← Back to Grace Moon

Privacy Policy

How We Collect, Use, Store, and Protect Your Personal Information

Effective Date: March 21, 2026  |  Last Updated: March 21, 2026

Section 1Introduction

Mycroft Wellness Group ("Company," "we," "us," or "our") operates the website gracemoon.shop and related digital properties under the brand "Grace Moon" (collectively, the "Website" or "Service"). This Privacy Policy ("Policy") describes how we collect, use, store, share, and protect your personal information when you visit our Website, interact with our content, complete our quiz or assessment, subscribe to our communications, purchase our products, or otherwise engage with our Service.

This Privacy Policy applies to all visitors, users, customers, and others who access or use our Service (collectively, "Users," "you," or "your"). By accessing or using our Service in any capacity, including visiting the Website, clicking any button, completing any form, or making any purchase, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

We are committed to protecting your privacy and handling your data with transparency. This Policy is designed to comply with applicable data protection regulations, including the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the UK Data Protection Act 2018, and other applicable privacy laws.

If you do not agree with this Privacy Policy, you should not access or use our Service. Your continued use of the Service constitutes your ongoing acceptance of this Policy and any updates thereto.

Section 2Data Controller Information

Mycroft Wellness Group is the data controller responsible for your personal data processed through our Service. For any questions, concerns, or requests regarding your personal data, please contact us using the information above.

Section 3Information We Collect

3.1 Information You Provide Directly

When you interact with our Service, you may voluntarily provide us with the following categories of personal information:

Data Category	Specific Data Points	Collection Point
Contact Information	Email address	Quiz completion (Question 5), checkout process
Quiz Responses	Energy level assessment, sleep pattern data, crystal preference selection, zodiac sign	Interactive quiz (Questions 1-4)
Frequency Assessment Data	Calculated frequency score, frequency tier classification, personalized reading results	Algorithmically generated from quiz responses
Payment Information	Name on card, billing address, payment method details (processed by Whop/Stripe — we do not store full card numbers)	Checkout/purchase process
Communication Data	Content of emails, support requests, and other communications you send to us	Email correspondence, support tickets

3.2 Information Collected Automatically

When you visit our Website, we automatically collect certain information about your device, browsing activity, and interaction with our Service:

• Device Information: Device type, operating system, browser type and version, screen resolution, device identifiers, and hardware specifications.
• Network Information: IP address (which may indicate approximate geographic location), internet service provider, connection type, and network characteristics.
• Usage Data: Pages visited, time spent on each page, click patterns, scroll depth, button interactions, quiz progression, funnel stage reached, referral source (URL that directed you to our site), and exit pages.
• Session Data: Session identifiers, session duration, number of sessions, return visit frequency, and session replay data for quality assurance and optimization purposes.
• Performance Data: Page load times, error logs, and technical performance metrics.

3.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Payment Processors (Whop/Stripe): Transaction confirmation, payment status, partial card information (last four digits), billing country, and fraud risk assessment.
• Analytics Providers: Aggregated and sometimes individual-level data about website traffic, user demographics (age range, gender, interests), and behavioral patterns.
• Advertising Platforms: If you arrive at our Website through an advertisement, we may receive information about the ad you clicked, the platform on which it was displayed, and associated audience segment data.

Section 4How We Use Your Information

We use the personal information we collect for the following purposes, each supported by a lawful basis for processing:

4.1 Product Delivery and Fulfillment (Contractual Necessity)

• Processing and fulfilling your purchase of Digital Products
• Delivering your personalized frequency reading and assessment results
• Providing access to purchased ebooks, guides, audio files, and supplementary materials
• Sending order confirmations, delivery notifications, and purchase receipts
• Providing customer support and technical assistance related to product access

4.2 Personalization and User Experience (Legitimate Interest)

• Generating your personalized frequency score and tailored reading based on your quiz responses
• Customizing the sales experience based on your zodiac sign, crystal preference, and energy assessment
• Adapting content presentation, recommendations, and messaging to your specific profile
• Remembering your preferences and quiz progress across sessions

