Privacy Policy

This Privacy Policy explains how Zvezdana collects, uses, stores and protects data when you use the app, website and related services. The goal of this Policy is to clearly explain what data we process, why we process it, with whom we share it and what rights you have regarding your data.

1. Introduction

This Policy applies to data we process through the app, website, user account, purchase flow, customer support and related technical services that are necessary for the Service to function.

By using Zvezdana, you confirm that you have read this Privacy Policy. This Policy is interpreted together with the Terms of Use and the Refund Policy.

2. Who is responsible for processing

The controller for data processed in connection with the Zvezdana Service is Marko Lekić, an independent developer based in Republic of Serbia.

For the purposes of applicable data protection law, Marko Lekić acts as controller to the extent it determines the purposes and means of processing personal data in connection with the functioning of Zvezdana.

For privacy questions, data access or deletion requests you can reach us at: support@zvezdana.ai

3. What data we process

Depending on how you use the Service, we may process the following categories of data:

• email address and basic account information;
• technical identifiers related to authentication and account access;
• date, time and place of birth and other data you provide for astrological analyses;
• data about persons/profiles you enter into the app;
• history of insights, generated analyses, messages and feature usage;
• data about purchases, subscriptions, transactions, payment statuses and usage logs;
• IP address, approximate location derived from IP, device type, browser, OS and technical logs;
• communication with support, problem reports and other enquiries you send us;
• usage data about the site and app, including navigation, interactions and basic analytics.

Zvezdanadoes not collect or store payment card details. Purchases are made through two separate storefronts: Google Play billing inside the Android app, where the merchant of record is Google (Google Ireland Ltd.), or Gumroad on the website, where the merchant of record is Gumroad, Inc. (USA). Both process payment under their own rules and security standards. From Google we receive only the purchase confirmation (purchase and order identifiers, product name and status). For website purchases, your email and name are passed to Gumroad as part of checkout, and our internal account identifier travels in the checkout link’s parameters so the purchase can be matched to the right account; Gumroad then returns to us, via webhook, the sale or subscription identifiers, your email and the purchased product’s details, so we can activate what you bought on your account.

4. Purposes of processing

We may process your data for the following purposes:

• creating and maintaining your user account;
• enabling app functionality and generating astrological analyses;
• recording subscriptions, purchases and feature usage within the system;
• handling user requests, complaints, refunds and communication with support;
• preventing abuse, fraud, unauthorised access and security incidents;
• analytics, diagnostics, maintenance and improvement of app performance;
• compliance with legal obligations, record-keeping and dispute resolution;
• sending service-related notifications and other messages necessary for the Service to function;
• sending marketing messages, but only where we have an appropriate legal basis.

5. Legal basis

The processing of your data is based, depending on the situation, on one or more of the following:

• performance of a contract or steps taken at your request before entering into a contract;
• legitimate interests, in particular for security, abuse prevention, logging and Service improvement;
• your consent, where required, for example for some marketing communication or cookies;
• compliance with legal obligations related to providing a digital service, accounting, record-keeping and dispute resolution.

We send marketing messages only with your consent. Consent is voluntary and you may withdraw it at any time — via the unsubscribe link in every marketing message or through the Email preferences page in your account. Withdrawal does not affect the lawfulness of processing before withdrawal, and does not affect service (transactional) messages that are part of the Service.

6. AI processing of data

Zvezdana uses algorithms, astrological rules and AI models to generate personalised interpretations based on the data you provide. This may include date, time and place of birth, your input in questions or chat, and technically prepared data needed to generate responses.

Data necessary to generate content may be sent to AI partners or model providers strictly to the extent required to perform the requested functionality. Such data is used to process your specific request and operate the Service.

The generated content is automated interpretation and is intended solely for informational, entertainment and personal reflection purposes. AI processing may contain simplifications, generalisations or inaccuracies.

7. Sharing and processors

Your data may be processed by or made available to trusted third parties providing infrastructure and services needed for the app to function. Such parties act as processors, service providers or, where applicable, separate controllers for their own purposes.

This may include in particular:

• hosting, database, authentication and backend infrastructure (e.g. Supabase);
• Google Play (Google Ireland Ltd.) as merchant of record — billing, invoicing, refunds and transaction handling, including subscription status notifications;
• Gumroad, Inc. (USA) as merchant of record for website purchases — card charging, invoicing, EU VAT handling and refunds; from Gumroad we receive sale and subscription identifiers, your email and purchased product details;
• email delivery (Resend) for transactional messages, confirmations and — with your consent — marketing messages;
• AI services or model providers for content generation and request processing;
• product analytics and session replay (PostHog, processed in the European Union), visitor statistics (Google Analytics) and ad performance measurement (Meta Pixel) — only with your consent, which you give or refuse in the banner on your first visit and can withdraw at any time;
• monitoring and security services when needed for system stability and protection;
• legal, accounting or regulatory recipients where required to meet legal obligations.

