PRIVACY POLICY

Effective Date: January 3, 2026
Last Updated: January 3, 2026

────────────────────────────────────────

1. INTRODUCTION

Welcome to Zodiac Zap ("we," "us," "our"). We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website zodiaczap.ai (the "Site") and use our services.

By using our Site and services, you consent to the data practices described in this Privacy Policy.

If you do not agree with the terms of this Privacy Policy, please do not access the Site or use our services.

Zodiac Zap is operated by ValiDATA.AI Pty Ltd (ABN 976 864 428 93, ACN 686 442 893), a company registered in Australia, with its principal place of business at Suite 302, 13/15 Wentworth Ave, Sydney NSW 2000, Australia.

────────────────────────────────────────

2. INFORMATION WE COLLECT

We collect several types of information from and about users of our Site and services.

2.1 Personal Information You Provide

When you create an account, purchase services, or interact with our Site, we collect information that can identify you personally, including:

Account Information:
• Full name
• Email address
• Password (encrypted)
• Account creation date
• Account preferences

Birth Information (for personalized reports):
• Date of birth
• Time of birth (if provided)
• Location of birth (city, state/province, country)
• Geographic coordinates (latitude/longitude derived from location)
• Timezone information

Payment Information:
• Credit card details (processed and stored by Stripe, not on our servers)
• Billing address
• Payment history
• Transaction records

Partner Information (for compatibility reports):
• Partner's name
• Partner's birth date, time, and location
• Relationship details you choose to provide

Communication Information:
• Messages sent through contact forms
• Support ticket content
• Email correspondence with us
• Testimonials or reviews you submit

Additional Information:
• Any other information you choose to provide through surveys, feedback forms, or voluntary submissions

2.2 Information Collected Automatically

When you access our Site, we automatically collect certain information about your device and how you interact with our Site:

Usage Information:
• Pages visited
• Time and date of visits
• Time spent on pages
• Referring website
• Links clicked
• Products viewed
• Reports generated
• Features used

Device Information:
• IP address
• Browser type and version
• Device type (desktop, mobile, tablet)
• Operating system
• Screen resolution
• Language preferences
• Timezone

Cookies and Tracking Technologies:
• Session cookies (essential for site functionality)
• Persistent cookies (for preferences and analytics)
• Web beacons
• Analytics identifiers

For more information about cookies, see Section 8 below.

2.3 Information from Third Parties

We may receive information about you from third-party services:

Payment Processors (Stripe):
• Payment confirmation
• Fraud detection data
• Billing address verification

Authentication Services:
• If you sign in using social media accounts (if implemented)

Analytics Providers:
• Aggregated usage statistics
• Performance metrics

────────────────────────────────────────

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

3.1 To Provide and Deliver Our Services

• Generate personalized astrological, numerological, and tarot reports
• Calculate precise planetary positions based on your birth details
• Create natal chart visualizations
• Deliver reports via email or member dashboard
• Process payments and maintain billing records
• Manage your account and subscriptions
• Provide customer support
• Send service-related communications (order confirmations, delivery notifications)

3.2 To Improve and Optimize Our Services

• Analyze usage patterns to improve user experience
• Develop new features and products
• Conduct research and analysis
• Test new technologies and methodologies
• Monitor and analyze trends
• Debug technical issues

3.3 To Communicate With You

• Send subscription reports (daily, weekly, monthly horoscopes)
• Deliver transit alerts and notifications
• Respond to your inquiries and support requests
• Send account updates and service announcements
• Request feedback or reviews
• Send marketing communications (with your consent)

3.4 For Marketing and Promotional Purposes

• Send newsletters and promotional offers (you may opt out at any time)
• Display personalized content and recommendations
• Conduct surveys and market research
• Promote new products and features

3.5 AI Processing

We use artificial intelligence (Claude AI by Anthropic) to generate personalized astrological, numerological, and tarot interpretations. This AI processing is necessary for the performance of our contract with you to deliver the reports you purchase. The AI generates interpretations based on calculated astronomical data; outputs are non-deterministic and may vary. AI-generated content is provided for entertainment and self-reflection purposes only.

