Privacy Policy

Last updated: 6 October 2026

This policy explains what happens to personal data when you use crystalcleanse.app, the Crystal Cleanse web app at my.crystalcleanse.app, and the Crystal Cleanse mobile apps for Android and iOS.

1. Who we are

Crystal Cleanse is operated by:

Saluxe, Andrejka Söke s.p.
Kidričeva ulica 35
9220 Lendava
Slovenia, EU

VAT identification number: SI52303110
Company registration number: 7429355000

Email: [email protected]

We are the data controller for the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR). We are not required to appoint a Data Protection Officer, and have not appointed one. You can reach us about any privacy matter at the email address above.

2. What this policy covers

This policy covers:

crystalcleanse.app — the website, guides and forms
my.crystalcleanse.app — the Crystal Cleanse web app
Crystal Cleanse mobile apps for Android and iOS – the native apps
audio.crystalcleanse.app – the audio files and lock-screen artwork the apps load

It does not cover saluxe.eu, our shop, which publishes its own privacy policy. It also does not cover third-party websites we link to, including social media platforms, which handle your data under their own policies.

3. The short version

What	Do we collect personal data?
Browsing the website	Yes — analytics and server logs
Using the web app to cleanse a crystal	Yes – technical delivery logs and web analytics; no account or user profile
Using the mobile apps to cleanse a crystal	Yes – technical delivery information for audio and artwork; no in-app analytics, account or user profile
Sending us a message via the contact form	Yes — what you type
Subscribing to the newsletter	Yes — your email address, consent record and email engagement data
Watching embedded content or using advertising or social features	Yes — by the platform concerned, after you consent where required

We never sell personal data. Optional analytics, advertising, embedded content and social technologies run only after you consent where consent is required.

4. Using the app

4.1 Web App

The Crystal Cleanse app at my.crystalcleanse.app does not require an account and does not create or store a user profile or session history about you.

When you select a crystal, choose an intention and play a session, the app does not create a user profile or deliberate session history from those choices. There is no login. Technical delivery logs may record which files are requested, as described in section 5.1, but we do not use those logs to build a history of the crystals you cleanse, your intentions or how often you use the app.

Your browser will download audio files from audio.crystalcleanse.app in order to play them, and it may cache them locally on your own device so they do not need to be downloaded again. That cache belongs to your browser, not to us, and you can clear it at any time through your browser’s settings.

Our infrastructure providers process technical information needed to deliver the app to you — see sections 5 and 8.

4.2 Mobile Apps for Android and iOS

The Crystal Cleanse mobile apps do not require an account and do not create a user profile or save your cleansing session history. They do not use analytics or advertising tools, track your activity across apps or websites, or set cookies.

The apps save two preferences on your device: whether to show the welcome screen and whether you want to keep the screen awake during a session. These preferences are not sent to us. You can remove them by clearing the app’s data where your device offers that option, or by uninstalling the app.

To play a session, the apps load audio and lock-screen artwork over HTTPS from audio.crystalcleanse.app, hosted by Cloudflare. Cloudflare receives your IP address and technical information about these requests. Delivery logs may show which files were requested, but we do not use them to build a profile or session history. Section 5.1 explains the purpose, legal basis and retention of delivery logs; sections 7 and 8 describe our providers and international transfers, and section 10 explains how to request access to or deletion of personal data.

When you open a guide, policy or other website link from the app, it opens in a browser view. The website’s privacy and cookie practices apply to that visit. If you choose Contact, the app opens your email app; we receive the information you include in the email and handle it under the correspondence purpose and retention period in section 5.3.

5. Data we collect and why

5.1 Server and delivery logs

Our hosting and network providers automatically record technical information whenever a page or file is requested: your IP address, the date and time, the file requested, HTTP status, referring page, and your browser and operating system.

Purpose: delivering the website and app content, keeping the service secure, diagnosing faults, and defending against attacks and abuse.
Legal basis: legitimate interests (GDPR Art. 6(1)(f)) — our interest in operating a functioning, secure service.
Retention: as retained by our providers for operational and security purposes, ordinarily no longer than 30 days, except where a longer period is needed to investigate a specific security incident.

