Privacy policy
Version 1.1 · Published 17 September 2026
1. The short version
We keep a record of the consultations you buy (when, how long, which channel, what it cost) because we have to bill you, answer questions about your account, and defend a payment dispute if one is raised.
We keep what is said during a consultation for 30 days, then it is gone. Nobody at MediumGuru can reach it while it is held.
There is one exception, and it is described in section 5: either you or your Guru can flag a session, during it or within those 30 days, and a flagged session is kept for longer so that we can look into it.
We never use what is said in a consultation to advertise to you, to build a profile of you, or to train any artificial-intelligence system. Nobody listens in.
2. Who we are
Solius Media B.V., trading as MediumGuru, is the controller of the personal data described in this policy. We are a private limited company (besloten vennootschap) incorporated in the Netherlands, registered with the Chamber of Commerce (KvK) under number 42151096, with registered office at Iwanhof 5, 3025 NW Rotterdam and VAT number NL869940375B01.
You can reach us about anything in this policy at [email protected].
We are established in the Netherlands and no company outside the European Union takes part in operating the platform or has access to what is said in a consultation.
Gurus are independent businesses working under the platform rules every Guru agrees to; if you work on MediumGuru as a Guru, a separate privacy notice applies to you.
3. What we process
| Category | Examples |
|---|---|
| Account data | Name, email address, date of birth and age confirmation, password (stored hashed), account settings including your spending limit |
| Transaction data | Amounts charged, the Guru's rate, session duration, payment-mandate reference, receipts, VAT data |
| Session metadata | Session identifier, start and end time, duration, channel used, which Guru, the rate applied |
| Technical data | IP address, device and browser information, system and connection logs |
| Consultation content | What is said or written during a consultation, for the periods in section 5 only |
| Reviews | A review you write about a Guru, published on their profile with your first name |
| Support and complaint data | Messages you send us, complaint records, the outcome |
| Consent and acceptance records | Which version of which document you accepted, and when |
4. Why we process it, and on what basis
| What we do | Why | Legal basis |
|---|---|---|
| Run your account and give you access to the platform | To provide what you signed up for | Article 6(1)(b): performance of a contract |
| Take payment for consultations, issue receipts, settle with the Guru | To perform the contract and meet our obligations as merchant of record | Article 6(1)(b); Article 6(1)(c) |
| Prevent fraud, keep accounts secure, recover amounts owed | Our legitimate interest in not being defrauded and in being paid for services delivered | Article 6(1)(f) |
| Look into a flagged session where safety is in issue | Our interest, and that of the person who reported it, in being able to investigate the report | Article 6(1)(f), with Article 9(2)(f) |
| Keep and use a flagged session as evidence in a dispute, complaint or claim | Establishment, exercise or defence of legal claims | Article 6(1)(f), with Article 9(2)(f) |
| Handle complaints and decide whether a Guru stays on the platform | Our interest in performing our contract with you and protecting other users | Article 6(1)(f) |
| Send you email about our own service | Our interest in telling our own customers about our service; consent where you have given it. You can opt out in every email we send | Article 6(1)(f), or Article 6(1)(a) |
| Look at overall usage figures to run and improve the platform | Our interest in understanding how the platform is used | Article 6(1)(f): aggregate metadata only |
| Keep invoicing and tax records | Dutch tax law | Article 6(1)(c) |
| Set cookies and similar technologies that are not strictly necessary | Only if you agree | Consent (see our Cookie policy) |
Where we rely on our legitimate interests, we have written down the assessment behind it. If you want to know the reasoning for a particular one, ask us and we will explain it.
5. What is said during a consultation
5.1 We keep it for 30 days, then it is gone
Whatever channel you use, the content of your consultation is kept for 30 days after the session ends and is then deleted. During those days nobody at MediumGuru can reach it; it is held only so that something raised during the session or shortly afterwards can still be looked into.
5.2 Unless the session is flagged
A session is kept beyond those 30 days where one of these happens, during the session or within those days:
- you flag it, because something was said that you want us to look at, or because you want a record;
- your Guru flags it, for the same kinds of reason;
- a report is made about that session;
- you dispute the payment, or a chargeback or refund claim is raised about that session; or
- we receive a legal, regulatory or safety request about that session.
Either of you can flag a session, on the same terms, without giving a reason. Every flag is logged. Nobody at MediumGuru can reach the content of a session that has not been flagged.
A flagged session is kept for 180 days. Where the flag concerns a live dispute or a safety matter, we keep it until that matter is concluded and for 90 days afterwards, and in no case longer than 24 months.
5.3 What we never do with it
- We do not listen to or watch consultations in real time. There is no monitoring.
- We do not analyse consultation content automatically: no sentiment analysis, no summarisation, no scoring, no crisis detection.
- We do not use it to train or improve any machine-learning or artificial-intelligence system, and our transcription provider may not do so either.
- We do not use it for advertising, marketing or product development.
- We do not use voice or facial data to identify anyone.
If we ever intend to change any of this, we will assess it first and tell you before it happens.
5.4 Other people you talk about
A consultation is often about someone else: a partner, a parent, a child, an employer. What you said about that person is kept with the session, for the periods in sections 5.1 and 5.2.
We do not contact those people. We hold no details for them and getting details in order to notify them would mean collecting more information about them, not less. What limits their exposure is that the content is deleted after 30 days unless the session is flagged, that the retention periods above apply, that nobody may use the content for anything else, and that staff actions on a kept session are logged. (This is the exception in Article 14(5)(b) GDPR.)
