Privacy Policy

1. Data controller

The controller of personal data is Grafeio, Miran Vugrinski s.p., Regentova ulica 20, 2000 Maribor, Slovenia, business registration number 7584474000, tax number 83235256. For any privacy question, write to grafeio.creative@gmail.com.

2. What data we collect

• Sign-in data: your name and email address, received via Google sign-in.
• Reading content: the questions, topics you choose, and any text you enter, plus the saved AI interpretation if you choose to save it to My space.
• Purchase data: at checkout, Stripe asks for your address and country (needed to issue an invoice), and we also record your IP address — both are legally required evidence of the customer's location for correct tax treatment. We never see or store your card details.
• Usage data: basic visit statistics via Google Analytics, only if you consent via the cookie banner — see Cookies and Local Storage.

3. Why we process this data

• to deliver the reading you requested and run My space (performance of a contract),
• to issue invoices and meet bookkeeping obligations (legal obligation),
• to respond to your questions (legitimate interest),
• to send newsletters and measure site traffic, only where you have given prior consent.

4. Who we share data with

We share data, where necessary, with external service providers who help run the site (data processors):

• Stripe (Stripe Payments Europe, Limited) — payment processing,
• Anthropic — receives the text of your question/reading in order to generate an AI interpretation; it does not receive your name or email address,
• Supabase — hosts our database and sign-in (servers in Frankfurt, EU), including backups for disaster recovery (point-in-time recovery), which are automatically overwritten after a limited period,
• Netlify — hosts the website,
• Brevo — sends newsletters, only to those who sign up for them,
• Google — account sign-in (Google Sign-In) and, with consent, website statistics (Google Analytics).

We do not sell your data and do not use it for third-party advertising.

5. International data transfers

Some of the providers above (Anthropic, Google) are based in the United States. Transfers to them rely on appropriate safeguards, such as EU Standard Contractual Clauses or certification under the EU–US Data Privacy Framework, depending on the provider.

6. How long we keep data

• Issued invoices are retained for the legally required accounting retention period, even if you delete your user account in the meantime.
• Reading content and account data are kept for as long as your account remains open, or until you delete them yourself in My space.
• Database backups are automatically overwritten after a short, technically determined period and are not meant for long-term retention.

7. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to: access your data, correct inaccurate data, request erasure, restrict processing, object to processing, and data portability. Send your request to grafeio.creative@gmail.com. If you believe your rights have been violated, you may lodge a complaint with Slovenia's Information Commissioner.

8. Deleting your account

You can delete your account yourself, at any time, in My space. This deletes your profile, saved readings, and subscription data. Issued invoices remain on file per section 6 above — that is a legal obligation, not our choice.

9. Data security

The connection to the site is encrypted (HTTPS). Access to the database is limited to what is necessary through row-level access rules, so each user can only see their own data.

10. Changes to this policy

We may update this policy from time to time. The date of the last change is shown at the top of this page.