Privacy Policy

Who is responsible

The service operator named at the top of this page is the controller of the personal information LensEast collects to provide the site, the free chart, and paid reports. If that name is not configured, merchant details are incomplete and paid sales stay closed. Privacy requests go to the support email displayed on this page.

Payment is processed by the provider configured for this deployment, which may be Waffo Pancake or Stripe. That provider collects card and checkout details on its hosted page. We do not operate that page and we do not receive full card numbers. We receive a payment reference, the amount, the currency, and the order status so we can deliver the report and handle a refund that support approves. When the provider is Waffo Pancake, Waffo is the merchant of record for that hosted checkout, and Waffo's privacy notice applies to the payment information it collects there. When the provider is Stripe, Stripe's notice applies to the payment information it collects. We do not claim that Waffo is the merchant of record on every deployment.

Information we collect

What we collect depends on what you use.

• Birth date, birth time or an unknown-time choice, birthplace, and time zone.
• The traditional sex parameter, when you provide it, used only to calculate luck-cycle direction. It is not a health record and it is not used for advertising.
• Your email address and verification records, when you request a paid report or access to an existing order. The free chart does not require an email address. Verification is not marketing consent.
• Order and payment references, the amount and currency, and the chart and report snapshots needed to generate and show the report. We do not collect or store full card numbers, card security codes, or full payment credentials.
• Records of consent choices, including marketing choices, security events, and support messages you send us.

An unfinished chart can stay in browser memory while you move through the site. Refreshing the page clears it. We do not put birth details or verification codes in the page address. Anonymous chart calculation does not create a saved birth-profile record. A paid purchase uses a stored snapshot of the chart used for that order.

Purposes and legal bases

Where the EU General Data Protection Regulation or the UK GDPR applies, the legal basis is stated with the purpose.

• To calculate a chart you ask for, write and deliver a paid report, verify the recipient, and support that order. The basis is the contract, or steps you ask for before a contract. A free chart calculation does not require an email address. We do not currently publish a free AI sample.
• To keep the service secure, prevent fraud and abuse, and investigate a failed delivery. The basis is our legitimate interest in a safe service. We do not use birth details for advertising under this interest. You may object, as described below.
• To send marketing email, and only with a separate consent that is not pre-selected. A verification message, a report notice, or a support reply is not marketing consent. The basis is consent. You may withdraw it at any time. Withdrawal does not affect a report you already bought.
• To keep records required for tax, accounting, chargebacks, or other legal claims. The basis is a legal obligation.

We do not sell personal information, and we do not use it to train public models for unrelated products.

AI generation and safety checks

To write a report, we send the calculated chart and the minimum birth details needed for that text to OpenRouter, which requests the model deepseek/deepseek-v4-flash. OpenRouter processes that input under a data-processing agreement, only to generate the report. We do not send your email address or your name to the model. The model can still produce inaccurate cultural interpretation.

Before generation and before publication, the generation input and the generated text may be sent to Waffo Prompt Sift for an automated safety check. The check receives the text under review. It is not a place to enter your email address or card details. We keep the check result and a request id. A blocked, pending, or unavailable check does not authorize publication. This describes the safety check. It does not mean a human reads your chart.

The report is not an automated decision that produces a legal effect, or a similarly significant effect, such as a credit, employment, or insurance decision. Do not use it that way.

Payments

You enter payment details on the configured payment provider's hosted checkout. That provider may be Waffo Pancake or Stripe, depending on this deployment. We store a payment reference, the amount, the currency, and the status. We do not store the full card number. Card data is handled by the payment provider. A refund that support approves uses that reference and, when the provider completes it, returns through the original payment channel.

Providers and international transfers

Cloudflare provides hosting, the D1 database, and private R2 object storage for reports. OpenRouter receives the generation input described above and requests the model deepseek/deepseek-v4-flash. The email provider receives the address and the message needed for a verification code or a report notice. The configured payment provider, Waffo Pancake or Stripe depending on this deployment, receives checkout data. Waffo may also receive text for Prompt Sift safety checks. Prompt Sift is a safety check. It does not make Waffo the merchant of record for a Stripe payment.

