Privacy Policy

1. Privacy at a glance

General information

The following gives a simple overview of what happens to your personal data when you visit this website or buy from us. Personal data is any data that can identify you personally. Detailed information follows in the sections below.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator's contact details in the section "Controller" below.

How do we collect your data?

Some data is collected because you give it to us — for example the birth details and email address you enter in our compatibility quiz or in the order form for your personal reading.

Other data is collected automatically or, where required, after your consent when you visit the website. This is mainly technical data (e.g. browser, operating system, time of access).

What do we use your data for?

Some data is needed to provide the website without errors. Some is needed to create and deliver the readings you request and to process your order. With your consent, some data is used to measure the performance of our advertising.

What rights do you have?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data, and to request its correction or deletion. If you have given consent, you can withdraw it at any time with effect for the future. You also have the right to request restriction of processing and to lodge a complaint with a supervisory authority. For all of this, contact us at any time.

2. Controller

The controller responsible for data processing on this website is:

Nicoló De Pascalis Ubierweg 5 53909 Zülpich Germany

Email: hello@mycelestia.app

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

We are not required to appoint a data protection officer.

3. Hosting and infrastructure

Website hosting (Lovable)

This website is hosted externally by:

Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden

Personal data collected on this website (e.g. IP addresses, access data, contact and order data) may be processed on the host's servers. Hosting is carried out to fulfil our contracts with potential and existing customers (Art. 6(1)(b) GDPR) and in our legitimate interest in a secure, fast and efficient provision of our website (Art. 6(1)(f) GDPR). Lovable belongs to a group with a parent company in the USA; where data is transferred to the USA, this is based on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses.

Backend and database (Supabase)

Our backend (database and server functions) is provided by Supabase Pte. Ltd., Singapore, together with its affiliates (including Supabase Inc., USA). Supabase stores the data you enter in our quiz and order forms (see sections 6 and 7) and runs the functions that calculate your signs and assemble your reading. Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in reliable technical operation). Transfers to countries outside the EU (e.g. Singapore, USA) are safeguarded by the EU Standard Contractual Clauses included in Supabase's data processing addendum (Art. 46 GDPR).

Data processing agreements

We have concluded data processing agreements with the service providers listed in this section and in sections 7–9 that act on our behalf. These agreements ensure that they process our visitors' and customers' data only on our instructions and in compliance with the GDPR.

4. General information and mandatory disclosures

Data protection

We take the protection of your personal data seriously and treat it confidentially, in accordance with statutory data protection regulations and this privacy policy. Please note that data transmission over the internet (e.g. by email) can have security gaps. Complete protection against access by third parties is not possible.

Storage period

Unless a more specific storage period is stated in this policy, your personal data remains with us until the purpose for processing no longer applies. If you make a justified request for deletion or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. tax or commercial retention periods); in that case, deletion takes place once those reasons no longer apply.

Legal bases

Where you have consented, we process your data on the basis of Art. 6(1)(a) GDPR. Where you have consented to the storage of cookies or access to information on your device, processing is additionally based on § 25(1) of the German TDDDG. Consent can be withdrawn at any time. Where your data is required to perform a contract or to take pre-contractual steps, we process it on the basis of Art. 6(1)(b) GDPR. Where processing is necessary to meet a legal obligation, the basis is Art. 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. The relevant legal basis for each case is stated in the sections below.

Recipients of personal data

We work with external service providers, as described in this policy. We only pass on personal data where this is necessary to perform a contract, where we are legally obliged to do so (e.g. to tax authorities), where we have a legitimate interest under Art. 6(1)(f) GDPR, or where another legal basis allows it. We do not sell your personal data.

Withdrawal of consent

Many processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

IF PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (ART. 21(1) GDPR).

IF YOUR DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO SUCH PROCESSING, INCLUDING PROFILING RELATED TO IT. YOUR DATA WILL THEN NO LONGER BE USED FOR DIRECT MARKETING (ART. 21(2) GDPR).

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Düsseldorf, Germany.

Your further rights

You have the right to data portability (receiving data we process on the basis of consent or contract in a common, machine-readable format), to access, correction and deletion, and to restriction of processing — for example while the accuracy of your data is being checked, if processing was unlawful, if you need the data for legal claims, or while an objection under Art. 21(1) GDPR is being assessed. To exercise any of these rights, email hello@mycelestia.app.

Age requirement

Our services are intended only for persons aged 18 or over. We do not knowingly collect data from minors.

5. Data collection on this website

Server log files

When you visit the website, the hosting provider automatically collects technical information that your browser transmits (e.g. browser type and version, operating system, referrer URL, time of the request, IP address). This data is not combined with other data sources. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the technically error-free and secure provision of the website.

Cookies and similar technologies

We use cookies and similar technologies (such as local storage in your browser) only where they are technically necessary or where you have given consent.

Necessary: we store your cookie choice in your browser's local storage so we do not have to ask you again. Legal basis: § 25(2) TDDDG and Art. 6(1)(f) GDPR.

Marketing (consent only): the Meta Pixel (see section 9) is loaded only after you click "Accept" in our cookie banner. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

You can change or withdraw your choice at any time via the "Cookie settings" link in the footer of every page. You can also set your browser to block or delete cookies; some functions of the website may then be limited.

Fonts

The fonts used on this website are hosted locally on our own servers. No connection is made to Google or other font providers when you load the page.

Contact by email

If you contact us by email (hello@mycelestia.app), we store your request, including the personal data it contains (e.g. name, email address, content), to handle your enquiry. We do not pass this data on without your consent. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual steps; otherwise our legitimate interest in handling enquiries effectively (Art. 6(1)(f) GDPR). The data remains with us until you ask us to delete it or the purpose no longer applies (e.g. after your request has been handled); statutory retention periods remain unaffected.

