Privacy policy
Effective date: September 8, 2026
Version 4
This policy replaces the version dated September 7, 2021 and last modified December 15, 2022.
Who we are
Mama Mandala is operated by Hagar Harpak as a sole proprietor. Under the GDPR and the UK GDPR, Hagar Harpak is the data controller for the personal information described here.
Contact for privacy questions and data rights requests:
- Email: mama@mamamandala.com
- Mail: Mama Mandala, 1301 N Broadway STE 83946, Los Angeles, CA 90012, United States
- Contact form: https://www.mamamandala.com/contact
We answer rights requests within 30 days.
What this policy covers
Everything Mama Mandala does with personal information. That includes the website at mamamandala.com, the online courses, the email list, and in-person workshops, classes, and retreats.
Information you give us
Contact form. Your name, email address, and whatever you write in the message. We use it to answer you.
Email list. Your email address, and your first name if you provide it. We use it to send classes, writing, and course announcements. Every email has an unsubscribe link and it works immediately.
Course purchases. Your name, email address, billing address, and country. Checkout runs on ThriveCart, and card payments are processed by Stripe. Your card number never reaches our website or our servers. We see the last 4 digits, the card brand, and whether the charge succeeded.
Course accounts. If you buy a course you get a login on mamamandala.com. That account holds your name, email address, password (stored hashed, never in readable form), and your progress through the course.
Comments and testimonials. If you comment on a post, WordPress stores your name, email address, comment text, and IP address. If you give a testimonial, we store what you submit and use it publicly only with your permission.
In-person classes, workshops, and ceremonies. Checkout collects your name, email address, and billing details, your agreement to our Terms of Use, and one field listing everyone you are booking for. No health information is collected at checkout, and there is no allergy or emergency contact field. Anything relevant about your health you tell the teacher in the room before the session starts, and we do not write it down.
Retreats and residential programs. Checkout collects your name, email address, and billing details, and your agreement to our Terms of Use and to that retreat’s own payment terms. Nothing else. After you book we send an intake form, and that form collects your emergency contact and, depending on the program, asks about injuries, physical limitations, pregnancy, medications, or dietary requirements.
The retreat intake form is the only place we collect health information. Under the GDPR it is special category data, and we only collect it with your explicit consent, only where it is needed to teach you safely or feed you safely, and we do not use it for anything else. You can decline any question on it. If declining means we cannot safely include you in part of a program, we will tell you.
People you book for. The one checkout field on in-person bookings asks who is attending: names, plus an age for anyone under 18. We use it to know who is coming. Everyone attending has to accept our Terms of Use in their own name, so if you booked for someone else we send them a link to do that.
Hands-on assists. Some sessions include hands-on adjustment and physical support. The teacher asks the room at the start of every session and you can change your mind during it. Your answer is not written down or stored anywhere.
Photography and video at events. The default is no. We do not photograph or film you for public use unless we ask you on the day and you say yes. If a session is being documented generally you will be told before it starts and can ask to stay out of frame. We never publish images of anyone under 18.
Your agreement to our terms. There is no separate paper waiver. You accept our Terms of Use, including the release of liability in Section 14, by ticking a box at checkout. That tick is stored with your order along with the version number you agreed to and the date, so both of us can tell later which version applies. If someone else booked for you, you accept the terms through a free acknowledgment item that grants no place and collects only your email address and your agreement.
Information collected automatically
Analytics. The site uses Google Analytics 4 (property G-VV14RPF5FW) and Jetpack Stats from Automattic. Both record pages viewed, referring site, approximate location by IP, device and browser type, and time on page. Google Analytics IP addresses are truncated before storage. In the EU and the UK these do not run until you accept analytics cookies.
ActiveCampaign site tracking. ActiveCampaign assigns a visitor identifier and, once you are a known contact, connects the pages you visit to your record on our email list. In the EU and the UK this does not run until you accept.
Server logs. Our host, DreamHost, keeps standard access logs including IP addresses. These exist for security and troubleshooting.
reCAPTCHA. Google reCAPTCHA runs on our forms to block automated spam. It reads device and behavior signals from your browser. We treat it as necessary security, so it runs for everyone. Google’s terms apply: https://policies.google.com/privacy and https://policies.google.com/terms
Fonts. Typefaces are delivered by Bunny Fonts, operated by BunnyWay in the European Union. It receives your IP address in order to serve the font files, and states that it sets no cookies and keeps no logs.
Images. Optimole delivers our images from its own network, which also receives your IP address.
Video. Blog posts and course lessons embed YouTube video. YouTube sets cookies when a video loads. In the EU and the UK, embedded video is blocked until you accept.
Cookies and tracking
Category | What it does | Runs without consent |
|---|---|---|
Necessary | Login sessions, cart and checkout, security, consent record | Yes |
Analytics | Google Analytics 4, Jetpack Stats | No in EU/UK. Yes elsewhere |
Marketing and personalization | ActiveCampaign site tracking | No in EU/UK. Yes elsewhere |
Embedded content | YouTube video | No in EU/UK. Yes elsewhere |
Visitors in the EU and the UK see a consent banner on arrival and nothing in the last 3 rows loads until a choice is made. You can change or withdraw that choice at any time from the cookie settings link in the site footer.
