Privacy Policy

1. Information we collect

• Account information: name, email address, and password (hashed - see §5).
• Birth & person data: birth date, time, and place, and names for each person you register, used solely to run the numerology/astrology/ esoteric calculations and readings you request.
• Payment metadata: purchase history, plan/credit balances, and order records. We never receive or store your full card number - see §3.
• Usage data: which pages are read and how people arrive (the referring website or campaign, not its full address), the steps reached in checkout, how fast pages load, and the kind of device, browser, operating system and language setting used, with an approximate location (country and region) worked out from your IP address by our network provider; collected by our own statistics, and, if you consent, a tracking pixel and Google Analytics (see §6). We do not store your IP address or full browser details for these statistics.
• Generated content: the readings, translations, and calculation results produced for you, stored so you can revisit and export them.
• Geomancy questions: the question you write when you make a geomancy casting, stored encrypted with the casting so you can come back to it, and added to a reading that includes geomancy when the reading is written. Geomancy does not answer medical, financial or legal questions, so please leave out questions about your health or about other people. You can delete a casting, and its question, at any time; a reading already written from it keeps its text until you delete the reading.
• Seven Rays questionnaire answers: your answers to the Seven Rays questionnaire and the rays you confirm afterwards, stored so you can retake it and see what changed. Readings that include Seven Rays use the confirmed rays, not the answers. You can delete an assessment, with its answers, at any time.
• Free charts: on a free chart page you enter only what that chart needs: a birth date; for some charts a birth time and place; for the Numerology and Gematria charts, your full name at birth; for the Luck Pillars chart, the chart's sex or the direction you choose; and for the Zi Wei Dou Shu chart, if you wish, the chart's gender. We use it only to draw the charts you ask for, there and then: from a chart's page you can have the same details drawn in another free chart, which is sent only the details it uses. Unless you save the chart, nothing you enter is stored: not in our database, a log, the session, a cookie or a web address. What we record about each free chart is not personal: which chart it was, whether it was drawn or turned away, and whether a birth time and place were given (yes or no, never the values), with the general details our statistics keep for any page (§6).
• Saving a free chart: if you choose "Save this chart", we keep the email address you enter and the details of that chart (the birth details, and the name, gender or direction where that chart asks for one) in a free account, with the record that you confirmed you are 18 or older and accepted our Terms and this policy. We email you a link to sign in. It works once and for a limited time, and using it confirms that the address is yours; you need no password, and can set one later. If the address already has an account, we add nothing to it and send that address a sign-in link instead. An account that is never signed into with its link is erased after 30 days (§4).
• How an account was made: if you open an account from one of our free chart pages, by saving a chart or through its sign-up link, the account records which free chart it was (for example "free chart: Sabian Symbols"). It names our page, never anything you entered, so we can count which free charts lead to accounts and purchases. It is kept, exported and erased with the account.

2. How we use information

We use the information above to: provide and operate the Service (run calculations, generate readings, process payments); communicate with you (transactional emails, receipts, account notices); maintain security and prevent abuse; and improve the Service.

3. Third parties we share data with (subprocessors)

We use the following subprocessors to operate the Service:

• Stripe - payment processing. Stripe is PCI-DSS compliant; we never see or store your full card number.
• Amazon Web Services (AWS S3) - storage of avatars and generated PDF exports.
• OpenAI, Anthropic, and Google (Gemini) - AI providers used to generate readings and translations. Birth data (dates, times, places), names and, for readings that include geomancy, the question of the person's geomancy casting, and for readings that include Seven Rays, the rays the person confirmed (not their answers) are sent to the selected AI provider as part of generating that reading. We do not sell this data, and we only send what's needed to produce the requested reading.
• Amazon SES - transactional email delivery (receipts, account and security notices).
• Cloudflare - our network and security provider, which handles every request to the Service and works out your approximate location (country and region) from your IP address, and checks that our forms are sent by people rather than automated programs (Cloudflare Turnstile, §5).
• Google Analytics - aggregate website usage analytics (pages viewed, general device/browser/location information). Only active if you accept it via the cookie banner; see §6.

We do not sell your personal information to third parties.

4. Data retention & deletion

You can request account deletion at any time from account settings. Deletion is a two-phase process: requesting it immediately disables the account and starts a 30-day grace period during which you can log back in and cancel the deletion; if the 30 days lapse, all associated data - people, calculations, readings, orders, credit history, and the account itself - is permanently and irreversibly erased. You'll receive an email when deletion is scheduled and another confirming the permanent erasure.

