Privacy policy

The short version: Cookies for analytics (Google Analytics) and ad measurement (Meta Pixel) only if you click “OK” in the banner. With “No”, only necessary cookies remain. We only process the data we need to send you your hypnosis and to stay in touch if you want us to. We don’t sell your data.

1. Who is responsible

Lindner International Ltd, Galileou 27, 6023 Larnaca, Cyprus
Email: [email protected]
Use this address for any privacy question or request.

2. Visiting the website and hosting

The website is delivered through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; hosting, content delivery, attack protection and data storage). When you visit, Cloudflare processes technically necessary data: IP address, date and time, the page requested, browser and operating system, referrer. This keeps the website secure and stable. Legal basis: our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Cloudflare keeps these logs only briefly. We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply as well.

Fonts are loaded from our own server. There’s no connection to Google Fonts or any other font service.

3. Cookies and local storage

We only set cookies that are needed for features you use yourself:

• epiq_lang remembers your language choice (English or German) so you see the right language next time. Duration: 1 year.
• h88 keeps you logged in to your personal hypnosis area after you open the link in your email. Duration: 1 year. Readable only by this website.

These cookies are strictly necessary to provide a service you asked for, so no consent is required. You can delete cookies in your browser at any time.

We store your banner choice as epiq_consent in your browser’s local storage (12 months) so we don’t ask again on every visit. You can change it anytime via “Cookie settings” at the bottom of the page.

3a. Google Analytics (only with your consent)

We use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand which pages are read, where visitors come from and whether our content helps. The Google tag runs in “Consent Mode”: before you click “OK”, it sets no cookies and only sends anonymous, cookieless signals (page view, consent status) to Google, from which Google estimates visitor numbers. Only after “OK” are cookies set and your usage recorded. Legal basis: your consent (Art. 6(1)(a) GDPR); for the cookieless signals our legitimate interest in basic reach measurement (Art. 6(1)(f) GDPR).

Google Analytics sets the cookies _ga and _ga_… (up to 2 years). Google Analytics 4 does not store IP addresses. Google signals, advertising features and personalized ads are switched off. We have a data processing agreement with Google; Google LLC is certified under the EU-US Data Privacy Framework. We keep reports in Google Analytics for 2 months. You can withdraw your consent anytime via “Cookie settings” at the bottom of the page. More at policies.google.com/privacy.

3b. Meta Pixel (only with your consent)

If you click “OK” in the banner, we use the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) to measure whether our ads on Facebook and Instagram lead to requests, and to show visitors of our site relevant ads. The pixel sets the cookies _fbp (3 months) and possibly _fbc, and sends to Meta: your IP address, browser data, pages visited and events such as “request sent” (without your email address, no advanced matching). Legal basis: your consent (Art. 6(1)(a) GDPR). For this collection we are joint controllers with Meta (Art. 26 GDPR, facebook.com/legal/controller_addendum). Meta is certified under the EU-US Data Privacy Framework. Withdraw anytime via “Cookie settings”. More at facebook.com/privacy/policy.

4. Your free hypnosis by email

When you enter your email address on one of our pages and tick the box, your hypnosis is unlocked right away. We also send you a personal access link by email. Clicking that link confirms your address (double opt-in). We only send promotional emails after this confirmation. We store: your email address, when and with which wording you gave consent, when you confirmed, the page you came from (including any campaign tag in the address, such as utm_source), and when you last logged in. Everyone can get one free hypnosis. To prevent multiple sign-ups, we compare email addresses and store your IP address only as a non-reversible check value for at most 7 days (Art. 6(1)(f) GDPR, legitimate interest in preventing misuse).

Purpose: to give you access to the hypnosis and, if you agreed, to send you emails from Hypnotic Rise, such as listening tips, more hypnosis sessions and information about the program. Legal bases: Art. 6(1)(b) GDPR (providing the hypnosis) and Art. 6(1)(a) GDPR (consent to emails). Every email has an unsubscribe link. You can withdraw your consent at any time, also by simply emailing [email protected].

5. Topic requests (request form)

When you request a topic for a hypnosis, we process your email address, the description of your topic, and your answers to a few short questions. This information may reveal something about your health or well-being, for example sleep, stress or fears. We only process it with your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), which you give in the form.

