Draft. Replace the bracketed details and have this page reviewed by a lawyer before you start selling.
Privacy policy
Last updated: [date]
Who is responsible
[Legal name of the business], [address], is the data controller for the Janma website and the Janma apps for Android and iOS. Contact: [privacy email].
What we process, why, on what basis and for how long
| Data | Purpose | Legal basis (GDPR) | Kept |
|---|---|---|---|
| Birth details you type for the free reading | Calculating the free reading | Not sent to us: calculated on your device | Not stored |
| Birth details and past events you enter in “Check Janma against your past” | Showing which events fall inside predicted periods and the best-fitting birth time | Steps you ask for before a contract (Art. 6(1)(b)) | Sent once, processed in memory, not stored or logged |
| Email address | Signing you in with a one-time code; telling you a report is ready | Contract (Art. 6(1)(b)) | Until you delete your account |
| Birth details, past events you choose to add, report PDFs | Making your report, letting you download it again | Contract (Art. 6(1)(b)) | Until you delete your account |
| Dated windows in your reports (the prediction ledger) | Alerts, check-ins, and a tamper-proof public record of what Janma predicted | Contract (Art. 6(1)(b)); legitimate interest in an honest public record (Art. 6(1)(f)) | Linked to you until you delete your account; afterwards kept only as anonymous rows (area and dates, no link to you, no birth details) |
| Your “did it happen?” answers | Shown in your account; used to measure accuracy only if you agree | Contract; research use only with your consent (Art. 6(1)(a)), which you can withdraw in Settings at any time | Deleted with your account unless you consented to research, in which case they stay without any link to you |
| Window alert and check-in emails | Service messages for reports that include alerts | Contract (Art. 6(1)(b)); you can turn them off in Settings | Until the alert period ends |
| Newsletter and offers | Marketing | Consent (Art. 6(1)(a)), off by default | Until you withdraw consent |
| Compatibility invites | Comparing two charts. Each person enters their own details and agrees to the comparison; both can see the score and the report | Contract with each person (Art. 6(1)(b)) | Until either person deletes their account; deleting your account also deletes compatibility reports that contain your details |
| Gift recipient email (given by the buyer) | Sending the gift code once | Legitimate interest of the buyer and recipient (Art. 6(1)(f)) | Until the gift is redeemed or expires (1 year) |
| Purchase records (product, price, date, payment or store reference) | Accounting and tax | Legal obligation (Art. 6(1)(c); French Commercial Code art. L123-22) | 10 years, without your birth details |
| Consent history | Proving what you agreed to and when | Legal obligation (Art. 7(1)) | Until you delete your account |
We never ask for health, religious, political or other special-category information. The list of past events deliberately excludes illness, death and similar events. Janma makes no automated decisions with legal or similarly significant effects.
Sign-in and security
Janma does not use passwords, so no password is ever stored. You sign in with a six-digit code sent to your email. Your session is kept on your device (browser storage, or the app’s private storage). All traffic is encrypted (HTTPS). Data is encrypted at rest by our providers. Database rules let each account read only its own records; nobody can change orders, payments or reports from a browser or app. Report PDFs are private and only reachable through download links that expire after two minutes. Secret keys exist only on our servers.
Service providers (processors) and transfers
Supabase (database, sign-in and private files; EU region [Frankfurt/Paris]); Cloudflare (website hosting, API and report generation; global network); Stripe (card payments on the website); Resend (emails); RevenueCat (verifying app-store purchases). They act only on our instructions under data processing agreements. Where data leaves the EU (Cloudflare, Stripe, Resend and RevenueCat are US companies), transfers rely on the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses. Apple (App Store) and Google (Google Play) process payments in the apps as independent controllers under their own privacy policies. Place search sends only the text you type to Open-Meteo to find coordinates.
Your rights
You can download everything we hold about you (access and portability) and delete your account at any time from My reports → Account settings, on the website or in the app. You can also ask us for access, correction, restriction, objection or deletion at [privacy email]; we answer within one month. You can withdraw any consent in Settings without affecting earlier processing. You may complain to your data protection authority (in France, the CNIL: www.cnil.fr).
Children
Janma is not intended for people under 16. We do not knowingly create accounts for them.
Cookies and device storage
We use no advertising or tracking cookies. Your browser or app stores your sign-in session locally so you stay signed in; this is strictly necessary and needs no consent.
If Janma changes owner
If the Janma business or its assets are sold or merged into another company, your account data may be transferred to the new owner so that it can keep providing the service you signed up for (legitimate interest, Art. 6(1)(f)). The new owner must keep the protections described in this policy. We will email account holders at least 30 days before such a transfer, so you can download your data or delete your account first.
Changes
We will update the date above when this policy changes and tell account holders by email about important changes.