Privacy Policy
Version: 1.1 Effective Date: 11 April 2026 Last Updated: 13 April 2026 Governing Language: English (en-GB)
1. Introduction
Welcome to BaZi Compass ("the Website", "the Service"). This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit our Website or use our Service.
We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the ePrivacy Directive 2002/58/EC, and other applicable data protection laws.
By accessing or using the Website, you acknowledge that you have read and understood this Privacy Policy.
2. Joint Data Controllers
BaZi Compass is currently operated by two natural persons acting as joint controllers within the meaning of Article 26 of the GDPR:
- Rostyslav Voitovych — Kamianets-Podilskyi, Ukraine
- Oleksii Kucherov — Wrocław, Poland
Joint contact point for data subjects: [email protected]
Both controllers are jointly responsible for determining the purposes and means of the processing of your personal data. Regardless of this arrangement, you may exercise all of your rights under the GDPR (see Section 8) against either of us, and we will coordinate internally to handle your request and respond within the statutory time limits.
No legal entity currently operates the Website. Once a legal entity is established (anticipated to be an Estonian osaühing / OÜ), this section will be updated and controllership will be transferred to that entity.
3. What Data We Collect
3.1 Account Registration Data
When you create an account, we collect:
| Data Category | Specific Data | Purpose |
|---|---|---|
| Identity data | Name | Account identification, personalization |
| Contact data | Email address | Account management, email verification, communication |
| Authentication data | Password (stored as a cryptographic hash) | Account security |
| Account metadata | User ID, role, email verification status | Service functionality |
Optional Profile Data
In addition to the required registration data above, your profile contains fields that you may complete voluntarily. These fields are not required to create or use your account and can be edited or removed at any time from your profile settings:
| Data Category | Specific Data | Purpose |
|---|---|---|
| Identity data | Last name | Profile personalization |
| Biographical data | Short bio / description | Profile presentation |
| Demographic data | Gender | Profile personalization; input for astrological features |
| Demographic data | Date of birth | Personalized astrological chart (the BaZi calculation relies on date and time of birth) |
| Localization preference | Preferred language | Interface language for your account |
| Media | Profile picture | Profile display |
| Contact data | Phone number(s) and messenger availability (WhatsApp, Telegram, Viber) | Contact information displayed on your profile when you choose to publish it |
| Social links | Facebook, Instagram, X, and Telegram profile URLs | Social links displayed on your profile when you choose to publish them |
Legal basis for optional profile data: your consent (Art. 6(1)(a) GDPR), given by the voluntary act of entering each field. You may withdraw consent at any time by editing or clearing the field in your profile settings, with effect for the future; withdrawal does not affect the lawfulness of prior processing.
Date of birth is used to generate astrological content that is a core feature of the Service. If you do not wish to provide your date of birth, astrology-related features will be unavailable for your account, but the rest of the Service remains usable.
We do not request any special categories of personal data within the meaning of Art. 9 GDPR (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data).
3.2 User-Generated Content
When you post comments on blog articles, we collect and store:
- Comment text
- Associated user identity (name, user ID)
- Timestamp of submission
3.3 Cookies and Similar Technologies
We use cookies and similar technologies for the following purposes:
Essential Cookies (Strictly Necessary)
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
auth_access_token |
User authentication | Session | HttpOnly |
auth_refresh_token |
Token refresh mechanism | Session | HttpOnly |
auth_expires_at |
Token expiration tracking (used by the client to schedule silent token refresh) | Session | Client-readable |
cookie_consent |
Stores your cookie consent preferences (status, categories, timestamp, policy version) | 1 year | Client-readable |
The authentication cookies are strictly necessary for the operation of the Website when you are logged in. They are set only upon user authentication and do not require separate consent under the ePrivacy Directive. The cookie_consent cookie is equally necessary: it records your consent decision and is required to comply with the ePrivacy Directive and the GDPR.
No personally identifying information (name, email, role, profile picture, etc.) is stored in client-readable cookies. Your profile information is fetched from our server over an authenticated API request using the auth_access_token cookie and is held only in the application's in-memory state for the duration of the page session.
Third-Party Cookies — Google reCAPTCHA
We use Google reCAPTCHA v2 and v3 to protect our Website against automated abuse (bots, spam). When reCAPTCHA is loaded, Google may set cookies and collect data including:
- IP address
- Browser and device information
- Mouse movements and interaction patterns
- Cookies set by Google (e.g.,
_GRECAPTCHA,NID)
This data is transmitted to and processed by Google LLC (United States). Google's processing of this data is governed by Google's Privacy Policy.
Legal basis: Your consent (Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive). reCAPTCHA is loaded only after you accept the corresponding category in our cookie consent banner. If you decline, reCAPTCHA and its associated cookies are not loaded, and features that rely on reCAPTCHA (such as sign-up, sign-in, and password reset) will be unavailable until consent is granted. You may withdraw your consent at any time via the cookie settings link in the Website footer, with effect for the future.
Analytics Cookies (Planned)
We do not currently use analytics cookies. If we deploy analytics tools (e.g., Google Analytics, Plausible) in the future, they will:
- Track page views, session duration, and user navigation patterns
- Collect pseudonymized usage data
- Be loaded only after you grant the "analytics" consent category in our cookie consent banner, in line with Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive
This section will be updated before any analytics tools are deployed.
3.4 Automatically Collected Data
When you visit the Website, our servers may automatically collect:
- IP address
- Browser type and version
- Operating system
- Referring URL
- Pages visited and time spent
- Date and time of access
This data is collected through standard server logs for security and operational purposes.
