Prélude

Privacy policy

Version 1.10 — Effective date 2026-09-21 — Status live — SHA-256 716606db6ab80e389b5d23fe16820ad8c3d8af18e1aaf6b47dde206636650cee

Data controller

PLEROMIA, 170 bis rue de Saint-Guirec, 22700 Perros-Guirec, France. Contact: contact@pleromia.fr.

Data and purposes

  • Email and hashed password: account creation and security.
  • First name and birth details entered: local chart computation, reading preparation and, for a signed-in account, storage of the natal chart on the account so it can be displayed again at every sign-in.
  • Derived chart, monthly context and reading text: service delivery.
  • Transaction references, billing snapshots, and local versioned consent proofs: credit-purchase and reading processing and audit duties.
  • Account email address: sending the messages the service requires (password-reset link, notice that a subscription reading has been credited) and, only if you have consented to it, sending Prélude news.
  • The state and history of your consent to news — its date, the means by which it was given or withdrawn, the version and hash of the wording accepted, its language: proof of consent and enforcement of your withdrawal.
  • Pseudonymous journey measurement, only if you consent to it: actions on buttons and steps, sign-up or purchase confirmation, channel, language and time, to improve navigation. It never records form fields, IP address or user-agent; no personal input is collected.

Legal bases

  • Account, natal tunnel, chart computation, reading generation and storage: performance of the contract to which you are a party, Article 6(1)(b) GDPR.
  • Credit purchase, invoicing, and consent proofs attached to a purchase or a reading: performance of the contract, Article 6(1)(b).
  • Retention of accounting records: compliance with a legal obligation to which Prélude is subject, Article 6(1)(c).
  • Account security and prevention of abusive use of the service: legitimate interest in protecting the service, Article 6(1)(f).
  • Messages required to perform the service (password reset, notice that a subscription reading has been credited): performance of the contract, Article 6(1)(b).
  • Sending Prélude news: your consent, Article 6(1)(a). That consent is optional, it conditions neither account creation nor any purchase, and withdrawing it has no effect on the service.
  • Pseudonymous journey measurement: your consent, Article 6(1)(a). That consent is optional, conditions neither an account nor payment, and withdrawing it has no effect on the service.

Storage and recipients

Natal tunnel state is kept in the tab sessionStorage under Prélude’s declared key. For consented journey measurement, the browser keeps an explicit choice and a random pseudonym in the tab; the server receives only the SHA-256 hash of that pseudonym, authorised actions, their time and, to confirm a purchase, a technical order hash. No personal input is collected in this rail. During a withdrawal not confirmed by the server, only the pseudonym needed for another deletion attempt remains in the tab for at most 24 hours and measurement does not resume. For a signed-in account, the natal chart birth inputs (first name, birth date, time and place) are stored in the database so the chart can be displayed at every sign-in; the computed chart itself (positions, houses) is not stored and is recomputed in the browser. Ordered readings, their content, status, and a natal hash are stored in the database. Consent proofs record the server-derived account, purchase or reading parent, type, language, canonical version and hash, and server time; no IP address or user-agent is collected by default. New StripeEvent rows retain only a minimal technical projection without a complete payload, email, userId, or other direct identifier. Complete JSON payloads stored by earlier versions are not deleted by P2.10-B. Strictly necessary providers are Vercel for application hosting, Neon for the database holding accounts, readings, natal hashes, natal chart birth inputs and consented journey measurement, Stripe for payment, Grok (SpaceXAI LLC) for reading generation, Hetzner Online GmbH for processing readings on a server in Finland, and OpenRouter for other text generation assigned to it. For one-time and subscription invoices, the account email address and a stable pseudonymous customer reference are sent to Stripe. Stripe collects the billing name and address directly during payment to issue invoices; Prélude does not store these billing details in its application database. The entered first name, derived chart, and monthly context are sent to Grok to generate the reading. The Hetzner relay keeps an encrypted technical copy during processing and deletes it after result delivery or expiry; a server interruption may delay that deletion. To send any message — password-reset link, notice that a subscription reading has been credited, consented news — the recipient email address and the message content are sent to Scaleway (Scaleway S.A.S., France), the email-sending provider. The state and history of your consent to news are stored in the database at Neon; they are sent to no third party, and no mailing list is hosted outside that database. The Transactional Email service’s special terms (version of April 7, 2026, Article 4.3) provide that the service is neither an email archiving nor an email storage system: sent messages are transmitted and then automatically deleted after processing.

