Privacy Policy

1. Who We Are and What This Policy Covers

Horoskope AI is an astrology web application operated by Clevera Inc., a California corporation (Clevera, "we", "us", or "our"). The service consists of our marketing website at https://horoskope.ai and our web application at https://app.horoskope.ai, together with all related features, content, and communications (collectively, the Services). Clevera is the controller (or, in California terms, the business) responsible for the Personal Information described in this policy.

This Privacy Policy describes how we collect, use, disclose, retain, and protect Personal Information, meaning information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, to you or another identifiable person. It applies to everyone who visits or uses the Services, including visitors to the marketing site who never create an account.

Your use of the Services is also governed by our Terms & Conditions (available at https://horoskope.ai/terms) and our Acceptable Use Policy (available at https://horoskope.ai/acceptable-use). If you do not agree with this Privacy Policy, please do not use the Services. This policy refers to our offerings collectively as the "Services"; the Terms and Acceptable Use Policy call the same offering the "Service". The two terms describe the same thing.

A note before anything else: astrology content in the Services, including charts, compatibility scores, timing windows, naming suggestions, reports, and AI chat responses, is provided for reflection, education, and entertainment only. It is not medical, mental-health, legal, financial, or professional advice, and it does not predict the future. The Terms & Conditions explain this in detail.

2. Our Commitments

Three commitments run through this whole policy, and we state them here so they cannot be missed:

• We never sell your data. We do not sell Personal Information for money and never have. The one place we share online identifiers for advertising measurement is the consent-gated TikTok pixel in Section 11, which you can switch off, and which never receives your birth details, chart, or conversations.
• Your chart never trains anyone's model. Neither Clevera nor any of the AI, speech, or infrastructure providers we use trains or improves foundation models on your birth details, charts, conversations, voice, hand measurements, or any other content you give us or we generate for you.
• Export or delete everything, any time. Data export, account deletion, profile deletion, and conversation deletion are built into Settings and need no email to us (Section 14).

3. Information We Collect

Account information

When you create an account, our authentication provider, Clerk, processes your sign-up and sign-in. We store your account email address, the name on your account, an account identifier, your interface language and presentation preference (Western or Vedic vocabulary), and the date and version of the Terms you accepted. Authentication credentials are handled by Clerk: we do not store a usable password for accounts created through Clerk. Accounts that existed before our move to Clerk may retain an encrypted hash of their old password; it can no longer be used to sign in and is deleted with the account.

Age confirmation

When you first sign in we ask for your date of birth to confirm you are an adult. We do not keep the date. We store only the outcome (confirmed, or refused because the date was below the minimum), how it was given, and when. Section 19 explains why.

Birth profiles

The core of the Services is the Birth Profile: a label or name, a birth date, an optional birth time (or a note that it is unknown), a birth place with its coordinates and time zone, and an optional gender. You can create one or more Birth Profiles. A Birth Profile may describe you, or it may describe another person, such as a family member, child, or partner. Section 4 explains the special rules that apply to birth data and profiles about other people.

Content you create

This includes your messages in the AI chat ("Ask"), including transcripts of questions you ask aloud; outcome ratings you submit; feedback you send through our feedback or contact forms (with the name and email you choose to give); names you check or shortlist in the newborn features; and, where the Hasta feature is offered, photographs of a palm (Section 7).

Content we generate for you

We store the outputs the Services produce for you: computed sidereal birth charts, dasha timelines, daily briefs and longer horizons, panchang information, AI chat responses, generated images, premium PDF and text reports, couples and family insights (Kundali Milan compatibility and Sacred Bond relationship insights), naming suggestions, hand measurements and readings, and in-app transit notifications.

Derived information

To power conversation memory, we create vector embeddings of chat messages and AI-derived profile memory notes (short facts the AI records about a profile based on your conversations). Section 6 describes this in detail.

Purchase and subscription information

Payments are processed by Stripe. We never store card numbers. We store Stripe customer and subscription identifiers, your plan, subscription status (including whether you are in a free trial and when it ends), renewal and cancellation choices and any reason you optionally give for cancelling, records of one-time purchases such as token booster packs and report unlocks, and a token-usage ledger that tracks your metered AI usage against your plan allowance.

Preferences and settings

We store your notification preferences, your interface language (the Services support eight languages), your advertising-cookie choice, and interface preferences saved in cookies as described in Section 10.

