Privacy Policy

1. Controller

G.M.L. Global Mind Ltd
6 Dimokratias, 4528 Pentakomo, Limassol, Cyprus
Email: support@birthcodex.com
Represented by: Marcus Meurer & Felicia Meurer (Directors)

For any privacy question, reach us at support@birthcodex.com.

2. Data we collect

First name
Date, time and place of birth
Email address (only if you save your reading by email or make a purchase)
IP address (automatically on page load)
Payment data (processed directly by Stripe, never stored by us)

3. Purposes

Creating your personal Birth Codex reading (birth data, name)
Delivering the reading by email (email address)
Processing payments (email, payment data via Stripe)
Abuse prevention and rate limiting (IP address)
Analysing and improving the service (usage data)

4. Legal bases

Art. 6(1)(b) GDPR: performance of a contract (creating the reading, payment)
Art. 6(1)(a) GDPR: consent (email communication)
Art. 6(1)(f) GDPR: legitimate interest (abuse prevention, analytics)

5. Hosting: Vercel

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA; function execution and data processing take place in the EU (Frankfurt, region fra1). Vercel automatically processes technical data (IP address, browser type, access time). As Vercel Inc. is a US company, the processing additionally relies on the EU Standard Contractual Clauses. Vercel Privacy Policy

6. Text processing by a data processor

To prepare the wording of your reading we transmit your first name, your birth data (date, time and place of birth) and the values computed from them to our data processor Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA. This data is not used for their own training purposes. Transfers are based on the EU Standard Contractual Clauses. Anthropic Privacy Policy

7. Payments: Stripe

Payments are handled by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Your payment data is processed directly by Stripe; we never receive card or bank details, only a confirmation of payment. Stripe Privacy Policy

Purchase record (proof of your order): For every completed purchase we also create an evidence record. It contains the Stripe identifiers for your transaction (session, payment-intent and customer ID), your email address, the name given at payment, the birth data you entered for the reading you ordered (first name, date of birth, time of birth and place of birth together with the coordinates derived from it, plus gender and email address where you provided them), the amount paid and its currency, any coupon code redeemed, the tier purchased, the country from your billing address, your IP address (to defend against unjustified chargebacks), pseudonymous analytics identifiers, the attribution data for your visit (the host and path of the referring site, your entry page, and the utm_source, utm_medium, utm_campaign and utm_content parameters of your entry URL, each where present), the ID of the reading delivered, your confirmation of the withdrawal waiver, and timestamps and status for the purchase, the reading generation and the confirmation email (dispatch, delivery, open, click). If a chargeback is raised we add its case number, the stated reason and the deadlines; if reading generation fails we keep the technical error message. Card numbers and bank details are not part of this record.

Why we keep it, and for how long: If someone disputes a payment with their bank (a chargeback), the card network gives us only a few days to prove that the service was ordered and actually delivered. Without this record we could not show that, not even when we did deliver correctly. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against unjustified chargebacks). The record is stored at Upstash (EU, Frankfurt) and deleted automatically after 5 years; that period reflects how long card networks can reopen a transaction after the original purchase. The period is sliding: every update to the record (e.g. a confirmed delivery or a later chargeback event) resets it back to the full 5 years. You can object to this processing or request deletion at any time; an email to support@birthcodex.com is enough.

To protect our payment routes from abuse (card testing), when there are unusually many payment attempts we briefly record the IP address and email address in our server logs (Art. 6(1)(f) GDPR).

8. Email: Brevo

For transactional email (the confirmation email with the link to your reading) we use Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany). Your email address is stored at Brevo and used for delivery and as a buyer record. Legal basis: Art. 6(1)(b) GDPR (contract). Brevo Privacy Policy

Daily horoscope & retrograde alert (newsletter): In addition to the transactional email, we run two separate, optional email subscriptions whose sending can be active or temporarily paused; any existing sign-up stays unaffected either way: a daily horoscope (a short interpretation based on the current planetary transits to your birth chart) and a retrograde alert (a notice whenever Mercury, Venus or Mars turns retrograde). Both are functionally a newsletter: you receive recurring emails until you unsubscribe. The sole legal basis is Art. 6(1)(a) GDPR (consent) via double opt-in; after signing up you receive a confirmation email with a link; only clicking it completes the sign-up. If you don't confirm, the sign-up automatically lapses after 7 days (daily horoscope) or 24 hours (retrograde alert), and no subscription is created.

