Privacy Policy

1. General

1.1. This Privacy Policy (the "Policy") describes how Vanteia ("we") processes the personal data of users of the Vanteia website and applications (the "Service").

1.2. The controller of your personal data is Vanteia. For questions about the processing of your personal data and to exercise your rights, write to [email protected].

1.3. We may update this Policy. Each new version is published with the date on which it takes effect. If you have an account, we will ask you to accept the new version, and you can go on using the Service only once you have; if you do not agree with it, stop using the Service.

2. What data we process

2.1. Account data: your email address, name, language and other settings, confirmation of your age, the status of your account, and your sign-in data. An email address is required to create an account.

2.2. Profile data: your name, including your full name at birth, your gender, the date, time and place of your birth, your place of residence, your time zone and your communication preferences, as well as the numerological and astrological data calculated from them. Providing them is optional, but the features that need them are not available without them.

2.3. Your messages and the Service's answers: your questions and other messages (typed or dictated), the cards drawn, the readings you receive and other answers, as well as the information the Service derives from your messages in order to take it into account in later answers (section 5).

2.4. Another person's data: the name and birth details you enter for a compatibility reading. They are used only in that session, are never added to anyone's profile, and are deleted together with the session. By entering them, you confirm that you are entitled to share them. That person may contact us at [email protected].

2.5. Plan data: your plan, the limits available to you and how much of them you have used, and, if you have told us which paid plan you would choose, your answer.

2.6. Messages to us: support requests and feedback reports, including any attached images and technical information about your browser at the time of sending.

2.7. Notification data, if you have switched notifications on: your browser's subscription details, your Telegram chat identifier and username, your notification settings, and the settings and contents of the daily digest «Your day».

2.8. Technical data: your IP address and the country determined from it, information about your browser and device (such as language, time zone and screen parameters), the referring source, the identifier we assign to your browser, information about your visits and actions in the Service, and operation and error logs.

2.9. Security and usage information: sign-ins and sign-in attempts, changes to settings and other actions on your account, and statistics and service records of how the Service is used.

2.10. Consent records: which documents you accepted, in which version and when, which consents you gave or withdrew, and the technical information needed to confirm these actions.

3. Special categories of data

3.1. Your messages may contain information that applicable law classifies as special categories of personal data — for example, information about your health or your beliefs, and so on. We do not ask for such information: include no more than your question requires.

3.2. We process such information only on the basis of your explicit consent. It is asked for separately from this Policy, in the document “Consent to the processing of special categories of personal data”. Consent is voluntary: without it, only the features in which you enter messages are unavailable; your account and the rest of the Service remain available.

3.3. You may withdraw your consent at any time — in your profile or by writing to [email protected]. Withdrawal does not affect the lawfulness of processing carried out before it and does not by itself delete any data; section 9 explains how to delete it.

4. Purposes and legal bases of processing

4.1. Providing the Service: running your account, creating readings, keeping the history of your sessions and taking it into account in later answers, adapting the Service to your language, time zone and device, and sending the notifications you have chosen. Legal basis: performance of our contract with you.

4.2. Processing special categories of data in your messages. Legal basis: your explicit consent (section 3).

4.3. Creating a compatibility reading from another person's data. Legal basis: our legitimate interest, and yours, in producing the reading you asked for.

4.4. Security of the Service: protecting it against abuse and fraud, and applying usage limits, including those on free access. Legal basis: our legitimate interest.

4.5. Usage statistics and improving the Service. Legal basis: our legitimate interest; you may object to this processing (section 9).

4.6. Answering your requests and feedback reports. Legal basis: our legitimate interest.

4.7. Recording your preferences about paid plans and telling you when they open, if you have asked us to. Legal basis: your consent.

4.8. Evidencing which documents you accepted and which consents you gave, complying with the law, and establishing, exercising or defending legal claims. Legal basis: our legal obligations and our legitimate interest.

4.9. Messages about the Service. Legal basis: performance of our contract with you. We send marketing messages only with your consent, which you may withdraw at any time.

5. Use of artificial intelligence

5.1. Readings and other answers in the Service are produced automatically, using artificial intelligence models run by third-party providers (section 6). Readings are for entertainment and have no legal or other significant effect on you.

5.2. A provider receives only what is needed to answer a particular request. We use providers only through interfaces whose terms exclude training models on the data sent through them. Providers may keep this data for a limited time under their own rules, for example to prevent abuse.

5.3. We do not use your data to train artificial intelligence models — ours or anyone else's.

5.4. So that answers take context into account, the Service keeps in your account information derived from your messages — for example, short summaries of your sessions and conclusions about which style of answer suits you. It is kept and deleted in the same way as your other account data.

5.5. If you use the voice features, your voice recording and the text to be read aloud are sent to speech technology providers. Neither the voice recording nor the synthesized speech is kept by us — only the recognized text is. If you use the voice built into your browser, the browser does the processing under its maker's rules.