Waiting list and contact forms

If you join a waiting list on our marketing site, we store the email address you give and where you signed up from. If you use a contact or feedback form, we store your message, any name and email you provide, your browser type, and a one-way hash of your network address used only to limit abuse of the form; the raw address is not stored.

Information collected automatically

Like most online services, our hosting infrastructure receives standard technical information when you use the Services, such as IP address, browser and device type, language settings, pages requested, referring addresses, and timestamps, in server and edge logs. We record product events (for example, that a chart was cast, a purchase completed, or a trial reminder was sent) tied to your account so we can operate, support, and secure the Services. We also keep admin audit logs that record administrative actions on accounts for security and accountability.

4. Birth Data and Profiles About Other People

We treat birth data with particular care. A birth date, birth time, and birth place are more than calendar entries: combined with the context of an astrology service, they can reveal age, approximate origin, and, through your conversations about them, matters you may consider deeply personal, including spiritual or religious beliefs, health, and relationships. We use birth data only to provide the Services described in this policy, we never sell it or use it for advertising, and we apply the security measures described in Section 13 to it.

Because Birth Profiles can describe people other than the account holder, the following rules apply and are also part of our Terms & Conditions and Acceptable Use Policy:

• You may only enter another person's birth details if you have that person's informed consent, or if you are the parent or legal guardian of a minor child with authority to do so, and you have a lawful basis under the privacy laws that apply to you and to them.
• You are responsible for the accuracy of the information you enter and for honoring the wishes of the person a profile describes, including deleting the profile if they ask you to.
• Couples and family features, including Kundali Milan compatibility, Sacred Bond relationship insights, and the family view, involve more than one profile. Do not run these features on a profile of another person without the consent described above.

When you enter another person's details, you act as the source of that information and, in some jurisdictions, as a controller of it in your own right; we process it on your instructions to provide the Services to you. If you believe someone has entered your birth details or photographed your hand for Horoskope AI without your consent, contact us at 1corporate@clevera.com. We will investigate and, after verifying your identity and the facts as far as we reasonably can, may delete the profile and the content derived from it.

5. How We Use Information

We use Personal Information to:

• Provide the Services: computing sidereal birth charts, dasha timelines, daily briefs and horizons, and panchang information from the Birth Profiles you create, and presenting them in the language and vocabulary you choose.
• Operate the AI chat, including maintaining conversation memory so the AI can respond in context, and generating images you ask for (see Section 6).
• Generate premium reports, couples and family insights, naming suggestions, hand readings, and other outputs you request.
• Show in-app transit notifications according to your notification preferences.
• Manage your account, plan, trial, and billing, including metering AI usage in tokens against your plan allowance, processing purchases through Stripe, and sending transactional email such as a reminder before a free trial converts to a paid plan, renewal or payment notices, and security or account notices. These service messages are not marketing and cannot be opted out of while you hold an account, except by deleting it.
• Respond to support requests and feedback, and use outcome ratings and feedback to improve the quality of the Services, for example by reviewing which readings people found useful.
• Protect the Services and our users: detecting fraud, trial and allowance abuse, and other misuse, enforcing the Terms & Conditions and Acceptable Use Policy, honoring age and consent requirements, and maintaining admin audit logs.
• Measure whether advertising we paid for led to a visit or purchase, only with your consent and only as described in Section 11.
• Comply with law, including tax, accounting, consumer protection, and lawful requests from authorities, and establish, exercise, or defend legal claims.

We do not sell Personal Information, we do not use it for profiling that produces legal or similarly significant effects, and we do not use your content to train foundation AI models. We may create aggregated or de-identified statistics (for example, how many charts were cast in a month) that cannot reasonably be linked to you, and we commit not to attempt to re-identify them.

6. How Our AI Features Process Your Information

AI text generation, embeddings, and image generation for the Services run on AWS Bedrock, Amazon's managed AI platform, in our own AWS account and configured to United States regions. Today we use the Amazon Nova model families for text generation and images and Cohere models for embeddings; we may also use other models hosted on AWS Bedrock, such as the Anthropic Claude family, under the same terms, which keep your content inside our account and exclude it from model training. Voice features use two further Amazon services in the same account: Amazon Transcribe converts your recorded speech to text, and Amazon Polly converts our written answer to audio. We have opted the account out of the use of customer content for AWS service improvement, so neither your speech nor your chart is used to train any model.

