Privacy Policy

Last updated 11 August 2026

1. Who we are

Palmistry Ltd, 62 Athalassas Avenue, Mezzanine Floor, Strovolos, 2012 Nicosia, Cyprus, is the data controller for the personal data described in this policy. This policy explains what we collect when you use our websites, quizzes, readings, sketches and reports (the “Service”), why we collect it, who we share it with and what rights you have.

This policy should be read together with our Terms of Service.

2. Definitions

• Personal data — any information relating to an identified or identifiable person.
• Processing — any operation performed on personal data, such as collecting, storing, using, sharing or deleting it.
• Controller — the party that decides why and how personal data is processed. For the Service, that is us.
• Processor — a third party that processes personal data on our instructions, such as our hosting or payment provider.
• You or User — the individual using the Service.

3. Data we collect

We collect this data directly from you when you enter it, automatically as you use the Service, and from the third-party providers listed in section 7 (for example, payment status from our payment processor).

4. How and why we use it

• To generate, deliver and store your personalised reading, sketch, report and compatibility profile.
• To operate the Service, remember your progress through a quiz and restore your session.
• To take payment, manage your subscription, process renewals, cancellations and refunds, and prevent fraudulent or duplicate charges.
• To send you your results, receipts, service notifications and answers to your support requests.
• To provide customer support and to verify your identity when you ask us to act on your subscription or your data.
• To measure how the Service is used, understand which content works, and improve and develop new features.
• To measure the effectiveness of our marketing and attribute installs and purchases to the campaign they came from.
• To detect, investigate and prevent abuse, security incidents and breaches of our Terms.
• To comply with our legal, accounting and tax obligations, and to establish, exercise or defend legal claims.

5. Legal bases

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract — to generate and deliver what you bought, take payment and manage your subscription.
• Consent — for non-essential cookies and analytics where consent is required, for marketing emails, and for any sensitive data you choose to give us. You can withdraw consent at any time.
• Legitimate interests — to secure and improve the Service, to understand how it is used, to prevent fraud and abuse, and to defend legal claims. We balance these interests against your rights.
• Legal obligation — to keep transaction records and to respond to lawful requests from authorities.

6. Sensitive data

Some answers you give us — for example about your relationships or the gender of the partner you are looking for — may reveal information that data protection law treats as a special category of personal data. We only process that information to generate the reading you asked for, on the basis of the explicit consent you give by submitting the answer, and you may withdraw that consent at any time by asking us to delete your data.

Please do not send us health, financial, biometric or other sensitive information that we have not asked for.

7. Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our instructions, and only as far as they need it:

We may also disclose personal data where we are required to do so by law, court order or a competent authority; where necessary to establish, exercise or defend legal claims; to protect the rights, property or safety of our users or the public; and to a buyer or successor in the event of a merger, acquisition, reorganisation or sale of assets, in which case we will notify you before your data becomes subject to a different privacy policy.

8. International transfers

We are based in Cyprus, and some of our providers are located outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA or the UK, we rely on an adequacy decision where one exists, or on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), together with additional safeguards where needed. You may ask us for a copy of the safeguards we use.

9. How long we keep it

• Quiz answers, generated readings, sketches and reports — while your account or lead record is active, and for up to 24 months after your last interaction, so that you can return to your results.
• Uploaded photographs — for as long as needed to generate and deliver your result, and deleted on request.
• Purchase and transaction records — for as long as required by accounting and tax law, typically 6 to 7 years.
• Support correspondence — up to 24 months after the issue is closed.
• Analytics and technical logs — typically up to 14 months, often in aggregated or pseudonymised form.

When a retention period ends we delete the data or irreversibly anonymise it. If you ask us to delete your data sooner, we will — except where we are legally required to keep a record, such as a transaction record.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), encryption at rest for payment provider credentials, access controls limiting who on our team can reach personal data, and providers who are themselves contractually bound to protect it. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If a breach affects your rights and freedoms, we will notify you and the competent supervisory authority as required by law.

