Privacy Policy & Confidentiality

1. What We Collect, Why, and On What Basis

(a) Account data: email, display name, password hash — to create and secure your account. Basis: performance of contract.

(b) Birth profile: name, date, time and place of birth, gender — to generate charts and provide consultations; the service cannot be provided without them. Basis: performance of contract.

(c) Order and payment data: order records, billing and shipping address, payment status (full card numbers are handled by the payment provider and not stored by us). Basis: performance of contract; legal accounting and tax obligations.

(d) Consultation content: in-app messages with masters, uploaded materials, delivered reports. Basis: performance of contract; for sensitive elements see Section 2.

(e) Technical data: IP address, device and browser information, strictly necessary cookies and local storage. Basis: legitimate interests (security, fraud prevention, basic functionality).

(f) Marketing preferences: we send marketing emails only if you opt in. Basis: consent, withdrawable at any time.

(g) Advertising and analytics data: only after you agree on this site to the use of advertising and analytics cookies, the scripts of the platforms listed in Section 7 collect page views, chart completions, sign-up submissions, contact clicks, order creation and payment events (including amount and currency), together with the IP address, device and browser information and page address that such scripts inherently collect. Basis: consent, which you may withdraw at any time via "Cookie settings" in the footer.

2. Sensitive Information and Information About Others (Important)

2.1 Your date, time and place of birth are not themselves special-category data; we use them only for charting and consultations.

2.2 Information you share during a consultation may concern health, family and marriage, fertility or beliefs, and ordering a blessing ritual may indicate your beliefs. We process such information only after you give explicit consent by ticking the dedicated box before placing a consultation order, and only for that consultation. You may withdraw consent at any time; withdrawal does not affect processing already carried out. To help you and the master communicate across languages, the text of messages between you and the master may be translated by a machine-translation provider located in mainland China (see Sections 4 and 6). We send only the text that needs translating, never your identity information.

2.3 Where you order a chart or consultation for another person, you warrant that you have their consent and have informed them of this Policy.

3. How We Use Information

To provide and improve charting, consultation, item and ritual services; process orders, payments and refunds; relay messages between you and masters and, where you use different languages, provide machine translation; secure accounts and prevent fraud; comply with legal obligations; and send marketing where you have consented. We do not use your information for automated decisions that have legal or similarly significant effects on you; charts are generated automatically as part of the service, not as a decision about you. Where you have consented, measure the effectiveness of our advertising and optimise ad delivery (see Sections 5(c) and 7).

4. Confidentiality Commitment (Important)

Your birth information, questions and consultation content are disclosed only to the master handling your order, and only to the extent necessary to provide the service. We do not disclose your consultation content to unrelated third parties without your consent. From 10 October 2026, where you and the master use different languages, the text of messages is sent for translation to the machine-translation provider we use, Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (DeepSeek, located in mainland China). We send only the message text that needs translating, never your name, email, order number, birth information or attachments, and nothing that identifies you. How that provider stores the text, for how long, and whether it uses it to improve its models is governed by its own privacy policy (https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html); we have no data-processing agreement with it and cannot make commitments on these points. You can turn off translation of your own messages within the order; once off, your messages are not sent to that provider.

Masters sign confidentiality and data-processing obligations when they join: they must not disclose, distribute or use your information for any purpose beyond providing the service, and these obligations continue after the service ends.

Legal exceptions: we may disclose information where required by law, regulation or a competent authority, or where necessary to protect the life, safety or lawful rights of any person.

5. Who We Share With

(a) The master handling your order (as necessary to provide the service); (b) service providers acting for us: Stripe (payments), Resend (email delivery), Cloudflare (email routing and network security) and Tencent Cloud (hosting, Hong Kong), each only as needed to perform their function for us and bound by data-processing agreements; and DeepSeek (machine translation of messages, mainland China), whose processing is governed by its own privacy policy, see Section 4; (c) Advertising and analytics platforms, only with your consent: Meta Platforms Ireland Limited (EU/EEA/UK users) or Meta Platforms, Inc. (other users); TikTok Technology Limited (Ireland) or TikTok Pte. Ltd. (Singapore); Google Ireland Limited or Google LLC. Purpose: measuring the effectiveness of the advertising we run on these platforms and optimising delivery. These platforms act as independent or joint data controllers for the data their scripts collect, under their own privacy policies (Meta: facebook.com/privacy/policy; TikTok: tiktok.com/legal/privacy-policy; Google: policies.google.com/privacy). Their scripts load only after you consent via the cookie banner or "Cookie settings" on this site, and you may withdraw at any time. Transfers to the United States and elsewhere rely on each platform's certification under the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as published by the platform. (d) where required by law or to protect lawful rights. We do not sell your personal information or share it with third parties for their own marketing.

6. Where Data Is Stored and International Transfers

Our servers and databases are located in Hong Kong (Tencent Cloud, Hong Kong). If you are elsewhere, your information is transferred to and stored in Hong Kong.