One feature uses a provider outside AWS, and we would rather name it plainly than bury it. Google Cloud Text-to-Speech reads answers aloud in Marathi, Punjabi, Gujarati, Telugu, Tamil and Kannada, because Amazon Polly has no voice for those six languages. What is sent to Google is the finished answer text and nothing else: never your birth date, birth time or birth place, never your chart or any position in it, never your name or email address or account identifier, and never your voice recording, which stays within AWS. The request goes to Google's United States endpoint, so the text is processed in the same country as the rest of the Services, and Google documents that it does not log Cloud Text-to-Speech text or audio data. If we cannot reach Google, those six languages report that reading aloud is unavailable rather than substituting another voice.

When you use the AI chat or request AI-generated content such as reports, briefs, naming suggestions, or insights, relevant information (for example, your message, the applicable Birth Profile data, computed chart data, passages from our astrological knowledge corpus, and stored conversation memory) is sent to AWS Bedrock to generate the response. If you ask for an image in chat, a paraphrase of your request and a few chart attributes (such as the ascendant sign and Moon nakshatra) are sent to the image model; the resulting image is stored with your account and served only to you. Neither Clevera nor AWS Bedrock uses your content to train foundation models.

Voice

If you ask a question aloud, the recording is sent to Amazon Transcribe to produce a transcript, and that transcript is then treated exactly like a typed question. If you have a reading read aloud, the text is sent to Amazon Polly to produce audio, or to Google Cloud Text-to-Speech for the six languages Polly cannot speak. We do not store your voice recordings: the audio is used to produce the transcript and is then discarded. The transcript itself is saved with your conversation, as a typed message would be, and you can delete it in the same way. We do not create voiceprints or use your voice to identify you.

Conversation memory

To make conversations useful over time, the Services maintain memory in two forms: vector embeddings of chat messages, which let the AI retrieve relevant past context, and AI-derived profile memory notes, which are short facts the AI records about a profile based on what you discuss. Both are stored with your account, are included in your data export so you can see exactly what the AI has recorded, and are deleted when you delete the related conversation, profile, or your account, as described in Section 14.

Accuracy, reliance, and automated decisions

AI-generated content can be inaccurate, incomplete, or inconsistent. Nothing in the Services predicts the future, and no output is medical, mental-health, legal, financial, or professional advice. Do not rely on the Services for decisions about health, medication, pregnancy, marriage or divorce, investments, employment, or legal matters; consult a qualified professional. The Terms & Conditions contain the full disclaimer. We do not use your Personal Information to make automated decisions that produce legal effects or similarly significant effects on you, and the Acceptable Use Policy forbids you from using our outputs to make such decisions about anyone else.

7. Hand Photographs (Hasta)

This Section applies only where we offer the Hasta hand-reading feature on your account; if it is not shown in your navigation, we hold no hand data for you. Before the camera opens you are shown a consent notice, and nothing is captured until you agree to it.

What is captured. One photograph of the palm, used for measurement only: the length and curve of the lines, the rise of the mounts, and the proportions of the fingers. No fingerprint or ridge detail is captured, and the crop leaves the thumb pad outside the frame by design. We do not use hand photographs or measurements to identify, authenticate, or match anyone, and the feature is not a biometric identification system.

Where it goes. The photograph is uploaded to encrypted storage in our own AWS account and measured there by our own extraction software. It is not sent to any third-party AI or image service, and it is never used to train any model.

How long it lives. The photograph is destroyed the moment the measurements have been read from it, and in every case within 30 minutes of upload, enforced by the extraction step, by every later view of the capture, and by a scheduled sweep. What remains is the set of measurements, quality scores for the frame (focus, exposure, coverage), and the written reading. If you separately choose the option to keep a rectified crop of the palm so the line overlay can be redrawn without a new photograph, that crop (which still excludes the thumb pad) is kept under that choice until you delete the capture; the default keeps no image at all.

Your control. Measurements and readings stay with the profile until you delete the capture, the profile, or your account; deleting erases them, and any retained crop, for good. The rules in Section 4 about other people apply to a hand exactly as to a birth date: photograph another person's hand only with their informed consent.