3.6 For Security and Legal Compliance

• Detect and prevent fraud
• Monitor for suspicious activity
• Enforce our Terms of Service
• Comply with legal obligations
• Protect our rights and property
• Respond to legal requests and prevent harm

3.7 For Analytics and Business Intelligence

• Understand how users interact with our Site
• Measure marketing campaign effectiveness
• Identify popular features and products
• Generate internal reports and statistics
• Make data-driven business decisions

────────────────────────────────────────

4. HOW WE SHARE YOUR INFORMATION

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we may share your information in the following circumstances:

4.1 Service Providers

We share information with trusted third-party service providers who assist us in operating our business:

Payment Processing:
Stripe - Payment processing, fraud detection, PCI compliance
Stripe has access to payment card information, billing address, and transaction history
See Stripe's Privacy Policy: https://stripe.com/privacy

Email Delivery:
Resend/Mailgun - Transactional email delivery (order confirmations, reports)
These services have access to your email address and the content of emails we send
See Resend Privacy Policy: https://resend.com/legal/privacy-policy

Astronomical Data:
AstroAPI - Professional astronomical calculations
We share your birth date, time, and location to calculate planetary positions
AstroAPI processes only the astronomical calculation request; no personal data is retained

AI Services:
Claude AI (Anthropic) - Report generation and interpretation
We share anonymized astrological data (planetary positions) for interpretation
Birth details are not directly shared; only calculated positions
See Anthropic Privacy Policy: https://www.anthropic.com/privacy

Location Services:
Google Maps API - Geocoding birth locations to coordinates
TimeZoneDB API - Determining accurate timezone for birth time
These services receive location names to provide coordinate data

Analytics:
Google Analytics or similar services (if implemented)
Aggregated, anonymized usage data
IP addresses may be anonymized

Hosting and Infrastructure:
Wix - Website hosting and content delivery
See Wix Privacy Policy: https://www.wix.com/about/privacy

All service providers are contractually obligated to:
• Use your information only for the purposes we specify
• Maintain appropriate security measures
• Comply with applicable privacy laws
• Not disclose your information to unauthorized parties

4.2 Business Transfers

If Zodiac Zap is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on our Site of any change in ownership or use of your personal information.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to:
• Court orders or subpoenas
• Legal processes or government requests
• Law enforcement investigations
• Requests to protect our rights, property, or safety
• Requests to protect the rights, property, or safety of others
• Enforcement of our Terms of Service

4.4 With Your Consent

We may share your information for purposes not described in this Privacy Policy with your explicit consent.

4.5 Aggregated or Anonymized Data

We may share aggregated or anonymized data that cannot be used to identify you personally:
• Statistical reports about user demographics
• Aggregate usage trends
• Research and analysis
• Marketing materials showcasing service popularity

────────────────────────────────────────

5. DATA RETENTION

5.1 How Long We Keep Your Information

We retain your personal information for as long as necessary to:
• Provide our services to you
• Maintain your account
• Comply with legal obligations
• Resolve disputes
• Enforce our agreements

Specific Retention Periods:

• Active Accounts: Information retained as long as your account is active
• Cancelled Subscriptions: Subscription data retained for 7 years (for tax and accounting purposes)
• Closed Accounts: Personal information deleted within 90 days of account closure, except:
  - Transaction records (7 years for legal/financial compliance)
  - Communications records (3 years)
• Marketing Data: Removed immediately upon unsubscribe request
• Cookies: Session cookies expire when you close your browser; persistent cookies expire per their individual settings (typically 1-2 years)

5.2 Exceptions

We may retain certain information longer if:
• Required by law (tax records, financial records)
• Necessary for legal proceedings
• Needed to investigate fraud or violations
• You explicitly request we maintain certain data

5.3 Deletion Requests

You may request deletion of your account and personal information at any time (see Section 9 for Your Privacy Rights). Upon deletion:
• Your account will be deactivated
• Personal information will be removed from active systems
• Some information may remain in backup systems for up to 90 days
• Legally required records will be retained per applicable laws

────────────────────────────────────────

6. DATA SECURITY

6.1 Security Measures

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

Technical Safeguards:
• SSL/TLS encryption for data transmission (HTTPS)
• Encrypted storage of sensitive data
• Secure password hashing (bcrypt or similar)
• Regular security audits and vulnerability assessments
• Firewall protection
• Intrusion detection systems
• Secure API authentication

