Privacy policy

1. Who we are

Rosaluna is a membership that casts an astrological chart, writes readings from it, and draws the Soulmate Sketch. It is operated by Rosaluna inc. Throughout this policy, "we", "us" and "our" mean Rosaluna, and our postal address is in section 21.

The person with the highest authority in the enterprise is responsible for the protection of personal information, as Québec's Law 25 requires. That person, and everyone else here who handles your information, can be reached at support@getrosaluna.com.

We are a small business and we have not appointed a data protection officer, which Law 25 and the GDPR both permit at our size. Every privacy question still reaches a person who can answer it.

2. What this policy covers

Rosaluna runs on two addresses. getrosaluna.com is the funnel: the quiz, the chart, the trial page and the checkout. rosaluna.app is the product: your portal, your readings, your sketch, your billing centre and the pages you manage your membership from. This policy covers both, and it covers the email and the push notifications we send you.

It covers the Soulmate Sketch and the Rosaluna membership. It does not cover anyone else's website that you reach from a link on ours; those sites have their own policies.

It is written in English. If we ever publish a translation and the two disagree, the English version governs.

By using Rosaluna you confirm that you have read this policy. Reading it is not legal advice, and this policy does not give you legal advice about your own situation.

3. Data we collect

3.1 What you give us

• Your email address. We ask for it partway through the quiz, when we offer to keep your chart for you, and it becomes the identifier for your account. There is no password: we sign you in with a link or a code sent to that address.
• Your first name, if you type one.
• Your answers in the quiz. That includes how you describe your situation and who you are drawn to, the cues that shape a sketch (hair, age band, the energy you put out), and the instincts and fears that guide a reading.
• Your birth details: the date, the place, and the time if you give it. The time is optional and a chart can be cast without it.
• A photo, if you choose to add one. The step is optional and the quiz carries on without it.
• Whether you ticked the box that asks us to send Lara's notes by email. It ships unticked and nothing turns it on for you.
• Anything you write to our support desk, and the address you wrote from. We hold the whole conversation.

3.2 What we collect automatically

• A session cookie that keeps you signed in. It is first-party and it cannot be read by scripts on the page.
• A salted hash of your IP address, used to rate-limit a form so that one script cannot hammer it. The hash cannot be turned back into the address, and that is the point: the limiter needs to recognise a repeat caller, not to know who they are. (Your raw IP address does reach our host, as it does on any website, and it is passed to Meta with a purchase report: section 6.7.)
• The advertising parameters on the link you arrived through: the campaign fields in the URL, and the click identifier an ad network adds to it. We store those with your order, so that we can tell which advertisement produced it.
• Which screens you reached and which answers you gave, written as a behavioural event. These rows are deleted 30 days after they are written (section 9).
• Standard technical records of the requests that reach us. Our host, Cloudflare, keeps those under its own policy, linked in section 6.1.

3.3 What we create and keep for you

• Your chart, computed from your birth details.
• Every reading we write for you: the daily card, the weekly reading, the monthly deep reading, and the answers a guide writes when you put a question to one.
• Your sketch, if you ordered one, together with the notes behind it.
• What you bought and what you paid: amounts, dates, the cadence you agreed to, any refund, and the consent sentence you accepted at checkout.
• The card brand and last four digits of the card that pays for your membership.

3.4 What we never hold

• Your full card number, its expiry date and its security code. You enter them into a payment form our provider serves from its own domain. The number never passes through our servers and we cannot read it. What comes back to us is a token and the last four digits.
• Your password, because there is not one. Sign-in is by a link or a code sent to your email address.
• Your photo in any form a model can see. The photo is used inside our own system to prepare the sketch. It is kept out of the derivations the model reads, on purpose.
• Your birth time, if you skipped it, and your photo, if you skipped it. We hold what you gave us and not what you did not.