8. Service Providers and Subprocessors

We use a small set of service providers to run Horoskope AI. Each processes Personal Information on our behalf, only on our instructions, under contractual terms that restrict their use of it to providing their service to us:

• Clerk: authentication and account management. Clerk processes your sign-up, sign-in, email verification, and session credentials.
• Stripe: payment processing for subscriptions, token booster packs, and one-time purchases. Stripe processes your payment card details directly and acts as an independent controller for fraud prevention and its own legal obligations; we never store card numbers and receive only Stripe identifiers, transaction state, and the billing details needed for tax and receipts.
• Amazon Web Services (AWS): hosting and infrastructure in United States regions, including an encrypted Postgres database, S3 object storage for reports, generated images, and hand captures, Lambda compute, and the CloudFront content delivery network. AWS Bedrock, Amazon Transcribe, and Amazon Polly provide the AI, speech-to-text, and text-to-speech access described in Section 6. Amazon Simple Email Service (SES) delivers our transactional email, such as trial reminders and account notices, and forwards feedback submissions to us.
• Google LLC (Google Cloud Text-to-Speech): converts our written answer to audio for Marathi, Punjabi, Gujarati, Telugu, Tamil and Kannada, using Google's United States endpoint. It receives the answer text only, and Google documents that it does not log Cloud Text-to-Speech text or audio data. It receives no birth data, no chart, no identifier and no recording.
• TikTok (advertising measurement): only if you allow advertising cookies, as described in Section 11. TikTok is not a service provider for the data it receives through its pixel; it is a third party to which identifiers are shared for cross-context behavioral advertising, which is why the choice is yours.

If we add or replace a provider that processes Personal Information, we will update this policy as described in Section 22 before the change takes effect.

9. When We Disclose Information

We disclose Personal Information only in these situations:

• With the service providers listed in Section 8, to the extent needed to provide the Services.
• With TikTok, limited to online identifiers and internet activity, only with your consent and only as described in Section 11.
• To comply with law: in response to a subpoena, court order, or other lawful request by public authorities, including to meet national security or law enforcement requirements, or where disclosure is necessary to protect the rights, safety, or property of Clevera, our users, or the public, or to detect, prevent, or address fraud, abuse, or security issues.
• With our professional advisers, such as lawyers, accountants, and auditors, under duties of confidentiality, where needed.
• In a corporate transaction: if Clevera is involved in a merger, acquisition, financing, due diligence, reorganization, bankruptcy, or sale of some or all of its assets, Personal Information may be transferred as part of that transaction, subject to this policy or to a successor policy with notice to you and, where the law requires it, your choice.
• At your direction: for example, when you export your data, share a report you generated, or ask us to send something on your behalf.

We do not sell Personal Information. We do not disclose it to data brokers, and we do not share it for cross-context behavioral advertising except through the single consent-gated pixel in Section 11.

10. Cookies and Similar Technologies

The Services use a small number of cookies and similar browser storage. Most are strictly necessary or a functional preference. One is an advertising cookie, and it is only ever set with your permission as described in Section 11. The cookies are:

• hs-profile: a first-party cookie set by Horoskope AI that remembers which of your Birth Profiles you last selected, so the app opens on the right chart. Purpose: functionality. Lifetime: up to one year.
• hs-tips: a first-party cookie that records whether you have turned in-app tips on or off. Purpose: functionality. Lifetime: one year.
• Clerk session cookies: set by our authentication provider to keep you signed in and secure your session. Purpose: strictly necessary. The Services cannot authenticate you without them.
• Stripe cookies: set by Stripe during checkout to process payment and help prevent fraud. Purpose: strictly necessary for purchases.
• horoskope_ad_consent (advertising choice): records whether you allowed or declined advertising cookies, so that the answer is remembered and applies on both horoskope.ai and app.horoskope.ai rather than having to be given twice. It holds one word, allowed or declined, and nothing else. Purpose: honoring your preference. Strictly necessary in the sense that without it we could not keep the promise made in Section 11.
• TikTok pixel cookies: set by TikTok when you allow advertising cookies, so we can tell whether an advertisement brought you here. Purpose: advertising measurement. Never set if your browser sends a Global Privacy Control signal, never set in the EEA or the UK unless you opt in, and deleted outright the moment you opt out, from the privacy choices link in our footer or in Settings under Privacy inside the app.
• _ttclid (advertisement click identifier): if you arrive from a TikTok advertisement, TikTok adds an identifier for that click to the web address. We store it in this cookie so that a purchase made afterwards can be matched back to the advertisement, since our marketing site and our application are on different addresses. It contains no information about you, it is set only when advertising cookies are allowed, and it expires after 30 days. Purpose: advertising measurement.