Organizational Safeguards:
• Limited employee access to personal information (need-to-know basis)
• Employee training on data protection practices
• Confidentiality agreements with employees and contractors
• Vendor security assessments
• Incident response procedures

Payment Security:
• We do not store full credit card numbers on our servers
• Payment processing handled by PCI-DSS compliant Stripe
• Tokenization of payment methods

6.2 Your Responsibility

You are responsible for:
• Maintaining the confidentiality of your password
• Using a strong, unique password
• Logging out after using shared devices
• Notifying us immediately of any unauthorized access

6.3 Limitations

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

In the event of a data breach that affects your personal information, we will:
• Notify affected users within 72 hours of discovery
• Report the breach to relevant authorities as required by law
• Provide details about what information was compromised
• Offer guidance on protective measures you can take

────────────────────────────────────────

7. INTERNATIONAL DATA TRANSFERS

7.1 Cross-Border Transfers

Zodiac Zap operates from Brisbane, Queensland, Australia. Our website is hosted by Wix, which operates servers in multiple locations globally. If you are accessing our Site from outside Australia, please be aware that your information may be transferred to, stored, and processed in Australia and other countries where our service providers operate (including the United States).

By using our services, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection laws than your country.

7.2 Safeguards for International Transfers

When we transfer personal information internationally, we ensure appropriate safeguards are in place, such as:
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules where applicable
• Contractual commitments with service providers requiring equivalent data protection
• Compliance with applicable data protection laws including the Australian Privacy Act 1988

Our primary service providers and their locations:
• Stripe (United States) - SCCs in place
• Anthropic/Claude AI (United States) - SCCs in place
• Wix (United States/Global) - SCCs in place
• Google APIs (United States) - SCCs in place

7.3 European Users

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, please see Section 10 for additional information about your rights under the General Data Protection Regulation (GDPR).

────────────────────────────────────────

8. COOKIES AND TRACKING TECHNOLOGIES

8.1 What Are Cookies

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work efficiently and provide information to site owners.

8.2 Types of Cookies We Use

Essential Cookies (Strictly Necessary):
• Required for the Site to function properly
• Enable account login and authentication
• Remember your session and shopping cart
• Cannot be disabled without affecting site functionality

Functional Cookies:
• Remember your preferences (language, timezone)
• Enable personalized features
• Improve user experience

Analytics Cookies:
• Collect information about how visitors use the Site
• Help us improve the Site and services
• Generate statistical reports
• Examples: Google Analytics, Wix Analytics

Marketing Cookies (with consent):
• Track your activity across websites
• Deliver targeted advertisements
• Measure ad campaign effectiveness

8.3 Third-Party Cookies

Third-party services we use may also set cookies:
• Payment processors (Stripe)
• Analytics providers (Google Analytics)
• Advertising networks (if applicable)

8.4 Managing Cookies

Browser Controls:
You can control and manage cookies through your browser settings:
• Block all cookies
• Delete existing cookies
• Accept cookies from specific sites only
• Receive notifications before cookies are set

Note: Disabling cookies may limit your ability to use certain features of the Site.

Opt-Out Links:
• Google Analytics: https://tools.google.com/dlpage/gaoptout
• Network Advertising Initiative: https://optout.networkadvertising.org/

8.5 Do Not Track

Some browsers have a "Do Not Track" (DNT) feature. Currently, there is no industry standard for responding to DNT signals. We do not respond to DNT signals at this time.

────────────────────────────────────────

9. YOUR PRIVACY RIGHTS

Depending on your location, you may have certain rights regarding your personal information:

9.1 Rights for All Users

Access: Request a copy of the personal information we hold about you

Correction: Request that we correct inaccurate or incomplete information

Deletion: Request that we delete your personal information (subject to legal retention requirements)

Opt-Out: Unsubscribe from marketing emails at any time

Account Control: Update your account information through your dashboard

9.2 Additional Rights for EEA/UK Users (GDPR)

If you are located in the European Economic Area or United Kingdom, you have additional rights under GDPR:

Right to Portability: Receive your personal data in a structured, machine-readable format

Right to Restriction: Request that we restrict processing of your personal information under certain circumstances

Right to Object: Object to our processing of your personal information based on legitimate interests

Right to Withdraw Consent: Withdraw consent for processing at any time (where processing is based on consent)

