Privacy Policy

This policy explains how the KSE Facilitator Network collects, uses, shares and protects personal data when you use the facilitator directory at facilitator.sensoryenergetics.com (the “Site”), including data we receive when you sign in with Google. It applies to visitors, clients who leave reviews or contact a facilitator, people who apply to join the network, and listed facilitators. Use of the Site is also governed by our Terms of Service.

1. Who we are

The Site is operated by Kyusho Sensory Energetics (“KSE”, “we”, “us”), which also runs the main website at www.sensoryenergetics.com. KSE is the controller of the personal data described in this policy. You can reach us about any privacy matter at sensorenergetics@ at gmail.com.

2. What data we collect

We only collect the data needed to run the directory:

• Facilitator profiles: name, country, city, approximate map location, photo, biography, specialty, certification modules and levels, reviews, and any client photo gallery the facilitator adds. This information is public by design. We also hold the facilitator’s email address and, if provided, Instagram and website, which are kept private and visible only to the KSE team.
• Reviews: the reviewer’s name, email address, rating, review text and, optionally, the city of the session. The name, rating, text and city are published on the facilitator’s profile. The email address is never published.
• Contact requests: when you ask to connect with a facilitator, your name, email address, phone number, the facilitator you chose, and your consent to be contacted.
• Applications: when you apply to join the directory or to become an instructor, the information in your application (such as name, email, location, modules completed, biography, photo and how you heard about us).
• Newsletter: your email address and subscription status.
• Sign-in data: to leave a review you sign in either with Google (described in detail in section 3) or with a one-time code we email to the address you enter. For the email code we process your email address to send the code; the code itself is never stored, only a secure fingerprint of it, held in your browser for 10 minutes.
• Technical data: your IP address is processed briefly to prevent spam and abuse (rate limiting). We keep an audit log of administrative and account actions in which IP addresses are stored only in hashed (irreversible) form. We use privacy-friendly, cookieless analytics that measure page views and performance in aggregate, without identifying you.

We do not collect payment card data, government identifiers, or special categories of data (such as health data) on purpose. Please do not include sensitive health details in reviews or messages.

3. Google Sign-In and Google user data

The Site offers “Sign in with Google” so that a facilitator can securely access and edit their own profile, and so that we can confirm a reviewer’s email address where review sign-in is enabled. This section explains exactly what we do with data received from Google.

Data we access

We request only the basic sign-in scopes openid, email and, where shown on the consent screen, profile. From Google we receive your email address, whether Google has verified it, and, if the profile scope is granted, your name. We do not request access to your Gmail, Google Drive, Calendar, Contacts or any other Google service, and we never see your Google password.

How we use it

• Facilitators: we compare your verified Google email with the email on file for the profile you are signing in to. If they match, we let you edit that profile; if they do not, access is refused.
• Reviewers: we record the verified email address with your review so the KSE team knows the review comes from a real person, and to enforce one review per person per facilitator. If your name is provided, we use it only to pre-fill the review form, which you can edit.

How we store it

After sign-in we keep a signed session cookie containing your email address (and name, for reviewers) so you stay signed in: 7 days for facilitators and up to 30 days for reviewers. We do not store Google access tokens or refresh tokens; the one-time code and identity token Google returns are used only to read your email at sign-in and are then discarded. A reviewer’s verified email is stored with their review in our database, as described in section 7. Sign-in attempts by facilitators are recorded in our audit log.

How we share it

We do not sell Google user data, use it for advertising, or share it with third parties, except with the infrastructure providers that host the Site and its database (listed in section 5) acting on our instructions, or where required by law. Google user data is not used to develop, improve or train generalised artificial intelligence or machine-learning models.

Limited Use

KSE’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access and deleting your data

You can sign out at any time from the Site, and you can revoke the Site’s access to your Google account at myaccount.google.com/permissions. To have the Google-derived data we hold about you deleted (for example the email stored with a review), write to sensorenergetics@ at gmail.com; we will act within 30 days.

4. How we use your data and our legal bases

We do not use your data for automated decision-making that has legal or similarly significant effects on you, and we do not sell or rent personal data.

5. Who we share data with

We share personal data only with the facilitator you contact and with service providers that process it on our behalf, under contracts that require them to protect it:

We may also disclose data if required by law, to protect the rights and safety of our users or KSE, or as part of a reorganisation of KSE, in which case this policy will continue to apply.

6. International transfers

Some of our providers store or process data outside your country, including in the United States and the European Union. Where data from the EU, UK or UAE is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses offered by those providers.

7. How long we keep data

• Facilitator profiles: while the facilitator is part of the network, or until they ask to be removed.
• Reviews (including the reviewer’s email): while the review is shown on the profile, or until the reviewer or the facilitator asks us to remove it.
• Contact requests: while they are being followed up, and for up to 24 months afterwards, unless you ask us to delete them sooner.
• Applications: until they are reviewed; rejected applications are deleted within 6 months.
• Newsletter and reviewer mailing lists: until you unsubscribe.
• Sign-in session cookies: 7 days (facilitators) or 30 days (reviewers), or until you sign out.
• Audit logs: 90 days, then deleted automatically.

8. How we protect data

All traffic to the Site is encrypted with HTTPS. Access to the admin area is restricted and logged, the database uses separate, least-privilege roles for public and administrative access, session cookies are signed and marked secure and HTTP-only, forms are protected against cross-site request forgery and spam, and uploaded images are checked before storage. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authorities as required by law.

9. Cookies and local storage

We use only cookies that are needed for the Site to work. We do not use advertising cookies or cookies that track you across other websites.

You can clear these at any time through your browser settings; the Site will ask for your cookie choice again.

10. Your rights and how to exercise them

Depending on where you live (for example under the EU and UK GDPR, the UAE Personal Data Protection Law, or US state privacy laws such as the CCPA), you may have the right to:

• access the personal data we hold about you and receive a copy in a portable format;
• correct inaccurate or incomplete data;
• have your data deleted;
• restrict or object to certain processing, including direct marketing;
• withdraw consent at any time, without affecting earlier processing;
• not be discriminated against for exercising your rights.

To make a request, email sensorenergetics@ at gmail.com or use the contact form on www.sensoryenergetics.com, saying that it is a privacy request. Facilitators asking for profile removal should include the URL of their profile. We may ask you to confirm your identity, and we respond within 30 days. Every marketing email also includes an unsubscribe link.

11. Children

The Site is intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. If a change materially affects how we use your data, we will highlight it on the Site before it takes effect and, where required, ask for your consent.

13. Contact and complaints

Questions about this policy or your data: sensorenergetics@ at gmail.com. If you are not satisfied with our response, you can complain to the data protection authority where you live, such as your national supervisory authority in the EU, the Information Commissioner’s Office in the UK, or the UAE Data Office.