What we store for this: For the daily horoscope we store your email address, first name and your complete birth data (date, time and place of birth), because we use it to recalculate your current transits every day, plus the time of sign-up and confirmation, the time of the last email sent, and an individual unsubscribe token. For the retrograde alert we deliberately store no birth data, only your email address, first name, the time of sign-up and confirmation, and an individual unsubscribe token. In both cases we additionally record which page you signed up from.

How long: We store a confirmed subscription without an automatic deletion period; it remains in place until you unsubscribe; we then delete the entry immediately and permanently. Storage is at Upstash (EU, Frankfurt), delivery via Brevo (see above).

Unsubscribing: Every daily-horoscope and retrograde email contains an unsubscribe link that revokes your consent instantly; alternatively, an email to support@birthcodex.com is enough. In the member area you can also pause the daily horoscope temporarily without fully unsubscribing.

Suppression list: If you unsubscribe, object to advertising, report one of our emails as spam, or an email to you bounces permanently, we note your email address on a suppression list so that we do not contact you again by mistake. For this we store your email address, the reason (unsubscribe, spam complaint or permanent bounce), the channel through which we learned of it and the time; Brevo keeps a corresponding blocklist for our account. Purpose: to honour your objection permanently and to stop sending to undeliverable addresses. Legal basis: Art. 6(1)(f) GDPR in conjunction with Art. 21(3) GDPR (our legitimate interest in reliably honouring your objection). Storage period: in deviation from the deletion described above, we keep this entry without a fixed deletion date for as long as it is needed to honour your objection. Recipients: our own list is stored at Upstash (EU, Frankfurt); the blocklist is operated by Brevo (see above).

9. Reach & performance: Vercel Analytics

Via our host Vercel we use Vercel Analytics and Speed Insights to measure page views, devices, countries of origin and performance metrics (load times, Web Vitals) anonymously. No cookies are set and no user IDs are created; the data cannot be traced back to individuals. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the service). Vercel Analytics Privacy

10. Web analytics: Google Analytics

We use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It uses cookies to analyse how the website is used; the generated information is usually transferred to a Google server in the USA (based on the EU Standard Contractual Clauses). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach analysis). You can prevent collection via the Google Analytics opt-out add-on or by blocking cookies in your browser.

11. Internal reading statistics: Upstash Redis & internal operational notifications

When you create a reading we store a compact record for evaluation and product improvement: your first name, date and place of birth (as entered), the approximate region (country from the IP address), your IP address (kept internally for security and fraud prevention), the traffic source (referrer host of your first visit), the entry page, the submit page, time on site before submitting, and a timestamp. When you open the finished reading we additionally measure how far you scrolled, which sections were in view and how long you stayed; we also keep each measurement in our analytics warehouse (section 19) together with your first name, your email address and your Google Analytics identifier. On a purchase we additionally record the amount paid and the Stripe session ID; your IP address is kept internally for security and fraud prevention. No automatic deletion period is set for this statistics record; it is kept until you expressly ask us to delete it.

Origin attribution in your browser: Your browser (sessionStorage) additionally remembers the path on the referring external site itself (e.g. "/reel/abc123" on instagram.com), with no search query or other parameters and truncated to 200 characters, plus the utm_source, utm_medium, utm_campaign and utm_content parameters of your entry URL, each where present. These values are transmitted to our server with every submission. We only use them when a source we have never seen before triggers a one-off internal notification to us, without storing the values themselves, or when you complete a purchase, in which case they become attribution data in the purchase record sent to Stripe (section 7). This is how we see which links bring visitors and purchases. If you arrive via a link in one of our emails (marked utm_medium=email), your browser (localStorage) also keeps these utm values for up to 30 days, together with the time of the click and, for our email series, the number of the series email (serie_step). We do not store an email address, a name or any other personal data. A click on a link in a later email of ours replaces the value; after 30 days it is deleted on your next visit to our site. This lets us attribute a purchase to the email that led to it, even if you buy in a new tab or on a later visit. You can delete the value at any time by clearing this site's data in your browser.