Transfers outside the European Union

Some strictly necessary providers are established in the United States. Application hosting is provided by Vercel Inc. and some text generation by OpenRouter, Inc.: both transfers rely on the standard contractual clauses adopted by the European Commission under Article 46 GDPR. Payment is contracted with Stripe Payments Europe, Limited, established in Ireland; onward transfers to Stripe, Inc. rely on the standard contractual clauses and on the Data Privacy Framework certification. The database is operated by Neon (Neon, LLC, part of Databricks, Inc., United States) and hosted in the AWS eu-central-1 region (Frankfurt, European Union), the region selected at project creation. Transfers to the group’s U.S. entities rely on the 2021 standard contractual clauses incorporated into the Databricks data-processing addendum, and on Databricks, Inc.’s EU-U.S. Data Privacy Framework certification, whose official registry listing expressly covers Neon, LLC. Transactional email is provided by Scaleway S.A.S., established in France: the service runs from the French fr-par region, within the European Union, and its data-processing agreement (DPA of June 1st, 2024, Article 11) provides that no transfer outside the Union takes place without prior notice and that any such transfer relies on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914).

Readings use a Grok subscription through the official Grok Build client. SpaceXAI states that it processes data in the United States. The Grok Build data-sharing option for retention and training is disabled; no zero-retention guarantee or agreement reserved for API or Enterprise offerings is assumed to apply to this subscription. See the SpaceXAI privacy policy.

Supervisory authority

You may lodge a complaint with the French data-protection authority, Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr. That route is open to you without contacting us first.

Retention

Session data ends with the tab session or browser controls. Consented journey measurement expires after 30 minutes of inactivity (24 hours maximum in the tab); on withdrawal, it stops immediately in the browser and server deletion is requested. If that request cannot be confirmed, only the pseudonym needed for another attempt remains in the tab for at most 24 hours. Its events and minimal consent proof are retained for no more than 30 days, then deleted by a daily purge. During an incident, that purge is delayed without allowing new collection. Natal chart birth inputs stored on the account are retained for as long as the account exists and are removed by account deletion. Account data is retained during the relationship and applicable legal periods. Accounting records are retained for the statutory period.

Retention honesty

No retention duration is presented here as an approved legal conclusion. The ten-year accounting rule may justify retaining qualifying invoices and accounting entries; it does not justify keeping profile fields, credentials, birth data, natal hashes, share tokens, or reading content. Withdrawal declarations, transitions, consent evidence, and deletion records require their own approved retention or restriction schedule; until that exists, no period is hard-coded as a legal conclusion.

Your rights

Requests for access, correction, erasure, restriction, portability or objection must be sent to contact@pleromia.fr. An autonomous account export is available to the authenticated account owner. That export is practical access to locally held data and is neither a complete legal response nor a portability finding. An account-deletion feature (local tombstone) is available to the authenticated account owner. Deletion is local: no external erasure is performed at Stripe, OpenRouter, Grok, an email provider, or logs outside the proved boundary. Email remains a complementary contact channel for exercising a right.

Account export and deletion

An autonomous account export is available to the authenticated account owner. That export is practical access to locally held data and is neither a complete legal response nor a portability finding. An account-deletion feature (local tombstone) is available to the authenticated account owner. Deletion is local: no external erasure is performed at Stripe, OpenRouter, Grok, an email provider, or logs outside the proved boundary.

Email communications

Two families of messages, kept apart and treated differently. Messages the service requires are sent without your consent because they perform the contract: the password-reset link, and the notice telling you a reading has just been credited to a subscribed account. They cannot be unsubscribed from without leaving the corresponding service. Prélude news, by contrast, is sent only if you asked for it through an unchecked box, at sign-up or from your member space. Every news message carries an unsubscribe link that acts in one click, without signing in and without justification, and unsubscribing takes effect immediately. We keep the date, the means and the exact wording you consented to, so that we can prove that consent and honour its withdrawal. Deleting your account also switches news off.

Cookies and browser storage

Only declared Auth.js cookies and sessionStorage are used. First-party pseudonymous journey measurement starts only after your explicit consent; no advertising pixel, third-party analytics or A/B testing is active. You may withdraw this consent at any time with the permanent “Journey measurement” button. See the cookies policy.