4. How we use your data

• To cast your chart from your birth details, and to write the readings that follow from it.
• To answer the questions you put to a guide.
• To draw your Soulmate Sketch from the cues you gave us and the photo, if you added one.
• To deliver everything into your portal, and to tell you by email that it is ready.
• To take payment, to renew your membership on the cadence you agreed to, and to refund you when you ask.
• To run the services in your account: the billing centre, the cancel route, your saved card.
• To reply when you write to support.
• To send you notes by email, only if you ticked the box, and never again after you tell us to stop.
• To measure which advertising brings people who stay, so that we know what the readings can afford to cost. That is aggregate reporting, not a profile of you.
• To prevent card fraud, and to answer a chargeback or a card-network dispute. This is why the payment records are the ones we keep longest.
• To meet our tax, accounting and other legal obligations.

We do not sell your personal information. We do not disclose it to advertising platforms so that they can build or target an audience from it. We do report a completed purchase to the ad network that produced it, using a one-way hash of your email address rather than the address itself, so that the network can credit the sale: section 6.7 sets out exactly what that report contains.

The only decisions we make about you automatically are billing decisions on the schedule you agreed to at checkout. We do not profile you for advertising, and we do not make an automated decision about who you are.

5. Legal bases for processing

If you are in the European Union, the European Economic Area or the United Kingdom, or anywhere else where the GDPR applies, we rely on the following.

• Performance of a contract (Article 6(1)(b)): casting your chart, writing and delivering your readings and your sketch, taking payment and renewing your membership.
• Consent (Article 6(1)(a)): notes by email, push notifications, and the optional photo. You can withdraw any of it at any time.
• Legitimate interest (Article 6(1)(f)): keeping the service secure and working, measuring our advertising in aggregate, and preventing fraud and answering disputes, in each case only where your rights do not outweigh that interest.
• Legal obligation (Article 6(1)(c)): tax and accounting records, and answering a lawful request.

In Québec, personal information is collected with your consent, for the purposes we state when we collect it, and only to the extent necessary to carry them out. You may withdraw consent at any time, subject to what the law and our records require us to keep.

6. Third-party service providers

A small number of companies process personal information for us. Below is what each one receives, where it processes it, and where to read its own policy. Each is bound by contract to process personal information only on our instructions.

6.1 Cloudflare, Inc.

• What it does: everything the service runs on. The web serving, the application itself, the database, the file storage, the background jobs and our server-side event log.
• What it receives: everything described in section 3 is stored on Cloudflare's infrastructure, because that is where the service runs. Cloudflare also sees the network metadata of each request, including the IP address.
• Where: a global network, with the company in the United States.
• Policy: cloudflare.com/privacypolicy

6.2 Stripe, Inc.

• What it does: card payments, including the renewals of memberships opened on this rail.
• What it receives: the card number, its expiry and security code, your name, your email address, your billing country, and the amount charged.
• Where: United States.
• Policy: stripe.com/privacy

6.3 TagadaPay

• What it does: card payments, for memberships opened on our second payment rail.
• What it receives: the same list as section 6.2 above.
• Where: as set out in their policy.
• Policy: tagada.io

6.4 Resend, Inc.

• What it does: delivering our email, both the transactional mail about your account and the notes, if you asked for those.
• What it receives: your email address, your first name where we have one, and the content of the message.
• Where: United States.
• Policy: resend.com/legal/privacy-policy

6.5 OpenRouter, Inc.

• What it does: routing each request to the language model that writes a reading or prepares a sketch note.
• What it receives: the prompt for the piece being written, which contains your quiz answers, your chart details, and the first name you gave us if you gave one. It does not contain your email address, your card details, or your photo.
• Where: United States, with each request routed on to the model provider that serves it.
• Policy: openrouter.ai/privacy

6.6 Microsoft Corporation

• What it does: understanding how the funnel is used, and reporting a sale to Microsoft Advertising.
• What it receives: on the production funnel pages, a Clarity session recording of which screens were reached and how they were used, together with the step name; and on the thank-you page, the fact and the value of a purchase. We do not call Clarity's identify interface, so nothing we send through it names you, and its masking is left at the default.
• Where: United States.
• Policy: privacy.microsoft.com

