Privacy Policy & Data Lifecycle Notice

Visitor analytics and security monitoring

Visitor analytics: The website automatically organizes first-party visit data in the background, including the network IP address; approximate country, region, city, and network provider derived from it; device type, operating system, browser, language, screen and connection summary; referring host; page path; UTM campaign tags; performance; duration, scroll and interaction summaries; and a short online heartbeat. IP geography is resolved by ipwho.is and cached by IP to reduce external requests. Analytics does not read passwords, form contents, cookie values, full query strings, or page text and does not create a cross-site fingerprint.

Security monitoring: The server minimally records request time, the correctly resolved source IP, method, page path, query-parameter names but not values, referring host, user-agent, crawler/search-engine classification, and rule-based risk signals to deter spam submissions, malicious scanning, injection attempts, abnormal request rates, and impersonated search crawlers. High-confidence automated messages are quarantined from the normal inbox; borderline items receive human review. Automated rules do not by themselves block ordinary browsing by normal visitors.

Session and page-view records default to 180 days, security/bot/attack request records to 90 days, and IP geography cache entries to 30 days, followed by scheduled deletion. An unresolved security incident or legal/governance hold may pause an ordinary period.

Yijing Knowledge Q&A conversations and usage data

When you use GFSA's Yijing Knowledge Q&A feature, the question, selected local conversation context, and generation parameters are sent through GFSA's server to the API of Xuanlin Q&A, an independent commercial platform, to produce an answer and are processed by that service under its policies. GFSA controls this website's interface, access rules, and member allowances; it does not own or operate the external platform. Do not submit identity numbers, passwords, exact birth data, health, legal, financial, or other unnecessary sensitive information about yourself or anyone else. Answers are for general knowledge, learning, and reflection and do not replace medical, legal, financial, or other regulated professional advice.

The GFSA database does not store question text, answer text, or full conversations. Conversation history in the browser is kept in this device's localStorage and can be cleared by the user. To enforce daily allowances, deter abuse, and investigate failures, the server stores only a member ID when signed in, a hashed visitor identifier, allowance class and date, question-character count, response-payload size, context-message count, hashed network identifier, status, and timestamps. Successful usage records default to no more than 180 days and failed records to no more than 30 days. Irreversible member anonymization removes the member link and clears the associated visitor and network identifiers.

New in this version: voluntary annual survey and de-identified industry data

Active members may voluntarily participate in an annual industry survey. Responses use predefined controlled choices only, covering broad operating region, experience, primary service, approximate CAD price band, service channels, technology mode, AI disclosure, privacy process, and complaint process. There is no free-text field, and the survey does not collect client identities, cases, revenue, exact locations, or sensitive consultation information. Participation is not a condition of membership, verification, ranking, or service approval. While a survey is open, a member can update or withdraw the response and can obtain their own choices in the self-service copy.

No individual response, MemberID, or identity is published. Publication requires at least 10 valid responses, independent approval by a different administrator, an immutable aggregate snapshot, and minimum-cell controls. An entire mutually exclusive dimension is suppressed where subtraction could reveal a small group. Public figures describe only that year's voluntary member sample; they are not national, regional, or population market statistics. Raw responses default to human deletion or unlinking review 36 months after survey closure. Published irreversible statistical snapshots contain no individual answers.

New in this version: de-identified public case library

A Professional or Institutional member with current human-reviewed identity verification may submit a bilingual working case under their own scope or an active institution they are authorized to administer. Before publication, the contributor declares explicit de-identified consent, a composite/synthetic case, or a historical-public basis; automated identifier and claims checks run; and a content administrator reviews combined-field re-identification risk, provenance, scope, and limitations before creating an immutable approved version.

