Privacy policy

Registration uses your name, email and password, stored as a hash. Google sign-in you initiate supplies a Google identifier, name, email and profile image. A voluntarily uploaded profile photo is re-encoded to remove image metadata and hosted at a public Vercel Blob URL: do not upload confidential images or documents.

Enquiries contain your name, one contact method (phone, email or Telegram), message, selected product, language and originating page. Accounts hold course access, progress, orders and status, referrals and points/rewards. Infrastructure processes connection information such as IP address and browser. New CRM records do not store IP, user-agent, referrer or UTM and use query-free paths; this does not confirm deletion of historical records. Message content is supplied by you.

Answering enquiries and preparing orders serve precontractual steps you request; account administration and agreed access serve delivery of the service. Analytics, marketing and optional preferences use separate consent. Security, abuse prevention and protection of rights may rely on legitimate interests after necessity and balancing assessments. The operator must identify concrete legal record-keeping duties.

TODO_LEGAL_BASES: the operator must confirm its processing register, each legal basis and legitimate-interest assessment. An enquiry does not subscribe you to advertising.

Vercel provides hosting and infrastructure; Neon (PostgreSQL) / Supabase stores accounts, access and CRM records; Vercel Blob hosts files and images. Authorised staff administering services and answering enquiries may access relevant data.

The contact form records your enquiry in the CRM. Its code can forward the name, contacts and message through Telegram Bot API to the team only when configured; saving an enquiry does not prove Telegram delivery. Google OAuth is used when you choose Google sign-in. Resend is integrated for course-access emails only when configured; this is not newsletter registration. Production activation of automatic Telegram and Resend delivery is not confirmed in this version. Google sign-in or manual contact are the displayed access-help options; the recovery page does not send a password-reset email.

Google Analytics 4 and Vercel Analytics load after Analytics consent; Google Ads and Meta Pixel after Marketing consent. They may receive device information, eligible page visits and advertising identifiers. Form fields are not added to the site's configured events. YouTube loads following your explicit playback action and notice; thumbnails are delivered through the site. Telegram, WhatsApp and social links open external services with their own policies.

Providers may process data outside Moldova and, where relevant, the EEA. TODO_TRANSFER_SAFEGUARDS: regions, legal recipients, processing agreements and transfer safeguards must be confirmed. Listing a provider does not establish a contract or an adequacy decision.

TODO_RETENTION_SCHEDULE: no verified schedule has been supplied for accounts, enquiries, Telegram messages, orders, logs, photos and backups. The operator must set periods, criteria and deletion procedures, including after account closure. Cookie lifetimes are not database retention periods.

Measures include HTTPS, password hashing, HttpOnly session cookies and access controls. Request limiting stores in kn_rate_limits a hash derived from IP, action and a 15-minute window, the attempt count and a 30-minute expiry. Expired entries are deleted on later requests, not by a guaranteed physical-deletion deadline; the hash is pseudonymous, not anonymous. Absolute security cannot be guaranteed. Do not send passwords, bank-card details, identity documents or medical information in free-text fields.

Subject to applicable law, you may request access, rectification, erasure, restriction and portability or object to processing. Consent may be withdrawn without affecting earlier lawful processing. Cookie settings in the footer lets you change preferences.

The designated privacy email remains TODO_OPERATOR_DATA. Until completed, use Contact or the public KARMANUMBERS channel to request routing of your enquiry; do not post identity documents publicly. Identity checks must be proportionate. You may complain to CNPDCP (datepersonale.md, centru@datepersonale.md, +373 22 820 801), or the competent EEA authority where GDPR applies, without the site's permission.

Messages about health, beliefs, relationships or sexuality and children's data may need additional protection. Do not supply these or another person's data without necessity and authority to disclose them. TODO_MINOR_POLICY: age eligibility and legal-representative involvement must be defined. LEGAL REVIEW REQUIRED / DPIA MAY BE NECESSARY for systematic processing of sensitive or children's data.

Numerology interpretations are reflection tools, not medical, legal or financial decisions. No solely automated decision with legal or similarly significant effects was identified; new functions must be reassessed.

This documentation considers Moldova's Law 195/2024 on data protection and Law 72/2025 on electronic communications. GDPR/ePrivacy applicability requires additional assessment when services target people in the EU/EEA or monitor their behaviour. Precise applicability requires legal review. Significant purpose or technology changes require information and, where necessary, a new choice.