6.7 Meta Platforms, Inc.

• What it does: reporting a conversion to the advertising platform that produced it.
• What it receives: a SHA-256 hash of your email address, never the address itself; the IP address and browser of the request; the click identifier that was on the link you arrived through; and the value and the time of the purchase.
• Where: United States.
• Policy: facebook.com/privacy/policy

6.8 Google LLC

• What it does: serving the two typefaces our emails use, when your mail program loads them from Google's font service.
• What it receives: your IP address and your browser, as any request for a file from anyone discloses them. Your reading is not requested from Google and does not pass through them.
• Where: United States.
• Policy: policies.google.com/privacy

We encourage you to read the policies linked above. If one of these companies changes what it does with data, we will update this section rather than leave it out of date.

7. Cookies and tracking technologies

• We set a small number of first-party cookies, and the one that matters is the httpOnly session cookie that keeps you signed in. Scripts running on the page cannot read it, and it is not used for advertising.
• Our production funnel pages also load Microsoft Clarity, which sets its own cookie so that it can hold one visit together. Clarity is a measurement tool: section 6.6 says what it gets and what it does not.
• We do not set advertising cookies, tracking pixels or fingerprinting scripts to follow you across other websites. The purchase report described in section 6.7 is made from our own system to Meta's, without a cookie of ours in the path.
• When you arrive through an advertisement, the click identifier is a parameter in the link itself rather than something we set. We attach it to your order if you buy.
• Blocking any of this in your browser leaves every page working. Nothing except the session cookie is needed to use Rosaluna, and without that one you simply sign in again.

8. Web push notifications

If you turn notifications on in your portal, your browser asks its own push service for an address it can deliver to, and we store that address and the two keys that belong to it. The push service is run by the maker of your browser, which is Apple, Google or Mozilla. What we send through it is a short line of text: that your card is ready, or that a reading has been written.

Turning notifications off in the portal deletes the subscription on our side. Turning them off in your browser settings also stops them, and may leave a subscription with us that can no longer reach you; write to us and we will clear it.

9. Data retention

We keep personal information only as long as we need it for the purposes above, or as long as the law requires.

What	How long
Your account, your chart and your readings	While your account is open. Removed when you ask us to delete them.
Your photo	While your account is open, and until you ask us to remove it.
Orders, charges, refunds, and the consent sentence recorded for each purchase	Kept after a membership ends. A card dispute can arrive months later and a tax record has to survive years, so these are the longest-lived rows we hold.
Behavioural events: which screen, which answer	Deleted 30 days after they are written.
Email delivery records	Held by our email provider under its own policy, linked in section 6.4.
Advertising click identifiers	Kept with the order they are attached to.
Your marketing consent, and the history of the notes we sent	Until you withdraw the consent.
Rate-limit hashes of IP addresses	Short-lived, and salted so they cannot be turned back into an address.

When a record reaches the end of its life we delete it. Where a copy survives in a backup we cannot reach into, it is not used for anything and it is gone when that backup rotates.

You can shorten any of these periods by asking us to delete your information: section 12 says how.

10. Data security

• Everything is served over HTTPS, with strict transport security set on the product domain.
• There is one door to the database. Every read and every write goes through a single service, which means there is one place to watch and one place to close.
• Your card number never touches us, so a compromise of our systems cannot expose it.
• Administrative access sits behind a second identity check at the network edge and a further check inside the service. A leaked key on its own does not open an administrative page.
• There are no passwords to steal, because we do not hold one.
• We collect as little as the job needs, and we would rather not hold something than defend it afterwards.

No system is perfectly secure and we will not pretend ours is. If a breach puts your rights at risk, we will tell you and the regulator as the law requires, and we will say what happened, what it touched, what we are doing about it and what you can do.