4.3 Marketing and Communications (Consent / Legitimate Interest)

• Sending marketing emails about related products, services, and content from Grace Moon and Mycroft Wellness Group
• Sending educational content related to frequency healing, energy work, and spiritual wellness
• Notifying you of special offers, promotions, and limited-time deals
• Re-engagement communications if you abandon the quiz or purchase flow
• Newsletter distribution through our email marketing platform (Systeme.io)

4.4 Analytics and Service Improvement (Legitimate Interest)

• Analyzing website traffic patterns, user behavior, and conversion metrics to improve our Service
• Conducting A/B testing to optimize the user experience, quiz flow, and sales funnel
• Identifying and resolving technical issues, bugs, and performance bottlenecks
• Understanding aggregate trends in user demographics, preferences, and engagement
• Developing new products, features, and content based on user interest and feedback

4.5 Legal and Security (Legal Obligation / Legitimate Interest)

• Complying with applicable laws, regulations, and legal processes
• Protecting against fraud, unauthorized transactions, and security threats
• Enforcing our Terms & Conditions, No Refund Policy, and other agreements
• Defending against legal claims and disputes, including chargeback disputes
• Maintaining records for tax, accounting, and regulatory compliance purposes

Section 5Third-Party Service Providers

We share your personal information with the following categories of third-party service providers, each of which processes your data in accordance with their own privacy policies:

Provider	Purpose	Data Shared	Privacy Policy
Whop	Payment processing, product delivery, checkout	Email, payment details, purchase records	whop.com/privacy
Stripe	Payment processing (via Whop)	Payment card details, billing address, transaction data	stripe.com/privacy
Systeme.io	Email marketing, automation, subscriber management	Email address, quiz data (zodiac, crystal, score), tags	systeme.io/privacy
Static hosting provider	Website hosting, CDN, edge functions	IP address, request headers, access logs	hosting provider privacy policy
Google Fonts	Web font delivery (Cinzel, Playfair Display, DM Sans)	IP address, browser user agent, referrer URL	policies.google.com/privacy

We require all third-party service providers to process your data only for the purposes specified above and in accordance with applicable data protection laws. We do not sell, rent, or lease your personal information to third parties for their own marketing purposes.

5.1 Data Transfers

Some of our third-party service providers are located outside of your country of residence, including in the United States. When your data is transferred internationally, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Service providers' certification under recognized data transfer frameworks
• Contractual obligations requiring equivalent data protection standards

Section 6Cookies and Tracking Technologies

6.1 Types of Cookies We Use

• Essential Cookies: Required for the basic functionality of our Website, including session management, quiz state preservation, checkout flow, and security. These cookies cannot be disabled without significantly impairing the Service.
• Analytics Cookies: Used to understand how visitors interact with our Website, including page views, traffic sources, bounce rates, and conversion paths. This data is used in aggregate to improve our Service.
• Functional Cookies: Used to remember your preferences, quiz progress, and personalization settings to enhance your user experience.
• Marketing Cookies: Used to deliver relevant advertisements, track the effectiveness of marketing campaigns, and enable retargeting across platforms. These cookies may be set by our advertising partners.

6.2 Session Storage

We use browser session storage (sessionStorage) to maintain your quiz state, answers, calculated frequency score, and session preferences during your visit. This data is automatically cleared when you close your browser tab and is not transmitted to our servers beyond the initial data submission.

6.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or receive a warning before a cookie is placed. Please note that disabling cookies may impair the functionality of our Website, including the quiz experience and checkout process.

Section 7Data Retention

We retain your personal information for the following periods:

Data Type	Retention Period	Basis
Email address (marketing)	Indefinite, until you unsubscribe	Consent / Legitimate Interest
Quiz responses & frequency data	Indefinite, until deletion request	Legitimate Interest
Purchase/transaction records	7 years from date of transaction	Legal obligation (tax/accounting)
Support communications	3 years from last communication	Legitimate Interest
Website analytics data	26 months (aggregated)	Legitimate Interest
Session data	Duration of browser session	Essential for Service
Chargeback dispute records	10 years from dispute resolution	Legal obligation / Legitimate Interest

We will retain your data for the duration specified above, or longer if required by applicable law, regulation, or legal proceeding. After the retention period expires, your data will be securely deleted or anonymized so that it can no longer be associated with you.