Purpose: to understand your topic and provide a matching hypnosis. A person on our team reviews every request. To sort requests and write the hypnosis, we use AI tools from Anthropic (Anthropic, PBC, San Francisco, USA). Your request is sent to that service without your email address. The finished hypnosis text is voiced by ElevenLabs (Eleven Labs, Inc., New York, USA), which receives only the hypnosis text, never your contact details. No automated decision with legal effect is made about you (Art. 22 GDPR).

5a. Your own hypnosis

When you request your own hypnosis, we process your email address, your written description, the summary we create from it (topic, goal, name of the hypnosis), the history of your order and the finished hypnosis. Your details may reveal information about your health or wellbeing. We process them only with your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), given in the form; after your order also to perform the contract (Art. 6(1)(b) GDPR).

For the automatic check against our safety and quality rules and for writing, we use AI services from Anthropic (Anthropic, PBC, San Francisco, USA), without your email address. The voice is created by ElevenLabs (Eleven Labs, Inc., New York, USA), from the hypnosis text only. Florian checks every hypnosis personally before it reaches you. Only Florian reads your details; we have voluntarily committed to confidentiality and never use your request as an example. The automatic check only decides whether we can accept a request; you can always ask for a human review ([email protected]). The data is stored at Cloudflare (Cloudflare, Inc.; Art. 28 GDPR). We delete requests without an order after 90 days; orders are kept as long as you use your hypnosis and as required by statutory retention periods. You can withdraw your consent at any time.

5b. Requesting a 1:1 analysis call

When you request a free 1:1 analysis call on our website, we process your email address, the times that suit you and, if you choose, a short sentence about what matters to you. Because that sentence may reveal something about your health or well-being, we only process it with your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). Purpose: to suggest times and prepare the call. The data is stored with Cloudflare (section 2), and our team is notified by email via Resend (section 6).

You book the appointment itself through the Cal.com calendar (Cal.com, Inc., San Francisco, USA) embedded on our “1:1 analysis call” page. It only loads on that page, and Cal.com then receives your IP address and browser data for technical reasons. When booking, you enter your name, email address and, if you like, a note. Cal.com processes this on our behalf to create the appointment and send confirmations to you and us (Art. 6(1)(b) GDPR; for loading the calendar Art. 6(1)(f) GDPR, since you opened the booking page yourself). The call takes place via Google Meet (Google Ireland Limited, Dublin, Ireland), which processes the data needed for the video connection. Transfers to the USA are based on standard contractual clauses or the EU-US Data Privacy Framework. The privacy policies of Cal.com and Google also apply.

6. Sending emails

We send emails through Resend (Plus Five Five, Inc., USA). Resend processes your email address and the content of the email to deliver it. The legal basis is the same as for the email itself (section 4). Transfers to the US are based on standard contractual clauses.

6a. Payments (Stripe)

When you buy a night version, your own hypnosis or a gift voucher, we send you to the payment page of Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Stripe processes your payment details, email address and the purchase to handle the payment and prevent fraud. We never receive card details, only the payment confirmation. Legal bases: Art. 6(1)(b) GDPR (performing the contract) and Art. 6(1)(c) GDPR (tax and commercial record keeping). Stripe’s own privacy policy also applies.

6b. Use of your hypnosis page (analytics)

To improve our offer, we record how our pages are used: views of the landing pages (without cookies and without personal data, bots excluded) and, for signed-in people, when the hypnosis page was opened, when a hypnosis was started and how far it was listened to (in steps from 10 to 100%), whether checkout was opened or a purchase made, and whether the analysis call was clicked or booked. We store this together with your lead ID in a database at Cloudflare (Cloudflare, Inc.; processing under Art. 28 GDPR) and analyse it internally only, also with the help of an AI assistant that never receives email addresses. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in improving the offer). You can object at any time by emailing [email protected]. We delete the data no later than 24 months after your last visit.

6c. Customer account and sign-in with Google

After requesting a free hypnosis you can set a password; for purchased content (for example the night version or your own hypnosis) an account is required. Under “My hypnoses” you will find your hypnoses. We store your email address and your password only as an encrypted check value (PBKDF2), never in plain text. To keep you signed in we set two technically necessary cookies (up to 12 months): one with a random session identifier and one without content that only shows that you are signed in. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). If you use “Continue with Google” (to sign in, or on a landing page instead of entering your email address, with the same consent as in the form), you are redirected to Google (Google Ireland Limited, Dublin; Google LLC, USA, certified under the EU-US Data Privacy Framework). We only receive your email address, whether it is verified, and an identifier of your Google account. You can delete your account yourself at any time under “My hypnoses” → Settings, or by emailing [email protected].

