Privacy Policy

Faltastik offers AI-assisted content for astrology and divination that is for entertainment purposes only; the data we process supports that experience and is never part of any medical, legal, financial or psychological advice process. This Privacy Policy explains how we collect, use and protect your personal data when you use Faltastik.

1. Data Controller

POI369 OÜ, registered at Paavli tn 5a/1, 10412 Tallinn, Estonia (registry code: 17460510), is the data controller for personal data processed through the Faltastik platform. For all privacy matters, contact us at [email protected].

The mobile app is distributed on the App Store and Google Play by our group company Chai Ventures LLC, which therefore appears as the seller on the store listings. The controller of your personal data remains POI369 OÜ.

2. Data We Collect

We may process the following categories of personal data when you use our service:

• Account and identity data: email address, chosen display name and profile photo.
• Profile and reading inputs: date of birth, questions you enter during a reading session, coffee-reading image descriptions and stated intentions.
• Payment metadata: card brand, last 4 digits, transaction ID and billing address, processed via Stripe for web payments or RevenueCat for mobile subscriptions and purchases. We never store full card numbers; this data lives exclusively within the relevant payment provider's infrastructure.
• Analytics and technical data: page-view events, feature-usage signals, IP address (anonymised), browser type and operating system: collected only if you have consented to analytics cookies.
• Reading security data: when you create a reading, your IP address, the approximate location derived from it (country/city/time-zone level) and your browser and device information are stored with the reading record to prevent abuse and keep the service secure (not consent-based; legitimate interest).
• Support communications: messages you send us via email or contact form.

3. Processing Purposes and Legal Bases

We process your data for the following purposes:

• Service delivery (GDPR Art. 6(1)(b): contract performance): account management, reading generation, subscription billing and customer support.
• Legal obligations (GDPR Art. 6(1)(c)): tax and accounting records, evidence retention for potential legal claims.
• Legitimate interests (GDPR Art. 6(1)(f)): fraud detection and security monitoring (including the IP address, approximate location and device information stored with a reading), and anonymised analytics to improve platform reliability.
• Consent (GDPR Art. 6(1)(a)): analytics cookies, diagnostic session recording, or optional communications such as marketing emails or campaign notifications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Reader memory

For member accounts, your reader keeps short notes about you to personalise later readings (for example important things going on in your life, topics you follow, cards that stood out in earlier readings, and the tone you prefer). Notes are extracted automatically by AI from your reading inputs and the interpretation, or added by you. This is profiling that tailors content to your preferences; it involves no automated decision with legal or similarly significant effects. No notes are kept or used until you tap "OK" or "Manage" on the notice shown after your first member reading (or switch memory on in settings). Guest readings are not remembered.

• Purpose and legal basis: personalising your readings; legitimate interests (GDPR Art. 6(1)(f)). You can object at any time by switching memory off (GDPR Art. 21); from that moment notes are no longer read and no new notes are written.
• Sensitive topics: we use automatic filters (word lists and an AI check) designed to keep special categories of data out of memory, such as health, sex life and sexual orientation, religion and beliefs, political opinions, ethnic origin, trade-union membership, biometric data and criminal convictions, as well as detailed financial information, ID numbers, contact details and the full names of other people. No filter is perfect; if you spot a note that slipped through, you can delete it with one tap. A reading may touch on these topics in the moment, but they are not knowingly remembered.
• Profile fields: while memory is on, details you enter in reading forms, such as your name, date of birth, relationship and work status, are kept to pre-fill later readings. They are not kept for temporary readings, while memory is off, or for guests; "Delete all memory" removes them too.
• Retention: notes are kept until you delete them. An automatically extracted note that is not used in any reading for 12 months is deleted automatically. Deleting a reading deletes the automatic notes it created or updated; notes you have edited yourself are yours and stay until you delete them. Deleting your account deletes all notes.
• Processor and international transfer: to extract, check and use notes in readings, the relevant text is sent to our AI service providers as data processors; the international transfer and its safeguards are described in that section. Notes are not sent to any provider other than those listed there, and are never sold or used for advertising.
• Your controls: under Settings > Reader memory you can view, edit and delete notes one by one or all at once, and switch memory off entirely. You can also make a single reading "temporary"; memory is neither read nor written for it. Notes and profile fields are included in your data export.

My circle (people you save)

In a member account you can save other people (for example a partner, a friend or family) to make compatibility and synastry readings easier. Such a record is that person's personal data; only the name and the relationship are required, the birth date, time and place are optional.

• Purpose and legal basis: preparing the compatibility readings you ask for (GDPR Art. 6(1)(b) / KVKK Art. 5(2)(c): performance of a contract). Add people only with their knowledge; you can also send an invite link so that the person enters their own details on their own account.
• Who sees it: the records are visible only in your account; they are not shared with other users and are not written to reader memory. When you ask for a compatibility reading, only the details that go into that reading are sent to our AI service providers to generate it.
• Retention and deletion: until you delete them; you can remove a person with one tap. When you delete your account, all records are deleted.
• Export: saved people are included in your data export file.

