Last updated: 2 October 2026. This is a draft prepared for legal review. Do not publish before a lawyer has checked the sections marked PENDING.
Who we are
Mahanse runs small group ayahuasca retreats in Spain. This page explains what personal data we collect through mahanse.com, why we collect it, who we share it with and what you can ask us to do with it.
Data controller: Francisco García, Barcelona Spain.
Contact for data matters: fransie@mahanse.com · +34 685 25 67 65
What we collect, and why
1. When you fill in the application form
Our application form asks for your name, email address, phone number, country, and a set of questions about your situation, your expectations and your health.
This includes health data. We ask whether you take SSRIs or MAOIs, whether you have a psychiatric or cardiac history, and whether you are in active addiction. Under Article 9 of the GDPR this is a special category of personal data, and we process it only on the basis of your explicit consent, given when you submit the form.
We need it for one reason: ayahuasca is not safe for everyone, and we screen every applicant before accepting a booking. If you would rather not give this information in writing, write to us and we will do the screening on a call instead.
Legal basis: explicit consent (Art. 9.2.a GDPR) for the health answers; steps prior to entering a contract (Art. 6.1.b) for the rest.
2. When you book a call
Your name, email, phone and the time slot you choose, so we can hold the call and remind you of it.
3. When you simply visit the site
Your IP address, browser, device, the pages you open and how you arrived. This is collected by the tools listed below.
The tools we use, and what each one sees
| Tool | What it does | What it sees |
|---|---|---|
| Meta Pixel (Facebook, Instagram) | Measures which adverts lead to applications | Pages visited, actions taken, a hashed identifier |
| Google Analytics 4 (via Site Kit) | Audience and traffic statistics | Pages visited, device, approximate location |
| Hotjar | Records how pages are used, to improve them | Mouse movement, scrolling, clicks |
| Fluent Forms | Runs our forms | Everything you type into them |
| GoHighLevel | Our CRM: holds your application and our conversations | Your contact details and form answers |
| Hostinger | Hosts the website | Server logs, including your IP address |
Meta, Google, Hotjar and GoHighLevel are established outside the European Economic Area. Transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
PENDING: confirm whether a consent banner is in place. Analytics, Meta Pixel and Hotjar require prior consent in Spain under Article 22.2 LSSI. At the time of writing this draft, no consent mechanism was found on the site.
How long we keep it
- Applications that do not become bookings: PENDING — proposed 12 months.
- Health answers: PENDING — proposed deletion once the retreat has finished, or once the application is rejected.
- Bookings and payments: as long as Spanish tax and accounting law requires.
- Analytics data: as set in each tool, typically 14 months.
Who else sees your data
The four people on the retreat team see what is relevant to keeping you safe during the retreat. Nobody else on the retreat sees your application. We do not sell your data and we do not share it for anyone else’s marketing.
Your rights
You can ask us to show you the data we hold, correct it, delete it, limit what we do with it, hand it over in a portable format, or object to a particular use. You can withdraw consent at any time, including consent for the health answers, and that does not affect what we did lawfully before.
Write to fransie@mahanse.com. We answer within a month. If you are not satisfied, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es).
Changes
If we change how we handle your data, we update this page and change the date at the top.