Last Updated: [Website Launch Date]

​

1. Who We Are
xcatholic LLC ("xcatholic," "we," "us," or "our") operates the website located at www.xcatholic.com (the "Site") and provides non-religious spiritual direction services to individuals worldwide. xcatholic LLC is a limited liability company organized under the laws of the State of Washington, with its principal address at:

xcatholic LLC
522 W. Riverside Ave., Suite N Spokane, WA 99201

For purposes of applicable data protection laws, xcatholic LLC is the data controller of personal information collected through the Site and our services.

2. Scope of This Policy
This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit the Site, book or attend a spiritual direction session, subscribe to our mailing list, or otherwise interact with us. It does not apply to third-party websites we merely link to (see Section 8).

3. Personal Information We Collect

1. Information you provide directly:

   • Contact information: name, email address, phone number, country/location

   • Booking and scheduling information provided through our scheduling platform (Calendly)

   • Payment information processed through our payment processor (Stripe) — we do not directly receive or store your full payment card number

   • Communications you send us (email, contact forms, intake forms)

   • Information you share during spiritual direction sessions, which may include your religious or philosophical background and beliefs, your reasons for leaving or

                  questioning a faith tradition, and your emotional or personal experiences ("Session Content")

1. Information collected automatically:

   • IP address, browser type, device type, operating system, referring URLs, pages visited, and time on page, via cookies and similar technologies (see our Cookie Policy)

   • Analytics data via Google Analytics

   • Advertising/retargeting data via the Meta (Facebook/Instagram) Pixel, if you interact with our ads or social content

2. Information from third parties:

   • Confirmation and scheduling data from Calendly

   • Payment confirmation data from Stripe (e.g., that a payment succeeded, last four digits of card, billing name) — not full card numbers

 

• Session-connection data from Zoom (e.g., that a session occurred, technical connection logs)

• Email engagement data (opens/clicks) from our email newsletter provider. Session recordings: We do not record spiritual direction sessions conducted via Zoom

​

4. Legal Basis for Processing (GDPR / UK GDPR)
If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, we process your personal information on the following legal bases:

• Consent (Art. 6(1)(a); and, for special category data, Art. 9(2)(a)) — for Session Content, marketing emails, and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

• Performance of a contract (Art. 6(1)(b)) — to schedule and provide the spiritual direction services you book, and to process payment.

• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and recordkeeping laws.

• Legitimate interests (Art. 6(1)(f)) — to maintain Site security, prevent fraud, and improve our services, balanced against your rights and interests.

For all other users, we rely on the closest equivalent legal bases available under applicable law (for example, contractual necessity and consent under U.S. and other frameworks)

.
5. How We Use Your Information

• To schedule, confirm, and provide spiritual direction sessions

• To process payments and maintain financial and tax records

• To communicate with you about your sessions, our services, and (with your consent) newsletters or announcements

• To operate, maintain, and improve the Site

• To understand how visitors use the Site (analytics)

• To comply with legal obligations and enforce our Terms of Service

• To protect the safety and security of our clients, ourselves, and the public We do not use Session Content for marketing or advertising purposes, and we do not sell Session Content to any third party

​

6. Cookies and Tracking Technologies
See our Cookie Policy for full details. In summary, we use strictly necessary cookies (Site functionality, security), analytics cookies (Google Analytics), and marketing/advertising cookies (Meta Pixel). If you are located in the EEA, UK, or another jurisdiction requiring prior consent, we will request opt-in consent before placing non-essential cookies through a cookie consent banner, and you may withdraw consent at any time.

7. Third-Party Service Providers
We share personal information with the following categories of service providers ("processors") who process it on our behalf and are contractually obligated to protect it:
Provider: Calendly
Purpose: Scheduling and booking
Data Shared: Name, email, phone, appointment details
Provider: Stripe
Purpose: Payment processing
Data Shared: Billing name, payment method details, transaction amount
Provider: Zoom
Purpose: Video/phone session hosting Data Shared: Name, email, connection logs Provider: Google Analytics
Purpose: Website analytics
Data Shared: Device/browser data, IP address, browsing behavior
Provider: Meta (Facebook/Instagram)

Pixel Email newsletter provider (e.g., Mailchimp / ConvertKit)
Purpose: Advertising and retargeting Newsletter delivery
Data Shared: Device/browser data, ad-interaction data Name, email address, engagement data
Provider: Web hosting provider
Purpose: Hosting the Site
Data Shared: Technical/log data
We do not sell your personal information, and we do not share it with third parties for their own independent marketing purposes without your consent.