We also use browser local storage on your device for convenience, for example to remember that you ticked the acceptance box for the current version of the Terms on this device and to remember interface state; this stays on your device and is not a tracking technology. You can delete or block cookies in your browser settings. Blocking Clerk or Stripe cookies will prevent sign-in or checkout from working.

11. Analytics and Advertising Technologies

We use one advertising technology: the TikTok pixel. It tells us whether an advertisement we paid for led to a visit, a sign-up or a purchase. It is the only third-party analytics or advertising technology on the Services; we use no third-party analytics suite, session recording, or fingerprinting.

What it receives, and what it never receives

The pixel sees the page address you are on, your IP address and standard browser information, and a cookie identifier TikTok uses to match a visit to an advertisement. It never receives your birth details, your chart, your questions, your readings, or anything you type or say to the Services. We do not send it your name or email address, and we do not use its identity-matching features.

The four moments we report

Beyond the page view, we report four moments in the purchase journey, so that we can tell which advertisements actually work: viewing our home page, starting a checkout, finishing account setup, and completing a payment. Each report says that the step happened and, where money is involved, which plan and how much. None of them carries anything about who you are.

The payment report is sent from our servers rather than from your browser, because a payment is confirmed by our payment processor after you have left the card form. It contains the amount, the currency, the plan purchased, and the two identifiers TikTok itself created: the click identifier from its own advertisement and the identifier its own pixel set in your browser. It does not contain your email address, your name, your account identifier, your IP address or your browser details. If you have not allowed advertising cookies, or you allowed them and later opted out, those identifiers are absent and no payment report is sent: opting out deletes them, and the report is refused independently whenever your recorded choice is no.

Your control over it

• Global Privacy Control: if your browser sends a GPC signal, the pixel is never loaded at all, and we do not ask you again.
• EEA and the United Kingdom: nothing loads until you choose to allow it. You are asked once, and declining is as easy as accepting.
• Everywhere else: the pixel operates unless you opt out, which you can do at any time from the privacy choices link in our website footer, or in Settings under Privacy inside the app. Your choice applies to both horoskope.ai and app.horoskope.ai, whichever one you make it on.

California: sharing for cross-context behavioral advertising

Using the pixel means we share Personal Information (online identifiers and internet activity) for cross-context behavioral advertising, as California law defines that term. We do not sell Personal Information for money, and we have never done so. The privacy choices link in our footer is the "Do Not Sell or Share My Personal Information" opt-out mechanism California requires, and we honor Global Privacy Control as a valid opt-out request. We do not knowingly share the Personal Information of anyone under 16.

If we ever add another analytics or advertising technology, we will update this section and the cookie list before it goes live, and obtain consent where the law requires it.

12. Data Retention

We keep Personal Information only for as long as needed for the purposes described in this policy, and we decide how long that is by reference to the purpose the data serves, your choices, and our legal obligations. In general:

• Account information, Birth Profiles, chat messages and transcripts, embeddings, memory notes, generated images, reports, hand measurements, and other generated content are retained while your account exists, and are deleted when you delete the relevant conversation, profile, capture, or your entire account using the controls described in Section 14.
• Voice recordings are not retained at all; they are discarded once transcribed. Hand photographs are destroyed within 30 minutes of upload at the latest (Section 7).
• Purchase and subscription records, including Stripe identifiers, invoices, and the token-usage ledger, may be retained after account deletion for as long as we are required to keep them for tax, accounting, billing-dispute, chargeback, or other legal purposes, typically up to seven years.
• When you delete your account, we keep a minimal deletion record (the internal number of the former account and when the deletion completed) so we can prove we honored it. It holds no email address, name, or birth data.
• Your acceptance of the Terms (date and version) and your age-confirmation outcome are kept for as long as your account exists and, as part of the deletion record, as long as needed to evidence compliance.
• Admin audit logs, product event logs, and security-related records are retained for a limited period appropriate to their security, support, and accountability purpose.
• Waiting-list email addresses are kept until you ask us to remove them or the list is no longer needed. Feedback submissions are kept while they are useful for improving the Services.
• Copies of deleted data may persist temporarily in encrypted backups until those backups are cycled out in the ordinary course, and are not restored to live systems except to recover from a failure.

When retention is no longer needed, we delete or de-identify the information.

13. Security

We use technical and organizational measures designed to protect Personal Information appropriate to its sensitivity, including encryption in transit (TLS) and at rest for our database and object storage, access controls and least-privilege credentials limiting who and what at Clevera can access production data, per-user scoping of stored files so one account cannot read another's images or reports, admin audit logs recording administrative actions, automated destruction of hand photographs, rate limiting and abuse detection, and reliance on the security programs and certifications of our infrastructure providers (AWS, Clerk, Stripe, and Google).

