Privacy Policy

This policy explains what personal data MyMysticDay processes, on what legal basis, who receives it, how long it is kept, and what you can require of us. It is written to the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and, for cookies and similar storage, § 25 of the German Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG).

The short version: we collect what an account, a reading and a purchase actually need, and nothing beyond that. Birth details are encrypted in the database. Analytics do not load until you accept them. Nothing about your birth is sold, shared with advertising networks, or published on any page a search engine can reach.

Controller

TrendPlus Marketing & Webentwicklung — Volodymyr Snihovyi
Danziger Straße 9, 57223 Kreuztal, Germany
support@mymysticday.com

We are not required to appoint a data protection officer: we are a sole proprietorship, fewer than twenty people are permanently engaged in processing personal data, and our core activity is neither large-scale processing of special categories of data nor systematic monitoring. Data protection enquiries go to the address above and are answered by the controller personally.

What we process, and why

Using the site without an account

Our server records the usual access data: IP address, date and time, the page requested, the referring page, and browser and operating system identifiers. This is necessary to deliver the site, keep it secure and diagnose faults. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a functioning and secure service. Access logs are deleted or anonymised after 7 days.

Essential storage keeps your session, protects the forms against cross-site request forgery and remembers your cookie choice. It is required for the site to work, is not used to track you, and is described key by key in the cookie policy.

Free tools: tarot, birth charts, calculators

Tarot draws, birth chart calculations, compatibility checks and the numerology calculators can all be used without an account. Where you enter a date, time or place of birth, that information is processed solely to perform the calculation you asked for. Legal basis: Art. 6 (1) (b) GDPR, performance of a service you requested, and Art. 6 (1) (a) GDPR where you consent to us keeping the result.

A guest tarot result is stored so that its link keeps working. Results that are never revisited are deleted automatically after 180 days.

Free features carry usage limits, and enforcing a limit means counting. We record which free features an account or browser has used and when, for that purpose alone. Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (f) GDPR in our legitimate interest in preventing circumvention of those limits.

Birth data

Date, time and place of birth are the raw material of every astrological feature on this site. They are stored encrypted at rest, are never shown on any public or indexable page, and are never passed to advertising networks or data brokers.

We treat this information as sensitive even where the law does not require it. An interest in astrology or tarot may reveal something about your philosophical outlook, which Art. 9 GDPR protects. Where that is the case, our legal basis is your explicit consent under Art. 9 (2) (a) GDPR, given when you save a birth profile or ask for a personalised report. You may withdraw that consent at any time, with effect for the future, by deleting the profile or the account.

What you write to us in a reading request

Some products ask you to describe your question in your own words, and some features ask about your situation — a relationship status, a theme you want the reading to address. People often write more than the reading needs: a diagnosis, a separation, a pregnancy, a sexual orientation, a religious practice, a debt. Article 9 GDPR calls those special categories of personal data, and the moment you type one into a form we are processing it.

So: we process what you write solely to produce the reading you paid for, on the basis of your explicit consent under Art. 9 (2) (a) GDPR, given when you submit the form having been told this. It is stored with the order, encrypted at rest, visible only to the operator and to the author writing your reading, and never used for advertising, profiling, model training or any purpose other than answering you.

Our honest advice is to write the situation and leave out what the reading does not need. A question can be answered in full without a name, an employer, a diagnosis or a third party's identity, and everything you leave out is data neither of us has to protect.

Other people's data

A compatibility or synastry report needs a second person's birth details. You are responsible for having their agreement before you enter them. We process those details only to produce your report, never contact the other person, never build a profile of them, and delete them when you delete the chart or the account. If someone tells us their details were entered without their agreement, we will delete them on request.

Account

An account stores your email address, optionally a display name, your saved charts, saved readings, journal entries and order history. There is no password: you sign in with a one-time code sent to your email, or with Google. Legal basis: Art. 6 (1) (b) GDPR, performance of the contract of use.

If you begin a paid checkout while signed out, we create an account for the email address you enter, or attach the purchase to the existing account for that address. This lets us deliver and retain the purchase without requiring registration before payment. Typing an email does not sign anyone in: private access begins only after the six-digit code sent to that inbox is confirmed. The checkout email is not a newsletter subscription.

If you sign in with Google, we receive your Google account email address and, where you have set one, your name. We do not receive your Google password and we request no further permissions.

Purchases and subscriptions

For an order we process your email address, the product, the amount, the currency, the payment status and the identifiers Stripe returns. For a subscription we additionally process the plan, the billing period, the renewal date, the cancellation date and the payment history. We never see or store your full card number. Legal basis: Art. 6 (1) (b) GDPR for the contract, and Art. 6 (1) (c) GDPR for the retention obligations described below.

Proof that you consented

At checkout you confirm two things: that you accept the terms, and that you want your reading produced immediately even though this ends your withdrawal right. Both confirmations have legal consequences, so both are checked on our server and not merely in your browser — an order without them is refused and no payment is attempted.