Reading content storage: the finished reading (birth data, computed results and interpretation texts) is stored in Upstash Redis: readings for up to 5 years, depending on use. The period slides: every time you reopen your reading, the period resets to its full length, so a reading you keep revisiting via its permanent link effectively stays available indefinitely. Without a further visit, the entry is automatically deleted once the period runs out. Separately, our customer records keep your birth data and the link to your reading for 5 years (section 20). Upstash (Upstash Inc., USA) stores this on servers in the EU (AWS, eu-central-1 region, Frankfurt); as Upstash Inc. is a US company, the processing additionally relies on the EU Standard Contractual Clauses (Art. 46 GDPR) and data is transmitted over TLS. You can request earlier deletion at any time (see below). Legal basis: Art. 6(1)(f) GDPR (legitimate interest); a copy of the balancing test is available on request.

Purchase entitlement (pseudonymous birth hash): So we can recognise that you are re-opening a reading you already bought, and avoid offering you the same product a second time (protection against an accidental double payment), we derive a pseudonymous key from your birth data (first name, date, time and place of birth). It is produced by a non-reversible one-way cryptographic process (SHA-256), contains no readable birth data itself and cannot be traced back to your inputs. Under this key we store only which tier or which individual interpretations you have already purchased, plus the time of purchase, not the content of your reading. Like the rest of the purchase record, it is kept at Upstash (EU, Frankfurt) for up to 5 years and then deleted; a further purchase resets this period back to the full 5 years. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correct order handling and preventing duplicate purchases); you can object to this processing or request deletion at any time.

Access log for chargebacks: Every time you open your reading, e.g. via the link in the confirmation email, we additionally log a hashed fingerprint of your IP address (SHA-256, non-reversible), your country and your browser's User-Agent together with a timestamp, for up to the last 50 accesses per reading. If someone disputes a payment with their bank, this lets us show that and when the reading was actually opened. Neither your name nor your full IP address is stored. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against unjustified chargebacks); kept for up to 5 years at Upstash (EU, Frankfurt), like the rest of the purchase record, then automatically deleted; this period also slides and is reset to the full 5 years on every further open (including internal clicks).

Type duo (comparing with friends): if you tap "Compare with friends" on your Codex type, you share a link that contains your first name, your Codex type, the element of your counterpart and the language. The link is signed so that it cannot be altered; it contains no birth data, no email address and no reference to your reading. We do not send it: you decide who receives it, and everyone who opens it sees these details. The comparison link that goes back to the inviting person contains the first names and types of both of you. If you open such a link and create a reading, we store the first name, Codex type, counterpart element and language of the person who invited you under the ID of your new reading in Upstash Redis (servers in the EU, Frankfurt), so that your reading can show the comparison. If you have your reading deleted, the entry is deleted with it; otherwise it expires automatically after 5 years at the latest. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the comparison that you or the inviting person started); you can object at any time (Art. 21 GDPR), an email to support@birthcodex.com is enough.

In addition, we use the messaging service Telegram for internal operational messages to our team; the service is provided by Telegram Messenger Inc., which according to its privacy policy (telegram.org/privacy) is the controller for the service and has appointed the European Data Protection Office (EDPO) as its EU representative. The messages can contain details from forms and orders as well as technical data such as the IP address. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the smooth operation and security of the service); you can object at any time (Art. 21 GDPR), an email to support@birthcodex.com is enough. Telegram is located outside the EEA: we are not aware of an EU adequacy decision covering Telegram and have not agreed standard contractual clauses with it. In the Telegram channel, messages remain until the reported matter is closed and any claims arising from it are time-barred, at the latest until the end of the third calendar year after the message; after that we delete them. Our own system keeps a short log of them for 90 days and then deletes it automatically.

Backup copies: So that we can restore our data after a technical failure, we make backup copies of the data described in this policy that is stored at Upstash, and keep them with Google Cloud EMEA Limited, Dublin, Ireland, on servers in Germany (Frankfurt); the safeguards stated for Google Cloud in this policy apply. Daily copies are deleted automatically after 35 days and monthly copies after 13 months, and we use them for no other purpose. In deviation from the deletions and retention periods described in this policy, data that has been deleted or has expired therefore stays in these copies until then. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and availability of our data); you can object at any time (Art. 21 GDPR); an email to support@birthcodex.com is enough.

Upstash Privacy

12. Cookies

We use technically necessary cookies for the website to function and analytics cookies (Google Analytics), set on the basis of Art. 6(1)(f) GDPR. You can block or delete cookies in your browser settings.

13. Your rights

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR)
Withdrawal of consent: at any time with future effect

To exercise your rights, an email to support@birthcodex.com is enough; deletion then covers both the Redis record and the history of that notification.