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your Personal Information, we will notify you and the relevant authorities as required by applicable law, without undue delay. You can help by keeping the email account you sign in with secure, by signing out on shared devices, and by contacting us at 1corporate@clevera.com if you suspect unauthorized access.

14. Your Choices and In-Product Controls

You do not need to email us to exercise the most important controls; they are built into the app:

• Data export: download a full export of your data from Settings, as machine-readable JSON. It includes your profiles, conversations, briefs, reports, purchases, subscriptions, events, bonds, token ledger, profile memory notes, outcome ratings, notifications and preferences, and feedback.
• Account deletion: delete your account from Settings, which first cancels any active subscription with Stripe so you can never be billed for an account that no longer exists, then removes your Birth Profiles, conversations, memory, generated content, stored reports and images, and hand data, subject to the limited legal retention described in Section 12. Deletion is permanent.
• Profile deletion: delete an individual Birth Profile and its associated charts, readings, memory notes, and hand captures.
• Conversation deletion: delete individual AI chat conversations, including their transcripts and embeddings.
• Capture deletion: where Hasta is offered, discard a hand capture and everything derived from it.
• Subscription: cancel a subscription online in Settings under Subscription; access continues to the end of the period and nothing further is charged. The free trial needs no cancelling: no payment method is held for it and it ends on its own.
• Advertising cookies: allow or decline the TikTok pixel from the privacy choices link in our footer or in Settings under Privacy.
• Notification preferences: control transit notifications in your settings.

You can also manage cookies in your browser (Section 10), correct your account name and profile details in the app, and contact us at 1corporate@clevera.com for any request these tools do not cover, including questions about data we hold or a request made on behalf of someone whose details were entered by another user.

15. Your California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy, as required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the CCPA).

Categories of personal information we collect

In the preceding 12 months we have collected the following categories of personal information, for the purposes in Section 5, from you directly, from your devices, and from our service providers (Clerk, Stripe, AWS):

• Identifiers: account email, name on the account, account and Stripe identifiers, IP address, and online identifiers (cookie and advertising click identifiers, only if you allow advertising cookies).
• Customer records: Birth Profile details you enter (name or label, birth date, optional birth time, birth place, optional gender) and billing details held by Stripe.
• Characteristics of protected classifications: age (derivable from a birth date) and gender, where you choose to provide it in a profile; religious or philosophical beliefs to the extent they can be inferred from using an astrology service or from what you write.
• Commercial information: plan, trial and subscription state, purchases of token booster packs and one-time items, and the token-usage ledger.
• Internet or network activity: technical log information and product events about your use of the Services, and the limited page-view information the advertising pixel receives if allowed.
• Geolocation data: the birth place you enter for a profile (which is about the chart subject, not your current location) and the coarse location implied by an IP address. We do not collect precise geolocation from your device.
• Audio and visual information: transient voice recordings that are transcribed and discarded, and, where Hasta is offered, transient hand photographs that are measured and destroyed, plus the measurements and any crop you choose to keep.
• Inferences and derived data: vector embeddings, AI-derived profile memory notes, and generated astrological content.
• Sensitive personal information: the content of your chat messages may reveal information you consider sensitive, such as religious or spiritual beliefs, health, or sex life; hand measurements may be considered biometric information under some definitions even though we do not use them to identify anyone. We use such information only to provide the Services you request and for the purposes the CCPA permits without a right to limit; we do not use or disclose it to infer characteristics about you for other purposes, and we do not sell or share it.

Disclosure, sale, and sharing

We disclose each of these categories to our service providers for business purposes as described in Sections 8 and 9. We do not sell personal information for money, and we have not done so in the preceding 12 months. We do share one category, identifiers and internet activity, for cross-context behavioral advertising, in one narrow way: the TikTok advertising pixel described in Section 11, and only if you allow it. It never receives your birth details, your chart or anything you write or say to the Services. You can stop that sharing at any time using the privacy choices link in our website footer or in Settings under Privacy inside the app, which also deletes the advertising cookies already set, and we honor Global Privacy Control as a valid opt-out request. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

Your rights

• Right to know and access: request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to. The Settings export provides the specific pieces directly.
• Right to delete: request deletion of your personal information, subject to legal exceptions. The in-product deletion tools in Section 14 provide this directly.
• Right to correct: request correction of inaccurate personal information. You can edit Birth Profiles and account details in the app, or contact us.
• Right to opt out of sale or sharing: use the privacy choices link, the Settings control, or Global Privacy Control, as described above.
• Right to limit use of sensitive personal information: because we already use sensitive information only for purposes that do not trigger this right, there is no additional use to limit; if that changes, we will offer the required control.
• Right to non-discrimination: we will not deny you service, charge you a different price, or provide a different level of quality because you exercised any of these rights.