11. International data transfers

We are in Canada. Most of the providers in section 6 are in the United States, and personal information is processed there when they handle it for us.

Before personal information leaves Québec we assess the regime of the place it is going to, as Law 25 requires, and we use contractual safeguards such as the European Commission's standard contractual clauses where the destination has no adequacy finding. Those clauses oblige the recipient to protect your information to a standard we can point at.

By using Rosaluna you accept that your information is processed in those places under those safeguards.

12. Your rights

Wherever you live, we will act on these.

• Access: ask for a copy of the personal information we hold about you.
• Correction: ask us to fix anything inaccurate or incomplete.
• Deletion: ask us to delete your personal information.
• Portability: ask for a copy in a structured, commonly used, machine-readable format.
• Withdrawal of consent: withdraw any consent you gave, including for notes by email. Withdrawal does not undo processing that already happened lawfully.
• Restriction and objection: ask us to limit what we do with your information, or object to a use based on our legitimate interest.
• To be told about an automated decision: ask what logic produced a decision made about you by an automated system, and ask for a person to review it.
• Cessation of dissemination and de-indexing: ask us to stop publishing information, or to de-index a link, where the law gives you that right.
• Complaint: complain to the authority named in the sections that follow.

How to exercise them. Write to support@getrosaluna.com from the address on your account, or tell us the address so we can find you, and say what you want. We may ask a question or two to be sure it is really you, because handing your information to somebody pretending to be you is the failure this step prevents.

What it costs and how long it takes. Nothing. We answer within 30 days. If a request is genuinely complex we will tell you why it is taking longer instead of leaving you to guess.

What we may refuse. Where a request would require us to delete a record the law makes us keep, such as a tax record or the evidence of a charge you agreed to, we will tell you which record and why. We will usually be able to delete everything else.

13. GDPR: EU and UK users

If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR or the UK GDPR applies to our processing of your personal information. Our legal bases are set out in section 5, your rights are set out in section 12, and our transfer safeguards are set out in section 11.

If you are not satisfied with our answer, you may complain to the data protection authority in your own country. A list of EU authorities is published at edpb.europa.eu. In the United Kingdom the authority is the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113.

Nothing in this policy reduces a right the GDPR gives you.

14. Law 25: Québec residents

We are subject to Québec's Act respecting the protection of personal information in the private sector, as modernized by Law 25, and to the regulation made under it.

• The person with the highest authority in the enterprise is responsible for the protection of personal information.
• We collect your information for the purposes stated when we collect it, and no further. When we want to use it for a new purpose we will tell you and ask.
• You can ask to see it, correct it, delete it, receive it in a structured and commonly used technological format, withdraw your consent, ask us to stop disseminating it, and ask us to de-index a link to it. Section 12 says how, and there is no charge.
• We use cookies and similar technologies as described in section 7, and you can refuse them and still use the service.
• We do not make a decision about you that is based exclusively on automated processing without telling you, and the only automated decisions we make are the billing decisions on the schedule you agreed to.
• We are a business in Québec and we keep an inventory of the personal information we hold, the purposes we hold it for, and how long we keep it. Section 9 is the public part of that inventory.

If we cannot resolve a complaint, you may take it to the Commission d'accès à l'information du Québec. You may also complain to them without going through us first.

15. PIPEDA and anti-spam: Canadian residents

Outside Québec, our commercial activity is subject to the Personal Information Protection and Electronic Documents Act and the ten fair information principles it is built on: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure and retention, accuracy, safeguards, openness, individual access, and the right to challenge our compliance. This policy is written to those principles, and the sections above are how we meet them.

Under Canada's anti-spam law we send notes by email only where you ticked the box. You can withdraw that consent at any time by writing to support@getrosaluna.com, and we will stop. Mail about your own account, your orders, your charges and what you bought is not marketing and is sent regardless.

If you are not satisfied with how we have handled your information, you may complain to the Office of the Privacy Commissioner of Canada.

16. CCPA and CPRA: California residents

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you additional rights.