Incoming emails to this address are forwarded by the email-forwarding service ImprovMX to our mailbox with Google (Gmail; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Replies are sent through our email provider Resend (see section 8). Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

6. Free compatibility quiz

When you take our free compatibility quiz, we process the details you enter — in particular the birth dates (and, where entered, names) of you and your partner — together with your email address, in order to calculate and send you your compatibility reading. We also record anonymous progress events within the quiz (e.g. which step was reached) to improve the quiz.

Legal basis: Art. 6(1)(b) GDPR (providing the reading you requested) and Art. 6(1)(f) GDPR for the anonymous quiz statistics.

Please only enter another person's details if you are entitled to share them.

We keep this data until you ask us to delete it. If you have consented to receive further emails from us, the rules in section 10 apply.

7. Personal reading (paid product) and payment

Order data

When you order a personal reading, we process: your first name, email address, date of birth, time of birth (or the information that it is unknown), place of birth, the geographic coordinates and time zone derived from it, the astrological signs calculated from these, your consent regarding the right of withdrawal (with time stamp), and order data (order status, amount, currency, payment reference, date of payment and delivery). We also create a private access link so that you can view your reading.

We use this data to calculate and deliver your reading and to process your order. Legal basis: Art. 6(1)(b) GDPR. Your birth details are used exclusively to create your reading. The reading is generated from pre-written text blocks; no automated decisions with legal or similarly significant effects are made.

Place-of-birth search

To help you find your place of birth, the text you type into the place field is sent from our server to the geocoding services Photon (operated by komoot GmbH, Germany) and Nominatim (OpenStreetMap Foundation, United Kingdom). Because the request is made by our server, your IP address is not transmitted to these services — only the search text. Legal basis: Art. 6(1)(b) GDPR. The United Kingdom is covered by an EU adequacy decision.

Right of withdrawal for digital content

Before purchase you expressly agree that we begin delivering the digital content before the withdrawal period expires and acknowledge that you thereby lose your right of withdrawal. We store this consent together with the text shown and a time stamp as proof. Legal basis: Art. 6(1)(c) GDPR (legal obligation to document) and Art. 6(1)(f) GDPR (defence of legal claims).

Payment via Stripe

Payment is processed by Stripe. For our product, Stripe acts as reseller and merchant of record ("Stripe Managed Payments"): Stripe sells the product to you, collects the payment, and handles taxes, fraud prevention and payment disputes. For this purpose Stripe processes your payment data (e.g. card details, billing address, email, IP address, device data) as an independent controller under its own privacy policy: https://stripe.com/privacy. We do not receive your full card details. Stripe tells us whether the payment succeeded and passes on basic order information (e.g. amount, currency, payment reference).

Stripe's European contracting entity is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Data may be transferred to Stripe, Inc. in the USA; this is based on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. Legal basis for passing your data to Stripe: Art. 6(1)(b) GDPR.

Storage period for order data

We keep your birth details and your reading for as long as your private reading page is available, so that you can access it again. You can ask us to delete them at any time. Records that we must keep for tax and commercial purposes (e.g. transaction data) are retained for the statutory periods (up to 10 years, § 147 AO, § 257 HGB) and then deleted.

8. Transactional emails (Resend)

We send the emails you request — your quiz reading, your order confirmation and the link to your personal reading — via Resend (Plus Five Five, Inc., USA). Resend processes your email address, the content of the email and technical delivery data on our behalf. Legal basis: Art. 6(1)(b) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

9. Advertising: Meta Pixel

With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The Meta Pixel helps us measure whether our ads on Facebook and Instagram lead to visits and purchases, and to show ads to people who are likely to be interested.

When you consent, the Pixel sets cookies and sends information to Meta, such as your IP address, browser and device information, the pages you visit and actions on our website (e.g. starting the quiz, starting checkout, completing a purchase). If you are logged in to Facebook or Instagram, Meta can link this information to your account. We receive only aggregated statistics, not data that identifies you.

Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. The Pixel is not loaded until you click "Accept" in the cookie banner. You can withdraw your consent at any time via "Cookie settings" in the footer.

For the collection and transmission of this data we are jointly responsible with Meta (Art. 26 GDPR); we have agreed a joint controller addendum with Meta: https://www.facebook.com/legal/controller_addendum. Meta is responsible for the further processing of the data after transmission. Data may be transferred to the USA; Meta is certified under the EU-US Data Privacy Framework. More information: https://www.facebook.com/privacy/policy/

10. Marketing emails

With your consent, we may send you further emails, for example about new readings. For this we use your email address and, where provided, your first name. We may evaluate whether emails are opened and links are clicked, in order to improve our emails.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link in every email or by writing to hello@mycelestia.app. The lawfulness of processing until withdrawal remains unaffected.

Double opt-in: after you tick the marketing checkbox, we send you an email asking you to confirm your address. Only after you confirm do we send you marketing emails. When you confirm, we store the time of confirmation, your IP address and your browser information in order to be able to prove your consent (Art. 6(1)(f) GDPR, our legitimate interest in documenting consent). If you do not confirm, we will not send you any marketing emails. These emails are sent through our provider Resend (see section 8).

We keep your email address for this purpose until you unsubscribe. After you unsubscribe, we may store your address in a blocklist solely to ensure we do not email you again (Art. 6(1)(f) GDPR). You may object to this storage if your interests outweigh our legitimate interest.

Where you have bought from us, we may also send you information about similar products of our own to the email address you used, without separate consent, as permitted by § 7(3) of the German UWG. You can object to this at any time, free of charge (other than the basic cost of transmission), via the link in every email.

11. Changes to this policy

We update this privacy policy when our services or the legal requirements change. The current version is always available on this page.