Privacy Policy

1. Controller

G.M.L. Global Mind Ltd
6 Dimokratias, 4528 Pentakomo, Limassol, Cyprus
Email: [email protected]
Represented by: Marcus Meurer & Felicia Meurer (Directors)

For any privacy question, reach us at [email protected].

2. Data we collect

First name
Date, time and place of birth
Gender
Email address
IP address (automatically on page load)
Payment data (processed directly by Stripe — never stored by us)

3. Purposes

Creating your personal Birth Codex reading (birth data, name)
Delivering the reading by email (email address)
Processing payments (email, payment data via Stripe)
Abuse prevention and rate limiting (IP address)
Analysing and improving the service (anonymised usage data)

4. Legal bases

Art. 6(1)(b) GDPR — performance of a contract (creating the reading, payment)
Art. 6(1)(a) GDPR — consent (email communication)
Art. 6(1)(f) GDPR — legitimate interest (abuse prevention, analytics)

5. Hosting — Vercel

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel automatically processes technical data (IP address, browser type, access time). Transfers to the USA are based on the EU Standard Contractual Clauses. Vercel Privacy Policy

6. AI processing — Anthropic (Claude)

To create your reading we transmit your first name and the computed astrological data (no raw data such as date or place of birth) to the API of Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA. Anthropic does not use this data to train its models. Transfers are based on the EU Standard Contractual Clauses. Anthropic Privacy Policy

7. Payments — Stripe

Payments are handled by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Your payment data is processed directly by Stripe; we never receive card or bank details — only a confirmation of payment. Stripe Privacy Policy

8. Email — Brevo

For transactional email (the confirmation email with the link to your reading) we use Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany). Your email address is stored at Brevo and used for delivery and as a buyer record. Legal basis: Art. 6(1)(b) GDPR (contract). We currently do not send a newsletter. Brevo Privacy Policy

9. Reach & performance — Vercel Analytics

Via our host Vercel we use Vercel Analytics and Speed Insights to measure page views, devices, countries of origin and performance metrics (load times, Web Vitals) anonymously. No cookies are set and no user IDs are created; the data cannot be traced back to individuals. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the service). Vercel Analytics Privacy

10. Web analytics — Google Analytics

We use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It uses cookies to analyse how the website is used; the generated information is usually transferred to a Google server in the USA (based on the EU Standard Contractual Clauses). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach analysis). You can prevent collection via the Google Analytics opt-out add-on or by blocking cookies in your browser.

11. Internal reading statistics — Upstash Redis & Telegram

When you create a reading we store a compact record for evaluation and product improvement: your first name, date and place of birth (as entered), the approximate region (country from the IP address — the full IP is not stored), the traffic source (referrer host of your first visit), the entry page, the submit page, time on site before submitting, and a timestamp. When you open the finished reading we additionally measure pseudonymously how far you scrolled, which sections were in view and how long you stayed (no name, no date of birth). On a purchase we additionally record the amount paid and the Stripe session ID (no email, no full IP).

Reading content storage: the finished reading (birth data, computed results and interpretation texts) is stored in Upstash Redis for 365 days so you can revisit it via a permanent link, then automatically deleted. Upstash (Upstash Inc.) processes this in an EU data centre. You can request earlier deletion at any time (see below). Legal basis: Art. 6(1)(f) GDPR (legitimate interest); a copy of the balancing test is available on request.

In addition, the operator receives an instant notification with the same pseudonymised data via Telegram (Telegram FZ-LLC, Dubai, UAE). The UAE is a third country without an EU adequacy decision; this transfer is based on Art. 49(1)(f) GDPR (important business interest). Pseudonymisation is applied (no full name, no full IP, no email in the Telegram channel). Upstash Privacy / Telegram Privacy

12. Cookies

We use technically necessary cookies for the website to function and analytics cookies (Google Analytics), set on the basis of Art. 6(1)(f) GDPR. You can block or delete cookies in your browser settings.

13. Your rights

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR)
Withdrawal of consent — at any time with future effect

To exercise your rights, an email to [email protected] is enough; deletion then covers both the Redis record and the Telegram history.

14. Right to lodge a complaint

You have the right to complain to a data protection supervisory authority. The competent authority in Cyprus is:

Office of the Commissioner for Personal Data Protection
1 Iasonos Street, 1082 Nicosia, Cyprus
www.dataprotection.gov.cy

15. Minors

Birth Codex is intended exclusively for adults. By using it you confirm you are at least 18. We do not knowingly process data of children under 16. Where processing exceptionally relies on consent (Art. 6(1)(a) GDPR), it requires parental consent for minors under 16 (Art. 8 GDPR). If we learn that such data reached us without that consent, we delete it without delay.

16. Updates

As of June 2026. We may adapt this policy to reflect changes in the law or the service.