How to exercise these rights

Use the in-product tools described in Section 14, or email 1corporate@clevera.com with the subject line "California Privacy Request". We verify requests by confirming control of the account email associated with the data, and may ask for additional information where needed to match you to our records. You may use an authorized agent to submit a request on your behalf; we will require proof of the agent's authorization (such as a signed permission or power of attorney) and may still verify your identity directly. We respond within the timeframes the CCPA requires, generally 45 days, with one permitted extension of a further 45 days on notice to you. We do not charge for requests unless they are manifestly unfounded or excessive.

How long we keep each category of personal information is governed by the criteria described in Section 12. Under California's "Shine the Light" law (Civil Code Section 1798.83) you may also request information about disclosures of personal information to third parties for their direct marketing purposes; we make no such disclosures.

16. Notice to Users in the EEA and United Kingdom (GDPR)

If you are in the European Economic Area or the United Kingdom, this section applies under the EU General Data Protection Regulation and the UK GDPR. Clevera Inc. is the controller of your Personal Information and can be reached at 1corporate@clevera.com.

Lawful bases

• Performance of a contract (Article 6(1)(b)): providing your account, charts, briefs, reports, AI chat, voice, naming and family features, notifications, trials, and subscriptions, and sending the service messages they require.
• Consent (Article 6(1)(a)): optional information you choose to provide (such as birth time or gender), profiles you create about other people with their consent, hand photographs, the advertising pixel, and any future analytics or advertising technologies that require consent. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal, by deleting the relevant content or changing the relevant setting.
• Legitimate interests (Article 6(1)(f)): securing the Services, preventing fraud, trial abuse, and misuse, keeping audit and event logs, improving features using feedback and outcome ratings, measuring our own advertising at an aggregate level, and establishing, exercising, or defending legal claims. We have balanced these interests against your rights and apply safeguards such as minimization and short retention.
• Legal obligation (Article 6(1)(c)): retaining tax, accounting, and similar records, responding to lawful requests, and honoring consumer protection requirements.

Special category data

Using an astrology service can itself reveal information about your spiritual or philosophical beliefs, your chat messages may include anything you choose to share, including health, sex life, or relationship matters, and hand measurements may in some views be biometric data even though we never use them to identify anyone. Where information you provide falls into a special category under Article 9, we process it on the basis of your explicit consent (Article 9(2)(a)), which you give by choosing to enter that information or to use that feature after reading the notice shown, and which you can withdraw at any time by deleting the relevant content, capture, profile, or your account.

Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests, as well as the right to withdraw consent and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we make no such decisions). The fastest way to exercise access, portability, and erasure is through the in-product tools described in Section 14: the Settings export provides your data in a structured, commonly used, machine-readable form, and the deletion controls remove it. For anything else, email 1corporate@clevera.com; we respond within one month, extendable by two further months for complex requests with notice to you.

You also have the right to lodge a complaint with your local supervisory authority or, in the UK, the Information Commissioner's Office, although we would appreciate the chance to address your concern first. Section 18 describes how your data is transferred to the United States.

17. Other United States State Privacy Rights

If you live in a US state with a comprehensive consumer privacy law (for example Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, or others as they take effect), you may have rights to confirm whether we process your personal data, to access, correct, delete, and obtain a portable copy of it, to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects, and, for sensitive data, to consent (or, in some states, to opt out) before it is processed.

We do not sell personal data and do not profile you for significant decisions. The advertising pixel in Section 11 is targeted advertising under these laws; you can opt out with the privacy choices link, in Settings under Privacy, or by sending a Global Privacy Control signal, which we honor. We treat your entry of birth details, chat content, and hand photographs as your consent to process the sensitive data they contain for the features you requested. To exercise any other right, use the tools in Section 14 or email 1corporate@clevera.com with the subject line "State Privacy Request"; we verify requests as described in Section 15 and respond within 45 days. If we decline a request, you may appeal by replying to our decision with the word "Appeal" in the subject line; we will respond to the appeal within the time your state's law requires and tell you how to contact your state attorney general if you are dissatisfied.