5.2 Analytics

We use Google Analytics 4 to understand how the website is used — which pages and guides are read, how visitors arrive, and where they leave. Google Analytics uses cookies and similar technologies. IP addresses are truncated and are not stored by Google Analytics in a form that identifies you.

We also use Vercel Web Analytics on my.crystalcleanse.app. It records page views without cookies and without building a persistent identifier for you.

These analytics tools apply to the website and web app. They are not included in the native mobile apps.

Purpose: measuring audience and improving the site and app.
Legal basis: your consent (GDPR Art. 6(1)(a)) for Google Analytics, given through our cookie banner and withdrawable at any time. For Vercel Web Analytics, legitimate interests (Art. 6(1)(f)) in measuring aggregate usage without tracking individuals.
Retention: Google Analytics data is retained for 14 months. Vercel Web Analytics uses a temporary visitor hash that is discarded after 24 hours. Aggregated reports remain available for the reporting period included in our Vercel plan and may be stored longer by Vercel in accordance with its documentation.

If you have not consented to analytics cookies, Google Analytics does not set them.

We may add other analytics tools in future. If we do, we will update this policy and, where consent is required, ask for it before the tool runs.

5.3 Contact form

If you write to us through the contact form, we receive the information you put in it — typically your name, your email address and your message — together with the time of submission.

Purpose: reading and replying to your message.
Legal basis: legitimate interests (Art. 6(1)(f)) in responding to inquiries; where your message concerns a request under data protection law, compliance with a legal obligation (Art. 6(1)(c)).
Where it goes: your message is sent from our website, hosted in the United Kingdom, to our mailbox, which is hosted by Zoho in its European Union data center. We do not keep a copy in our website database.
Retention: correspondence is kept for as long as needed to deal with the matter and ordinarily deleted within 24 months, unless we need to keep it longer for legal reasons.

Please do not send us health information, or any other sensitive information, through the contact form. We do not need it and we would rather not hold it.

5.4 Saluxe Newsletter

If you subscribe to the Saluxe Newsletter through crystalcleanse.app, we collect your email address and, if you provide it, your name. Saluxe is the team behind Crystal Cleanse. We also record the date and time of subscription, the sign-up source, your consent and confirmation status, and technical information such as your IP address. We use a double opt-in process, so you must confirm the subscription through a link sent to your email address.

Our newsletter provider may also record delivery information and whether an email was opened or a link was clicked. We use this information to understand whether our emails are being delivered and are useful to subscribers. Where consent is required for this measurement, it is used only with your consent.

Purpose: sending the Saluxe Newsletter you requested, with crystal care notes, new guides, and news about Saluxe products; managing subscriptions; maintaining evidence of consent; and measuring newsletter performance.
Legal basis: your consent (Art. 6(1)(a)), which you may withdraw at any time.
Where it goes: to our email newsletter service provider, acting as our processor, and to staff who manage Saluxe communications.
Retention: we keep your subscription information while you remain subscribed. If you unsubscribe, we stop sending marketing emails and retain only the minimum information needed to record your opt-out, demonstrate compliance and prevent accidental resubscription, for as long as reasonably necessary for those purposes.

Every newsletter contains an unsubscribe link. You can also withdraw your consent by writing to [email protected]. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

If the newsletter expands to subjects outside what you agreed to receive, we ask for your fresh consent before sending you that content.

5.5 Cookies and similar technologies

A cookie is a small file a website stores on your device. Some are necessary for the site to work; others are optional.

Strictly necessary — these are set without consent because the site cannot function without them: session and security cookies, and a cookie recording your own cookie preferences so we do not have to ask again on every page.

Optional — these are set only after you agree: analytics cookies (section 5.2), and cookies or similar technologies used for embedded content, advertising, social features and conversion measurement (section 5.6).

You can change or withdraw your choice at any time through the cookie settings link in the site footer, and you can delete cookies through your browser at any time. Blocking optional cookies does not affect your ability to use the app.

Our separate Cookie Policy lists the individual cookies in use, their provider, purpose and lifetime.