The case store processes contributor-scope type, broad region, adult age band, time band, consent/provenance basis, a masked consent reference, bilingual context/method/observation/limitations, risk flags, and human decisions. It prohibits names, contacts, URLs, account/document numbers, exact dates, birth data, exact age/address/coordinates, minors, consultation transcripts, report bodies, and raw consent documents. Public pages reveal neither contributor identity nor the internal masked reference. Withdrawal or irreversible anonymization immediately hides member-owned cases; governance records default to human review 84 months after publication ends.

New in this version: institutional public brands, team consent, and cases

An active institution may submit bilingual brand content, service scope, boundaries, public complaint routing, and de-identified cases. An independent administrator creates an immutable approved version. Approval of the institution account does not approve its brand content, and the public page reads only a still-active approved snapshot.

Each team member personally consents to public name/title display; an owner or administrator cannot consent for them. Withdrawal removes the member immediately. Case submission blocks obvious emails, URLs, telephone numbers, and long identifiers and must not contain client identity, exact address, consultation/report body, or an outcome guarantee. These publication-governance decisions default to human review 84 months after publication ends.

New in this version: governed service delivery

Human-reviewed offerings may use minimized appointments, versioned informed consent, order states, report-version metadata, receipt acknowledgement, follow-up categories, and human refund records. GFSA does not collect payment-card data, client questions, birth/health/legal/financial details, consultation narratives, or report bodies in this workflow. A report record contains only a masked external-governed-store reference and SHA-256.

Service-governance records default to a human review 84 months after the relationship ends. A deletion request stops new booking and cancels unconfirmed orders; confirmed, delivery, follow-up, or refund duties must close before irreversible anonymization. Necessary consent-version, state, and refund-accountability records may remain minimized for retention, third-party rights, complaint, and legal needs.

1. Scope and accountability

This notice explains how the Global Feng Shui Association website, member centre, institutional and named-team authorization, public member profiles, identity verification, CPD, certificates, advanced-tier applications and peer review, contact, and complaint processes handle personal information. An institutional accountable owner separately accepts responsibility for data control, role revocation, privacy requests, and complaint routing. Applicable law depends on the service, the individual’s location, and the activity; this notice does not promise that one jurisdiction’s rights apply unconditionally everywhere.

2. Information we process

• Member account: username, hashed password, person or organization name, email, telephone, country/region, member type, status, and dates.
• Institutions and team authorization: institution name and region, accountable owner, controller and privacy contacts, complaint officer, named-member roles, hashed invitation tokens, acceptance, revocation, ownership-transfer, and administrator-approval events. Raw invitation tokens are not stored.
• Institutional public content: bilingual brand overview, service scope and boundaries, website, complaint route, each member's team-publication consent/title, de-identified case working copies, risk flags, human decisions, and immutable approved versions.
• Member-authored public content: bilingual biography, expertise, services, qualifications, location, selected contact details, fee disclosure, languages, delivery methods, and service boundaries. Submission does not publish content until human approval.
• Identity verification: method, issuing region, masked reference, public registry URL, and a minimized summary. This portal does not ask members to upload raw identity documents or full document numbers.
• CPD and certificates: learning activity, date, credits, masked evidence reference, public verification URL, human decision, and annual status.
• Advanced tiers and peer review: applicant statements, evidence index/summary, public portfolio URL, an immutable snapshot of the applicable standard, reviewer eligibility and conflict declarations, confidential assessments, recommendations, reasoned decisions, validity, revocation, and event history.
• Governance and support: contact messages, complaints, evidence, investigation, decisions, remedies, discipline, appeals, and necessary event history, which may contain third-party information.
• Technical and security: session cookies, IP address, browser identifier, CSRF tokens, security events, and administrator audit history.

This website does not currently collect or store payment-card numbers directly. If payment functionality is introduced, the relevant processor, purpose, and terms will be disclosed separately.