18. International Data Transfers

Clevera is based in California, and the Services are hosted on AWS in United States regions, so your Personal Information is processed and stored in the United States. If you use the Services from the EEA, the UK, Switzerland, India, or elsewhere, your information is transferred to the US, a country whose data protection laws may differ from those where you live.

Where such transfers require safeguards under the GDPR, UK GDPR, or similar laws, we rely on recognized transfer mechanisms, such as the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable) in our contracts with providers, or a provider's certification under the EU-US Data Privacy Framework, its UK Extension, or the Swiss-US Data Privacy Framework. You can contact us at 1corporate@clevera.com for more information about the safeguards that apply to your data, including a copy of the relevant clauses where we are permitted to share them.

19. Children and Age Requirements

You must be at least 18 years old, or the age of majority where you live if that is higher, to hold an account. The Services are for adults, are not directed to children, and we do not knowingly collect Personal Information from anyone under 18 as an account holder. If we learn that someone under 18 holds an account, we will close it and delete the data. If you believe this has happened, contact us at 1corporate@clevera.com.

We ask for your date of birth once, when you first sign in, and check it against that minimum. We do not keep the date. What we store is the answer and when it was given, because holding a second birth date that identifies you as the account holder would be more information than the question needs. If the date is below the minimum we record that too, so that the question is not simply answered again with a different date, and the account is closed.

We set the minimum at 18 because the Services process birth details, record voice, measure hands where offered, produce marriage compatibility readings, and discuss health, money, and relationships if asked, and because our lawful basis in the EEA and the UK for the special-category aspects of that processing is your explicit consent, which is not something a child can give in many of the countries we serve.

A parent or legal guardian may create a Birth Profile describing their child, and may use the newborn naming features for a child, as described in Section 4. That profile is data provided by the parent under their own account, is used only to provide the features the parent requests, and the parent can delete it at any time using the profile deletion control. We do not knowingly sell or share the Personal Information of anyone under 16, and we do not direct advertising to children.

20. Do Not Track and Opt-Out Preference Signals

We honor Global Privacy Control. If your browser sends a GPC signal, we treat it as a valid opt-out request under California law and the other state laws in Section 17: the TikTok pixel described in Section 11 is never loaded, no advertising cookie is set, no conversion is reported, and you are not asked about it again. That is the only practice on the Services such a signal has anything to opt you out of, because it is the only way we share Personal Information for cross-context behavioral advertising. We do not sell Personal Information, and we use no other cross-site tracking. Browsers vary in how they send Do Not Track, and there is still no common standard for interpreting it, so we act on GPC, which is unambiguous.

21. Related Policies

This Privacy Policy works together with two other documents:

• The Terms & Conditions (at https://horoskope.ai/terms), which govern your use of the Services, subscriptions, trials and billing, the astrology and AI content disclaimer, and dispute resolution.
• The Acceptable Use Policy (at https://horoskope.ai/acceptable-use), which describes prohibited uses of the Services, including misuse of other people's birth data and hand photographs and the use of outputs to make decisions about others.

If this Privacy Policy conflicts with either document on a question of how Personal Information is handled, this Privacy Policy controls.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the effective date at the top and post the updated version at https://horoskope.ai/privacy. For material changes, such as adding a provider, an analytics or advertising technology, or a new purpose, we will provide more prominent notice before the change takes effect, for example an in-app notice or an email to your account address, and obtain consent where the law requires it. We will not apply a material change retroactively to Personal Information already collected without your consent where the law requires consent. Your continued use of the Services after the effective date of an updated policy means the updated policy applies to you.

23. How to Contact Us

For privacy questions, requests, or complaints, contact Clevera Inc. at 1corporate@clevera.com. Please include "Privacy" in the subject line so we can route your message quickly. If you are in the EEA or the UK and we are required to appoint a representative or a data protection officer, we will publish their details here.

California consumer notice

Under California Civil Code Section 1789.3, California users are entitled to the following notice: the Services are provided by Clevera Inc.; you may request our current mailing address by writing to 1corporate@clevera.com, and it is also available from the California Secretary of State's business records for Clevera Inc. Complaints regarding the Services or requests for further information may be sent to 1corporate@clevera.com. You may also contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.