Privacy Policy
23 September 2026
1. Data controller
- Summit Collective (S.L.)
- Registered office: Avenida Diagonal 536, 08006 Barcelona, Spain
- Registration number (CIF / VAT): B21663216
- Contact us — for payment questions: info@aurakosmos.lyzorn.com
Summit Collective is the sole data controller for all the processing operations described below, including payment administration. We process your data in accordance with the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection (LOPDGDD).
2. Data we collect
When you sign up:
- First name
- Email address
- Password (hashed, never stored in plain text)
- Date of birth and zodiac sign
- Gender (optional)
When you use the service:
- Reading history (tarot, chat, numerology, etc.) and the questions you ask
- Birth data you enter for a birth chart or a compatibility reading (date, time, place)
- Communication preferences
- Progress data (Auras, badges, levels)
- IP address, browser type and technical logs (for security)
- Browsing data (via cookies, if you consent)
When you pay:
- Transaction history, plan subscribed and amounts paid
- Billing address and "tokenised" payment identifiers (including Apple Pay and Google Pay tokens)
Card details are entered on the secure checkout page of our payment provider Lyzorn and processed by PCI DSS-certified gateways. We never store card numbers.
Psychics' memory:
To personalise your readings, each psychic keeps a summary of what you share with them (situation, questions, predictions and advice given). This information stays with that psychic and is not shared with the other psychics on the platform. You can view, edit or delete it at any time from your Settings, under "What our psychics know about you".
3. Purposes of processing
| Purpose | Legal basis |
|---|---|
| Providing the service (readings, horoscopes, Premium content) | Performance of the contract |
| Managing your account, purchases and subscriptions | Performance of the contract |
| Processing payments, renewals and refunds | Performance of the contract |
| Preventing fraud and abusive chargebacks | Legitimate interest |
| Sending the daily horoscope | Consent |
| Sending marketing emails | Explicit consent (opt-in) |
| Personalising your experience | Legitimate interest |
| Analysing site usage (analytics) | Consent (cookies) |
| Ensuring site security | Legitimate interest |
| Meeting our accounting and tax obligations | Legal obligation |
4. Data sharing
Your data may be shared with the following providers, solely for the purposes of the service:
- Lyzorn and its payment gateways (PayXpert / CelerisPay, Apple Pay, Google Pay): payment processing, 3D Secure authentication and fraud prevention
- Artificial intelligence providers (Anthropic, Google, OpenAI, etc.): generating readings. Only the data needed for the requested reading is sent (first name, birth data, questions). These providers are contractually prohibited from using this data to train their models
- Resend: sending transactional emails
- Contabo: server hosting
- Cloudflare: file storage (R2) and protection against attacks
- Microsoft Clarity, Google Analytics: audience measurement, only with your consent
We never sell your personal data to third parties.
5. Retention periods
| Data | Period |
|---|---|
| Active account | As long as the account is active |
| After account deletion | 3 years maximum (statutory limitation periods) |
| Payment and billing data | Up to 7 years (accounting, tax and anti-fraud obligations) |
| Analytics cookies | 6 months |
| Security logs | 12 months |
| Backups | 14 days maximum |
6. Your rights (GDPR)
Under the GDPR, you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct inaccurate data
- Right to erasure: delete your account and your data, subject to our legal retention obligations
- Right to data portability: receive your data in a structured format
- Right to object: object to processing based on legitimate interest
- Right to restriction: restrict the processing of your data
- Right to withdraw consent: withdraw your consent at any time
To exercise these rights, visit our contact page or your account settings (account deletion). To prevent fraudulent requests, we may ask you to confirm that you control your account's email address. You may appoint someone to act on your behalf, provided they present a signed written authorisation.
You may also lodge a complaint with a data protection authority: in Spain, the Agencia Española de Protección de Datos (www.aepd.es), or the authority in your country of residence.
We never discriminate against anyone for exercising their rights. Our website honours the Global Privacy Control (GPC) signal: when your browser sends it, it is treated as a refusal of non-essential trackers.
7. Security
We implement technical and organisational measures to protect your data:
- HTTPS encryption (TLS 1.3)
- Hashed passwords (bcrypt)
- API keys encrypted in the database (AES-256-CBC)
- Encrypted backups on private storage
- Security monitoring and logs
- Restricted data access (Super Admin only)
Do not enter highly sensitive information (health data, identity numbers, passwords, bank details) in your questions to the psychics: these texts are processed automatically to generate the answers.
8. International transfers
Data is mainly processed within the European Economic Area. Some of our providers (artificial intelligence providers, analytics tools) are based in the United States. These transfers are covered by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework.
9. Minors
The Platform is intended for people aged 18 or over. We do not knowingly collect data from minors.
10. Changes
This policy may be updated at any time. The date of the last update is shown at the top of this page.
11. Contact
For any question about the protection of your data, contact us through our contact page.