DestinyKey
Contents
1. About this policy
This Privacy Policy describes how DestinyKey collects, uses, stores, and protects your personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679), Israel's Protection of Privacy Law (5741-1981), and other applicable law.
By using the Service, you agree to the data processing terms set out in this Policy. If you disagree — please do not use the Service.
2. Data controller
The controller of your personal data is:
DestinyKey (sole proprietor — Osek Patur, State of Israel)
Contact for data protection matters: support@destinykey.org
3. What data we collect
3.1. Data you provide directly
- Upon registration: email address, password (stored as a cryptographic hash);
- For natal chart generation: date of birth, time of birth, place of birth (city name and/or geographic coordinates), name (optional);
- For payments: payment data is processed exclusively by our payment partner (see Section 5). DestinyKey does not store full card numbers.
3.2. Data collected automatically
- IP address (for abuse prevention and language detection);
- Browser User-Agent and device type;
- Session cookies (to maintain authentication) — see Section 8;
- API request logs (without payment data);
- Anonymized usage statistics (Google Analytics, Yandex.Metrica — see Section 5).
3.3. Sensitive data
Date, time, and place of birth may be considered special categories of data in some jurisdictions. We process them exclusively to provide the Service and do not share with third parties, except as described in Section 5.
4. Purposes of processing and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service (interpretation generation, chart calculation) | Performance of contract (Art. 6(1)(b)) |
| Billing and payment processing | Performance of contract (Art. 6(1)(b)) |
| Tax and accounting records | Legal obligation (Art. 6(1)(c)) |
| Fraud and abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Analytics and product improvement | Consent (Art. 6(1)(a)) — managed via cookie banner |
| Email communications (news, updates) | Consent (Art. 6(1)(a)) — opt-in, revocable |
5. Data sharing (processors)
We share limited data with the following processors, acting under our instructions and bound by Data Processing Agreements:
5.1. Payment processor
Our payment partner — merchant of record for all payments.
Shared data: email, country, IP, payment data.
Purpose: payment processing, tax calculation, anti-fraud.
Our payment partner's privacy policy is available on their website.
5.2. Cloud infrastructure
Hostinger — server hosting (Europe).
Shared data: all user data (database storage).
Purpose: technical infrastructure.
Policy: hostinger.com/privacy-policy
5.3. AI providers (content generation)
Google Gemini API and DeepSeek API — text interpretation generation.
Shared data: calculated astrological data (planet positions, aspects) and language. Email, name, exact date of birth — are not shared.
Purpose: generation of personalized interpretation text.
Policies: Google Privacy · DeepSeek Privacy
5.4. Analytics
Google Analytics and Yandex.Metrica — anonymized usage statistics.
Shared data: anonymized IP, User-Agent, on-page events.
Purpose: understanding usage patterns, UX improvement.
These trackers are loaded only after consent through the cookie banner.
5.5. Email service
For transactional emails (registration confirmation, password reset) we use an in-house email service on our server. No third-party email marketing tools are used at this time.
6. Retention periods
| Data type | Retention period |
|---|---|
| Active account | Until deletion request |
| Deleted account (access logs) | 30 days (for security) |
| Payment and tax records | 7 years (Israeli tax law requirement) |
| Interpretation generation history | Until account deletion |
| Server logs (without personal data) | 90 days |
| Session cookies | Until browser close |
| Analytics cookies | Up to 2 years, or until consent withdrawal |
7. Your rights
Under GDPR (Articles 15-22) and applicable local law, you have the following rights:
- Right of access (Art. 15): obtain a copy of all data we hold about you;
- Right to rectification (Art. 16): correct inaccurate data;
- Right to erasure / "right to be forgotten" (Art. 17): delete your account and all associated data (with exceptions for data we must retain by law);
- Right to restriction of processing (Art. 18): suspend processing in certain cases;
- Right to data portability (Art. 20): receive your data in a machine-readable format (JSON);
- Right to object (Art. 21): object to processing based on legitimate interest;
- Right to withdraw consent: revoke consent for marketing, analytics, etc. at any time;
- Right to lodge a complaint: with a supervisory authority in your country (for EU citizens) or the Israeli Privacy Protection Authority.
To exercise any of these rights, please write to support@destinykey.org. We respond to requests within 30 days (as required by GDPR Art. 12(3)).
8. Cookies and tracking
We use the following types of cookies:
- Strictly necessary (session ID, authentication): loaded without consent — the Service does not function without them;
- Functional (interface language, UI settings): loaded after consent;
- Analytics (Google Analytics, Yandex.Metrica): loaded only after explicit consent in the cookie banner.
You may change cookie settings at any time via the "Cookie Settings" link in the site footer or by deleting cookies in your browser settings.
9. Data security
We apply technical and organizational security measures:
- HTTPS encryption of all traffic (TLS 1.2+);
- Password hashing (bcrypt with salt);
- Isolated server with regular OS updates;
- Database backups;
- Restricted server access (SSH keys, IP whitelist for admin access);
- Logging of suspicious activity.
Despite the measures taken, no system is absolutely secure. In the event of a data breach affecting your rights and freedoms, we will notify you and the competent authority within 72 hours (GDPR Art. 33-34).
10. Children under 16
The Service is not intended for persons under 16. We do not knowingly collect data from minors. If you are a parent or legal guardian and discover that your child registered without your consent, please contact us — we will immediately delete the account and associated data.
11. International data transfers
As our processors may be located outside the EEA (e.g., Google Gemini, DeepSeek), data transfers to third countries are based on:
- EU Standard Contractual Clauses;
- European Commission adequacy decisions (e.g., the adequacy decision for Israel is in effect);
- Explicit user consent (where other mechanisms do not apply).
12. Changes to this policy
We may update this Policy. We will notify registered users of material changes by email at least 30 days before they take effect. The last update date is shown at the top of this document.
13. Contact
For data protection matters:
Email: support@destinykey.org
Subject: "GDPR / Privacy"
If you believe we are violating your rights, you may contact:
- In the EU: the data protection supervisory authority in your country (list);
- In Israel: the Privacy Protection Authority.
Related documents: Terms of Service · Refund Policy