GDPR Compliance
23 September 2026
1. Our commitment
AuraKosmos is committed to complying with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the Spanish Organic Law on Data Protection (LOPDGDD). This page summarises our processing activities, our processors and your rights; full details are in our Privacy Policy.
2. Data controller
- Controller: Summit Collective (S.L.)
- Registered office: Avenida Diagonal 536, 08006 Barcelona, Spain
- Registration number (CIF / VAT): B21663216
- Contact: Contact us
3. Record of processing activities
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Account management | First name, email, date of birth, gender | Contract | Life of the account + 3 years |
| Readings | Reading history, questions asked | Contract | Life of the account |
| Psychics' memory | Summary of what you shared with each psychic | Contract | Life of the account (editable and erasable) |
| Payments and subscriptions | Transactions, plan, tokenised payment identifiers | Contract + legal obligation | Up to 7 years |
| Fraud prevention | Payment history, chargebacks, IP | Legitimate interest | Up to 7 years |
| Daily horoscope | Zodiac sign, email | Consent | Until withdrawn |
| Marketing emails | Email, preferences | Explicit consent | Until withdrawn |
| Audience measurement | Browsing data | Consent (cookies) | 6 months |
| Security | IP, user agent, technical logs | Legitimate interest | 12 months |
| Backups | All data | Legitimate interest | 14 days |
4. Processors
| Processor | Role | Location | Safeguards |
|---|---|---|---|
| Contabo GmbH | Server hosting | Germany (EU) | GDPR |
| Lyzorn and its payment gateways | Checkout page, payment collection, 3D Secure, fraud prevention | EU | GDPR, PCI DSS |
| Artificial intelligence providers (Anthropic, Google, OpenAI…) | Generation of readings and translations | United States | Standard contractual clauses, no reuse for training |
| Resend | Transactional emails | United States | Standard contractual clauses |
| Cloudflare | CDN, protection, file storage (R2) | Global | Standard contractual clauses + DPF |
| Google Analytics, Microsoft Clarity | Audience measurement (with consent) | United States | Standard contractual clauses + DPF |
We never sell your personal data.
5. Your rights
| Right | How to exercise it |
|---|---|
| Access | From your account settings or via the contact page |
| Rectification | From your account settings |
| Erasure | "Delete my account" button in the settings |
| Portability | On request via the contact page |
| Objection | Communication preferences in the settings |
| Restriction | On request via the contact page |
| Withdrawal of consent | Communication preferences, unsubscribe link or cookie settings |
Response time
We respond to every request within one month, which may be extended by two months for complex requests, in which case we will let you know.
Complaint
If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es), the lead supervisory authority, or with the data protection authority of your country of residence (in France, the CNIL — www.cnil.fr).
6. Security measures
- HTTPS encryption (TLS 1.3) of all communications
- Hashed passwords (bcrypt)
- Service access keys encrypted in the database (AES-256-CBC)
- Encrypted backups on private storage
- No card data stored: card details are entered on the Lyzorn checkout page
- Access to data restricted to authorised persons
7. Data breach notification
In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach:
- we notify the competent supervisory authority within 72 hours of becoming aware of it;
- if the breach is likely to result in a high risk to your rights and freedoms, we inform you without undue delay;
- we document every breach and the corrective measures taken.
8. Data protection by design
- Minimisation of the data collected
- Only the data needed for a reading is sent to artificial intelligence providers
- Audience measurement cookies blocked by default (opt-in) and Global Privacy Control signal honoured
- Psychics' memory viewable, editable and erasable from the settings
- Self-service account deletion
9. Contact
For any question about the protection of your data: contact page — Summit Collective, Avenida Diagonal 536, 08006 Barcelona, Spain.