Privacy Policy

Last updated: 2026-04-25

Faltastik offers AI-assisted content for astrology and divination that is for entertainment purposes only; the data we process supports that experience and is never part of any medical, legal, financial or psychological advice process. This Privacy Policy explains how we collect, use and protect your personal data when you use Faltastik.

1. Data Controller

POI369 OÜ, registered at Paavli tn 5a/1, 10412 Tallinn, Estonia (registry code: 17460510), is the data controller for personal data processed through the Faltastik platform. For all privacy matters, contact us at [email protected].

2. Data We Collect

We may process the following categories of personal data when you use our service:

Account and identity data: email address, chosen display name and profile photo.
Profile and reading inputs: date of birth, questions you enter during a reading session, coffee-reading image descriptions and stated intentions.
Payment metadata: card brand, last 4 digits, transaction ID and billing address, processed via Stripe for web payments or RevenueCat for mobile subscriptions and purchases. We never store full card numbers; this data lives exclusively within the relevant payment provider's infrastructure.
Analytics and technical data: page-view events, feature-usage signals, IP address (anonymised), browser type and operating system: collected only if you have consented to analytics cookies.
Support communications: messages you send us via email or contact form.

3. Processing Purposes and Legal Bases

We process your data for the following purposes:

Service delivery (GDPR Art. 6(1)(b): contract performance): account management, reading generation, subscription billing and customer support.
Legal obligations (GDPR Art. 6(1)(c)): tax and accounting records, evidence retention for potential legal claims.
Legitimate interests (GDPR Art. 6(1)(f)): fraud detection, security monitoring and anonymised analytics to improve platform reliability.
Consent (GDPR Art. 6(1)(a)): analytics cookies, diagnostic session recording, or optional communications such as marketing emails or campaign notifications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. Data Sharing and Recipients

We share data with the following processors, strictly for the purposes described below:

Supabase: authentication and database hosting. Your data is held on servers within the European Union.
Stripe: payment processing and subscription management for web purchases. Stripe's own privacy policy applies to data processed within their infrastructure.
RevenueCat: management of mobile app (iOS/Android) subscriptions and purchases.
PostHog: product analytics, active only with your consent; usage data is hosted in the EU region.
Sentry: application error monitoring and performance tracking. Personal identifiers are scrubbed before transmission and are not sent to Sentry.
OpenAI: reading generation. Photos and text you submit are processed solely to generate the relevant reading. Per OpenAI's public statements, data submitted through its API is not used to train their models by default.
Expo: mobile push-notification infrastructure.
Cloudflare: content delivery network (CDN) and security (bot/DDoS protection).

POI369 OÜ is incorporated in Estonia (Estonia), meaning our company records are held within the European Union and subject to EU data-residency requirements. We do not sell, rent or otherwise commercialise your personal data beyond the processors listed above.

5. Retention Periods

Account data: for as long as your account is active, plus 90 days after deletion (dispute and legal review window).
Reading records: 1 year from creation; automatically deleted thereafter.
Consent records (audit trail): 5 years for compliance audit purposes.
Billing and payment metadata: 10 years in accordance with applicable tax law.

6. Your Rights

Under GDPR Chapter III, you have the following rights:

Right to be informed about how your data is used.
Right of access: to receive a copy of your personal data.
Right to rectification of inaccurate or incomplete data.
Right to erasure (“right to be forgotten”) where legal grounds are met.
Right to restriction of processing.
Right to data portability in a machine-readable format.
Right to object to processing based on legitimate interests or for direct marketing.
Rights related to automated decision-making and profiling.

To delete your account and data directly, use Settings > Account in the app, Dashboard > Settings > My Data on the web, or follow the steps on our Delete Account page; your data is permanently deleted within 30 days of the request.

Submit other requests to [email protected] or through the /account page. We will respond within 30 days.

7. Children

Faltastik is intended for users aged 18 and over. We do not knowingly collect data from minors. If we become aware that a minor's data has been collected, we will delete it promptly.

8. Security

We apply industry-standard technical and administrative safeguards: including TLS encryption in transit, access control policies, and periodic security reviews: to protect your personal data from unauthorised access, alteration, disclosure or destruction.

9. Policy Changes

We may update this policy from time to time. For material changes, we will send notice to your registered email address at least 14 days before the change takes effect. Continued use of the platform after the notice period constitutes acceptance of the updated policy.

10. Contact

POI369 OÜ
Paavli tn 5a/1, 10412 Tallinn, Estonia
Email: [email protected]

2. Data We Collect

We may process the following categories of personal data when you use our service:

Account and identity data: email address, chosen display name and profile photo.

Profile and reading inputs: date of birth, questions you enter during a reading session, coffee-reading image descriptions and stated intentions.

Payment metadata: card brand, last 4 digits, transaction ID and billing address, processed via Stripe for web payments or RevenueCat for mobile subscriptions and purchases. We never store full card numbers; this data lives exclusively within the relevant payment provider's infrastructure.

Analytics and technical data: page-view events, feature-usage signals, IP address (anonymised), browser type and operating system: collected only if you have consented to analytics cookies.

Support communications: messages you send us via email or contact form.

3. Processing Purposes and Legal Bases

We process your data for the following purposes:

Service delivery (GDPR Art. 6(1)(b): contract performance): account management, reading generation, subscription billing and customer support.

Legal obligations (GDPR Art. 6(1)(c)): tax and accounting records, evidence retention for potential legal claims.

Legitimate interests (GDPR Art. 6(1)(f)): fraud detection, security monitoring and anonymised analytics to improve platform reliability.

Consent (GDPR Art. 6(1)(a)): analytics cookies, diagnostic session recording, or optional communications such as marketing emails or campaign notifications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. Data Sharing and Recipients

We share data with the following processors, strictly for the purposes described below:

Supabase: authentication and database hosting. Your data is held on servers within the European Union.

Stripe: payment processing and subscription management for web purchases. Stripe's own privacy policy applies to data processed within their infrastructure.

RevenueCat: management of mobile app (iOS/Android) subscriptions and purchases.

PostHog: product analytics, active only with your consent; usage data is hosted in the EU region.

Sentry: application error monitoring and performance tracking. Personal identifiers are scrubbed before transmission and are not sent to Sentry.

OpenAI: reading generation. Photos and text you submit are processed solely to generate the relevant reading. Per OpenAI's public statements, data submitted through its API is not used to train their models by default.

Expo: mobile push-notification infrastructure.

Cloudflare: content delivery network (CDN) and security (bot/DDoS protection).

5. Retention Periods

Account data: for as long as your account is active, plus 90 days after deletion (dispute and legal review window).

Reading records: 1 year from creation; automatically deleted thereafter.

Consent records (audit trail): 5 years for compliance audit purposes.

Billing and payment metadata: 10 years in accordance with applicable tax law.

6. Your Rights

Under GDPR Chapter III, you have the following rights:

Right to be informed about how your data is used.

Right of access: to receive a copy of your personal data.

Right to rectification of inaccurate or incomplete data.

Right to erasure (“right to be forgotten”) where legal grounds are met.

Right to restriction of processing.

Right to data portability in a machine-readable format.

Right to object to processing based on legitimate interests or for direct marketing.

Rights related to automated decision-making and profiling.

Submit other requests to [email protected] or through the /account page. We will respond within 30 days.