5.6 Embedded content, social platforms and advertising technologies

Our guides may embed content from YouTube, and we operate accounts on Instagram, Facebook, Pinterest, TikTok and YouTube. We may use the following optional measurement and advertising technologies:

Meta Pixel and Meta Conversions API for Facebook and Instagram;
TikTok Pixel and Events API;
Pinterest Tag and Conversions API; and
Google Ads conversion tracking, Google tags and YouTube measurement technologies.

These tools help us measure visits, content views, clicks, newsletter sign-ups and other conversions; understand whether our posts and adverts are effective; control how often adverts are shown; and create or measure advertising audiences.

Where these are used, the platform concerned may set cookies or similar identifiers and receive your IP address, page URL, referring page, event information, cookie or device identifiers, consent status, and technical details about your browser and device. Server-side conversion tools may transmit equivalent event information from our systems. A platform may combine this information with data it already holds if you have an account with it.

Where enhanced or advanced matching is enabled and you have consented, a conversion tool may also receive a cryptographically hashed email address or another contact identifier so that it can match a conversion to an account on its platform. Hashing reduces direct exposure but does not make the information anonymous.

Legal basis: your consent (Art. 6(1)(a)), collected through the cookie banner. Advertising and measurement technologies do not load or receive event data, and embedded content does not play, until you consent. You can withdraw consent at any time through the cookie settings link in the site footer.
Joint controllership: for some of these tools, we and the platform may act as joint controllers for the collection and transmission of your data to the platform. Where this applies, the platform’s joint-controller terms govern that part of the processing. What the platform then does with the data for its own purposes is governed by its own privacy policy.
Retention: determined by each platform.

Where we run advertising, we do not upload bulk newsletter subscriber lists or contact-form messages to advertising platforms, and we do not send them information about the crystals or intentions you select in the app.

We do not sell personal data as defined under applicable law. Depending on how a platform uses information received through an optional advertising technology, that disclosure may be treated as sharing for cross-context behavioral advertising under some US state privacy laws. If we enable a use that is subject to an opt-out right under applicable law, we will provide the required opt-out mechanism. See section 10.

5.7 Fonts and assets

Our typefaces are self-hosted on our own servers. Loading a page does not send a request to Google Fonts or any other font provider, and no data is transmitted to a third party in order to display text on this site.

6. What we do not do

We do not require or offer accounts, so there is nothing to log in to and no profile attached to you.
We do not create a user profile or deliberate session history from the crystals you select, the intentions you set or how often you use the app.
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
We do not sell personal data.
We do not knowingly collect data from children (section 9).

7. Who we share data with

We do not sell personal data. We disclose it only to the service providers we need in order to run the website and apps, and only for that purpose. Each acts as our processor under a data processing agreement, except where marked as an independent or joint controller.

Provider	Role	Purpose
WPX Hosting	Processor	Website hosting — servers in the United Kingdom
Vercel Inc. (USA)	Processor	Hosting and analytics for the web app
Cloudflare, Inc. (USA)	Processor	DNS, content delivery, audio and lock-screen artwork storage, security
Google Ireland Ltd / Google LLC	Processor	Google Analytics
Zoho	Processor	Email — EU data center
Email newsletter service provider	Processor	Newsletter subscriptions, delivery and performance measurement
YouTube (Google)	Independent controller	Embedded video
Meta (Facebook and Instagram), Pinterest, TikTok, Google / YouTube	Joint / independent controllers	Social features, advertising, conversion measurement and embedded content

We may also disclose personal data where we are legally required to — for example to comply with a court order or a lawful request from a public authority — or where necessary to establish, exercise or defend legal claims.

If our business is ever transferred or reorganized, personal data may transfer with it; we would inform affected individuals beforehand where the law requires it.

8. International transfers

Most of the personal data described in this policy stays within the European Economic Area or the United Kingdom.

Website hosting — United Kingdom. Our website is hosted on servers in the UK. The European Commission has decided that the UK provides an adequate level of data protection, so no additional transfer safeguards are required. That decision was renewed in December 2025 and runs to 27 December 2031.

Email — European Union. Our mailbox is hosted in Zoho’s EU data center. No transfer outside the EEA takes place for ordinary correspondence.

United States. Some providers — including Vercel, Cloudflare, Google, and the social platforms named in section 5.6 — are established in the United States or may process data there. For those transfers we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses, supported by technical measures such as encryption in transit.