Section 8Your Rights

8.1 Unsubscribe from Marketing Emails

You have the right to unsubscribe from our marketing communications at any time. Every marketing email we send contains an unsubscribe link at the bottom. You may also unsubscribe by emailing support@mycroftwell.com with the subject line "Unsubscribe." We will process your request within 10 business days. Please note that unsubscribing from marketing emails does not affect transactional or service-related communications (such as purchase confirmations or product access information).

8.2 Data Access Request

You have the right to request a copy of the personal data we hold about you. To submit a data access request, email support@mycroftwell.com with the subject line "Data Access Request." We will verify your identity and provide the requested information within 30 days of receiving your verified request.

8.3 Data Deletion Request

You have the right to request the deletion of your personal data, subject to certain exceptions. To submit a deletion request, email support@mycroftwell.com with the subject line "Data Deletion Request." Please note that we may retain certain data where we have a legal obligation to do so (e.g., transaction records for tax purposes), where the data is necessary for the establishment, exercise, or defense of legal claims, or where deletion would impair our ability to enforce our Terms & Conditions or No Refund Policy.

8.4 Data Correction

You have the right to request the correction of inaccurate or incomplete personal data we hold about you. Contact support@mycroftwell.com to submit a correction request.

8.5 Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, and machine-readable format (such as CSV or JSON) and to transmit that data to another controller.

8.6 Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes at any time. You also have the right to object to processing based on legitimate interest, in which case we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

8.7 Right to Restrict Processing

In certain circumstances, you have the right to request that we restrict the processing of your personal data. This means we will store your data but not actively process it, except as required by law.

Section 9GDPR Compliance (European Union / EEA / UK)

If you are located in the European Union, European Economic Area, or the United Kingdom, the following provisions apply to you in addition to the general terms of this Privacy Policy:

9.1 Lawful Basis for Processing

We process your personal data under the following lawful bases as defined by the General Data Protection Regulation (EU) 2016/679:

• Consent (Article 6(1)(a)): Where you have given clear, affirmative consent for us to process your personal data for specific purposes, such as receiving marketing emails. You may withdraw consent at any time.
• Contractual Necessity (Article 6(1)(b)): Where processing is necessary for the performance of a contract with you, such as delivering purchased Digital Products and processing payments.
• Legitimate Interest (Article 6(1)(f)): Where processing is necessary for our legitimate interests (or those of a third party) and your interests, rights, and fundamental freedoms do not override those interests. Our legitimate interests include fraud prevention, service improvement, analytics, and direct marketing to existing customers.
• Legal Obligation (Article 6(1)(c)): Where processing is necessary to comply with a legal obligation to which we are subject, such as maintaining transaction records for tax purposes.

9.2 Data Protection Officer

Given the scale and nature of our data processing activities, we have not appointed a formal Data Protection Officer. For all data protection inquiries, please contact support@mycroftwell.com.

9.3 Supervisory Authority

If you are located in the EU/EEA/UK, you have the right to lodge a complaint with your local data protection supervisory authority if you believe that our processing of your personal data violates applicable data protection law. We encourage you to contact us first so that we can attempt to resolve your concern directly.

9.4 International Transfers

Your personal data may be transferred to, stored in, and processed in countries outside of the EU/EEA/UK, including the United States. We ensure that all international transfers are protected by appropriate safeguards, including Standard Contractual Clauses approved by the European Commission (Decision 2021/914), and equivalent mechanisms for UK transfers as approved by the UK Information Commissioner's Office.

