Privacy Policy

1. Who we are (data controller)

The controller of personal data processed through the website myvelvet-secret.com is GRAFEIO.

Phone: 051 845 307
Email: grafeio.creative@gmail.com
Business registration number: 7584474
Tax number: 83235256
GRAFEIO is not registered for VAT.

Hereinafter "GRAFEIO", "we" or "us". For any privacy question, write to the email address above.

2. What data we collect

• Sign-in data: your name and email address, received via Google sign-in.
• Reading content: the questions, topics you choose, any text you enter, and the AI interpretation. Readings are saved to My space automatically, and you can delete them there at any time. The exception is the free Whisper in Signs, which is not saved.
• Form of address: if you choose one for Slovenian readings (feminine, masculine or neutral), we store it only to write your readings in that form. You can change or delete it in My space; without an account it stays in your browser only.
• Free readings and the emotion calculator without an account: to limit how many there are, we compute a hashed value from your IP address with a salt that changes every day. We never store the IP address itself, and the hashed values are deleted after two days. Free readings without an account are not saved.
• Purchase data: at checkout, Stripe asks for your address and country (needed to issue an invoice), and we also record your IP address. Both are legally required evidence of the customer's location for correct tax treatment. We never see or store your card details.
• Usage data: basic visit statistics via Google Analytics, only if you consent via the cookie banner. See Cookies and Local Storage.

3. Why we process this data

• to deliver the reading you requested and run My space (performance of a contract),
• to issue invoices and meet bookkeeping obligations (legal obligation),
• to respond to your questions (legitimate interest),
• to send newsletters and measure site traffic, only where you have given prior consent.

4. Who we share data with

We share data, where necessary, with external service providers who help run the site (data processors):

• Stripe (Stripe Payments Europe, Limited): payment processing,
• Anthropic: receives the text of your question/reading in order to generate an AI interpretation; it does not receive your name or email address,
• Supabase: hosts our database and sign-in (servers in Frankfurt, EU), including backups for disaster recovery (point-in-time recovery), which are automatically overwritten after a limited period,
• Netlify: hosts the website,
• Brevo: sends newsletters, only to those who sign up for them,
• Google: account sign-in (Google Sign-In) and, with consent, website statistics (Google Analytics).

We do not sell your data and do not use it for third-party advertising.

5. International data transfers

Some of the providers above (Anthropic, Google) are based in the United States. Transfers to them rely on appropriate safeguards, such as EU Standard Contractual Clauses or certification under the EU–US Data Privacy Framework, depending on the provider.

6. How long we keep data

• Issued invoices are retained for the legally required accounting retention period, even if you delete your user account in the meantime.
• Reading content and account data are kept for as long as your account remains open, or until you delete them yourself in My space.
• Database backups are automatically overwritten after a short, technically determined period and are not meant for long-term retention.

7. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to: access your data, correct inaccurate data, request erasure, restrict processing, object to processing, and data portability. Send your request to grafeio.creative@gmail.com. If you believe your rights have been violated, you may lodge a complaint with Slovenia's Information Commissioner.

8. Deleting your account

You can delete your account yourself, at any time, in My space. This deletes your profile, saved readings, and subscription data. Issued invoices remain on file per section 6 above. That is a legal obligation, not our choice.

9. Data security

The connection to the site is encrypted (HTTPS). Access to the database is limited to what is necessary through row-level access rules, so each user can only see their own data.

10. Changes to this policy

We may update this policy from time to time. The date of the last change is shown at the top of this page.

11. Controller details

GRAFEIO, Miran Vugrinski s.p., Regentova ulica 20, 2000 Maribor, Slovenia. The address is stated because the law requires it. Please use email to contact us.