Right to Lodge a Complaint: File a complaint with your local data protection authority

Legal Basis for Processing:
We process your personal information based on:
• Performance of contract (to provide services you've purchased)
• Legitimate interests (to improve our services, prevent fraud)
• Consent (for marketing communications, optional features)
• Legal obligations (tax records, compliance)

9.3 California Residents (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act:

Right to Know: Request information about the personal information we've collected about you in the past 12 months

Right to Delete: Request deletion of your personal information

Right to Opt-Out: Opt-out of the "sale" of personal information (Note: We do not sell personal information)

Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

Shine the Light: Request information about personal information shared with third parties for their marketing purposes (we don't do this)

9.4 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: privacy@zodiaczap.ai
Subject Line: "Privacy Rights Request"

Please include:
• Your full name
• Email address associated with your account
• Specific right you wish to exercise
• Any relevant details to help us locate your information

Verification: For security purposes, we may request additional information to verify your identity before processing your request.

Response Time: We will respond to verified requests within:
• 30 days (GDPR requests)
• 45 days (CCPA requests)
• 30 days (general requests)

We may extend this timeframe by an additional 30-60 days if necessary, and will notify you of any extension.

No Fee: We do not charge a fee to process privacy rights requests unless they are excessive or unfounded.

────────────────────────────────────────

10. CHILDREN'S PRIVACY

10.1 Age Restriction

Zodiac Zap is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age.

10.2 Parental Consent

If you are a parent or guardian and believe your child under 18 has provided us with personal information without your consent, please contact us immediately at privacy@zodiaczap.ai.

10.3 Deletion of Children's Information

Upon verification, we will promptly delete any information we have collected from anyone under 18 years of age.

10.4 Compliance

We comply with applicable laws regarding minors, including the Children's Online Privacy Protection Act (COPPA) in the United States. Our age restriction of 18+ exceeds the minimum requirements of such laws.

────────────────────────────────────────

11. THIRD-PARTY LINKS AND SERVICES

11.1 External Websites

Our Site may contain links to third-party websites, plugins, or services that are not operated by us. This Privacy Policy does not apply to third-party sites.

We are not responsible for:
• Privacy practices of third-party sites
• Content on external websites
• How third parties collect or use your information

11.2 Third-Party Services

When you use third-party services (such as social media sharing buttons), those services may collect information about you subject to their own privacy policies.

We encourage you to:
• Review privacy policies of any third-party sites you visit
• Understand how external services collect and use your information
• Exercise caution when sharing personal information on third-party platforms

────────────────────────────────────────

12. MARKETING COMMUNICATIONS

12.1 Types of Communications

With your consent, we may send you:
• Promotional emails about new products and features
• Special offers and discounts
• Newsletters with astrological insights
• Surveys and feedback requests

12.2 Transactional Communications

You will continue to receive transactional emails even if you opt out of marketing:
• Order confirmations
• Report delivery notifications
• Account security alerts
• Subscription renewal notices
• Customer support responses

12.3 Opt-Out Options

You can opt out of marketing communications at any time by:
• Clicking "unsubscribe" in any marketing email
• Adjusting email preferences in your account settings
• Contacting us at privacy@zodiaczap.ai

Note: Opt-out requests are processed within 10 business days.

────────────────────────────────────────

13. CALIFORNIA AND VIRGINIA RESIDENTS - ADDITIONAL RIGHTS

13.1 California Privacy Rights

In addition to CCPA rights listed in Section 9.3, California residents have:

Categories of Information Collected:
• Identifiers (name, email, birth details)
• Commercial information (purchase history)
• Internet activity (browsing behavior)
• Geolocation data (birth location)
• Inferences (astrological profile)

Business Purposes for Collection:
• Providing services
• Fraud prevention
• Service improvement
• Marketing (with consent)

Third Parties We Share With:
• Service providers (as listed in Section 4.1)
• No sale of personal information

13.2 Virginia Consumer Data Protection Act (VCDPA)

Virginia residents have the right to:
• Confirm whether we process their personal data
• Access their personal data
• Correct inaccuracies in their personal data
• Delete personal data
• Obtain a copy of personal data in a portable format
• Opt out of targeted advertising (we don't currently engage in this)

────────────────────────────────────────

14. DATA PROTECTION OFFICER

For questions about this Privacy Policy or to exercise your privacy rights, you may contact our Data Protection Officer:

Data Protection Officer
Zodiac Zap / ValiDATA.AI Pty Ltd
Email: privacy@zodiaczap.ai
Response Time: 2-3 business days

────────────────────────────────────────

15. CHANGES TO THIS PRIVACY POLICY

15.1 Updates

We may update this Privacy Policy from time to time to reflect:
• Changes in our practices
• Changes in applicable laws
• New features or services
• User feedback

15.2 Notification

When we make changes:
• We will update the "Last Updated" date at the top of this policy
• For material changes, we will notify you via email or prominent site notice
• We may require you to accept updated terms before continuing to use services

15.3 Your Acceptance

Your continued use of our Site and services after changes are posted constitutes your acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

────────────────────────────────────────

16. CONTACT US

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact us:

Zodiac Zap
Operated by ValiDATA.AI Pty Ltd (ABN 976 864 428 93)

Privacy Inquiries:
Email: privacy@zodiaczap.ai

General Inquiries:
Email: support@zodiaczap.ai
Website: https://zodiaczap.ai

Mail:
ValiDATA.AI Pty Ltd
Suite 302, 13/15 Wentworth Ave
Sydney NSW 2000
Australia

Response Time: We strive to respond to all privacy inquiries within 2-3 business days and formal privacy rights requests within legally required timeframes.

────────────────────────────────────────

17. SUPERVISORY AUTHORITY

If you are located in the EEA or UK and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

EU Data Protection Authorities: https://edpb.europa.eu/about-edpb/board/members_en
UK Information Commissioner's Office: https://ico.org.uk/make-a-complaint/

────────────────────────────────────────

Last Updated: January 3, 2026
Effective Date: January 3, 2026

────────────────────────────────────────

APPENDIX: DATA PROCESSING DETAILS

A. Types of Personal Data We Process

Identity Data
• Information: Name, username
• Purpose: Account management
• Legal Basis: Contract

Contact Data
• Information: Email address, physical address
• Purpose: Communications, delivery
• Legal Basis: Contract

Birth Data
• Information: Date, time, location of birth
• Purpose: Report generation
• Legal Basis: Contract

Financial Data
• Information: Payment card details (via Stripe)
• Purpose: Payment processing
• Legal Basis: Contract

Transaction Data
• Information: Purchase history, billing records
• Purpose: Service delivery, accounting
• Legal Basis: Contract, Legal Obligation

Technical Data
• Information: IP address, browser type, device info
• Purpose: Site functionality, security
• Legal Basis: Legitimate Interest

Usage Data
• Information: Pages visited, features used
• Purpose: Service improvement
• Legal Basis: Legitimate Interest

Marketing Data
• Information: Email preferences, communication history
• Purpose: Marketing (opt-in only)
• Legal Basis: Consent

────────────────────────────────────────

B. Third-Party Service Providers

Stripe
• Purpose: Payment processing
• Data Shared: Payment card, billing address, email
• Privacy Policy: https://stripe.com/privacy

Resend/Mailgun
• Purpose: Email delivery
• Data Shared: Email address, message content
• Privacy Policy: Provider-specific

AstroAPI
• Purpose: Astronomical calculations
• Data Shared: Birth date, time, location
• Privacy Policy: Provider-specific

Anthropic (Claude AI)
• Purpose: AI interpretation
• Data Shared: Anonymized astrological data
• Privacy Policy: https://www.anthropic.com/privacy

Google Maps API
• Purpose: Geocoding
• Data Shared: Location names
• Privacy Policy: https://policies.google.com/privacy

TimeZoneDB
• Purpose: Timezone data
• Data Shared: Location coordinates
• Privacy Policy: Provider-specific

Wix
• Purpose: Website hosting
• Data Shared: All site data
• Privacy Policy: https://www.wix.com/about/privacy

────────────────────────────────────────

C. International Data Transfers

Stripe
• Location: United States
• Safeguard: Standard Contractual Clauses

Anthropic
• Location: United States
• Safeguard: Standard Contractual Clauses

Wix
• Location: United States/Global
• Safeguard: Standard Contractual Clauses

Google Maps/TimeZoneDB
• Location: United States
• Safeguard: Standard Contractual Clauses

Resend/Mailgun
• Location: United Sta