Free charts you do not save are not kept at all. An account made by saving a free chart whose sign-in link is never used is erased, with its person and chart, 30 days after it was made, and we send no email about it. Once the link has been used, the account is kept like any other.

Statistics records of individual visits (§6) are kept for 25 months for visitors in the EU and EEA, 90 days for visitors in the UK or whose country we cannot tell, and 400 days elsewhere. After that only daily totals, which contain no individual, are kept.

5. Security

• Data is encrypted in transit (TLS) and sensitive data at rest is encrypted using AES-256.
• Passwords are never stored in plain text - we use industry-standard hashing (bcrypt/Argon2).
• We do not store credit card numbers; all card handling is delegated to PCI-compliant Stripe.
• Access to production data is restricted to authorized personnel.

Protecting our forms from automated abuse. Our public forms (the free charts, saving a chart, sign-up, sign-in, password reset, checkout and surveys) carry a hidden field that people never see or fill in, and limit how often one connection, one email address and everyone together can send them. To count, we use your IP address and the email address you typed, held only as a one-way code in short-lived counters that are not linked to your account and are deleted within a day; we keep only whether a form was turned away. We also use Cloudflare Turnstile, a check by our network provider that a form was sent by a person. It processes your IP address, details of your browser and connection, and a code naming our site, only to tell people from automated programs, and we keep only whether the check passed. Cloudflare acts as our processor for the check, and as its own controller for improving it. We do this on our legitimate interest in keeping the Service and its users secure, and it needs no consent.

6. Cookies & tracking

Necessary. We use essential cookies for login sessions and security (these cannot be disabled without breaking the Service). When you arrive through a referral link, we set a referral_code cookie for up to 30 days so the referral discount can be applied when you sign up. When Cloudflare Turnstile is on (§5), its script runs in your browser on our forms to check that you are a person; this is strictly necessary for security, and it sets no advertising cookie.

Our statistics. We run our own statistics, on our own servers and those of our network provider (Cloudflare), to understand overall use of the Service and improve it: which pages are read, how people arrive (the referring website or campaign link, not the full address), the steps people reach in checkout, where on a page people click or scroll, how fast pages load, and the kind of device, browser, operating system and language setting used. Your approximate location (country and region) is worked out from your IP address by Cloudflare; we do not store your IP address or full browser details, and these statistics use no advertising cookies and share nothing with any outside company. Our page-statistics script (Umami, run on our own servers) sends your screen size and language, and groups the pages you open in one day into a visit, using a code that changes daily and is not linked to your account. We also set a first_touch cookie for up to 12 months recording the first page and campaign you arrived on, which we add to your account if you sign up, so we know which of our pages and campaigns bring people to EsoTerrier.

Outside the EU, the EEA and the UK, these statistics also record, if you are signed in, your account with the public pages you read, and a click identifier from an advertisement (such as Google's gclid) or a referral code you arrived with. In the EU, the EEA and the UK, and wherever we cannot tell your country, they record only whether you were signed in and which advertising platform a click came from.

You can opt out of these statistics at any time with Privacy choices (also in the footer of every page); we then stop recording visits from that browser and set no first_touch cookie. We treat a Global Privacy Control signal from your browser as the same opt-out. We do not track you across other websites.

Analytics and marketing. With your consent via the cookie banner, we additionally use a first-party tracking pixel and Google Analytics for deeper usage insight; both are off by default and only activate if you accept, and Google Analytics may then collect information about your visit. You can change any of these choices at any time with Privacy choices.

7. AI-generated content disclosure

Readings and translations are generated by AI, not a human. They are labeled as AI-generated in the product and in exported PDFs. See our Terms of Service §5 for more detail on AI usage and §2 for the "entertainment/education only" disclaimer.

8. Your rights (GDPR / CCPA)

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate information (via account settings or by contacting us);
• Request deletion of your account and data (§4);
• Object to or restrict certain processing, including our statistics at any time with Privacy choices (§6); and
• Data portability, where applicable.

To exercise any of these rights, email privacy@esoterrier.com.

9. Children's privacy

The Service is not directed to individuals under 18. We do not knowingly collect information from anyone under 18; account creation requires confirming you meet this age requirement.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will require you to re-accept the policy the next time you use the Service before continuing.

11. Contact

Privacy questions or data requests: email privacy@esoterrier.com. General support: support@esoterrier.com.