Legal

Privacy Policy

Effective date:

Automa ("we", "us", "our") operates PathFinder ("the Service"). This privacy policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable Dutch and European privacy laws.

1. Data Controller

The data controller responsible for your personal data is:

Automa
Email: [email protected]

2. What Data We Collect

We collect the following personal data when you create an account and use the Service:

  • Account information — your name, email address, and password (hashed)
  • Birth data — date, time, and location of birth, used to calculate astrological charts
  • Usage data — which charts and features you use within the Service

We do not collect payment information. All payment processing is handled directly by Stripe. We do not store credit card numbers or billing details on our servers.

We do not use cookies or tracking technologies.

3. How We Use Your Data

We process your personal data for the following purposes:

  • Providing the Service — calculating astrological charts and generating AI-powered interpretations based on your birth data
  • Account management — authenticating your identity and managing your subscription
  • Transactional emails — sending account-related communications (e.g., password resets, subscription confirmations)

4. Legal Basis for Processing

We process your data based on the following legal grounds under the GDPR:

  • Performance of a contract (Art. 6(1)(b)) — processing necessary to provide the Service you signed up for
  • Legitimate interest (Art. 6(1)(f)) — improving and securing the Service

5. Third-Party Services

We share data with the following third-party processors, all of which maintain their own privacy policies:

  • Stripe — payment processing. Stripe receives your payment details directly; we never see or store them.
  • Fireworks AI — AI model provider used to generate astrological interpretations. Chart data may be sent for processing.
  • Hetzner — cloud hosting provider where our servers and databases are located (EU-based data centres)
  • Resend — transactional email delivery

6. Data Storage and Security

Your data is stored on servers hosted by Hetzner in the European Union. We protect your data with:

  • Encryption in transit (TLS/HTTPS)
  • Encryption at rest for sensitive data
  • Hashed passwords (never stored in plain text)
  • Access controls limiting who can access production systems

7. Data Retention

We retain your personal data for as long as your account is active. If your account is inactive for more than 6 months, we may delete your account and all associated data. We are working on formalising this policy and will update this section accordingly.

You may request deletion of your data at any time (see Section 8).

8. Your Rights Under the GDPR

As a data subject, you have the following rights:

  • Right of access — request a copy of the personal data we hold about you
  • Right to rectification — request correction of inaccurate data
  • Right to erasure — request deletion of your data ("right to be forgotten")
  • Right to restriction — request that we limit how we process your data
  • Right to data portability — receive your data in a structured, machine-readable format
  • Right to object — object to processing based on legitimate interest

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. International Transfers

Our primary infrastructure is hosted in the EU (Hetzner, Germany/Finland). Some third-party processors (Stripe, Fireworks AI, Resend) may process data outside the EU. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Children's Privacy

The Service is available to users of all ages. If you are a parent or guardian and believe your child has provided personal data without your consent, please contact us and we will take steps to remove that data.

11. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the effective date at the top of this page. We encourage you to review this policy periodically.

12. Supervisory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

13. Contact

For any questions about this privacy policy or your personal data, contact us at:

Automa
Email: [email protected]