• Right to know the categories and the specific pieces of personal information we have collected, where it came from, why we hold it, and who we disclose it to.
• Right to delete your personal information, subject to the exceptions the law allows.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. The purchase reports described in section 6.7 are conversion attribution: they are not used to target advertising to you from data collected by other businesses. There is therefore nothing for you to opt out of, and we have no "do not sell my information" link because there is no sale to stop.
• Right to limit the use of sensitive personal information. We do not use or disclose sensitive personal information for any purpose beyond providing the service.
• Right not to be discriminated against for exercising any of these rights.

What we collected in the last 12 months.

Category	Examples, and whether we collect it
Identifiers	Email address, first name, IP address. Yes.
Personal records	Birth date, birth place, and the card brand and last four digits of the card on file. Yes.
Commercial information	Orders, charges, refunds and subscriptions. Yes.
Internet or network activity	Which screens you reached, how you used them, and the advertisement you arrived through. Yes.
Geolocation	The country your connection comes from, and the city you tell us you were born in. Yes.
Inferences	The chart and the readings we produce for you. Yes.
Sensitive personal information	None beyond the above, and none used to infer characteristics about you.
Biometric information	None. Your photo is used to prepare a drawing, never to identify anyone.

To make a request, write to support@getrosaluna.com. We verify that the request comes from you before we act on it, and we answer within 45 days.

17. Other US state privacy laws

If you live in a state with a comprehensive privacy law, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon or Montana, you have the rights that law gives you, which are broadly the rights listed in section 12: to know, to access, to correct, to delete, to obtain a copy, and to opt out of targeted advertising and of the sale of personal information. We do not sell personal information and we do not use it for targeted advertising, so those opt-outs have nothing to act on.

Where your state gives you the right to appeal a decision we make about a request, write back to us with the word appeal, and somebody who did not make the first decision will look at it again. If you are still not satisfied you may complain to your state's attorney general.

18. Children's privacy

Rosaluna is for adults. You must be 18 or older to use it, and the youngest age band in our quiz is 18 to 29.

We do not knowingly collect personal information from anyone under 18. If we find that we have, we delete it. If you are a parent or a guardian and you believe a child has given us personal information, write to support@getrosaluna.com and we will delete it.

This commitment is made under the GDPR's provisions on children, the US Children's Online Privacy Protection Act, and the law of Québec and Canada that protects minors.

19. Changes to this policy

We will revise this policy when our practices change or the law does. The date at the top is when it last changed.

If a change materially affects what we do with your information, we will email the address on your account before it takes effect, so that you can decide whether to stay. Continuing to use Rosaluna after a change means you accept it. If you do not accept it, stop using the service, and you may ask us to delete what we hold.

20. Miscellaneous provisions

20.1 Limitation of liability

To the greatest extent the law allows, our total liability to you for anything arising out of or related to privacy under this policy will not exceed the amount you paid us in the twelve months before the event you are complaining about. That limit does not apply where the law forbids it, where the cause is our gross negligence or intentional misconduct, or where it would cut down a right you have under the consumer protection or privacy law of the place you live.

20.2 Severability

If a provision of this policy is found invalid or unenforceable, the rest of it stands, and the provision is read down to the least extent needed to make it valid while keeping its intent.

20.3 Governing law

This policy is governed by the laws of the Province of Québec and the federal laws of Canada that apply there, without regard to conflict of law rules. That choice does not remove the protection of the mandatory privacy or consumer law of the place you live.

20.4 Entire agreement

This policy and our terms of service are the whole agreement between us about your personal information. If they ever disagree about privacy, this policy governs.

20.5 Language

This policy is drafted in English. If a translation is published and the two disagree, the English version governs.

21. How to contact us

Write to us for anything in this policy, including a request to see, correct or delete what we hold:

We answer every privacy request within 30 days. This policy describes what we do; it is not legal advice to you, and if you need advice about your own rights you should ask a lawyer in your own jurisdiction.