Privacy Policy
Last updated 2026-10-08
This policy explains what personal data OBANG collects when you create a Korean Saju reading, why we use it, who we share it with, how long we keep it, and what rights you have.
Who is responsible for your data
The data controller is [Legal name: to be completed], [Address: to be completed] (Spain), tax ID [Tax ID: to be completed]. Contact: [email protected]. Because we operate from Spain, the EU General Data Protection Regulation (GDPR) applies to us even though our customers are in the United States.
What we collect
- Details you give us for your reading: name or nickname, email address, birth date, birth time (optional), birth city, and, optionally, whether you want your 10-year timeline counted the male or female way.
- Order data: order ID, price, payment status and payment identifiers, timestamps, and the text of your finished report.
- Payment details: you enter your card details on Stripe’s payment page. We never see or store your card number.
- Technical data: your IP address is used briefly in server memory to limit abuse and is not stored by our application. Our servers and hosting provider may keep standard security logs.
We do not use advertising or analytics cookies. Our site currently sets no cookies for visitors; a technical cookie is used only for our own staff sign-in.
Why we use it and our legal basis
- To calculate your chart, write and deliver your report, and take payment (performance of our contract with you).
- To email you a private link to your report and respond to your requests (contract and our legitimate interest in supporting customers).
- To prevent fraud and abuse and keep the service secure (legitimate interest).
- To keep accounting and tax records (legal obligation).
We do not sell your personal data, and we do not use it for advertising or profiling.
AI-assisted writing and what is sent to the AI provider
Your chart is calculated by our own software. The written interpretation is generated with the help of an AI language model. To write it, we send the model only chart data (for example the four pillars, element balance and derived chart features). We do not send your name, email, birth date, birth city, coordinates or time zone. Chart data is derived from your birth details, so we treat it as personal data too.
Who we share data with (processors)
| Provider | Purpose | Data |
|---|---|---|
| Stripe | Payment processing | Email, payment details you enter, order amount |
| AI model provider (DeepSeek) | Writing your report text | Chart data only, no identifying details |
| [Hosting and database provider: to be completed] | Running the service and storing orders | All order data |
| [Email delivery provider: to be completed] | Sending your report link | Email address, name |
These providers process data on our instructions under data processing terms. We may also disclose data when the law requires it.
Transfers outside the EU
Some providers are located outside the European Economic Area (for example in the United States, and the AI provider in another country). Where required, we rely on safeguards such as the European Commission’s Standard Contractual Clauses. You can contact us for details.
How long we keep it
- Unpaid checkouts: personal details are erased after 30 days.
- Paid orders: your details and report are kept for up to 24 months after purchase so you can reopen your report, then erased.
- Accounting records (order ID, amount, payment identifiers, dates) are kept for as long as tax and commercial law require. They no longer contain your name, email, birth details or report.
You can ask us to erase your data earlier at any time (see below).
Your rights
You can ask us to access, correct, erase, restrict or export your personal data, and you can object to certain uses. To exercise these rights, email us from the address you used for your order. We reply within one month. If you are not satisfied, you may complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es) or your local authority. If you live in a US state with its own privacy law, you may have similar rights, and you can use the same email to exercise them.
Erasing your data from our systems does not erase records held independently by Stripe. Contact Stripe for those, or tell us and we will point you to the right request.
Children
Our service is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will erase it.
Security
Reports are opened through a private link that contains a random secret; we store only a hashed copy of it. Connections use HTTPS. No system is perfectly secure, so please keep your link private.
Data sources
City names and time zones come from GeoNames (geonames.org), licensed under CC BY 4.0. Contains data from GeoNames.
Changes
If we change this policy in a meaningful way we will update the date above and, where appropriate, tell you by email.