Because those sentences decide whether you keep a statutory right, we record them with the order: the exact wording you were shown, the version of the terms it referred to, the time you confirmed, the IP address the confirmation came from, and your browser's identifier. The wording is stored as the words themselves rather than as a reference to a page that could later change.

Subscribing to Mystic Premium works the same way and records one thing more. The confirmation that the membership renews automatically carries the amounts you were shown — what is taken today, what recurs, and how often — and those figures are stored with it, because a private offer can change the first payment without changing the renewal price, and the record has to hold the version you actually saw rather than the standard one.

We keep that record for one reason and use it for one purpose — to be able to show, if a payment is later disputed, what you were actually asked and what you actually agreed to. Legal basis: Art. 6 (1) (c) GDPR, our obligation under Art. 7 (1) GDPR and § 312f BGB to be able to evidence the transaction, and Art. 6 (1) (f) GDPR, our legitimate interest in defending a claim. It is kept with the order and never used for marketing.

Fraud and payment abuse

We and Stripe check payments for signs of fraud, card testing and abuse of the refund policy. This can involve the IP address, the device and browser signature, the email address and the pattern of previous orders. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in not being defrauded, and Art. 6 (1) (c) GDPR where a check is required of us. No purchase is refused by automated means alone; where a check flags an order, a person looks at it.

Emails you asked for

The newsletter and the daily reading are opt-in and confirmed by a link sent to your address (double opt-in). We record the confirmation and the time it happened, because we have to be able to prove that you asked. Legal basis: Art. 6 (1) (a) GDPR. Every message carries a one-click unsubscribe link that works without signing in and never expires.

We log which messages were sent to which address and when, so that a message cannot be sent twice and so that delivery problems can be traced. We do not use tracking pixels to record whether you opened a message.

Emails about your own order

Order confirmations, delivery notices, refund confirmations, renewal reminders and notices about a change to these documents are part of performing the contract, not marketing. They are sent on the basis of Art. 6 (1) (b) GDPR and cannot be unsubscribed from while the contract lasts, because they are how we tell you what is happening to your money.

If you have bought from us, we may also email you about our own similar products. That is permitted by § 7 (3) UWG and Art. 6 (1) (f) GDPR, and only on the conditions that provision sets: you gave us the address in connection with a sale, you were told at the point of collection and in every message that you can object, and objecting costs nothing but the transmission. You may object at any time, in any message or by writing to us, and we will stop.

If you begin a checkout and do not finish it, we may send one reminder to the address you entered, on the same basis. One reminder, then nothing.

The current product-email sequence is deliberately bounded: one reminder about an unfinished checkout after about 4 hours; one related-product message about 3 days after a completed purchase; one purchase-credit offer about 14 days after an eligible birth-chart purchase; and, if a membership has ended, one return offer about 21 days after cancellation. Not every order qualifies for every message. Each product email identifies why it was sent, contains no tracking pixel, and has a permanent one-click opt-out that stops all future product recommendations and checkout reminders.

Contact form and reviews

A message sent through the contact form is processed to answer it (Art. 6 (1) (b) or (f) GDPR) and deleted once the matter is closed and no retention period applies.

A review you submit is held for moderation and read by a person before anything is published. If we publish it, it appears with the name or initials you chose, your rating and your text — never your email address. You can ask for it to be removed at any time. Where the review reached us through a private link sent to a paid order, we keep the connection to that order, because that connection is what the verified mark on the review states. Legal basis: Art. 6 (1) (a) GDPR for the publication, and Art. 6 (1) (f) GDPR for moderating submissions and for keeping the link to an order that a verified mark asserts.

Analytics

We use analytics to understand which pages people reach, where they leave, and which steps of a purchase break. These tools do not load, set anything on your device, or receive any data until you choose Accept in the cookie panel. If you choose Reject, or make no choice at all, they stay switched off and the site works exactly as it otherwise would.

• Google Analytics 4 — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Measures page views, sessions and the steps of the purchase funnel. We operate it with IP addresses truncated before storage, with Google Signals off, with advertising features off, and with Google Consent Mode so that no measurement cookie is written before consent. Data retention in Google's systems is set to the shortest interval Google offers.
• Microsoft Clarity — Microsoft Ireland Operations Limited, One Microsoft Place, Dublin 18, Ireland. Records aggregated interaction data — clicks, scrolls, where a page is abandoned — so that a broken step can be found. Clarity masks text input by default, and we leave that masking on, so what you type into a form is not captured.

Legal basis for the storage of and access to information on your device: your consent under § 25 (1) TDDDG. Legal basis for the subsequent processing of the resulting data: Art. 6 (1) (a) GDPR. You can withdraw that consent at any time, with effect for the future, from the cookie policy page; withdrawal does not affect the lawfulness of what happened before it.

We run no advertising networks, no advertising pixels and no remarketing tags on this site. If that ever changes, the tool will be named in this policy and in the cookie policy before it is switched on, it will sit behind the same consent, and we will say so in the change note at the foot of this page.

