Privacy Policy

Automa ("we", "us", "our") operates PathFinder ("the Service"). This privacy policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable Dutch and European privacy laws.

This policy covers the PathFinder web application at app.pathfindercharts.com, this website, and the PathFinder mobile applications for iOS and Android. It applies the same way however you access the Service.

1. Data Controller

The data controller responsible for your personal data is:

Automa — eenmanszaak registered in the Netherlands
Adriaan Kooningsstraat 262
3077 ML Rotterdam
Netherlands
KvK: 75088088
BTW: NL002328391B46
Email: [email protected]

2. What Data We Collect

We collect the following personal data when you create an account and use the Service:

• Account information — your name, email address, and password (hashed)
• Birth data — date, time, and location of birth, used to calculate astrological charts
• Usage data — which charts and features you use within the Service
• Subscription status — whether you are on the free or paid plan, and the identifier your payment provider assigns to your subscription
• Device data (mobile apps only) — if you turn on notifications, a push notification token so we can deliver them. Turning notifications off removes it.

We do not collect or store payment information. Card numbers and billing details go directly to the payment provider — Stripe for web subscriptions, Apple or Google for subscriptions bought inside the mobile apps — and never reach our servers.

We do not show advertising or use advertising identifiers (Apple IDFA or Google Advertising ID). We do not track you across other apps or websites, and the iOS app therefore never asks for App Tracking Transparency permission.

Analytics and advertising measurement — only with your consent. On this website (pathfindercharts.com) and in the web app (app.pathfindercharts.com) we use two analytics tools to understand how the Service is used so we can improve it: PostHog, a product analytics service hosted in the European Union, and Plausible, a cookieless analytics tool we host ourselves in the Netherlands. Both run on both surfaces. Both are loaded only after you choose "Accept" in the consent banner shown on your first visit — each surface asks separately. If you choose "Reject", or make no choice at all, neither is loaded and no analytics data is sent anywhere — the only thing stored is your consent choice itself, kept in your browser's local storage. After you accept, PostHog stores a randomly generated identifier in your browser (a cookie and local storage) and records the pages you view and interactions such as clicks, along with technical details like browser type and screen size. Plausible sets no cookie and records only aggregate page views. We do not use session recording or surveys. On this website only — the web app does not load it — we also use the Meta Pixel for advertising measurement: measuring whether our Pinterest and Meta marketing works and building ad audiences. The Meta Pixel is loaded only after you choose "Accept" on this website; after acceptance, Meta sets the _fbp cookie. You can withdraw your consent at any time: on this website via the "Privacy choices" link in the footer of every page, and in the web app via the "Privacy choices" button on its privacy page. Choosing "Reject" stops analytics capture and the Meta Pixel immediately, and neither analytics tool nor the Meta Pixel will be loaded on future visits.

The mobile apps store your login session in the device's encrypted storage (iOS Keychain / Android Keystore) and keep a local copy of your display preferences. This data stays on your device and is removed when you sign out or uninstall the app. The apps request no access to your contacts, photos, camera, microphone, or location.

2.1 Email Capture

We collect email addresses on this website through an opt-in email capture form to send you a free astrology guide and occasional insights. This is a separate consent from analytics — you can accept marketing email without accepting analytics, and vice versa. When you submit the form, we collect:

• Your email address — needed to send you the guide and follow-up messages
• Your consent choice — the checkbox confirming you want to receive email from us
• The source of the form — which page or section you signed up from (e.g., "homepage-hero", "blog-footer")
• Campaign attribution metadata (optional) — if you arrived via a marketing campaign link, we capture: which campaign brought you here (utm_campaign), the medium it came through (utm_medium like "social"), the source platform (utm_source like "pinterest"), optional campaign content identifier (utm_content), and optional custom term (utm_term)
• Your landing page — the pathname of the page you signed up on (e.g., "/blog/what-is-predictive-astrology"), never the full URL or query string
• Referring site hostname (optional) — the hostname of the site that referred you, if it's external to pathfindercharts.com and app.pathfindercharts.com (e.g., "pinterest.com" if you came from a social link). We exclude our own sites to avoid logging internal traffic.

The campaign attribution data, landing page, and referrer host allow us to understand which marketing campaigns and messaging work best, so we can improve future content. None of these fields are required — if you visit directly or without a campaign link, you can still sign up successfully.

We do not sell this email list. We use it only to send you the guide you requested and occasional astrology insights. You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any email.

3. How We Use Your Data

We process your personal data for the following purposes:

• Providing the Service — calculating astrological charts and generating AI-powered interpretations based on your birth data
• Account management — authenticating your identity and managing your subscription
• Transactional emails — sending account-related communications (e.g., password resets, subscription confirmations)

4. Legal Basis for Processing

We process your data based on the following legal grounds under the GDPR:

• Performance of a contract (Art. 6(1)(b)) — processing necessary to provide the Service you signed up for
• Legitimate interest (Art. 6(1)(f)) — improving and securing the Service
• Consent (Art. 6(1)(a)) — analytics on the website and the web app, which run only after you accept them in the consent banner. You can withdraw this consent at any time via the "Privacy choices" controls described above; withdrawing it is as easy as giving it and does not affect your use of the Service.