Notes after a reading

• What: a short note you leave yourself at the end of a reading; it is kept with that reading and deleted when the reading is deleted.
• Memory: if reader memory is on and the note does not touch a sensitive topic, the same note is also written to memory (the reader memory rules above apply); it is not written while memory is off, while it waits for your OK, or for a temporary reading.
• Reminder after 30 days: only if you ask for it, a single notification is sent about 30 days later; it does not contain the note and no more than one is sent per day.
• Control: you can edit or delete the note at any time; notes are included in your data export file and deleted with your account.

Ask your reader

• What is processed: your question, the signs of your saved birth chart and, if reader memory is on, summaries of your recent readings and your notes; they are sent to our AI service providers to generate the answer.
• Retention: the question and answer are kept in your account (also to count Premium's monthly included questions); they are included in your data export and deleted with your account.
• Cost: each question uses a credit or a Premium monthly included question; if no answer can be generated, the credit is refunded.

4. Data Sharing and Recipients

We share data with the following processors, strictly for the purposes described below:

• Supabase: authentication and database hosting. Your data is held on servers within the European Union.
• Stripe: payment processing and subscription management for web purchases. Stripe's own privacy policy applies to data processed within their infrastructure.
• RevenueCat: management of mobile app (iOS/Android) subscriptions and purchases.
• PostHog: product analytics, active only with your consent; usage data is hosted in the EU region.
• Sentry: application error monitoring and performance tracking. Personal identifiers are scrubbed before transmission and are not sent to Sentry.
• Expo: mobile push-notification infrastructure.
• Cloudflare: content delivery network (CDN) and security (bot/DDoS protection).
• Resend: delivery of transactional e-mails (account verification, password reset, purchase and account notices); only your e-mail address and the message content are transferred.

POI369 OÜ is incorporated in Estonia (Estonia), meaning our company records are held within the European Union and subject to EU data-residency requirements. We do not sell, rent or otherwise commercialise your personal data beyond the processors listed above.

Service providers / recipient groups: AI service providers

To generate readings and interpretations, answers to follow-up questions, reading images and reader-memory notes, your inputs (questions and text, photos you share, birth details where needed, and notes) are sent to our third-party AI service providers acting as data processors. The app and website refer to this recipient group; the current list is kept only here, and this section is updated if a provider changes.

• Currently: OpenAI (USA). Inputs are processed solely to generate the relevant content; per OpenAI's public statements, data submitted through its API is not used to train their models by default.
• International transfer: as the provider is located outside the European Economic Area and Türkiye, transfers are made under the safeguards required by the GDPR and KVKK, such as standard contractual clauses or, where applicable, your explicit consent. You can ask us which safeguard applies.
• Your confirmation: before your first reading we ask you to confirm this processing separately; readings cannot be generated without it.

5. Retention Periods

• Account data: for as long as your account is active. After a deletion request, the account and its data are permanently deleted within 30 days; signing in again during that window cancels the request.
• Reading records (including your follow-up questions and the answers to them) and uploaded photos: for as long as your account is active; deleted together with your account.
• Uploaded photos not added to a reading (for example a photo you abandoned or one that did not pass the photo check, including guest uploads): deleted together with their photo-check result in the daily automatic cleanup once 24 hours have passed since upload.
• IP address, approximate location and device information recorded with a reading: 1 year from creation; automatically deleted thereafter.
• Consent records (audit trail): 5 years for compliance audit purposes. When your account is deleted, these records are unlinked from your identity and kept without IP address or device information.
• Billing and payment metadata: 10 years in accordance with applicable tax law. When your account is deleted, these records are de-identified (only amount, date and transaction type remain).
• Support messages, newsletter subscription and personal memory records: deleted together with your account; in e-mail delivery logs your address is irreversibly hashed.

6. Your Rights

Under GDPR Chapter III, you have the following rights:

• Right to be informed about how your data is used.
• Right of access: to receive a copy of your personal data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) where legal grounds are met.
• Right to restriction of processing.
• Right to data portability in a machine-readable format.
• Right to object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making and profiling.

To delete your account and data directly, use Settings > Account in the app, Dashboard > Settings > My Data on the web, or follow the steps on our Delete Account page; your data is permanently deleted within 30 days of the request.

Submit other requests to [email protected] or through the /account page. We will respond within 30 days.

7. Children

Faltastik is intended for users aged 18 and over. We do not knowingly collect data from minors. If we become aware that a minor's data has been collected, we will delete it promptly.

8. Security

We apply industry-standard technical and administrative safeguards: including TLS encryption in transit, access control policies, and periodic security reviews: to protect your personal data from unauthorised access, alteration, disclosure or destruction.

9. Policy Changes

We may update this policy from time to time. For material changes, we will send notice to your registered email address at least 14 days before the change takes effect. Continued use of the platform after the notice period constitutes acceptance of the updated policy.

10. Contact

POI369 OÜ
Paavli tn 5a/1, 10412 Tallinn, Estonia
Email: [email protected]