Privacy Policy
Last updated: 7 November 2026
1. Who is responsible
The data controller is Xi Cheng (SinoDestiny), Czech Republic. For any privacy question or request: [email protected].
2. What we collect
| Data | Why | Kept |
|---|---|---|
| Email address, name (optional) | Deliver your report and receipt; identify your order | As long as needed to support your order and meet accounting law |
| Birth date, time, place, city/country | Compute your chart — this is the product | Same as above |
| Order record (product, amount, currency, status, timestamps) | Fulfil the order; accounting and tax records | Czech law requires accounting records to be kept for 10 years |
| Payment reference (Stripe session / payment intent IDs) | Match payments to orders; handle refunds and chargebacks | Same as the order record |
| Hashed IP and browser fingerprint | Abuse and rate limiting only — we do not store raw IP addresses or use advertising trackers | Rolling, deleted automatically |
| Report access token | So only you can open your report link | 90 days, then the link can be re-issued on request |
We do not run advertising or analytics cookies. The only cookies/local storage are those strictly needed to run the site (e.g. your admin session never applies to customer pages).
3. Who processes your data
- Cloudflare — website hosting, database (D1) and edge network. Processor locations include the EU and US.
- Stripe Payments Europe — card payments, receipts and invoices. Stripe processes card data under its own PCI-DSS obligations; we never receive your card number.
- Brevo (Sendinblue) — delivery of transactional emails (receipt, report link).
We never sell your data and do not share it for marketing.
4. Why we may process it (legal bases)
- Performance of a contract — computing, delivering and supporting your report.
- Legal obligation — accounting and tax records under Czech law.
- Legitimate interest — preventing abuse of the free preview and payment flow (rate limiting with hashed identifiers).
5. Your rights
Under the GDPR you can ask us to access, correct, export or delete your personal data, and object to processing based on legitimate interest. Email [email protected] — we answer within 30 days. You also have the right to complain to the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, ÚOOZ).
Note: deleting your data removes our ability to re-send your report link or support the order, so deletion requests are applied going forward and to non-essential data.
6. Children
The service is not directed at children. Purchasers must be 18 or older.
7. Changes
If this policy changes materially, the updated version is published on this page with a new date.