Artificial intelligence

No artificial intelligence system generates the readings, reports or interpretations on this site. The astronomical part is arithmetic performed on our own servers; the written part is composed by people. Nothing you enter is sent to an external AI provider, and nothing you enter is used to train a model — ours or anyone else's.

If we introduce an AI-assisted feature, it will be labelled as such where you use it, this policy will name the provider and the country of processing before the feature goes live, and where the feature would send your input to that provider it will run on your consent under Art. 6 (1) (a) GDPR rather than being switched on for everyone.

Who receives your data

We use the following processors and recipients, each only to the extent the function requires:

• Our hosting provider — operates the servers on which this site, its database and its backups run, and sends our email. Servers are located in Germany. Engaged under a data processing agreement pursuant to Art. 28 GDPR.
• Stripe — payment processing. Receives your email address, the amount and the order reference; handles card details directly, so they never reach our server. Stripe Payments Europe Ltd., Ireland, with onward transfer within the Stripe group including the United States.
• Google — optional sign-in, if you choose it, and analytics, if you consent to it. Google Ireland Ltd.
• Microsoft — interaction analytics, if you consent to it. Microsoft Ireland Operations Ltd.
• Open-Meteo geocoding — converts a place name you type into coordinates and a time zone. It receives the search text, never your date or time of birth, and never anything identifying you.
• The author of a hand-written reading — where you order a reading written by a person, that person sees your question and the chart it concerns, and nothing else about you. They are bound in writing to confidentiality and to using the material for your reading alone.

We do not sell personal data. We do not share it for cross-context behavioural advertising. We do not disclose it to anyone else except where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim.

Transfers outside the EU

Stripe, Google and Microsoft may process data in the United States. Such transfers are covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise by the Commission's Standard Contractual Clauses together with supplementary technical and organisational measures. You may request a copy of the safeguards from the address above.

Everything we control ourselves — the application, the database, the backups, the email — stays on servers in Germany.

How long we keep it

• Access logs — 7 days.
• Guest tarot results that were never revisited — 180 days.
• Account data, saved charts, journal entries — until you delete the account.
• Orders, payments and invoices — up to 10 years, because German commercial and tax law requires it (§ 257 HGB, § 147 AO). These records are retained even after an account is deleted, and are then processed only to meet that obligation and to defend a claim arising from the order.
• Consent records for a purchase — with the order, for the same period, because they are what proves the order was properly concluded.
• Newsletter consent records — for the duration of the subscription and for as long afterwards as we may need to prove the consent was given.
• Analytics data — for the shortest retention period the provider offers, currently 2 months in Microsoft Clarity and 14 months in Google Analytics.
• Records of a refund refused for abuse — 3 years, the ordinary limitation period, and only the minimum needed to recognise a repetition.

Data security

The site is served only over TLS. Birth details are encrypted at rest. There are no passwords to steal, because sign-in uses a single-use code or Google. Administrative access is restricted to the operator. Backups are held by the hosting provider in Germany. Where a breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and, where the risk is high, notify you directly.

Children

This site is not directed to children. You must be at least 16 to create an account, which is the age Germany has set under Art. 8 (1) GDPR, and at least 18 to buy anything. We do not knowingly collect data from anyone under 13 and will delete such an account and its data on becoming aware of it.

Your rights

You have the right to access your data (Art. 15), to have inaccurate data corrected (Art. 16), to have data erased (Art. 17), to restrict processing (Art. 18), to receive your data in a portable format (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future (Art. 7 (3)).

Two of these are built into the site and need no correspondence: export your data and delete your account are available from your account at any time. Everything else goes to the address above and is answered within one month.

You have an unconditional right to object to direct marketing under Art. 21 (2) GDPR. If you exercise it we stop, without asking why.

You also have the right to lodge a complaint with a supervisory authority. The one responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany

If you are in the United States

We are a German business and we apply the GDPR to everyone, wherever they live, because running two standards would mean running the weaker one for someone. The rights described above are therefore available to you in full, and you do not have to be in Europe to use them.

For the avoidance of doubt, in the language of the California Consumer Privacy Act as amended: in the preceding twelve months we have not sold personal information and we have not shared personal information for cross-context behavioural advertising, and we do not do so now. We do not offer financial incentives in exchange for personal information, and we do not discriminate against anyone for exercising a privacy right. We do not currently meet the thresholds that make the CCPA apply to a business, and we honour these requests regardless.

Automated decision-making

Astrological and tarot results on this site are produced by arithmetic and by written interpretations we publish. They are not automated decisions producing legal or similarly significant effects within the meaning of Art. 22 GDPR: nothing on this site decides anything about you, and no result affects any right, entitlement or obligation you hold. We carry out no profiling for advertising purposes.

Is providing data required?

No. You can use most of this site without an account and without giving a name. Where information is genuinely necessary — an email address to deliver a report you bought, a date of birth to calculate a chart — the feature simply cannot work without it, and we say so at the point we ask.

Changes

We update this policy when the processing it describes changes. A new tool, a new recipient or a new purpose is named here before it goes live, not after. Where a change materially affects you and you have an account, we tell you by email. The current version always applies and is dated by its last update on this page.