Privacy Policy

1. Controller

G.M.L. Global Mind Ltd
6 Dimokratias, 4528 Pentakomo, Limassol, Cyprus
Email: [email protected]
Represented by: Marcus Meurer & Felicia Meurer (Directors)

For any privacy question, reach us at [email protected].

2. Data we collect

First name
Date, time and place of birth
Email address (only if you save your reading by email or make a purchase)
IP address (automatically on page load)
Payment data (processed directly by Stripe — never stored by us)

3. Purposes

Creating your personal Birth Codex reading (birth data, name)
Delivering the reading by email (email address)
Processing payments (email, payment data via Stripe)
Abuse prevention and rate limiting (IP address)
Analysing and improving the service (anonymised usage data)

4. Legal bases

Art. 6(1)(b) GDPR — performance of a contract (creating the reading, payment)
Art. 6(1)(a) GDPR — consent (email communication)
Art. 6(1)(f) GDPR — legitimate interest (abuse prevention, analytics)

5. Hosting — Vercel

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA; function execution and data processing take place in the EU (Frankfurt, region fra1). Vercel automatically processes technical data (IP address, browser type, access time). As Vercel Inc. is a US company, the processing additionally relies on the EU Standard Contractual Clauses. Vercel Privacy Policy

6. Text processing by a data processor

To prepare the wording of your reading we transmit your first name and the computed values (no raw data such as date or place of birth) to our data processor Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA. This data is not used for their own training purposes. Transfers are based on the EU Standard Contractual Clauses. Anthropic Privacy Policy

7. Payments — Stripe

Payments are handled by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Your payment data is processed directly by Stripe; we never receive card or bank details — only a confirmation of payment. Stripe Privacy Policy

8. Email — Brevo

For transactional email (the confirmation email with the link to your reading) we use Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany). Your email address is stored at Brevo and used for delivery and as a buyer record. Legal basis: Art. 6(1)(b) GDPR (contract). We currently do not send a newsletter. Brevo Privacy Policy

9. Reach & performance — Vercel Analytics

Via our host Vercel we use Vercel Analytics and Speed Insights to measure page views, devices, countries of origin and performance metrics (load times, Web Vitals) anonymously. No cookies are set and no user IDs are created; the data cannot be traced back to individuals. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the service). Vercel Analytics Privacy

10. Web analytics — Google Analytics

We use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It uses cookies to analyse how the website is used; the generated information is usually transferred to a Google server in the USA (based on the EU Standard Contractual Clauses). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach analysis). You can prevent collection via the Google Analytics opt-out add-on or by blocking cookies in your browser.

11. Internal reading statistics — Upstash Redis & Telegram

When you create a reading we store a compact record for evaluation and product improvement: your first name, date and place of birth (as entered), the approximate region (country from the IP address — the full IP is not stored), the traffic source (referrer host of your first visit), the entry page, the submit page, time on site before submitting, and a timestamp. When you open the finished reading we additionally measure pseudonymously how far you scrolled, which sections were in view and how long you stayed (no name, no date of birth). On a purchase we additionally record the amount paid and the Stripe session ID (no email, no full IP).

Reading content storage: the finished reading (birth data, computed results and interpretation texts) is stored in Upstash Redis — free teaser readings for 1 year, paid full readings for up to 5 years — so you can revisit it via a permanent link, then automatically deleted. Upstash (Upstash Inc., USA) stores this on servers in the EU (AWS, eu-central-1 region, Frankfurt); as Upstash Inc. is a US company, the processing additionally relies on the EU Standard Contractual Clauses (Art. 46 GDPR) and data is transmitted over TLS. You can request earlier deletion at any time (see below). Legal basis: Art. 6(1)(f) GDPR (legitimate interest); a copy of the balancing test is available on request.

Purchase entitlement (pseudonymous birth hash): So we can recognise that you are re-opening a reading you already bought — and avoid offering you the same product a second time (protection against an accidental double payment) — we derive a pseudonymous key from your birth data (first name, date, time and place of birth). It is produced by a non-reversible one-way cryptographic process (SHA-256), contains no readable birth data itself and cannot be traced back to your inputs. Under this key we store only which tier or which individual interpretations you have already purchased, plus the time of purchase — not the content of your reading. Like the rest of the purchase record, it is kept at Upstash (EU, Frankfurt) for up to 5 years and then deleted. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correct order handling and preventing duplicate purchases); you can object to this processing or request deletion at any time.

In addition, the responsible party receives a technical operational notification with the same pseudonymised data via Telegram (Telegram FZ-LLC, Dubai, UAE). The UAE is a third country without an EU adequacy decision; this transfer is based on Art. 49(1)(f) GDPR (important business interest). Pseudonymisation is applied (no full name, no full IP, no email in the Telegram channel). Upstash Privacy / Telegram Privacy

12. Cookies

We use technically necessary cookies for the website to function and analytics cookies (Google Analytics), set on the basis of Art. 6(1)(f) GDPR. You can block or delete cookies in your browser settings.

13. Your rights

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR)
Withdrawal of consent — at any time with future effect

To exercise your rights, an email to [email protected] is enough; deletion then covers both the Redis record and the Telegram history.

14. Right to lodge a complaint

You have the right to complain to a data protection supervisory authority. The competent authority in Cyprus is:

Office of the Commissioner for Personal Data Protection
1 Iasonos Street, 1082 Nicosia, Cyprus
www.dataprotection.gov.cy

15. Minors

Birth Codex is intended exclusively for adults. By using it you confirm you are at least 18. We do not knowingly process data of children under 16. Where processing exceptionally relies on consent (Art. 6(1)(a) GDPR), it requires parental consent for minors under 16 (Art. 8 GDPR). If we learn that such data reached us without that consent, we delete it without delay.

16. Updates

As of June 2026. We may adapt this policy to reflect changes in the law or the service.