8. Third-Party Websites
Our Site may reference or link to third-party resources, including the Center for Non-Religious Spirituality (nonreligiousspirituality.com), Jim Palmer (jimpalmerauthor.substack.com), YouTube, and our social media pages. These are independent organizations, and their privacy practices are governed by their own privacy policies, not this one. We encourage you to review their policies before providing them any information.

9. International Data Transfers
We are based in the United States, and the third-party providers listed in Section 7 also process data in the United States and elsewhere. If you are located outside the United States, your information will be transferred to, stored, and processed in the United States and other countries that may have different data protection laws than your home country.
Where required, we rely on appropriate safeguards for these transfers, including the EU-U.S. Data Privacy Framework (and its UK extension) and/or Standard Contractual Clauses approved by the European Commission, to the extent our service providers participate in or offer such mechanisms. Contact us for more information about the safeguards in place for a particular transfer.

10. Data Retention
Category: Contact & booking information
Retention Period: Duration of client relationship, plus 3 years after last contact
Reason: Ongoing service, follow-up, statute of limitations
Category: Session Content / notes
Retention Period: 7 years after last session, or as required by law
Reason: Continuity of care, professional recordkeeping practice, potential legal claims
Category: Payment and financial records
Retention Period: 7 years
Reason: U.S. federal and state tax recordkeeping requirements
Category: Marketing/email list data
Retention Period: Until you unsubscribe or request deletion
Reason: Consent-based
Category: Website analytics data
Retention Period: Per provider defaults (e.g., Google Analytics: 14 months, configurable)
Reason: Service improvement
We will delete or anonymize personal information when it is no longer needed for the purposes above, unless a longer period is required or permitted by law.

11. Data Security
We use reasonable administrative, technical, and physical safeguards designed to protect your personal information, including encrypted transmission (HTTPS/TLS), limited access to Session Content, and reliance on reputable third-party providers that maintain their own security standards. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and any applicable regulators as required by law. We are not a HIPAA-covered entity, and Session Content should not be treated as medical records protected by HIPAA. See our Terms of Service for more on the nature of our services.

12. Your Privacy Rights
If you are in the EEA, UK, or Switzerland (GDPR/UK GDPR): You have the right to access your personal information; correct inaccurate information; request erasure; restrict or object to processing; receive a copy of your information in a portable format; withdraw consent at any time; and lodge a complaint with your local data protection authority.
If you are a California resident or a resident of another U.S. state with a comprehensive privacy law: Although xcatholic LLC is a small business that likely does not meet the statutory thresholds that trigger obligations under the California Consumer Privacy Act (CCPA/CPRA) or similar state laws, we voluntarily extend the following rights as a matter of practice: the right to know/access the personal information we hold about you; the right to request deletion; the right to correct inaccurate information; the right to opt out of the "sale" or "sharing" of personal information (we do not sell personal information, and any sharing for advertising
purposes, such as through the Meta Pixel, can be opted out of via our cookie tool); and the right to be free from discrimination for exercising these rights. We honor Global Privacy Control (GPC) signals where technically feasible.
If you are located elsewhere: Many countries (e.g., Canada, Australia, Brazil) have their own data protection frameworks. We aim to honor comparable rights for all users regardless of location, to the extent reasonably practicable
— contact us using the information in Section 16 and we will respond in accordance with applicable law. To exercise any of these rights, contact us at us@xcatholic.com. We may need to verify your identity before fulfilling a request, and we will respond within the time required by applicable law (e.g., 30 days under GDPR, 45 days under CCPA), or otherwise within a reasonable time.

13. Children's Privacy
Our services are intended for adults 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, please contact us and we will delete it.

14. Do Not Track
Some browsers offer a "Do Not Track" signal. Because there is no common industry standard for responding to these signals, we do not currently respond to them, though we do honor Global Privacy Control signals as noted in Section 12.
 
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated "Last Updated" date, and, for material changes, will provide additional notice (such as an email or Site banner) where required by law.

16. Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:
xcatholic LLC
522 W. Riverside Ave., Suite N Spokane, WA 99201

Email: us@xcatholic.com