Privacy policy

This policy covers the ordinary information a website and a small business collect: an email address, a payment reference, a line of correspondence, a server log, one cookie.

It does not cover your intake answers or your photograph. Those are health information, they are held under a different legal basis, and they have their own document — the health data notice. Where the two overlap, that one governs. Nothing in this policy weakens it.

The controller of everything described here is Bencao House · Hangzhou, Zhejiang Province, People’s Republic of China. Write to us at privacy@bencaohouse.com.

• Your email address, and a name if you choose to give one. We do not require a real name and we do not check it.
• A Stripe payment reference: an identifier, an amount, a currency, a date, and the country your card was issued in. Never a card number.
• Correspondence: what you write to us, and what we write back.
• Server logs, described in the next clause.
• One cookie, described in the cookie notice.

We do not build a profile of you. We do not buy data about you. We do not have an advertising business, an affiliate arrangement, or a partner who would like a copy of anything.

Our host records what any web server records in order to stay upright: the time of a request, the path requested, the response status, the rough size of the response, the browser’s user-agent string, and the requesting IP address.

Those logs exist so that we can see an error and fix it. They are kept for 30 days and then discarded. They are not joined to your account, they are not used to work out who you are, and they are never used for measurement or marketing. On the routes that touch health information the log line is truncated: the path is recorded, the query string is not.

The lawful basis for holding them is our legitimate interest in running a site that works and is not being attacked.

There is no Google Analytics, no Meta pixel, no TikTok pixel, no heatmap recorder, no session replay, no A/B testing tool and no tag manager. Not on the essays, not on the homepage, not on the intake. This is unusual enough that it is worth saying in a sentence you can check: view the source of any page and look for a script loaded from a domain that is not this one. There is none, and there cannot be — the site sends a Content-Security-Policy header that permits scripts from this origin and nowhere else, so a third-party tag would be refused by your browser even if one of us added it by mistake.

What we do run is a page counter, and we would rather describe it exactly than hide behind the word analytics. It is served from this domain, it sets no cookie, it stores nothing on your device, and it creates no identifier for you — so it cannot follow you between visits, cannot follow you to another site, and cannot be joined to an intake, an order or an email address. It records that a page was loaded, which page, and the rough shape of where the visit came from. That is the whole of it. It is run for us by Vercel, who already host the site.

It is switched off in two situations. The first: if your browser sends a Do Not Track or a Global Privacy Control signal, the counter is never loaded at all. Not loaded and silent — not loaded. The second: it is absent from every page that touches health information. On the health routes no measurement code is served, which is why moving from an essay into the intake reloads the page rather than sliding into it — the browser is being made to throw away the old page, and everything that was running on it, at the door.

Separately, and on the public pages only, we keep a small record of two things. The first is visits by machines: which search engine or AI crawler fetched which path, and when. The second is arrivals sent by one: when your browser opens a public page from a Google result or from a link in an AI assistant, we note the engine’s name, the path and the time. The engine is read from the Referer header your browser sends or, when an app strips that header, from the utm_source tag the app itself puts on the link. Nothing else in the address is read. This is how we can tell whether Google has found an essay or whether an AI assistant has read one or pointed someone to it, which for a site like this one is the only distribution we have. Those rows hold a name, a path and a timestamp. No IP address, no user-agent string, no cookie, no search terms, no other part of the query string, and nothing at all from the health routes.

We also know how many reports we sell, because Stripe tells us.

Payment is processed by Stripe. Card details are entered on Stripe’s own hosted page, are transmitted to Stripe, and never reach our servers — we could not leak a card number, because we never hold one.

Stripe acts as an independent controller for its own fraud prevention and regulatory obligations, and its privacy policy governs that. What comes back to us is a reference, an amount, a date, the last four digits of the card, and the issuing country. We keep those for seven years because tax law says so.

Stripe may place its own cookies on its checkout page, on its own domain. The cookie notice says what they are for.

We send three kinds of email: a receipt, your report, and a reply when you write to us. All three are necessary to do the thing you paid for, and you cannot unsubscribe from them without asking us to cancel.

Anything else — a seasonal note, a new essay — is a separate opt-in, asked for with an unticked box, and one click unsubscribes. We do not send that email more than once a month, and we have never sold or rented the list.

Open tracking and click tracking are switched off in our email provider’s settings. We do not know whether you opened your report. If you would like a delivery confirmation, ask and we will look at the delivery log directly.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we have no arrangement under which anyone receives it in exchange for anything. Under California law that means there is nothing for you to opt out of, and we offer no financial incentive in return for your data because there is no scheme it could feed.

The companies that necessarily see something are the ones that run the plumbing:

• Supabase — database and file storage, European Union region.
• Vercel — hosting, edge routing, and the cookieless page counter described above. Sees requests; stores the counts, and nothing that identifies you.
• Stripe — payment.
• Our email provider — carries the receipt and the report.

Each is bound by a data processing agreement and acts only on our instructions. If we ever change one, this list changes with it, and the version at the top of the page moves.

If we received a binding legal order for someone’s records, we would comply only so far as the order actually required, and we would tell the person unless we were forbidden to. We have not received one.

Intake answers, photographs and reports run on their own clock, set out in the health data notice.

Wherever you live, we will do all of the following on request: tell you what we hold, send you a copy, correct anything wrong, delete it, stop using it, or hand it over in a machine-readable file. We do not ask why.

Write to privacy@bencaohouse.com from the address you used. We reply within 72 hours, finish within 30 days, and charge nothing. If we cannot verify that the request is yours, we ask one question you would know the answer to rather than demand identity documents.

• California. Rights to know, delete, correct and limit under the CCPA as amended by the CPRA. We do not sell or share, and we do not discriminate against anyone who exercises a right.
• United Kingdom and European Economic Area. The full set of GDPR rights, including the right to complain to the Information Commissioner’s Office or to your national supervisory authority without asking us first.
• Elsewhere. The same, by policy rather than by statute.

No decision about you is made automatically. There is no profiling and no scoring anywhere in this business.

Everything travels over TLS 1.3. Records are encrypted at rest. Access is by named individual account with two-factor authentication, never a shared login, and every read of a record is logged. Nobody has a copy of the database on a laptop.

If a breach happens, we will tell the relevant supervisory authority within 72 hours and tell the people affected without undue delay, in plain language: what went, when, what we have done, and what you should do. We will not wait for certainty about the scale before saying that something happened.

This service is for adults. You must be 18 or older to buy a report, and we do not knowingly collect anything from anyone younger. If you tell us that a record belongs to someone under 18, we delete it and refund the fee without asking anything further.

We do not write reports about a child from a parent’s account. If you are worried about a child, please see someone in person where you live.

The date and version at the top of this page are the ones in force. Material changes are emailed to anyone who bought a report in the previous twelve months, at least fourteen days before they take effect. Typographical corrections are made without notice.

Anything about your information: privacy@bencaohouse.com. Anything else, including a complaint: care@bencaohouse.com.