Privacy Policy
What we collect, why, who else processes it, how to get it back or delete it.
Updated September 14, 2026
Contents
Privacy Policy
Last updated: 14 September 2026
1. Who is responsible
Septagram LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States, is the controller of the personal data described here.
Privacy questions and data-rights requests: privacy@septagram.app.
2. What we collect
You give us:
| Data | Why |
|---|---|
| Email address, password hash | To create and secure your account |
| Display name, language, gender (optional) | To address you correctly in readings |
| Date of birth; time and place of birth (optional) | To calculate charts — this is the core function of the Service |
| Current location (optional) | For local transits and the lunar calendar |
| Questions you ask, journal entries, saved readings | To deliver and store your readings |
| Payment details | Handled by our payment provider; we receive only status and the last four digits |
We collect automatically:
Device and browser type, approximate location from IP, pages visited, feature usage, timestamps, and error logs. Visit and page-view analytics are collected only after you accept analytics in the cookie banner.
Birth data is sensitive in practice even where it is not a special category in law. Providing it is optional. Without it, chart-based modules will not work, but the rest of the Service will.
3. Why we process it, and on what basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service you signed up for | Performance of a contract |
| Calculating charts from your birth data | Performance of a contract, at your request |
| Taking payment, preventing fraud | Contract; legitimate interests |
| Security, abuse prevention, debugging | Legitimate interests |
| Product analytics | Consent |
| Marketing email | Consent |
| Meeting legal and tax obligations | Legal obligation |
Where we rely on consent, you can withdraw it at any time in Settings → Data and privacy. Withdrawal does not affect processing that already happened.
4. AI processing
When you ask a question in Ask, our AI assistant, your question — and, if you have enabled personal context, a summary of your chart data — is sent to a third-party model provider to generate a response. We send the minimum needed to produce the reading.
Our current model provider is OpenRouter. We do not permit model providers to use your content to train their models. Providers are listed in section 6, and this policy is updated when they change.
5. What we do not do
- We do not sell your personal data.
- We do not share your readings, journal, or birth data with advertisers.
- We do not build advertising profiles, and we run no advertising or cross-site tracking technology.
- We do not publish your data. There is no public sharing of readings in the Service.
6. Who else processes your data
| Processor | Role | Location |
|---|---|---|
| Supabase | Database, authentication, backend functions, product analytics | EU / US |
| Lovable | Hosting and deployment | EU / US |
| Cloudflare | CDN, DNS, security | Global |
| OpenRouter | Generating AI assistant responses | US |
| — to be named before payments launch | Payment processing and invoicing | EU / US |
Each is bound by a data-processing agreement. Product analytics runs on our own database — there is no third-party analytics service and no analytics data leaves our infrastructure.
7. International transfers
We are based in the United States and some processors are outside the European Economic Area. Where data leaves the EEA, we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
8. How long we keep it
- Account data: while your account exists, then deleted within 30 days.
- Readings and journal entries: while your account exists, or until you delete them.
- Payment and invoice records: as long as tax law requires, typically 7 years.
- Server and security logs: up to 90 days.
- Anonymous visit records: up to 12 months, then purged.
- Backups: overwritten on a rolling cycle, no longer than 35 days after deletion.
9. Your rights
If you are in the EEA or the UK, you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent. Residents of California and several other US states have comparable rights.
Three of these are built into the product. In Settings → Data and privacy you can download everything we hold about you, turn analytics on or off, and delete your account. For anything else, write to privacy@septagram.app. We respond within 30 days.
You also have the right to complain to your local data-protection authority.
10. Security
Data is encrypted in transit and at rest. Database access is governed by row-level security, so one account cannot read another's rows. Administrative access is limited and role-based. Payment card details never reach our servers.
No system is perfectly secure. If a breach affects your data and poses a risk to you, we will notify you and the relevant authority as the law requires.
11. Children
The Service is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, write to privacy@septagram.app and we will delete it.
12. Cookies and local storage
The Service stores a small number of items in your browser, most of them in local storage rather than in cookies. What they are and which ones need your consent is set out in the Cookie and local storage policy.
13. Language
This policy is written in English; translations are provided for convenience. If a translated version differs from the English one, the English version governs.
14. Changes
We will post any update here and change the date at the top. For material changes we notify you by email or in the Service before they take effect.
15. Contact
Septagram LLC 30 N Gould St, Ste N, Sheridan, WY 82801, United States privacy@septagram.app