6. Who we share data with

6.1. We share data only to the extent necessary for the purposes in section 4, with the following recipients: providers of artificial intelligence technology — to create readings and other answers; providers of speech technology — if you use the voice features; hosting and network infrastructure providers — to run the Service, deliver requests and protect it against attacks and automated requests; and email delivery providers — to send emails. Providers process data on our instructions. We will provide the list of specific providers on request at [email protected].

6.2. The notifications you have switched on are delivered through the channels you chose: browser notifications through a service run by your browser's maker, and Telegram messages through Telegram. A browser notification carries only a title, one line and a link, and never the text of a reading. Emails and Telegram messages carry «Your day» itself, including the text of that day's reading. Every email has a one-click unsubscribe, and any channel can be switched off in your settings.

6.3. We may disclose data to public authorities where the law requires it, and where this is necessary to establish, exercise or defend legal claims.

6.4. If the Service passes to someone else, data may be transferred to them together with the Service; your rights under this Policy remain unchanged.

6.5. We do not sell personal data and we do not share it for advertising.

7. Transfers of data abroad

7.1. The providers listed in section 6 may be located outside your country of residence, including in the United States, and the Service's servers may be in various countries. Your data may therefore be transferred and processed abroad, including where the law protects personal data differently from the law of your country.

7.2. We transfer data abroad only to the extent necessary to run the Service. Where applicable, a transfer relies on mechanisms recognized by data protection law — for example, adequacy decisions or standard contractual clauses included in our agreements with providers. Otherwise, it rests on the transfer being necessary to provide the Service you requested and, for special categories of data, on your explicit consent (section 3).

8. How long we keep data

8.1. We keep personal data no longer than is needed for the purposes for which it was collected. Account and profile data, session content and other data linked to your account are kept while the account exists or until you delete them; some of it is deleted sooner.

8.2. Technical logs and records of sign-ins and sign-in attempts are kept for no more than 90 days; information about visits from a device, including the IP address, for no more than 180 days from the last visit; a reading received without an account, for no more than 30 days; and usage statistics and service records, for no more than two years.

8.3. After an account is deleted, only the following are kept: consent records — for the applicable limitation period; the log of actions on the account — for no more than ten years; a marker of the email address from which the address itself cannot be recovered — for two years, and only to recognize a repeat registration in order to prevent abuse; and de-identified and aggregated data. None of these records names you.

8.4. Database backups are kept for no more than 90 days. A backup holds data as it stood on the day it was made, so deleted data may survive in backups until they expire.

8.5. We may keep data for longer where the law requires it or where this is necessary to establish, exercise or defend legal claims.

9. Your rights

9.1. In accordance with applicable law, you have the right to access your data and to obtain a copy of it, including in a machine-readable format; to have it corrected; to have it deleted; to restrict its processing or to object to it, including to processing based on our legitimate interest; and to withdraw your consent — this does not affect the lawfulness of processing carried out before the withdrawal.

9.2. You can delete your account yourself, from your profile: everything we hold about you is deleted, except the information that section 8 says is kept after an account is deleted. To exercise your other rights, or to delete particular data without deleting your account, write to [email protected]. We may ask you to confirm that the request comes from you, and we will reply within one month.

9.3. If you have a complaint about how we process your data, write to us at [email protected] — we will consider it and reply. You also have the right to complain to a data protection authority, where applicable law provides for that right.

10. How we protect data

10.1. We apply organizational and technical measures to protect personal data. Data is transmitted over encrypted channels; your questions and messages, your birth details and what the Service writes about you are stored encrypted, except in the case set out in point 10.3; passwords are stored in a form from which they cannot be recovered.

10.2. Only authorized persons have access to data, and only to the extent necessary to run the Service, support users and fix errors.

10.3. A feedback report, together with any images attached to it, is not encrypted at rest: it is meant to be read by us. Do not include personal details in it.

10.4. No system is perfectly secure. If a data breach may create a risk to your rights, we will notify you and the data protection authority in the cases and in the manner provided by law.

11. Cookies and browser storage

11.1. We do not use advertising or analytics cookies. The Service stores in your browser only what it needs to work: the data that keeps you signed in to your account or guest session, the identifier we assign to your browser, your settings (such as language and sound) and service markers.

11.2. The sign-in data and the browser identifier are necessary for the Service to work and to protect it against abuse. If you clear your browser storage, you will be signed out and your settings will return to their defaults.

12. Age restrictions

12.1. The Service is for adults. You may use it if you are at least 18 — or older, where the age of majority in your country is higher — and where the law of your country permits services of this kind.

12.2. We do not knowingly collect children's data. If you believe a child has given us their data, write to [email protected] and we will delete it.