4. How We Use Your Data
We process your personal data for the following purposes and legal bases:
| Purpose | Legal Basis (GDPR Art. 6) | Data Used |
|---|---|---|
| Providing and maintaining your account | Performance of a contract (Art. 6(1)(b)) | Name, email, password hash |
| Email verification | Performance of a contract (Art. 6(1)(b)) | Email address |
| Enabling you to post comments | Performance of a contract (Art. 6(1)(b)) | Name, user ID, comment content |
| Providing optional profile features (astrology, personalization, displayed contact & social links) | Consent (Art. 6(1)(a)) — given per field by voluntary entry | Last name, bio, gender, date of birth, preferred language, profile picture, phone numbers, messenger availability, social profile URLs |
| Protecting against automated abuse (reCAPTCHA) | Consent (Art. 6(1)(a)) — via cookie consent banner | IP address, device/browser data |
| Website security and abuse prevention | Legitimate interest (Art. 6(1)(f)) | Server logs, IP address |
| Improving the Website and user experience | Legitimate interest (Art. 6(1)(f)) | Aggregated usage data |
| Responding to your inquiries | Legitimate interest (Art. 6(1)(f)) | Email address, inquiry content |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) | As required by applicable law |
5. Data Sharing and Third Parties
We do not sell your personal data.
We may share your personal data with the following categories of recipients:
5.1 Service Providers
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Google LLC | reCAPTCHA (anti-abuse) | IP address, device data, interaction patterns | United States |
| Hosting provider (EEA-based infrastructure) | Website hosting, database, and application infrastructure | All data stored on our servers | European Economic Area |
| Resend (Resend, Inc.) | Sending account verification, password reset, and similar service emails | Recipient email address, recipient name, message content generated from template | United States (transfers covered by Article 46 GDPR Standard Contractual Clauses) |
The up-to-date list of all processors, including any future changes, is maintained in our internal sub-processor register and may be obtained on request by writing to [email protected].
5.2 Legal Requirements
We may disclose personal data if required by law, regulation, legal process, or governmental request.
6. International Data Transfers
Some of our service providers (notably Google LLC) are located in the United States. When your data is transferred outside the European Economic Area (EEA), we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- EU-U.S. Data Privacy Framework (where the recipient is certified)
- Other appropriate safeguards as required under Chapter V of the GDPR
You may request a copy of the applicable safeguards by contacting us at [email protected].
7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy:
| Data Category | Retention Period |
|---|---|
| Active account data | For as long as your account remains active |
| Deleted account data | Purged from our production systems within 30 days of a verified deletion request (short grace period to allow recovery and to complete abuse investigations) |
| Comment data | Retained for as long as the comment remains published; when the author's account is deleted, the comment is anonymised (the author name is replaced with "Deleted User") rather than erased, to preserve the integrity of ongoing discussions |
| Server and application logs | 90 days, after which they are rotated and deleted |
| reCAPTCHA data | Controlled by Google in accordance with its own retention policies |
| Authentication cookies | Cleared upon logout or session expiration |
| Email verification tokens | 24 hours after creation |
| Password reset tokens | 1 hour after creation |
| Cookie consent records | 3 years from the date consent was given or last refreshed, as evidence of lawful consent |
When data is no longer needed, it is securely deleted or irreversibly anonymised. Backups containing deleted personal data are overwritten on the usual backup rotation cycle.
8. Your Rights Under GDPR
If you are located in the EEA or a jurisdiction with equivalent protections, you have the following rights:
| Right | Description | GDPR Article |
|---|---|---|
| Access | Request a copy of your personal data | Art. 15 |
| Rectification | Request correction of inaccurate data | Art. 16 |
| Erasure | Request deletion of your data ("right to be forgotten") | Art. 17 |
| Restriction | Request restriction of processing | Art. 18 |
| Data Portability | Receive your data in a structured, machine-readable format | Art. 20 |
| Objection | Object to processing based on legitimate interest | Art. 21 |
| Withdraw Consent | Withdraw consent at any time (where processing is based on consent) | Art. 7(3) |
To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days of receiving your request. If we cannot fulfill your request, we will explain why.
You also have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Passwords are stored using cryptographic hashing (never in plaintext)
- Authentication tokens are stored in HttpOnly cookies to mitigate XSS attacks
- HTTPS encryption for all data in transit
- Access controls limiting who can access personal data
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.
10. Children's Privacy
The Website is not directed at individuals under the age of 18. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact us at [email protected], and we will take steps to delete such data.
11. Multilingual Availability
This Privacy Policy is available in multiple languages. In the event of any discrepancy between translated versions, the English version shall prevail.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. For significant changes, we will make reasonable efforts to notify registered users via email or a prominent notice on the Website.
We encourage you to review this Privacy Policy periodically.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact the joint controllers using the shared contact point below:
Joint Controllers of BaZi Compass Rostyslav Voitovych (Kamianets-Podilskyi, Ukraine) and Oleksii Kucherov (Wrocław, Poland) Email: [email protected]
Changelog
| Version | Date | Summary of changes |
|---|---|---|
| 1.1 | 13 April 2026 | Updated §3.1: added "Optional Profile Data" subsection disclosing voluntary profile fields (last name, bio, gender, date of birth, preferred language, profile picture, phone numbers with messenger availability, social profile URLs), legal basis and withdrawal. Added corresponding row to §4 purposes table. Rewrote §3.3 Essential Cookies table: removed 7 PII cookies (reflecting client-side PII reduction), added the cookie_consent cookie, and clarified that no PII is stored in client-readable cookies. |
| 1.0 | 11 April 2026 | Initial publication. |