Some of our service providers (Stripe, Resend, Cloudflare) are located in the United States and elsewhere. When we transfer EU/UK personal data to them, we rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum) or their certification under the EU-US Data Privacy Framework. You may request a copy of the relevant safeguards at the email below.

Transfers to mainland China. From 10 October 2026, message text sent for translation is transferred to DeepSeek in mainland China. Mainland China has not been recognised by the EU or the UK as providing adequate data protection; local law may allow public authorities to access data without notifying you, and your ability to exercise data rights there may be limited. If your order address is in the EU/EEA or the United Kingdom, we do not currently provide machine translation for your order and your messages are not sent to that provider; the rest of the service is unaffected. Users elsewhere can turn translation off within the order at any time.

The master handling your order may be located outside Hong Kong; their processing is governed by the data-processing and confidentiality terms of their agreement with us.

7. Cookies and Local Storage

Strictly necessary (no consent required): the login cookie (set only after you sign in); the shopping-cart entry in local storage (items and quantities only); and the "remember your cookie choice" entry in local storage (dp_consent, kept for 1 year, recording your consent to or refusal of the advertising and analytics cookies below). Fonts and static assets are hosted by us. We keep an anonymous count of two events, "chart completed" and "sign-up submitted", and of the choice you make in the cookie banner or "Cookie settings" (agree, essential only, or a browser privacy signal), recording only the event name and interface language, without recording IP address, device identifiers, session identifiers or anything that could identify you, and without using any browser storage.

Advertising and analytics (only with your consent): on your first visit you will see a cookie banner. Only if you click "Agree" do we load the scripts of the platforms below; if you click "Essential only" or make no choice, none of these scripts is loaded and none of these cookies is set. You can change your choice at any time via "Cookie settings" in the footer. If your browser sends a Global Privacy Control signal, we treat it as "Essential only". These scripts set the following cookies and send your IP address, device and browser information and page address to the respective platform:

Names and durations are as published by each platform. The only events sent to the platforms are: page view, chart completed, sign-up submitted, contact click, order created, and payment completed (with amount, currency and an irreversibly hashed order identifier used for de-duplication); we never send your name, email, birth information or consultation content.

You may also clear cookies and local storage in your browser settings, which will sign you out and empty your cart.

8. Data Retention

Account data and birth profile: for the life of your account, deleted within 30 days of account closure (unless retention is required by law). Order and payment records: 7 years from the end of the transaction year, to meet Hong Kong tax and accounting requirements. Consultation content (including machine translations): 24 months after delivery, for dispute and after-sales handling, then deleted or anonymised; translations are deleted together with the originals. Retention by the translation provider of the text it receives is outside our control; see Section 4. You may delete your birth profile earlier at any time in your account. Marketing preferences: until you withdraw.

9. Data Security

We use reasonable technical and organisational measures to protect your information (hashed passwords, encrypted transmission, access controls, least privilege). No system is perfectly secure, so please safeguard your account credentials. If a data breach is likely to affect your rights, we will notify you and the relevant authorities as required by law.

10. Your Rights

10.1 Wherever you are, you may: access the personal information we hold about you; correct inaccurate information; delete information (except where we must retain it by law); and withdraw any consent you have given. You may withdraw your consent to advertising and analytics cookies at any time via "Cookie settings" in the footer; withdrawal does not affect the lawfulness of processing before withdrawal.

10.2 If you are in the EU/EEA or the United Kingdom, you also have the right to: receive the data you provided in a machine-readable format (portability); restrict or object to processing; not be subject to solely automated decisions; and lodge a complaint with the data protection authority in your country.

10.3 If you are a California resident, you have the right to know the categories of information we collect and their purposes, to request deletion, and not to be discriminated against for exercising your rights. We do not sell personal information.

10.4 How to exercise: manage your birth profile and marketing preferences in your account, or email [email protected]. We will respond within 30 days of receiving your request; for complex requests this may be extended by up to 60 further days, and we will tell you why within the first 30 days. Exercising your rights is free.

11. Minors

The Platform is intended for persons aged 18 and over. We do not knowingly collect personal information from minors; if we become aware of such data we will delete it promptly. At checkout we ask you to confirm that you are 18 or older. If we learn that a purchaser is under 18, we will cancel the order, refund it and delete the related information.

12. Our Representatives

We are in the process of appointing a representative in the EU under Article 27 GDPR; the details will be published on this page once appointed. We are in the process of appointing a representative in the United Kingdom under Article 27 UK GDPR; the details will be published on this page once appointed. Until then, you can contact us or exercise your rights directly at [email protected].

13. Changes to This Policy

We may update this Policy. We will give at least 14 days' notice of material changes by email or in-app notice.

14. Contact

Privacy matters: [email protected]; general matters: [email protected].