Privacy Policy
How we process account information, orders, I Ching questions, AI interpretations and technical data · Last updated: September 25, 2026
Data controller
The controller of the personal data described in this Privacy Policy is Falpes SARL.
What data we process
Depending on the features you use, we may process the following categories of information:
- Account information: Name or username, email address, a secure password hash, language, account role and information you voluntarily provide.
- Purchase and transaction information: Order number, products, amount, currency, payment status, discount information, invoices and necessary payment identifiers. Full payment card information is generally processed directly by payment service providers.
- Divination and AI content: Questions you submit, draw results, I Ching texts, system-generated results, AI interpretations, feedback and context necessary to provide the service to you.
- Guest features: Email address, verification code records, verification status and temporary identifiers associated with the result-saving feature.
- Technical and security information: IP address, browser, device type, request times, logs, security incidents and anti-abuse information.
- Contact information: The name, email address, order number, reason for contact and message you send us through the contact form.
Sensitive data and free-text questions
I Ching questions are entered as free text, so users may voluntarily include special categories of personal data under the GDPR, such as information about health, religious or philosophical beliefs, sex life or sexual orientation, or political opinions.
We do not require users to provide such information. Wherever possible, describe your question in a non-identifying way and include only the minimum necessary information. Do not submit medical records, identity documents, full home addresses, payment card details or third parties’ sensitive information.
If a feature intentionally processes special categories of data requiring an additional legal basis under Article 9 of the GDPR, we will, where applicable, obtain the necessary explicit consent or take other legally required measures.
Purposes and legal bases for processing
| Purpose of processing | Main legal basis |
|---|---|
| Creating accounts, signing in, saving results and providing purchased services | Performance of a contract or steps taken before entering into a contract |
| Generating divination results and AI interpretations actively requested by users | Performance of the service requested by the user; a separate assessment of the Article 9 GDPR basis where special categories of data are involved |
| Orders, payments, invoices and accounting records | Performance of a contract and compliance with legal obligations |
| Preventing fraud, attacks and abuse, and protecting platform security | Our legitimate interests and, where applicable, legal obligations |
| Responding to enquiries and providing customer support | Performance of a contract, pre-contractual steps or our legitimate interests, depending on the nature of the request |
| Non-essential marketing communications | Your consent where required by law; you may unsubscribe at any time |
AI processing
When you use AI interpretation features, we may need to send your question and the necessary I Ching context to AI technology service providers processing data on our behalf in order to generate the content you request.
We must limit the information sent in accordance with the data minimisation principle. The entertainment-based nature of AI interpretations does not permit unrestricted collection of personal information.
We do not use AI interpretations to make automated eligibility, employment, credit, insurance, medical or law enforcement decisions that produce legal effects concerning users or similarly significantly affect them.
Data recipients and service providers
Only personnel or service providers whose involvement is genuinely necessary for the purposes described above may process the relevant data. Categories may include:
- Website hosting, server, database and security service providers.
- AI model or AI infrastructure service providers used to generate AI interpretations expressly requested by users.
- Payment service providers, such as the payment processors displayed on the website’s checkout page.
- Email and notification service providers.
- Courts, regulators, tax authorities or law enforcement agencies legally entitled to request information.
Data transfers outside the EU
Some technology service providers may be located outside the European Economic Area or access data from outside it.
Where an international transfer subject to the GDPR takes place, we will use an applicable European Commission adequacy decision, standard contractual clauses or another lawful transfer mechanism appropriate to the circumstances, together with supplementary safeguards where necessary.
Payment information
Payment pages may be provided by third-party payment service providers. These providers process payment data, such as payment card details, under their own applicable policies.
Falpes SARL retains the transaction information necessary for order completion, refunds, accounting and dispute handling, but generally does not retain full bank card numbers or payment card security codes.
Data retention periods
| Data category | Principle or retention period |
|---|---|
| Account and profile information | Retained while the account remains active; after account deletion or prolonged inactivity, handled under established deletion or archiving rules, except for information that must be retained by law. |
| Questions, results and AI interpretations | Retained for as long as necessary to provide history or result-saving features; following lawful deletion by the user or account termination, deleted or de-identified in accordance with technical backup cycles and legal obligations. |
| New email addresses awaiting verification and verification information | Retained only for the short period necessary for verification, then deleted or invalidated upon expiry. |
| Customer support and dispute information | Retained for the period necessary to handle requests and establish rights within applicable limitation periods. |
| Invoices, orders and necessary accounting documents | Generally retained for 10 years in accordance with the law. |
| Security logs | Retained for a limited period determined by security purposes and risks, unless a longer period is needed to investigate a specific security incident. |
Security measures
We implement technical and organisational measures appropriate to the risks of processing, including access controls, password hashing, HTTPS/TLS, permission restrictions, security logs, server protection and appropriate backup measures.
Internet-based systems cannot be guaranteed to be completely secure, so no security measure can guarantee zero risk.
Your GDPR rights
Subject to the applicable conditions, you may request access to, rectification or erasure of your personal data, or restriction of its processing. You may also exercise your right to data portability, object to certain processing based on legitimate interests, and withdraw consent at any time where processing is based on consent.
Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.
If you believe that the processing of your personal data violates the applicable rules, you may also lodge a complaint with the French data protection authority, CNIL.
Automated processing and decisions
Divination algorithms, random draws and AI generation are used to provide entertainment and reflective content actively requested by users.
We do not make automated decisions based solely on these divination results or AI outputs that produce legal effects concerning users or similarly significantly affect them.
Minors
This service is intended for users aged 18 or over. We do not knowingly provide divination or AI interpretation services requiring registration or payment to anyone under 18.
Updates to this Privacy Policy
We may update this Privacy Policy following changes to our products, technology, service providers or legal requirements. We will notify users of significant changes through the website, account interface, email or other appropriate means.
The update date at the top of the page identifies the version currently published.
Privacy enquiries and complaints
For requests relating to access, rectification, erasure, restriction of processing, portability, objection or other GDPR rights, please contact: falpesfrance@gmail.com.
You may also lodge a complaint with the French Commission nationale de l’informatique et des libertés (CNIL), in accordance with the law.