We collect your email, birth date, time, sex and place, the topic and question, your language, and order and payment references. Card details go to Stripe only.
Second person in a Relationship Reading: used only for your reading, never contacted, no surname or contact details collected.
Processors: Supabase, OpenAI (no training on your data), Stripe, Resend, Geoapify, Vercel. Some are outside the UK, under recognised safeguards.
Retention: unpaid orders 30 days; paid orders 365 days, then only a non-personal sale record for the accounting period; statistics 90 days. Delete your own data any time from the Delete data page.
Rights: access, correction, deletion, restriction, objection, portability via Support; complaints to the ICO or your local authority.
ASG Studio Ltd (trading as Cosmic Pillars), registered in unset, company number 17423379, registered office unset, is the controller of the personal information described here. Email support@cosmicpillars.com, or use the Support page.
What we collect, and why
We only collect what a reading and an order actually need.
Your email address: to confirm your order, deliver your reading and answer support requests. Basis: performance of our contract with you.
Your birth date, time (or 'unknown'), sex and birthplace, and the timezone and coordinates we derive from the birthplace: to calculate the Four Pillars and prepare your reading. Basis: performance of the contract. Sex is used only to set the direction of the ten-year cycles the method uses.
The topic you choose, the question you type, and the language you order in: to write the reading around what you asked. Basis: performance of the contract.
The reading itself and the PDF: so we can deliver it, re-send it while the link is valid, and investigate a complaint. Basis: performance of the contract and our legitimate interest in resolving disputes.
Order and payment references (order id, amount, Stripe checkout and payment ids, payment state, refund events): to take payment, prevent double charges, process refunds and keep accounting records. Basis: contract and legal obligation (tax and accounting law), and our legitimate interest in preventing fraud. We never receive or store card numbers; Stripe does.
Creator referral code and campaign, if you arrived through a creator's link: to apply the discount you came for and to credit the creator. Basis: contract (the discount is part of your order) and our legitimate interest in running the referral programme. The code is not personal to you and is not shared with the creator together with your details.
A random browser-session token, rate-limit counters and short-lived security logs (request timing, error codes, a hashed session id): to keep the service secure and to stop abuse. Basis: our legitimate interest in security. We do not build profiles from these.
Optional usage statistics (which step of the order flow was reached, topic chosen, delivery speed, language): only if you accept them in the banner. Basis: your consent, which you can withdraw at any time from 'Privacy choices' in the footer. Birth details, questions, email and reading text are never sent to analytics.
Relationship Readings: the other person's details
For a Relationship Reading, you give us a second person's birth date, time, sex and birthplace, and a first name or nickname so the reading can refer to them. We ask you to confirm that you are entitled to share those details. We use them only to prepare your reading. We do not contact the other person, we do not collect their surname, email or any contact details, we do not use their details for anything else, and we delete them on the same schedule as your own.
Our basis for handling the second person's details is our legitimate interest, and yours, in providing the reading you ordered, balanced against the other person's interests: the details are limited to what the method needs, they are never used to make decisions about that person, and we keep them only as long as your order. Because we hold no way of contacting the other person, we cannot send them this notice directly; this page is the public notice of how their details are used, and the other person may exercise the same rights as you by contacting us.
Who processes information for us
We use a small number of service providers, each under a contract that limits what they may do with the information.
Supabase: hosts our database (orders, birth details, readings) and the private storage where PDFs are kept. Data is stored in the region our project is set to.
OpenAI: composes the written reading from a structured plan we send it. The plan carries the calculated pillars, the topic, the question you typed and, for a Relationship Reading, the nickname you gave; it does not carry your email or your birth date and time as such. We send requests with storage turned off and OpenAI does not use API data to train its models.
Stripe: takes payment. Stripe receives your email address, the amount, the order id, the type of reading and delivery speed, your language, and the referral code if any. Stripe never receives your birth details or your question. Stripe is an independent controller for the payment itself under its own privacy notice.
Resend: sends the order confirmation and the delivery email to your address.
Geoapify: powers the birthplace search box. When you type a place, the text you type is sent to Geoapify to find matching places; nothing else about you is.
Vercel: hosts the website and runs our code, and therefore handles requests, including your IP address, in the ordinary course of serving pages.
International transfers
Some of these providers process information outside the United Kingdom, including in the United States. Where they do, we rely on the safeguards recognised under UK data-protection law: the UK's adequacy regulations where they apply, and otherwise the International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, as incorporated in each provider's data-processing terms.
How long we keep information
Orders you did not complete (no payment): kept for 30 days, then removed by our automatic cleanup.
Paid orders, including the reading, the PDF and any second person's details: kept for 365 days from payment, so we can re-send or investigate, then removed by our automatic cleanup. Only a non-personal record of the sale (order id, amount, dates, payment references) is kept after that, for the period accounting and tax law requires, normally six years.
The automatic cleanup runs at least once a day and de-identifies every order whose period has ended; an order therefore leaves our systems within a day or so of its period ending, not at the exact minute.
Delete data control: you can remove the birth details, readings and PDFs linked to your browser session yourself, at any time, from the Delete data page. The non-personal sale record remains.
Usage statistics: 90 days.
Security logs: up to 30 days unless an incident requires a documented hold.
Support correspondence: as long as the matter is open plus 12 months, so we can handle any follow-up.
Stripe keeps its own transaction records under its legal duties.
Your rights
You can ask us for a copy of the information we hold about you, ask us to correct it, delete it, restrict or object to how we use it, or give it to you in a portable form. Where we rely on your consent you can withdraw it at any time. Email support@cosmicpillars.com, or use the Support page. We may ask for your order reference or the email address you ordered with, so that we do not release one person's details to another. We reply within one month.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data-protection authority of the country where you live.
Cookies and browser storage
The Cookies page lists exactly what we store in your browser and why. We set no advertising or cross-site tracking cookies.
Age
The service is for adults. We do not knowingly accept orders from anyone under 18, and we will delete an order and refund it if we learn that the customer is under 18.
Automated processing
The Four Pillars calculation is automated and the written reading is composed by software, including a language model, from that calculation. The reading is a reflective interpretation for you to read; it is not a decision about you and has no legal or similar effect on you.