5. Third-Party Services

We share data with the following third-party processors, all of which maintain their own privacy policies:

• Stripe — payment processing for subscriptions bought on the web. Stripe receives your payment details directly; we never see or store them.
• Apple and Google — payment processing for subscriptions bought inside the iOS and Android apps. Your purchase is made with Apple or Google under their own terms and privacy policies; they tell us only that a valid subscription exists.
• RevenueCat — manages mobile subscription status. It receives your PathFinder account identifier and the purchase details needed to confirm your subscription. It does not receive your name, email address, or birth data.
• Fireworks AI — AI model provider used to generate astrological interpretations. Your chart data (planetary positions derived from your birth data) is sent for processing. For relationship charts, the display names you have given the two profiles are included so the reading can refer to them. We never send your email address. Fireworks does not use what we send to train or improve their models, and operates zero data retention on the interface we use: your prompt and the generated interpretation exist only in memory for the duration of the request and are not logged or stored by them.
• Plausible Analytics — web analytics. Plausible is self-hosted by Automa on our EU infrastructure (no data sent to external servers), operates without cookies, and runs only if you have accepted analytics consent.
• Meta Platforms Ireland Limited — processor/joint controller for advertising measurement and building ad audiences on this website, loaded only after consent. See Meta's privacy policy.
• Hetzner Online GmbH — hosting provider for our primary application servers and database, in their Falkenstein, Germany data centre. Hetzner is a German company and the data it holds for us stays inside the EU.
• Cloudflare — content delivery network and edge network for the website and web app. Cloudflare provides DDoS protection and performance optimization for our edge traffic.
• GitHub and Slack — if you submit in-app feedback through the Service, its text (which may include technical diagnostics) is forwarded to our issue tracker and team chat for review. Both GitHub and Slack are US-based services.
• Resend — transactional email delivery
• PostHog — consent-based analytics on the website and the web app, hosted on PostHog's EU Cloud (data stored in the European Union). It receives usage data (pages viewed, clicks, browser and device details) only if you have accepted analytics, and never receives your name, email address, or birth data.

We do not sell your personal data, and we do not share it with advertisers or data brokers.

6. Data Storage and Security

Our primary application servers and database are hosted by Hetzner Online GmbH in their Falkenstein, Germany data centre, inside the European Union. AI inference processing is performed by Fireworks AI under Standard Contractual Clauses with zero-data-retention configuration. Web traffic transits through Cloudflare's global edge network. We protect your data with:

• Encryption in transit (TLS/HTTPS) for all traffic
• Encryption at rest — the disks holding your data use full-disk encryption
• Passwords and tokens stored hashed (never in plain text)
• Access controls limiting who can access production systems

7. Data Retention

We retain your personal data for as long as your account is active. If you do not sign in for 24 consecutive months, we may delete your account and all associated data after giving you notice by email.

When you delete your account, your profile, birth data, charts, and interpretations are erased from our production database immediately. Copies in operational logs and short-lived caches age out on fixed retention schedules rather than being deleted instantly. We keep only the records we are legally required to keep — principally payment and invoice records, which Dutch tax law requires us to retain for seven years.

You may delete your account at any time (see Section 8).

8. Your Rights Under the GDPR

As a data subject, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — request that we limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest

Deleting your account yourself

You do not need to contact us to erase your data. You can delete your account and everything associated with it directly from the Service:

• iOS and Android apps — Settings → Delete Account
• Web app — Settings → Delete Account

Deletion is permanent and takes effect immediately. If you have an active subscription bought through Apple or Google, cancel it in your App Store or Google Play subscription settings as well — deleting your PathFinder account does not cancel a store subscription on your behalf.

You can also export a copy of your data from Settings at any time.

To exercise any of these rights, or if you would rather we handled it for you, contact us at [email protected]. We will respond within 30 days.

9. International Transfers

Our primary application servers are located in Germany, inside the EU. Some third-party processors (Stripe, Apple, Google, RevenueCat, Fireworks AI for AI inference, Resend, PostHog, Plausible, Cloudflare, Meta) may process data outside the EU or at the edge. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission. Meta relies on the EU-US Data Privacy Framework and SCCs.

10. Children's Privacy

The Service is not directed at children. You must be at least 16 years old to create a PathFinder account, which matches the age of digital consent under the GDPR in the Netherlands. We do not knowingly collect personal data from anyone under 16.

If you are a parent or guardian and believe your child has created an account or provided personal data, contact us at [email protected] and we will delete the account and its data.

11. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the effective date at the top of this page. We encourage you to review this policy periodically.

12. Supervisory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

13. Contact

For any questions about this privacy policy or your personal data, contact us at:

Automa — eenmanszaak registered in the Netherlands
Adriaan Kooningsstraat 262
3077 ML Rotterdam
Netherlands
KvK: 75088088
BTW: NL002328391B46
Email: [email protected]