Privacy Policy

Last updated: 21 June 2026

This Privacy Policy explains how KRISH Consultations (operating as Mystic Poonam, hereinafter "we", "us", "our") collects, uses, stores, and shares your personal information when you interact with us through our website krish.co.in, social media advertising (including Meta/Facebook/Instagram Lead Ads), WhatsApp enquiries, email, or in-person sessions.

We are committed to protecting your privacy and handling your data in accordance with the Digital Personal Data Protection Act, 2023 (India) and, where applicable, the EU General Data Protection Regulation (GDPR) for visitors from the European Economic Area.

1. Who we are

KRISH Consultations is a holistic healing and wellness practice founded by Poonam Sharma (also known as Mystic Poonam) in 2004. We offer one-to-one sessions in tarot reading, Reiki and energy healing, numerology, astrology, vaastu, deep healing, coaching, and certified courses in tarot and Reiki.

Data controller: KRISH Consultations · #8062, Buddha Marg, Sector 125, Greater Mohali, Punjab 140301, India.

2. Information we collect

2.1 Information you provide directly

• Contact details: name, email address, phone/WhatsApp number, city — when you fill a registration form, lead form, booking enquiry, or our newsletter.
• Session/course context: the service you are enquiring about, your question or area of focus, prior experience, birth details (only when relevant to numerology/astrology sessions and only with your consent).
• Payment information: when you purchase a product or course online, payment is processed by Razorpay. We do not see or store your full card or UPI details — we only receive a transaction ID and confirmation. See Razorpay's privacy policy at razorpay.com/privacy.
• Shipping address: only collected when you order a physical product (the Tarot Deck, books, etc.) for delivery.
• Communication you send us: WhatsApp messages, emails, contact-form submissions.

2.2 Information collected automatically

• Site analytics: pages viewed, time on site, referring source, approximate location (city/country), device type and browser — collected via Google Analytics through Google Tag Manager.
• IP address: temporarily logged by our hosting provider and Cloudflare (CDN and security) for fraud prevention and rate limiting.
• Cookies: see section 6 below.

2.3 Information from social media advertising

When you submit a Meta (Facebook/Instagram) Lead Ad form, you are sharing your name, email, and phone number with us (and with Meta as the platform). We receive this information through Meta's lead delivery system. We may also use Meta Pixel/Conversions API to measure the effectiveness of our ads.

3. How we use your information

We use the information we collect to:

• Respond to your enquiry and confirm your session, course, or product booking;
• Schedule and deliver sessions, courses, and products you have purchased;
• Send transactional emails (booking confirmations, course access details, reminders, payment receipts);
• Provide customer support over WhatsApp, phone, and email;
• Improve our website, services, and content;
• Send occasional updates about new sessions, courses, and offerings — only to people who have opted in or are existing clients;
• Measure and optimise advertising performance (only aggregated, where possible);
• Comply with applicable legal and regulatory obligations.

We do not sell your personal data to anyone. Ever.

4. Legal basis for processing (EU/GDPR visitors)

If you are in the European Economic Area or the United Kingdom, our legal basis for processing your data is one of the following, depending on context:

• Consent — when you fill a lead form, subscribe to a newsletter, or agree to cookie use;
• Performance of a contract — when we provide a session, course, or product you have purchased;
• Legitimate interests — for fraud prevention, site security, and basic analytics;
• Legal obligation — where we are required to retain information by law (e.g. tax records).

5. Who we share data with

We share data only with the following categories of trusted service providers, strictly to the extent needed to operate the service:

• Razorpay — payment processing.
• Cloudflare — content delivery network, DDoS protection, and Workers (for the booking and email automation backend).
• Resend — transactional email delivery (booking confirmations, reminders).
• Google (Analytics, Tag Manager) — site analytics.
• Meta Platforms (Facebook, Instagram) — lead ad form delivery and ad measurement, only if you submit a lead form or click an ad.
• Bluehost — website hosting infrastructure.
• WhatsApp (Meta) — when you choose to contact us via WhatsApp.

We do not share your data for any other party's marketing purposes.

We may also disclose data when required by law, in response to a valid legal request, or to protect the rights, property, or safety of KRISH Consultations, our clients, or others.

6. Cookies & analytics

Our site uses cookies for site analytics (Google Analytics) and basic site functionality. By continuing to use the site, you consent to our use of cookies. The cookie banner you see on your first visit records your acknowledgement in your browser's local storage.

You can disable cookies at any time in your browser settings, but some features may not work as expected. Google Analytics offers an opt-out browser add-on.

7. How long we keep data

• Booking and session records: retained for up to 7 years for tax and accounting compliance.
• Lead form submissions: retained for up to 24 months unless you opt out earlier.
• Course access (LMS): retained for as long as you have active access; deleted upon revocation.
• Site analytics (Google Analytics): retained per Google Analytics default settings (up to 14 months).
• WhatsApp and email correspondence: retained as long as needed for support and historical reference.

8. Your rights

You have the right to:

• Access — request a copy of the personal data we hold about you;
• Correct — ask us to fix any inaccurate or incomplete data;
• Delete — ask us to delete your data (subject to legal retention obligations);
• Withdraw consent — at any time, for any processing based on consent;
• Object — to processing for marketing purposes;
• Portability — receive your data in a structured, commonly used format (EU/GDPR visitors).

To exercise any of these rights, email us at [email protected] with the subject "Privacy Request". We will respond within 30 days.

9. Children's data

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we may have collected data about a child, please contact us so we can delete it.

10. International transfers

Our hosting and services are primarily operated from India. If you are accessing our site from outside India, you understand that your data may be transferred to and processed in India. Some of our service providers (Cloudflare, Google, Meta, Resend) operate global infrastructure and may process data in jurisdictions outside India, in accordance with their own privacy commitments.

11. Security

We use industry-standard security practices including HTTPS encryption across the entire site, secure payment processing via Razorpay's PCI-DSS-compliant infrastructure, and access controls on our backend systems. No system can be guaranteed 100% secure, but we take reasonable steps to protect your data from unauthorised access, alteration, or disclosure.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The "Last updated" date at the top of this page will always show when the policy was last revised. Material changes will be communicated via a notice on the site or by email to active clients.

13. How to contact us