Privacy and cookies policy

This policy explains what personal data is processed on the website morozova.online (the “Site”), why, who receives it and how to manage it. The policy follows the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). Data controller: a sole trader whose details are given at the end of this document (the “Controller”). For any questions about your data, write to the Controller's email.

1. What data is processed

Test and natal chart. The date, time (if given) and place of birth and the name you entered. The Site's server calculates the chart and the test result from them and does not store them: they are kept only in your browser (section 6).

Reading order: name, gender, date, time and place of birth and its coordinates, email, order number and status, amount, currency and payment method, the payment ID in the payment service, the dates of ordering, payment and sending, the finished PDF, the accepted version of the terms and the record of your request to start work immediately (clause 5.2 of the terms).

Technical data: IP address and the country determined from it (to show a suitable payment method), browser type, request time. These are processed by the hosting provider and Cloudflare to run and protect the Site.

Correspondence with the Controller by email.

Analytics, only if you agreed in the cookie banner (section 6).

The Controller does not receive or store bank card details. The Site does not ask for special categories of data (health, beliefs and so on).

2. Why and on what basis

• Calculating the natal chart and test result at your request. Basis: performance of a contract (a free service, Art. 6(1)(b) GDPR).
• Preparing and sending the reading, accepting payment, order status emails, handling complaints and withdrawals. Basis: performance of a contract (Art. 6(1)(b) GDPR).
• Bookkeeping and tax records. Basis: the Controller's legal obligation (Art. 6(1)(c) GDPR).
• Running and protecting the Site, anonymised order statistics, defence against claims. Basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR).
• A short mention of Anna's other services in the email with the finished reading (a 30-day horoscope, compatibility). Basis: the Controller's legitimate interest in direct marketing of its own similar services (Art. 6(1)(f) GDPR). You can opt out at any time by replying “stop” to the email; the Site does not send separate marketing emails.
• Visit analytics (if enabled). Basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time (section 6).

Data is not passed to third parties for advertising. There is no automated decision-making with legal effects for you.

3. Who receives the data

Only to the extent needed for the purpose:

• Anthropic, PBC (USA): name, gender, date, time and place of birth and the calculated planet positions. To prepare the texts of the reading using artificial intelligence. Anthropic acts as a processor under a data processing agreement and does not use the data to train models.
• Stripe (Stripe group companies, EU and USA): order number, name, email, amount, country. To accept payment in euros. For these payments Stripe acts as the seller (merchant of record) and processes payment data as an independent controller under its own privacy policy.
• TRBT Limited, the Tribute service (Cyprus, EU): order number, form data in the order description, amount. To accept payment in roubles.
• Brevo (France, EU): name, email, the texts of order emails and the PDF attachment. To send emails.
• Cloudflare, Inc. (USA) and the Site's hosting provider: technical data (section 1). To deliver and protect the Site.
• The Controller's accountant: payment data, for bookkeeping.
• Public authorities: only when required by law.

4. Transfers outside the EU

Some recipients are in the USA. Transfers are based on the European Commission's adequacy decision under the EU-US Data Privacy Framework, where the recipient participates in it, or on the standard contractual clauses approved by the European Commission (Art. 46 GDPR). A copy of the safeguards can be requested from the Controller.

5. How long data is kept

• Order data, including the PDFs sent and correspondence: 3 years from the order date (the limitation period for claims), then deleted.
• Payment documents: as long as Polish tax law requires (usually 5 years from the end of the year in which the tax obligation arose).
• Unpaid orders: 1 year from the order date.
• Test and chart data is not stored on the server; in your browser it stays until you delete it (section 6).

6. Cookies and browser storage

So that you do not have to enter your details again, the Site saves in your browser's storage (localStorage and sessionStorage): your date, time and city of birth, name, test answers, order email, chosen payment method, the deadline of the first reading price and your choice in the cookie banner. This data does not go to the server until you submit a form yourself, and it is needed for the Site to work at your request, so it does not require consent. You can delete it by clearing the site data in your browser settings.

Payment services (Stripe, Tribute) use their own cookies on their payment pages, including for fraud prevention, under their own rules.

The Site sets analytics cookies (for example, Yandex Metrica or Google Analytics) only after your consent in the banner. Until you click “Allow”, analytics is not loaded. You can change your choice at any time via the “Cookie settings” link at the bottom of every page.

7. Your rights

You have the right to:

• access your data and get a copy;
• correct inaccurate data;
• have your data deleted (“right to be forgotten”);
• restrict processing;
• receive your data in a machine-readable format (portability);
• object to processing based on legitimate interest, and to mentions of other services in emails at any time without giving a reason (Art. 21 GDPR);
• withdraw consent to analytics, without affecting the lawfulness of processing before withdrawal.

Send requests to the Controller's email; the reply comes within a month. You also have the right to complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or to the supervisory authority of your country of residence.

The form data and email are needed to conclude and perform the contract: without them the reading cannot be prepared and sent.

8. Another person's data

By ordering a reading for another person, you pass on their data and confirm that they agree to it. That person may contact the Controller with any request from section 7.

9. For users from Russia and other CIS countries

The Controller is located in Poland. Data is stored by the Controller and the recipients in section 3, including in the USA. By sending data on the Site, the user understands that it is processed outside their country of residence under this Policy. The rights given to the user by the law of their country of residence remain: requests under them are sent the same way as in section 7.

10. Data protection

Only the Controller has access to order data. The admin interface is password-protected; connections of the Site, payment services, the email service and the AI service are encrypted (TLS).

11. Changes

A new version is published at this address and applies from the moment of publication.