These providers may process personal information outside your country, including in the United States. Where the GDPR or the UK GDPR requires a transfer safeguard, the safeguard is an adequacy regulation or standard contractual clauses, including the UK international data transfer addendum where that applies, plus any supplementary measure the transfer needs. You may ask the support email which safeguard applies to a named provider.

How long we keep information

Seven days of web access is the time you can open a paid report on the website. It is not a promise to erase records after seven days. We also do not delete the order, the birth snapshot, or the report a fixed number of months after purchase.

We keep those records for operations: delivering the report, supporting the order, correcting a failed delivery, and ordinary accounting. We may keep a record longer when tax law, a chargeback, a legal claim, or a retention hold requires it. We explain a hold that prevents deletion. Recording a retention rule does not by itself delete data.

Marketing consent is kept until you withdraw it. We may keep a short record of the withdrawal so we do not email you again. Security records are kept only as long as needed to protect the service.

On a verified deletion request, eligible information is soft-deleted. It then becomes eligible for permanent purge about 90 days after that soft-delete, which is the default waiting period. Purge happens when cleanup runs. It is not an automatic deletion counted from the purchase date. A hold or a legal duty can keep the record longer. We explain anything the law requires us to keep.

Your privacy rights

Write to the support email to use the rights that apply where you live. We may verify that the request comes from you, or from a person authorized to act for you, before we release or change private information. We explain any refusal and any record we must keep.

If the EU GDPR or the UK GDPR applies, you may request access, rectification, erasure, restriction, and a portable copy of information you provided. You may object to processing based on legitimate interests, and you may withdraw consent. You may lodge a complaint with a supervisory authority. In the United Kingdom that includes the Information Commissioner's Office. In the European Union it includes an authority in your country of residence. If a UK or EEA representative is required and is not yet named on this page, you can still use the support email and you can still complain to an authority.

If you are a California resident, you may request to know, delete, and correct personal information, and to opt out of sale or sharing, under the California Consumer Privacy Act as amended by the CPRA. An authorized agent may submit a request with proof of authorization. We will not discriminate against you for exercising these rights.

If you are in Canada, you may request access to and correction of your personal information. You may contact the Office of the Privacy Commissioner of Canada, or the provincial commissioner that has jurisdiction, about our handling of that information.

Sale, sharing, and advertising

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use birth details, charts, or reports to advertise to you or to anyone else. There is no sale or sharing to opt out of under California law. This section is our Do Not Sell or Share My Personal Information notice. You may still email the support address and ask us to confirm that position for your records.

Cookies and similar storage

We use essential cookies and similar storage so the site can remember a browser, keep a verification session, protect forms, and store your language choice. If you arrive through a referral link, we store a referral cookie to attribute that referral. The referral cookie is not an advertising profile.

We do not currently set analytics or advertising cookies, and we do not use a third-party analytics product on these pages. If that changes, we will update this policy before using non-essential cookies and, where the law requires it, ask first.

Marketing messages

Service email is limited to messages you asked for: verification codes, a notice that a report is available, and replies to support. Those messages do not sign you up for marketing. Marketing email is optional. It uses a separate consent that is not pre-selected, and you can withdraw it from the message or by writing to the support email. Service email and marketing email stay separate because electronic-marketing rules, including in the United Kingdom, require that separation.

Children

You represent that you are at least 18 years old. We do not verify age at signup or checkout. The chart, email verification, and payment forms have no age field and no age checkbox. We do not knowingly collect personal information from children. Do not submit a child's birth details or email address. If you believe we hold a child's information, write to the support email and we will delete it, except for a record the law requires us to keep.

Changes and how to contact us

A material change to this policy is published with a new policy version, shown at the top of this page. The version you see is the current notice.

For a privacy request, use the support email displayed on this page. Include enough detail for us to find the order. Do not include card numbers, passwords, or verification codes. If no support email is displayed, privacy contact details are not configured and paid sales stay closed.