Section 10CCPA Compliance (California Residents)

If you are a California resident, the following provisions apply to you under the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA):

10.1 Categories of Personal Information Collected

In the preceding twelve months, we have collected the following categories of personal information from California consumers:

• Identifiers: Email address, IP address, device identifiers
• Internet or Network Activity: Browsing history on our Website, interaction with our Service, referral data
• Commercial Information: Purchase records, transaction history, products purchased
• Inferences: Frequency score, energy assessment tier, personalized recommendations derived from quiz responses
• Sensitive Personal Information: We may collect information about your spiritual beliefs, wellness practices, and health-related interests through the quiz. This data is used solely for personalization and is not used for discriminatory purposes.

10.2 Your CCPA Rights

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the sources from which the information was collected, the business purpose for collecting the information, and the categories of third parties with whom the information is shared.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions (e.g., completing a transaction, maintaining security, complying with legal obligations).
• Right to Opt-Out of Sale: We do not sell your personal information as defined by the CCPA. Therefore, there is no need to opt out of the sale of personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit the use and disclosure of your sensitive personal information to that which is necessary to perform the services.

10.3 Exercising Your CCPA Rights

To exercise any of the above rights, submit a verifiable consumer request by emailing support@mycroftwell.com with the subject line "CCPA Request." We will verify your identity by matching the information you provide with the information we have on file. We will respond to your request within 45 days. If we need more time (up to an additional 45 days), we will inform you of the reason and extension period.

10.4 Do Not Sell or Share

Mycroft Wellness Group does not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising purposes.

Section 11Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your browser and our Website is encrypted using TLS 1.2 or higher (HTTPS). Payment data is encrypted end-to-end by our payment processors.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. All access is logged and audited.
• Third-Party Security: Our service providers (Whop, Stripe, Systeme.io, Static hosting provider) maintain industry-standard security practices, including PCI-DSS compliance for payment processing.
• Infrastructure Security: Our Website is hosted on Static hosting provider's globally distributed infrastructure, which provides DDoS protection, edge caching, and automated security patching.
• Incident Response: We maintain an incident response plan to address potential data breaches promptly. In the event of a breach affecting your personal data, we will notify affected users and relevant supervisory authorities in accordance with applicable law.

While we implement robust security measures, no method of electronic storage or internet transmission is 100% secure. We cannot guarantee absolute security of your data, but we commit to using commercially reasonable measures to protect it.

Section 12Children's Privacy

Our Service is not directed to individuals under the age of 18 ("minors"). We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@mycroftwell.com and we will promptly delete such information.

If we discover that we have inadvertently collected personal information from a minor, we will take immediate steps to delete that information from our records.

Section 13Third-Party Links and Services

Our Website may contain links to third-party websites, services, or platforms (such as Whop for checkout). This Privacy Policy applies only to our Website and Service. We are not responsible for the privacy practices, content, or security of any third-party websites or services. We encourage you to review the privacy policies of any third-party sites you visit.

Section 14Email Marketing Practices

When you provide your email address through our quiz or purchase process, you consent to receive marketing communications from Mycroft Wellness Group and Grace Moon. Our email marketing practices comply with the CAN-SPAM Act (United States), GDPR (EU/EEA/UK), CASL (Canada), and other applicable anti-spam legislation.

Each marketing email we send includes:

• Clear identification of the sender (Mycroft Wellness Group / Grace Moon)
• A valid physical postal address or registered agent address
• An unsubscribe mechanism that is honored within 10 business days
• Accurate subject lines that are not misleading

We may send you the following types of communications:

• Transactional emails: Order confirmations, delivery notifications, account-related updates (cannot be unsubscribed)
• Marketing emails: Promotional offers, new product announcements, educational content, newsletters (can be unsubscribed at any time)
• Automated sequences: Welcome series, post-purchase follow-ups, re-engagement campaigns (can be unsubscribed at any time)

Section 15Changes to This Privacy Policy

We reserve the right to modify, update, or replace this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes that materially affect how we use your personal information, we may also notify you via email or a prominent notice on our Website.

Your continued use of our Service after any changes to this Privacy Policy constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

Section 16Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For GDPR-related complaints, EU/EEA residents may contact their local data protection supervisory authority. For CCPA-related complaints, California residents may contact the California Attorney General's office.