6. Sensitive information
People talk to a Guru about bereavement, health, faith, relationships and money. That means the content of a consultation is, by its nature, special-category data under Article 9(1) GDPR. We treat it that way throughout, and it is the reason the platform keeps it only briefly and only for the purposes in section 5.
Where content is kept because a session was flagged, we rely on Article 9(2)(f): necessity for legal claims.
7. How long we keep things
| What | How long | Why |
|---|---|---|
| Content of a session that is not flagged | 30 days after the session ends | Reports and disputes about a session arise within days |
| Audio and transcript of a flagged session | 180 days | The card dispute window runs to 120 days, plus the response period |
| A session kept for a live dispute or safety matter | Until it is concluded, plus 90 days; never more than 24 months | Covers the SEPA 13-month claim period with a margin |
| Session metadata and billing records | 7 years | Dutch tax law |
| Invoices and tax records | 7 years | Dutch tax law |
| Account data | For as long as you have an account; anonymised at once when you close it | |
| Technical data kept for fraud and security | No longer than 12 months | Derived from that purpose, not merged into the 7-year period |
| Complaint records | 90 days after the complaint is closed | Long enough to answer a follow-up |
| Consent and acceptance records | For as long as you have an account, plus 7 years | So we can show what you agreed to and when |
Deletion is automatic, verified, and includes our backups. We audit it quarterly.
8. Who else sees your data
| Who | What they get |
|---|---|
| Your Guru | What you say to them during your consultation, and your display name |
| Everyone | A review you write about a Guru, published on their profile with your first name. We remove a review from public view for abuse, personal data, illegal content, or another breach of the platform rules, and the author is told why |
| Our hosting provider | Platform data, stored in the Netherlands |
| Our real-time calling provider | Session media while a call is in progress |
| Our transcription provider | Audio of a flagged session only, under terms that forbid keeping it or using it to train anything |
| Stripe | Your payment and mandate data. Stripe collects this directly and is responsible for it in its own right |
| Support tooling | Whatever is attached to a support ticket |
| A card scheme or bank | Where you dispute a charge, the minimum needed to answer the specific reason for the dispute, never a whole session |
| Authorities | Where the law requires it |
Everyone who processes data for us does so under a written agreement and only on our instructions.
9. Where your data is
Hosting, calling, transcription and storage all take place in the Netherlands. No consultation content leaves the European Union.
The one exception is payments: Stripe processes payment and mandate data with elements of its operation in the United States, under its own transfer mechanism. Stripe never receives consultation content. Where you dispute a card payment, the evidence we submit may travel outside the EU as part of how the card scheme works, which is why we submit the least we can.
10. Your right to object
This right sits on its own because the law says it must, and because it is the one people use.
You can object at any time to anything we do on the basis of our legitimate interests.
- If you object to marketing, we stop. Immediately, permanently, no reasons asked, no assessment. That is absolute.
- If you object to anything else, we look at your particular situation and stop, unless we can show compelling grounds that outweigh your interests, or unless we need the information for a legal claim. We decide that case by case, in writing, with reasons, never by pointing at a policy.
- If you object while a dispute or safety matter about your session is still open, we will usually need to keep that session until it is finished. We will tell you so, tell you how long we expect it to take, and delete it afterwards without you having to ask again.
To object, email [email protected] or use the setting in your account. You do not need to mention any article of the GDPR; just tell us. We reply within one month.
11. Your other rights
| Right | What it means here |
|---|---|
| Access | You can ask for a copy of your data through Your data. Where a kept session involves you and your Guru, we give you your own contributions in full, and the other person's only where the record makes no sense without them and their rights are not unfairly affected |
| Rectification | We correct wrong data. A transcript can be corrected or annotated; audio is not altered, but a correction is stored alongside it |
| Erasure | We delete when you ask through Your data, except where a session is being kept for a live dispute or safety matter (then it goes when that finishes), and except invoices and tax records, which Dutch fiscal law requires us to keep for seven years |
| Restriction | You can ask us to pause processing while something is being sorted out |
| Portability | You can take your data with you |
| Withdraw consent | Any consent you gave can be withdrawn as easily as you gave it, without affecting what was lawful before |
We answer within one month, and can extend by two months for complicated requests; we will tell you if that happens.
Automated decisions. Your spending limit is applied automatically, and our payment provider may block a payment it considers fraudulent. Neither has legal effect on you, and you can always ask a person to look at it.
12. Security
Data is encrypted in transit and at rest. Kept sessions are stored separately from account and payment data, with key management held apart from the application. Access to session content is limited to named people and is only possible while a session is held under a flag; staff actions that change something are logged. No system is perfectly secure, and we do not claim otherwise.
13. If you are under 18
The platform is for adults. We do not knowingly provide consultations to anyone under 18, and you confirm that you are 18 or over when you create an account. If we find out that an account belongs to someone under 18, we close it and delete what we hold, unless we have to keep something for a live safety matter.
14. Cookies
Cookies and similar technologies are covered by our Cookie policy. Anything that is not strictly necessary is set only if you agree, and you can change your mind at any time.
15. Complaints
Tell us first, at [email protected]; it is usually the fastest route. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live, and you can go to court.
Complaints that are not about data are handled under our Complaints procedure.
16. Changes
We will update this policy when what we do changes. Material changes are notified to your registered email address before they take effect. The version and date are shown at the top.
This is version 1.1; the publication date is shown at the top of this page. Earlier versions are available on request.
Questions about this page
Email [email protected].