14. Right to lodge a complaint

You have the right to complain to a data protection supervisory authority. The competent authority in Cyprus is:

Office of the Commissioner for Personal Data Protection
1 Iasonos Street, 1082 Nicosia, Cyprus
www.dataprotection.gov.cy

15. Minors

Birth Codex is intended exclusively for adults. By using it you confirm you are at least 18. We do not knowingly process data of children under 16. Where processing exceptionally relies on consent (Art. 6(1)(a) GDPR), it requires parental consent for minors under 16 (Art. 8 GDPR). If we learn that such data reached us without that consent, we delete it without delay.

16. Updates

As of 23 October 2026. We may adapt this policy to reflect changes in the law or the service.

17. Use of Artificial Intelligence

For the language processing of your reading's interpretive texts, we use an AI language model operated by our processor, Anthropic PBC. The AI creates the interpretive texts based on your birth data, the values computed from them and templates we curated; the underlying astronomical and numerological calculations themselves are computed deterministically, without AI.

This processing does not constitute an automated individual decision within the meaning of Art. 22 GDPR: your reading has no legal effect on you and does not similarly significantly affect you.

The content serves personal inspiration and entertainment and does not replace professional advice.

18. Cloudflare: DNS/CDN & bot protection

Our website runs technically behind Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as a DNS and CDN layer in front of our hosting provider Vercel (section 5). Cloudflare automatically processes technical data (IP address, requested URL, browser type) on every page load to deliver and protect the website.

We additionally use Cloudflare Turnstile as bot protection on several forms (the birth data form for your reading, the contact form); your IP address and a verification token are transmitted to Cloudflare to detect automated abuse attempts.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical operation of the website and in abuse prevention). As Cloudflare, Inc. is a US company, the processing additionally relies on the EU Standard Contractual Clauses. Cloudflare Privacy Policy

19. Internal CRM & analytics warehouse: Google Cloud (BigQuery)

To understand how our product is used over time and to keep improving it, we maintain an internal CRM and analytics warehouse in Google BigQuery, a service of Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland. The data is stored in the EU, in Google Cloud data centres in Belgium or the Netherlands.

What we keep here: a pseudonymous birth-identity key (derived from your first name and birth data by a non-reversible one-way cryptographic process, SHA-256, containing no readable birth data and impossible to trace back to your inputs), an opaque person identifier, your first name, and a history of lifecycle events: that a reading was created, that a purchase was made (with the amount, currency and billing country), which lifecycle email was sent, opened or clicked, and when you gave or withdrew consent, as well as the measurements of how you read your reading (section 11).

Email address: these records may also contain your email address, so we can link the events to you. Card or bank details are never part of this data.

How long: 5 years. Each entry is deleted 5 years after the event it records. The period does not slide: a later event does not extend it. We also transfer the usage data from Google Analytics (section 10) into this warehouse; it is likewise kept there for 5 years and then deleted.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving the product and in managing the customer relationship). As Google is part of a US group, the processing additionally relies on the EU Standard Contractual Clauses, and data is transmitted over TLS. You can object to this processing or request deletion at any time; an email to support@birthcodex.com is enough. Google Cloud Privacy Notice

20. Customer records (CRM): recognising you and linking your reading

So that we can recognise you as the same person when you come back, link your reading to you and help you when you contact us, we keep an internal customer record for every person who creates a reading, including visitors who have not given us an email address or bought anything. It is stored at Upstash (EU, Frankfurt) and is separate from the analytics warehouse described in section 19.

What it contains: pseudonymous keys derived from your first name and birth data (SHA-256, not reversible), a random internal identifier, your first name, your date, time and place of birth, your language, the IDs of your readings, your email address if you have given it to us, the tier you have purchased, whether and when you confirmed marketing emails, the events the record is based on (for example a new reading, an email address you entered or a purchase), the IP address sent with those events (at most the last 20) and when we first and last recorded something about you. Once you give us an email address or make a purchase, we also assign you a customer number. Card numbers and bank details are never part of this record.

How long: 5 years. The period slides: every new event concerning you (for example another reading, an email address you give us, a purchase or a consent) resets it to the full 5 years. Without such an event, the record is deleted automatically once the 5 years have passed. This period applies regardless of how long the reading itself is kept (section 11), so a reading may already have been deleted while this record remains.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in recognising returning visitors, linking their readings to them and managing the customer relationship). We keep the IP address for security and fraud prevention. You can object to this processing or request deletion at any time; an email to support@birthcodex.com is enough.