8. International transfers

Some of our providers may process data outside the Republic of Serbia or outside the European Economic Area. This may include servers, technical support, backups or processing by partners based in other countries.

Where such transfers occur, we aim to apply appropriate safeguards, where available and applicable, including contractual, technical and organisational measures and choosing partners that provide an adequate level of data protection.

Email is delivered by Resend, processed on infrastructure in the European Union. Where data transfers occur, we rely on appropriate safeguards, including a data processing agreement (DPA) with the provider.

Website purchases are processed by Gumroad, Inc., based in the United States — this is an international transfer of data (email, name and purchase details) outside the European Economic Area. For transfers from the European Economic Area to the United States, Gumroad states in its privacy policy that it relies on standard contractual clauses adopted by the European Commission. For the sale itself Gumroad acts as a processor on the seller’s instructions, while for charging, invoicing and VAT it acts as the merchant of record.

Product analytics and session replays are processed by PostHog on infrastructure in the European Union, so no transfer outside the European Economic Area takes place for that data. Visitor statistics are processed by Google Analytics (Google Ireland Limited); for its own transfers Google relies on the safeguards described in its privacy policy, and the same applies to Meta (Meta Platforms Ireland Limited). All three tools run only with your consent.

9. Data retention

Data is kept for as long as necessary for the Service to function, to maintain your account, display the history of insights, keep transaction records, comply with legal obligations, handle complaints and disputes and protect the legitimate interests of Zvezdana.

Retention periods depend on the type of data. For example, account and usage history may be kept while the account is active and for a certain time afterwards, whereas some transactional, accounting and security records may be stored longer where required by law, evidence or abuse prevention.

When data is no longer needed for the purpose for which it was collected, it will be deleted, anonymised or kept only to the extent required by law or a legitimate record-keeping need.

10. User rights

Under applicable law, you may have the following rights with respect to your data:

• the right to request access to your data;
• the right to ask for correction of inaccurate or incomplete data;
• the right to request deletion of data where conditions are met;
• the right to request restriction of processing in certain cases;
• the right to object to processing based on legitimate interests, where applicable;
• the right to withdraw consent for processing that is based on consent, without affecting prior lawful processing;
• the right to lodge a complaint with a supervisory authority where you believe processing is contrary to law.

Privacy-related requests can be sent to support@zvezdana.ai. In some cases we may ask for additional identity verification to protect data from unauthorised access.

You can permanently delete your account and all associated data yourself, at any time, on the Account deletion page, which details exactly what is deleted and what is retained by law.

11. Cookies and analytics

Essential cookies and local storage are used for sign-in, security and core app functionality. These always run, because the service does not work without them.

Analytics tools are not loaded until you consent. On your first visit we show a banner with two equally weighted options — accept and decline. Until you choose, no analytics tool loads; if you decline, none loads then either. Your choice is stored locally on your device, and we ask again only when this section of the policy changes.

With your consent we use Google Analytics for visitor statistics and PostHog for product analytics. PostHog also includes session replay — a record of how you use the page (clicks, scrolling, movement through the app), so we can see where users run into obstacles.

Under the same consent we also use Meta Pixel to measure our ads. We do not send Meta your name, email, birth details or the content of readings and messages.

A session replay does not record what you type or the text generated for you. All input fields are masked, as are birth details, reading text and chat messages. The replay shows how you move through the app, not what you wrote or what Zvezdana answered.

You can withdraw consent at any time via the Podešavanja analitike link in the page footer. Withdrawing stops all of these tools immediately and brings the choice banner back.

12. Security

We take reasonable technical and organisational measures to protect data from unauthorised access, loss, misuse, alteration or destruction. This may include access controls, authentication, encryption in transit, privilege limitation, logging and infrastructure protection.

However, no system is completely secure and we cannot guarantee absolute security of data in all circumstances.

13. Children

The Service is not intended for individuals under 18 years of age. If we learn that data of a person under 18 was entered or processed contrary to the Service rules, we may take reasonable steps to delete such data or restrict account access, in line with technical capabilities and applicable law.

14. Changes to the policy

This Privacy Policy may be updated from time to time to reflect changes in functionality, business model, technical infrastructure, billing processes, legal requirements or security needs. The effective date will be updated at the top of the document.

15. Contact

For questions about this Privacy Policy, data processing or exercising your privacy rights, contact us at: support@zvezdana.ai