6d. Feedback and testimonials

After listening, you can send us a rating (1 to 5 stars) and a few words, and voluntarily a photo or video. We store your email address, the hypnosis, your details and the files (Cloudflare R2). The legal basis is our legitimate interest in improving our offer (Art. 6(1)(f) GDPR). Only if you expressly consent do we show your feedback with photo or video and the name you provided on hypnoticrise.com and on social media (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by emailing [email protected]; we will then remove the content. For a testimonial you receive a one-time discount voucher.

6e. Refer-a-friend and partner programme

With an account you receive a personal referral link; partners receive a partner link (parameter “ref”). When someone opens such a link, we count the click without a cookie. Only if the person allows cookies for analytics and ads do we store the code for 12 months in the cookie epiq_ref (Art. 6(1)(a) GDPR, Section 25(1) TTDSG). If they buy within this period, we assign the purchase to the link so that the referring person receives a free hypnosis or the partner their commission. Partners only see date, product, amount and a shortened part of the email address, never names or complete contact details. For partner applications we store name, email address, website and your details to prepare and perform the contract (Art. 6(1)(b) GDPR); commission data is kept in line with statutory retention periods.

7. Contacting us by form or email

When you write to us via the contact form or by email, we process your name, email address, topic and message to answer you (Art. 6(1)(b) or (f) GDPR). Form messages are stored at Cloudflare (Cloudflare, Inc.; Art. 28 GDPR) and sent to our mailbox via Resend; we delete them after two years at the latest. To protect against spam, we store your IP address only as a checksum and only for ten minutes. Emails to [email protected] are forwarded to our mailbox by Cloudflare Email Routing.

8. Links to studies and other websites

Our articles link to studies and research. Only when you click such a link do you leave our website, and that provider then handles your data under its own rules.

9. Recipients and international transfers

Your data is only shared with the service providers named above, who work on our behalf, and with authorities where the law requires it. Some providers are based in the US. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46 GDPR).

10. How long we keep data

• Your access and email address: until you unsubscribe or ask us to delete it. After you unsubscribe, we keep the address blocked only to prove that you no longer receive anything from us.
• Topic requests and analysis call requests: up to 24 months after last use, then deleted. Immediately if you ask.
• Unconfirmed sign-ups: 30 days at most.
• Server logs at Cloudflare: a few days.
• Tax and accounting records if you buy something: as long as the law requires.

11. Your rights

You have the right to access (Art. 15), correct (Art. 16) and delete your data (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20) and to object (Art. 21 GDPR). You can withdraw consent at any time (Art. 7(3) GDPR). An email to [email protected] is enough.

You can complain to a data protection authority. Our lead authority is the Commissioner for Personal Data Protection of the Republic of Cyprus (Iasonos 1, 1082 Nicosia, www.dataprotection.gov.cy). You can also contact the authority where you live.

12. For residents of the United States

This section applies to residents of California and other US states with consumer privacy laws (for example the CCPA/CPRA).

• What we collect: identifiers (email address, IP address), internet activity on our own site (pages requested, technical logs), the information you choose to give us in the request form, which may include sensitive information about your health or well-being, and, if you buy something, purchase records.
• Sources: directly from you and from your browser when you use the site.
• Why: to provide the hypnosis and our services, to send you the emails you agreed to, and to keep the site secure.
• No sale; sharing only if you opt in: We do not sell your personal information. Data is shared with Meta for ad measurement and targeted advertising only if you click “OK” in the cookie banner; you can withdraw that choice anytime via “Cookie settings” (this is your right to opt out of sharing). Sensitive information is used only to create your hypnosis and is never shared for advertising.
• Your rights: You can ask to know, access, correct or delete your personal information, and to limit the use of sensitive information. Email [email protected]. We may need to confirm your identity, usually by replying from the email address you used with us. You can use an authorized agent. We won’t treat you differently for using your rights.
• Browser signals: If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as “only necessary” and load neither analytics nor the Meta Pixel.
• Email: Every marketing email contains an unsubscribe link and our postal address. We honor unsubscribe requests promptly.

13. Minimum age

Our services are for adults aged 18 and over. We do not knowingly collect data from children under 13 or anyone under 18.

14. Security

The website is fully encrypted with HTTPS. Access links are randomly generated and can’t be guessed. Only our team can see requests.

15. Changes

If we start using new services, we’ll update this policy. The version published here always applies.

If there’s any difference between this English version and the German version for users in the EU, the German version takes precedence.

Last updated: October 2026