Privacy
Last updated: date · to be completed before launch
1. Who is responsible
Controller legal name · to be completed before launch, address · to be completed before launch, email · to be completed before launch ("we"). Data protection contact: name/email · to be completed before launch. EU representative: name/address, if appointed · to be completed before launch. UK representative: if appointed · to be completed before launch.
2. What we collect and why
| Data | Why | Legal basis (GDPR) | Kept |
|---|---|---|---|
| Email, login data | Account, sign-in, service emails | Contract | Until you delete your account |
| Language, time zone | Show the app correctly | Contract | Same |
| Your birth date; optional birth time, place, name/nickname | Calculate your readings | Contract | Same, or until you delete them |
| Another person's nickname and birth date (and optional time/place); for past-relationship readings also the years you were together | Compatibility or past-relationship readings that you ask for | Our legitimate interest in providing the reading you request, balanced against that person's interests (see §4) | Not saved unless you turn on "Save"; deletable any time |
| Readings, saved steps, your notes | Your history | Contract | Until you delete them or your account |
| Wellbeing check-ins (mood, energy, emotions, body notes) | Show your own history | Your explicit consent (health-related data) | Until you delete them or withdraw consent |
| Psychosomatics lookups | — | Not stored on our servers (kept on your device only) | — |
| Purchase status (plan, dates, status) — no card numbers | Give you access you paid for | Contract; legal obligations | As required by tax law (usually 5–10 · to be completed before launch years for records) |
| Referral visit ID and link token | Count invites | Consent where required (EU/UK) / legitimate interest elsewhere | 12 · to be completed before launch months |
| Technical logs (IP, device, errors) | Security, fixing bugs | Legitimate interest | 30 · to be completed before launch days |
| Analytics (aggregate, cookieless) | Improve the product | Legitimate interest | Aggregate only |
We don't ask for gender, photos, contacts or diagnoses. Please don't put full names or health details of other people in your notes.
3. Payments
Merchant of Record · to be completed before launch processes payments and is an independent controller for payment and tax data. We receive only the status of your purchase, your email and country. See MoR privacy link · to be completed before launch.
4. Data about other people (partner, ex-partner)
If you enter another adult's details, we use them only to make the reading you asked for. Only you can see them. They never appear in share cards, links or emails to anyone. We don't contact that person and have no way to, so we can't inform them directly (GDPR Art. 14(5)(b)). That is why we keep the data minimal and unsaved by default. Anyone who believes their data is in Ausmi can write to email · to be completed before launch, and we will help where we can identify the data.
5. Who we share data with
Service providers who work for us under contract: hosting/database Supabase, region · to be completed before launch, web hosting Vercel · to be completed before launch, email Resend · to be completed before launch, payments MoR · to be completed before launch, analytics provider · to be completed before launch, AI provider, if used, with no training on your data · to be completed before launch. We don't sell your data and don't use it for third-party advertising.
6. International transfers
Our providers may store data outside your country (e.g. EU/US · to be completed before launch). We use safeguards such as the EU Standard Contractual Clauses / UK addendum, and the transfer rules of Indonesia's PDP Law.
7. Your rights
You can access, correct, download, delete, restrict or object to the use of your data, and withdraw consent at any time (this doesn't affect earlier use). Most of this is in Settings. Otherwise write to email · to be completed before launch. We reply within one month (Indonesia: access and correction requests within 3×24 hours where the law requires). You can complain to your data protection authority.
8. Security
Encryption in transit and at rest; each user can only read their own rows (row-level security); minimal staff access. If a breach affects you, we'll tell you and the authorities as the law requires (in Indonesia within 3×24 hours).
9. Age
Ausmi is for adults 18+. We don't knowingly collect data from minors.
10. Cookies
We use only strictly necessary storage (login, language, saving your guest reading on your device). Analytics are cookieless. If we add other cookies or pixels, we'll ask first.
11. Changes
We'll tell you about important changes in the app or by email.