3. Purposes and processing context

We use information to create and administer accounts, manage human-approved institutions and least-privilege team authorization, assess applications, provide membership services, publish information expressly selected and approved for publication, process CPD and certificates, operate advanced-tier peer review under a published standard, answer enquiries, operate complaint/discipline/appeal procedures, protect the website, meet legal obligations, and preserve accountability evidence. Public profiles, verification indicators, advanced-tier public indicators, and optional communications have separate choices and events.

Rule-based risk flags may help identify outcome guarantees, fear marketing, or out-of-scope claims, but they do not make final publication, membership-tier, discipline, or privacy decisions. Authorized people perform human review, observe separation of duties, and record reasons.

4. Publication, sharing, and international context

Only fields a member asks to publish, that pass review, and that remain in an active publication state are public. A valid advanced tier publishes only its level/title, governing policy version, and validity dates. Masked identity references, verification summaries, internal CPD evidence, application statements, peer-reviewer identities and confidential assessments, complaint material, administrator notes, and account credentials are not public-profile content.

We may disclose the minimum necessary information to people or providers supporting service delivery, peer review, website operation, security, legal requirements, investigations, or professional advice, subject to purpose and confidentiality limits. The website serves international visitors. Where information is lawfully accessed or processed across jurisdictions, protection and government-access rules may differ. You may ask about categories of recipients relevant to a specific request.

5. Retention, holds, and disposal

These are initial operational defaults established July 14, 2026. They begin a human disposal review; they are not unconditional automatic-deletion promises. Open access requests, complaints, appeals, security incidents, contracts, certificate, peer-review, or institution-authorization governance, third-party rights, or a legal hold can override ordinary timing.

Information no longer needed and not subject to a hold is deleted, erased, or anonymized. A legal/governance hold records its category, reason, masked authority reference, review date, and release history.

6. Your choices and request process

• Self-service copy: signed-in members can download JSON for records linked directly by MemberID. It includes their own advanced-tier application, decision, and minimized event timeline, but excludes passwords, reset secrets, peer-reviewer identities, confidential assessments, internal notes, third-party complaint evidence, and unlinked contact correspondence.
• Formal access: request a human search, exception review, and understandable access response.
• Correction: edit available fields or request correction of controlled records.
• Withdrawal of optional consent: stop new profile publication (including the advanced-tier public indicator and the member's institution-team display), verification, CPD, or optional communications processing. Withdrawal does not retroactively erase records lawfully retained and does not automatically republish stopped content.
• Restriction, deletion, or anonymization: identify the scope. Deletion requests require current-password confirmation and human review.

Where Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) applies, our target is to respond within 30 days of receiving a written request. A permitted extension is recorded with reasons, and a refusal or inability to disclose is explained with available recourse. Third-party information, legal privilege, safety, peer-review, complaint/discipline, and appeal records may require redaction, retention, or partial completion.

Open the Privacy & Data Rights Centre

7. Safeguards and incidents

The website uses HTTPS, parameterized database operations, role permissions, live administrator revalidation, CSRF protection, output encoding, password hashing, expiring reset tokens, audit events, and controlled human review. No network or storage system can guarantee absolute security. We investigate suspected incidents proportionately, contain impact, and notify affected people or regulators when applicable law requires it.

8. Cookies, children, and external links

Member and administrator sign-in uses necessary session cookies and security tokens. The website is not directed primarily to children. Do not submit unnecessary child, client, health, financial, or other sensitive third-party information in profiles, CPD, contact, or complaint forms. External registries, research sources, and social links have their own practices.

9. Contact, complaints, and changes

To exercise a right, challenge a decision, or report an incident, use the contact form or email info@globalfengshui.org with “Privacy and data request” in the subject. Do not email full document numbers, passwords, or unnecessary third-party sensitive data.

A material change receives a new version and effective date and is presented through the privacy centre or another appropriate notice. Where PIPEDA applies, you may also complain to the Office of the Privacy Commissioner of Canada. Contacting the Association first can help define the scope but does not remove statutory recourse.

References: PIPEDA section 8; OPC access guidance.