Visitors elsewhere do not see a banner. You can still opt out of Google Analytics with Google’s browser add-on at https://tools.google.com/dlpage/gaoptout, and you can unsubscribe from email at any time.
Do Not Track
California law requires us to say how we treat Do Not Track browser signals. There is no agreed industry standard for what a site must do when it receives one, and our site does not currently change its behavior in response to Do Not Track headers. Visitors in the EU and the UK are covered by the consent banner described above. If a common standard is adopted, we will honor it and update this section.
Why we are allowed to use your information
For visitors in the EU and the UK, the GDPR requires a legal basis for each use.
What we do | Legal basis |
|---|---|
Answer your message | Legitimate interest in responding to you |
Deliver a course or program you paid for | Performance of a contract |
Keep sales and tax records | Legal obligation |
Send marketing email | Consent, withdrawable at any time |
Analytics and site tracking cookies | Consent |
Health and dietary information on retreat intake forms | Explicit consent, GDPR Article 9(2)(a) |
Names of other people you book for | Legitimate interest in knowing who is attending |
Recording your agreement to our terms | Legitimate interest in being able to show what was agreed |
Spam protection and site security | Legitimate interest in keeping the site working |
Who we share information with
We do not sell personal information. We have never sold it and we have no plans to. We do not share it for cross-context behavioral advertising.
We use these service providers, and each one receives only what it needs to do its job:
Provider | What it handles |
|---|---|
DreamHost | Website hosting and server logs |
Google (Analytics, reCAPTCHA, YouTube) | Analytics, spam protection, video |
Automattic (Jetpack) | Site statistics and security |
ActiveCampaign | Email list, email delivery, site tracking |
ThriveCart | Checkout and order records |
Stripe | Card processing |
Optimole | Image delivery |
BunnyWay (Bunny Fonts) | Font delivery |
We also disclose information when the law requires it, and if the business is ever transferred to someone else, in which case we will tell you before your information moves.
Where your information goes
Mama Mandala operates in the United States, and every provider listed above stores data in the United States. If you are in the EU or the UK, your information is transferred there.
For those transfers we rely on the EU-US Data Privacy Framework and the UK extension where the provider is certified, and on Standard Contractual Clauses where it is not. You can ask us which mechanism applies to a specific provider.
How long we keep things
Information | Kept for |
|---|---|
Contact form messages | 2 years |
Email list subscription | Until you unsubscribe, then 12 months in a suppression list so we do not email you again by mistake |
Purchase and tax records | 7 years, as US tax law requires |
Course accounts | While the account is active, then 3 years |
Google Analytics event data | 14 months |
Server logs | As long as DreamHost retains them, currently short-term |
Retreat intake forms, including health information | Deleted 90 days after the retreat ends |
Terms of Use acceptance records | Kept with the order record, 7 years |
Names of other people you booked for | Kept with the order record, 7 years |
Comments and testimonials | Until you ask us to remove them |
Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, delete it, or stop emailing you.
If you are in the EU or the UK you also have the right to receive your data in a portable format, to restrict or object to processing, to withdraw consent at any time without affecting what we did before you withdrew it, and to complain to your national data protection authority. In the UK that is the Information Commissioner’s Office at ico.org.uk.
If you are in California, the CCPA thresholds do not currently apply to a business of this size, so we are not required to offer its formal request process. We will honor an access or deletion request from a California resident anyway. California Civil Code 1798.83 also lets California residents ask what personal information we disclosed to third parties for their direct marketing purposes. We disclose none.
To exercise any of this, email mama@mamamandala.com. We may ask you to confirm your identity before we act, and we will not treat you differently for asking.
Children
The website, the online courses, and the email list are for adults. We do not knowingly collect information online from anyone under 16.
Someone under 18 can take part in an in-person program, and only when a parent or legal guardian books for them, names them at checkout, and accepts our Terms of Use on their behalf. A child never registers themselves, so we never collect information online directly from a child. What we hold about a minor participant is the name and age their parent gave us, plus an emergency contact if the program is a retreat. We never publish images of anyone under 18, and hands-on assists happen only with a parent or guardian present and agreeing on the day.
If you are a parent or guardian and want us to show you or delete what we hold about your child, email mama@mamamandala.com.
Security
Traffic to and from the site is encrypted with TLS. Passwords are stored hashed. Card numbers are handled by Stripe and never stored on our systems.
No website is perfectly secure. If a breach affects your personal information we will notify you, and the relevant authorities, as the law requires.
Changes
When this policy changes we will update the effective date at the top. Material changes to how we use your information will be announced by email to the list and by a notice on the site.
Contact
Email: mama@mamamandala.com
Mail: Mama Mandala, 1301 N Broadway STE 83946, Los Angeles, CA 90012, United States