Our email newsletter provider may also process personal data outside the EEA. Where it does, we use an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

You can ask us which safeguard applies to a specific provider by writing to [email protected].

9. Children

Crystal Cleanse is not directed at children. You must be at least 16 years old to send us a message or subscribe to the newsletter.

We do not knowingly collect personal data from children under 16, or, for visitors in the United States, from children under 13 within the meaning of the Children’s Online Privacy Protection Act. If you believe a child has provided us with personal data, write to [email protected] and we will delete it.

10. Your rights

10.1 If you are in the EEA, UK or Switzerland

Under the GDPR you have the right to:

access the personal data we hold about you, and receive a copy;
rectify data that is inaccurate or incomplete;
erasure of your data, in the circumstances the law provides for;
restrict how we process your data;
data portability — receive data you gave us in a machine-readable format, where processing is based on consent or a contract and carried out by automated means;
object to processing based on our legitimate interests, on grounds relating to your particular situation, and to object at any time to processing for direct marketing;
withdraw consent at any time, without affecting the lawfulness of processing carried out before you withdrew it.

To exercise any of these, write to [email protected]. We reply within one month, and will tell you if we need longer because the request is complex. We may ask for information to confirm your identity — no more than is necessary — and exercising your rights is free unless a request is manifestly unfounded or excessive.

Because we hold very little data and none of it is tied to an account, we may be unable to identify you from the data we hold. Where that is the case, GDPR Art. 11 applies and we will tell you so rather than ask you for additional identifying information.

Complaints. If you think we have handled your data unlawfully, you can complain to your local supervisory authority. In Slovenia this is:

Informacijski pooblaščenec (Information Commissioner)
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Email: [email protected] · Telephone: +386 1 230 97 30
www.ip-rs.si

We would appreciate the chance to resolve the matter first, but you are not obliged to contact us before complaining.

10.2 If you are in the United States

Depending on where you live, state privacy laws — including in California, Virginia, Colorado, Connecticut, Utah and other states with comparable legislation — may give you the right to know what personal information we collect and why, to obtain a copy of it, to correct it, to delete it, and not to be discriminated against for exercising those rights.

We do not sell personal information as defined under applicable state law. Depending on how the optional advertising technologies described in section 5.6 are configured and used, the transmission of identifiers and internet activity to a platform may be treated as sharing for cross-context behavioral advertising under some state laws. Where an applicable law gives you the right to opt out of that sharing, you may exercise it through our cookie settings or by writing to [email protected]. We do not knowingly sell or share the personal information of anyone under 16.

To exercise any of these rights, write to [email protected]. We will verify your request by asking you to confirm details we can match against what we hold, and will respond within the period the applicable law requires. You may use an authorized agent where state law permits; we will ask for evidence of their authority.

Global Privacy Control. Where applicable law requires it, we treat a Global Privacy Control signal transmitted by your browser as a valid request to opt out of sale or sharing.

California “Shine the Light”. We do not disclose personal information to third parties for their own direct marketing purposes.

Categories. During the preceding twelve months, to the extent the relevant features were enabled, we collected identifiers (such as IP address, cookie or device identifiers and email address), internet activity information (such as pages viewed, advertising interactions and newsletter engagement), and the contents of any message you sent us, from you directly and automatically through your device. We collect these for the purposes set out in section 5 and retain them for the periods stated there.

11. Security

We use HTTPS across all our domains, keep our software and plugins updated, restrict administrative access, and use reputable providers who maintain their own security programs.

No method of transmitting or storing data is completely secure, and we cannot guarantee absolute security. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner within 72 hours and, where the risk is high, notify affected individuals directly.

12. Changes to this policy

We may update this policy as the site changes. The date at the top always shows the current version. If a change materially affects how we handle your personal data — a new tracking technology, a new purpose, a new category of recipient — we will make that clear on the site and, where consent is required, ask for it again before the change takes effect.

13. Contact

Questions about this policy, or about your data:

Saluxe, Andrejka Söke s.p.
Kidričeva ulica 35, 9220 Lendava, Slovenia, EU
[email protected]