11. Cookies and tracking

We use cookies, local storage and similar technologies for three purposes:

• Strictly necessary — to keep your session, remember your progress through a quiz, and keep the Service secure. These cannot be switched off.
• Analytics — to understand how the Service is used and where people drop off.
• Marketing and attribution — to measure campaigns and attribute purchases to the source they came from.

Most browsers let you block or delete cookies through their settings, and you can clear local storage the same way. Blocking strictly necessary cookies will break parts of the Service, including your ability to return to a quiz in progress.

12. Payment details

Payments are processed by Zotlo. When you pay, your card or payment account details are entered into their checkout and handled by them under their own privacy policy — we never receive, see or store your full card number. We receive only the information needed to give you access and support you: the plan, amount, currency, status, renewal date and the subscriber and transaction identifiers they assign. We store those records against your email address so we can find your subscription when you contact us.

13. Marketing emails

We may send you emails about your results, your subscription and, where we are permitted to, similar products and offers. Every marketing email includes an unsubscribe link, and you can opt out at any time by using it or by emailing support@palmistry.app. Opting out of marketing does not stop service emails such as receipts and renewal notices, which we must send you.

14. Automated processing and AI

Your reading, sketch, report and compatibility profile are produced automatically from the answers you give, using AI models operated by us and by the providers named in section 7. Your answers are sent to those providers to generate the output.

This processing is not used to make any decision that produces a legal effect concerning you or similarly significantly affects you. The output is for entertainment only, is not based on real knowledge of you or of anyone else, and any generated portrait is a fictional composite that does not depict a real person — see our Terms of Service.

15. Children’s privacy

The Service is intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at support@palmistry.app and we will delete it promptly.

16. Your rights (GDPR)

If the GDPR applies to you, you have the right to:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted where there is no overriding reason for us to keep it.
• Restriction — have processing limited in certain circumstances.
• Portability — receive the data you gave us in a structured, machine-readable format, and have it sent to another controller where technically feasible.
• Object — object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent — at any time, without affecting processing carried out before you withdrew it.
• Complain — lodge a complaint with a supervisory authority. Ours is the Office of the Commissioner for Personal Data Protection of Cyprus; you may also complain to the authority where you live or work.

To exercise any right, email support@palmistry.app from the address you used with us. We may ask you to verify your identity before we act, and we will respond within one month, extendable by two further months for complex requests. Exercising your rights is free unless a request is manifestly unfounded or excessive.

17. Deleting your data

You can ask us to delete your account and personal data at any time by emailing support@palmistry.app from the address you used, with the subject line “Delete my data”. We will confirm your identity and then delete your quiz answers, uploaded images, generated readings and account within 30 days, and instruct our processors to do the same.

Two things to note: deleting your data does not cancel an active subscription — cancel it first, or ask us to do both — and we must retain transaction records for the period required by accounting and tax law.

18. California residents

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect, use, disclose and (if applicable) sell or share; the right to request deletion; the right to request correction; the right to opt out of the sale or sharing of personal information and of targeted advertising; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising any of these rights.

We do not sell your personal information and we do not knowingly sell or share the personal information of anyone under 16. The categories we collect, the purposes we use them for and the parties we disclose them to are set out in sections 3, 4 and 7. To exercise a right, or to submit a request through an authorised agent, email support@palmistry.app.

19. Links to other websites

The Service may link to sites we do not operate. This policy does not apply to them. We are not responsible for their content or privacy practices, and we encourage you to read the privacy policy of every site you visit.

20. Changes to this policy

We may update this policy from time to time. When we do, we will change the “last updated” date at the top of this page, and where the change is material we will take reasonable steps to notify you before it takes effect. We encourage you to review this page periodically.

21. Contact us

Don’t hesitate to contact us if you have any questions about this policy or about how we handle your data.