Moonwritten

Moonwritten Privacy Policy

TEMPLATE GRADE. REVIEW BY COUNSEL RECOMMENDED BEFORE PUBLICATION. This document is a working draft for launch preparation and has not been reviewed by a licensed attorney. Bracketed items require completion.

Effective date: [DATE] Data controller: [LEGAL ENTITY NAME], [POSTAL ADDRESS] Contact: [email protected]

1. Summary

Moonwritten creates personalized tarot and astrology readings. To do that, we collect the information you give us in the reading quiz and your account, we process it with third party providers (including AI providers), and we email you your readings. We do not sell your personal information. You can export or delete your data by emailing [email protected].

2. What We Collect

You provide:

• Identity and contact: first name, email address.
• Birth data: birth date, birth time (if known), birth place. We treat this as sensitive in practice, though its legal classification varies by jurisdiction.
• Question and quiz text: your free text questions and quiz answers, including emotional context you choose to share. Please do not include health details, other people's personal data, or anything you would not want processed to generate your readings.
• Payment: handled by Stripe. We receive subscription status and the last four digits of your card, never your full card number.

Collected automatically:

• Usage and device data: pages viewed, quiz progress, feature use, approximate location from IP, device and browser type, via our analytics provider (PostHog) and server logs.
• Email engagement: delivery, open, and click events via our email provider (Resend).
• Cookies: session cookies for sign-in and preference cookies. Analytics may use cookies or similar identifiers; where required by law we request consent.

3. How We Use It

• Generate your readings: your birth data, quiz answers, and questions are sent to large language model providers ([LLM PROVIDER NAMES, e.g. Anthropic / OpenAI]) to generate your reading text, and to ElevenLabs to generate audio narration. We use providers under terms that restrict use of your data for training their models where such options are available. [CONFIRM CURRENT PROVIDER TERMS.]
• Deliver the Service: send readings, magic sign-in links, and account emails via Resend; process payments via Stripe.
• Improve the Service: analyze aggregated usage via PostHog; debug errors.
• Marketing: lifecycle emails about your membership and readings. You can unsubscribe from marketing at any time; transactional emails (receipts, sign-in links) continue while you have an account.

Legal bases (GDPR): performance of contract (delivering readings and membership), legitimate interests (analytics, service improvement, fraud prevention), consent (marketing where required, non-essential cookies), legal obligation (tax and accounting records).

4. Who We Share It With (Processors)

We share personal data only with service providers who process it on our behalf under contract:

We may also disclose data if required by law, to protect rights and safety, or in connection with a merger or acquisition (with notice to you). We do not sell your personal information and we do not share it for cross-context behavioral advertising.

5. International Transfers

Our providers may process data in the United States and other countries. Where GDPR applies, transfers rely on adequacy decisions or Standard Contractual Clauses. [COUNSEL: confirm transfer mechanisms per provider.]

6. Retention

• Account, birth, and reading data: kept while your account is active. Your reading archive is retained so you can access it, including after cancellation.
• If you delete your account, we delete or anonymize personal data within 30 days, except records we must keep for legal, tax, or fraud prevention purposes (kept up to [7] years) and residual copies in backups (purged on backup rotation).
• Analytics data: retained [12] months, then aggregated or deleted.

7. Your Rights

Depending on your location (including under GDPR and CCPA/CPRA), you may have the right to:

• Access / know what personal data we hold about you
• Export your data in a portable format
• Correct inaccurate data
• Delete your data
• Object to or restrict certain processing, and withdraw consent at any time
• Opt out of sale or sharing (we do not sell or share as defined by the CPRA)
• Non-discrimination for exercising these rights

To exercise any right, including export or deletion, email [email protected] from the address on your account, or use the controls on your account page where available. We respond within 30 days (45 for complex CCPA requests). You may use an authorized agent where the law allows. EU/UK residents may also lodge a complaint with their supervisory authority.

8. Security

We use encryption in transit, access controls, and reputable infrastructure providers. Magic link sign-in means we never store a password for you. No system is perfectly secure; if a breach affects your data we will notify you as required by law.

9. Children

The Service is for adults 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

10. Sensitive Topics, Honestly

Your questions to Moonwritten can be intimate. We designed for that: your question text is used to generate your readings and is visible to the AI processors listed above under contractual confidentiality, and to a limited number of our staff for support and quality purposes. It is never published, never used in marketing, and never shared with advertisers.

11. Changes

We will post changes here and, for material changes, notify you by email at least 14 days before they take effect.

12. Contact

[LEGAL ENTITY NAME] [POSTAL ADDRESS] [email protected]

[COUNSEL: add EU/UK representative and DPO details if thresholds are met.]