Privacy Policy

1. Information we collect

We collect the following categories of information:

Account data — an anonymous identifier created for guest sessions, and, if you sign in, your name, email address, and profile photo from your chosen sign-in provider.

Reading and message content — the messages you send, your reading history, the advisor you select, and related session details.

Purchase data — your credit balance and transaction history, the package purchased, the billing email associated with your payments, and limited payment-related information used to deliver credits and prevent fraud. Your full payment-card number is collected and stored by our payment processor, not by us.

Device and technical data — IP address, browser and device information, and identifiers used to operate and secure the Service and to detect and prevent fraud and abuse.

Usage and analytics data — pages viewed, features used, and events within the Service.

Marketing and attribution data — cookies and identifiers, advertising click identifiers, and campaign parameters that tell us how you found us.

Communications — messages you send us, such as support and refund requests.

2. How we use your information

We use your information to: provide and operate the Service and deliver readings; process purchases and deliver credits; provide customer support and handle refunds; detect, investigate, and prevent fraud, abuse, and chargebacks; measure and improve the Service; and comply with our legal obligations.

3. Fraud and abuse prevention

To protect the Service, our advisors, and legitimate customers, we use fraud-prevention measures and maintain internal records of identifiers (such as device, payment, customer, and email identifiers) associated with fraud, chargebacks, or abuse. We may share certain identifiers with our payment processor to prevent fraudulent transactions. We rely on our legitimate interest in securing the Service and preventing financial loss for this processing.

4. Payments

Payments are processed by Stripe. We receive confirmation of your purchase and limited details needed to deliver credits and prevent fraud, but we do not collect or store your full payment-card number. Stripe's handling of your data is governed by its own privacy policy.

5. Service providers and sharing

We share data with trusted third-party service providers that process it on our behalf under appropriate agreements, to provide hosting and infrastructure, process payments, secure the Service and prevent fraud, deliver readings, and measure and support the Service through analytics and advertising partners. Our key providers include Stripe, Inc. (payment processing), Google LLC (Firebase hosting, authentication, and database infrastructure; Google Ads measurement), Vercel Inc. (website hosting), Meta Platforms (advertising measurement), and analytics providers such as Mixpanel and PostHog. We may also disclose information where required by law, to enforce our terms, or in connection with a corporate transaction. We do not sell your personal data for money.

6. Cookies and similar technologies

We and our partners use cookies and similar technologies to keep you signed in, remember preferences, measure usage, prevent fraud, and (where permitted) support advertising and attribution. Where required by law, we ask for your consent to non-essential cookies. You can control cookies through your browser settings.

7. Legal bases (EEA/UK)

Where the EU or UK General Data Protection Regulation applies, we process personal data on these legal bases: performance of our contract with you (to provide the Service and process purchases); our legitimate interests (to secure the Service, prevent fraud, and analyze and improve it); your consent (for non-essential cookies and certain marketing, which you may withdraw at any time); and compliance with legal obligations.

8. International transfers

We and our providers may process your data in countries other than your own, including the United States. Where we transfer personal data internationally, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

9. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service, then for as long as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. Records related to fraud and chargeback prevention may be retained longer where necessary for those purposes.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data; to object to or restrict certain processing; and to withdraw consent. If you are in the EEA or UK, you may also lodge a complaint with your local data-protection authority. If you are a California resident, you have rights to know, delete, and correct your personal information and to opt out of any “sharing” for cross-context behavioral advertising; we do not sell personal information for money. You can delete your account from within the app, which removes your associated profile data, or exercise any of these rights by contacting us.

11. Children

The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Security

We use technical and organizational measures designed to protect your personal data. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date and, where appropriate, provide additional notice of material changes.

14. Contact

Orb is operated by Seventy Souls Tech Group Ltd, Griva Digeni 78, 2nd floor, Flat/Office V1, Neapoli, 3101, Limassol, Cyprus, the data controller for personal data processed through the Service. For privacy questions or to exercise your rights, email contact@seventysouls.com.