caller number when one is supplied and, because voicemail email and transcription are enabled, sends the available notification and transcript to the business email inbox. Google Voice does not automatically summarize unattended voicemail, and Veil and Sage does not create a separate website summary. Contact and support messages may otherwise include information a visitor chooses to provide. Future checkout information is described separately.
How it is used
Weekly Veil information is used only to manage the consent-based list and send one weekly tarot reading, an in-character oracle reflection, a crystal companion, and occasional Veil and Sage product news, launches, sales, or promotions. Every subscriber receives the same general weekly edition; we no longer segment or personalize by birthstone month. No automated email sending provider is connected. Each marketing message will include a one-click unsubscribe link once delivery is configured. Other information may be used to provide the site, review and respond to voicemail messages, prevent abuse, maintain records, comply with law, and later process orders when checkout is activated.
Service providers
Weekly Veil subscriber records are stored in the website's built-in Cloudflare database and are inspectable or exportable only through the authenticated Sites Database interface. No public subscriber-list endpoint exists. Newsletter delivery remains disabled while its sender connection and authorization are completed. Veil and Sage does not sell or rent subscriber information. Google Voice processes and stores voicemail audio and its machine transcript, and the business email provider receives the enabled voicemail notification and available transcript. These Google Voice messages do not enter the website's Cloudflare database. A separate Twilio and Cloudflare D1 database (D1) development prototype remains disabled, is not connected to Google Voice, and receives no Google Voice voicemail data. Information may otherwise be shared only as reasonably needed with Shopify, payment processors, shipping carriers, fulfillment partners, hosting and security services, professional advisers, or authorities when legally required.
Owner mailbox connection
We are preparing a private connection to the business owner's Gmail account to check newsletter connection readiness and look up sent-message identifiers. This owner/operator connection uses the Gmail Application Programming Interface (API); it does not access customers' Gmail accounts. When configured, the hosted server refreshes its authorization, checks the owner's account address, and searches Sent for an exact site-generated message identifier, returning at most two identifiers. The connection does not read message bodies or send messages. Newsletter delivery remains disabled.
Google and our hosting platform process these connection requests. Refresh credentials are held in server-only secret settings until replaced or removed; short-lived access tokens are used in server memory. Credentials are not included in public pages or browser code. The readiness check does not save mailbox results to the website database; its private report contains account and connection status, not message contents.
Cookies and advertising
The Weekly Veil signup adds no advertising cookie, third-party tracker, or cross-site behavioral advertising. Essential hosting, security, and future Shopify checkout functions may use technical cookies or similar technology. Optional first-party browser page counts are off until you allow them using the visit-count control below. We keep daily totals for approved page paths and video campaign labels. Independently of that browser choice, video-link redirects create technical daily request totals. A request does not establish a page view or a person. Internal, automated, and test traffic remain separate classifications. We do not store network addresses, browser signatures, raw referrers, full query strings, visitor identifiers, or analytics cookies for these counts. Your browser stores only your measurement choice, an internal-traffic opt-out, or a constant test-profile exclusion. Browser privacy signals disable optional page collection; privacy request headers also suppress technical redirect counts. The browser choice and local opt-out cannot accompany an unmarked redirect request, so that request remains unclassified. Counters expire after 35 days and are removed on the next measurement write; nothing reconstructs earlier traffic or establishes unique human visitors.
Retention and security
An active Weekly Veil record is kept while the person remains subscribed. Unsubscribing immediately marks the record inactive rather than deleting it and clears any retired birthstone month still stored on an older record, so the choice can be honored without retaining that personalization and the consent history can be documented. That inactive consent and suppression record is kept only as long as reasonably needed for those purposes or another legitimate or legal obligation. Rate-limit buckets stop affecting requests after 15 minutes; old hashed rows are deleted during later signup processing and may remain until that cleanup runs. Routine Google Voice voicemail audio, machine transcripts, and emailed copies will be reviewed and deleted from the active Google Voice and email accounts within 90 days after receipt, unless a message is needed longer for an unresolved request, transaction, dispute, security issue, legal obligation, or the caller's request. Provider backup retention may continue under the provider's own deletion process. Reasonable safeguards are used, but no internet transmission or storage method can be guaranteed perfectly secure.
Your choices
The Weekly Veil consent box is unchecked by default. A subscriber may use the one-click link in any message to deactivate the record immediately, or contact us to ask about access, correction, deletion, or another privacy right that applies where they live. Some minimal records may be retained when needed to honor an opt-out or when law or a legitimate business obligation requires it. Veil and Sage does not create a duplicate record for an active subscriber after a repeat signup. If someone who unsubscribed decides to come back, joining again simply reactivates your original subscription. Veil and Sage does not knowingly collect personal information from children under 13. A caller may hang up without leaving a voicemail and may contact us to ask about access, correction, or deletion of a stored message.
