1. Controller and Purposes
The data controller is Support Global Goods s.r.o., company identification number (IČO) 21983330, Kojetínská 3157/55, Přerov I-Město, 750 02 Přerov, Czech Republic; support@theorbit.world. We process your name, date and optional time of birth, location, coordinates and time zone, selected gender, tarot inputs, language, email address, and generated reading to prepare, provide access to, and support the service. The legal bases are taking steps at your request and performing the contract. Providing your time of birth is optional. Payment and billing identifiers, countries, amounts, currencies, and documents are used for payments, accounting, and compliance with legal obligations. Consent records and proportionate diagnostic data are used for security and the protection of legitimate claims. Do not enter health information or data about third parties.
2. AI and Recipients
Selected personal inputs and calculated information are processed automatically and sent to AI to generate the reading. Your email address and card details are not sent to the model that writes the reading. This does not involve decisions about employment, credit, health, or any other legally significant status. We use Lovable Cloud for operations and storage, Lovable AI Gateway and the encrypted (TLS) OpenAI API for generating readings, Lovable Emails for service emails, Stripe for payments, and Zoho for support. To the extent necessary, other contracted providers of these services, accountants, and authorized authorities may receive data. Stripe may act as an independent controller for its own statutory purposes. We do not claim that data never leaves the operator.
3. Retention, Data Protection Officer, and International Processing
We retain customer data (reading data, email addresses, orders, consent records, and support communications) for 3 years after the last purchase or contact for customer support and defense against payment disputes (chargebacks); we then delete or anonymize it. Accounting and tax documents are retained for the period required by law, and OSS records are generally retained for ten years from the end of the year of the transaction. You may request earlier deletion at support@theorbit.world, unless a legal obligation or legitimate legal claim prevents it. No data protection officer (DPO) has been appointed because one is not required for the scope of our processing; personal data inquiries are handled directly by the controller’s managing director at support@theorbit.world. Inputs for readings are transmitted over an encrypted connection to the provider OpenAI, which may also process data outside the EEA (particularly in the United States) on the basis of Standard Contractual Clauses or the EU–U.S. Data Privacy Framework. You have the right to file a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz) or with the supervisory authority in your country of residence.
4. Technical Storage and Communications
The website uses the local storage entry reading_id to allow you to return to your reading. This entry has no automatic expiration date; it remains until overwritten or until the browser’s storage is cleared. Deleting the entry does not delete the stored reading data. Payment and security tools may use their own necessary storage under their own policies. An inventory of all cookies and their expiration periods must be completed before launch. Analytics and advertising tools that require consent must not be activated without it. Service messages and ordered readings are distinct from marketing, which requires a separate lawful basis and an easy way to unsubscribe.
5. Your Rights and Security
Subject to applicable conditions, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests; you may withdraw consent. Send requests to support@theorbit.world. We may take reasonable steps to verify your authority to make the request. Under the GDPR, we generally respond within one month and will explain the reasons for any legally permitted extension; in the United States, applicable state deadlines and rights apply, including any applicable right to appeal. You may file a complaint at https://uoou.gov.cz/ or with the appropriate local supervisory authority. Required records cannot be deleted before the statutory retention period expires. We use reasonable safeguards; absolute security is not guaranteed. Consent to immediate delivery is not consent to marketing or unrestricted data processing.