Privacy Policy

Last updated: 19 October 2026

In short. We collect only what we need to prepare your reading, run your account and arrange consultations. We never sell your information, we do not use advertising or tracking cookies, and you can download or delete your data yourself at any time from your account.

1. Who we are

Sacred Avatar (“we”, “us”) offers personalised readings calculated from a date of birth, and consultations with an expert. We are responsible for the personal information described in this policy.

Person in charge of the protection of personal information: the owner of Sacred Avatar. Write to support@sacredavatar.com with “Privacy” in the subject line.

Sacred Avatar is run by a sole proprietor registered in Ukraine; the seller’s details are listed in the Terms of Service. We follow the Law of Ukraine “On Personal Data Protection”.

We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25.

2. What we collect

Account: your name, email address, password (stored only as an irreversible hash), preferred language, whether you confirmed your email, and your newsletter choice with the date you made it.
Dates of birth you enter and the reports calculated from them. If you enter someone else’s date of birth, please do so only with their agreement.
Purchases: the plan you bought, the date, and the payment reference from our payment processor. We never see or store your card number.
Consultation requests: your name, email, the contact method you choose (phone number or messaging username), time zone, preferred language, optionally your date of birth and availability, the topics you select and the question you write, and the history of our messages and appointment with you.
Reviews you choose to leave: rating, text, and the name shown publicly (your first name and the initial of your last name).
Newsletter sign-ups from the preview page: email address, language, optionally the date of birth you were looking at, and the date and source of your consent.
Emails: a record of the service emails we send you (address, subject, date, delivered or not) and any messages you send us.
Security data: a one-way hash of your IP address (the address itself is not stored) used to limit abuse, a record of sign-in attempts, and your session cookie. Our hosting provider keeps standard server logs for security.

A consultation question can touch on personal matters such as health, family or relationships. Please share only what you are comfortable sharing. Only the team members who arrange and give your consultation can read it.

3. Why we use it

To calculate, store and show your reports, and to let you sign in and read them again.
To process payments and keep the accounting records the law requires.
To arrange and hold consultations: contact you, agree on a time, send the video link and reminders.
To send service emails: email confirmation, password reset, purchase confirmation, consultation messages. These are part of the service and are not marketing.
To send newsletters, only if you have agreed to receive them.
To keep the service secure: prevent fraud, abuse and unauthorised access.
To answer your questions and requests.

We use aggregate counts (for example, how many reports were sold this month) to run the business. We do not build advertising profiles, and we do not sell or rent personal information.

We collect personal information when you give it to us and for the purposes explained when you do. You can withdraw your consent at any time; this may mean we can no longer provide part of the service (for example, we cannot keep your reports without an account).

Newsletters are sent only with your express consent, as required by Canada’s anti-spam legislation (CASL). Every newsletter identifies us, includes our contact address and a one-click unsubscribe link. You can also untick the newsletter box in your account. We process unsubscribe requests immediately and in any case within 10 business days. Service emails about your account, purchases and consultations continue to reach you.

We share personal information only with service providers who help us run Sacred Avatar, only as far as they need it, and under agreements that require them to protect it:

Hostinger — hosts our website, database and email. Your account, reports, consultation requests and emails are stored there.
Railway (United States) — runs our calculation service. It receives only a date of birth, the plan and the language; never your name or email.
LiqPay (JSC CB PrivatBank, Ukraine) — processes payments. You enter your card details on the LiqPay page, not on ours; its own privacy policy applies. We receive only the order number, amount, currency and payment status.
Video services such as Zoom or Google Meet — used for consultations. You join through a link; their privacy policies apply to the call. We do not record consultations.
YouTube (Google, United States) — shows videos in some blog articles. Nothing is loaded from YouTube until you press play; from then on YouTube receives your IP address and may store cookies on your device, and Google’s privacy policy applies. The typefaces of our pages are served from our own server.
OpenAI — our team may use it to draft translations of our own interpretation texts. No client information is ever sent to it.

Some of these providers store data outside Quebec and outside Canada, including in the United States and Ukraine. Before using them we assessed the protection they offer, and we rely on contractual safeguards. Information stored in another country may be accessible to that country’s courts and authorities under its laws.

We may disclose information if the law requires it, or to protect the rights and safety of our clients and our service.

6. How long we keep it

Account and reports: while your account is open. When you delete your account, your personal information is removed immediately from the live system and from backups within 30 days.
Consultation requests: 24 months after the last activity, then the name, contact details and question are deleted. The reference, dates and amount remain for accounting.
Payment records: as long as tax and accounting law requires (up to six years). They contain no date of birth.
Newsletter list: until you unsubscribe. We then keep only your email address marked as unsubscribed, so that we never write to you again by mistake.
Email log: 12 months. Security log of account and staff actions: 24 months. Sign-in attempts: 30 days. Sessions: 14 days after your last visit.

7. How we protect it

All pages and connections use encryption (HTTPS/TLS).
Passwords and one-time links are stored only as irreversible hashes; repeated failed sign-ins lock the account temporarily.
Team members can access client information only through a personal account protected by two-step verification, and only to the extent their role requires. Their actions are logged.
Our calculation service is protected by secret keys and never receives identifying information.

No system is perfectly secure, but we review these measures regularly.

8. Your rights

Wherever you live, you can:

Access the personal information we hold about you and learn how it is used;
Receive a copy in a structured, commonly used format — use “Download my data” in your account;
Correct information that is inaccurate or incomplete — your name and language can be changed in your account;
Delete your account and the personal information in it — use “Delete my account” in your account;
Withdraw a consent you gave, including for newsletters.

For anything you cannot do yourself in your account, write to support@sacredavatar.com. We may ask you to confirm your identity. We reply within 30 days, free of charge.

If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada or, if you live in Quebec, the Commission d’accès à l’information du Québec.

9. Cookies and browser storage

We use only what the site needs to work:

Session cookie — keeps you signed in and protects forms against forgery. It expires 14 days after your last visit or when you log out.
Language cookie — remembers the language you chose, if you choose one.
Browser storage — remembers small interface choices, for example that we already asked you for a review during this visit.

We use no advertising cookies, no analytics or tracking tools, and no social-media pixels.

10. Automated processing

Your report is produced automatically from a date of birth by a fixed set of rules. It is a text for reflection, not a decision about you. We do not use it to profile you, rate you or target advertising.

11. Age requirement

Sacred Avatar is intended for adults aged 18 and over. We do not knowingly collect information from minors. If you believe a minor has given us information, write to us and we will delete it.

12. If something goes wrong

If personal information under our control is lost, accessed or disclosed without authorisation, we act promptly to limit the harm. If there is a real risk of significant harm (a risk of serious injury under Quebec law), we notify you, the Office of the Privacy Commissioner of Canada and, where applicable, the Commission d’accès à l’information, and we keep a record of every incident.

13. Changes and contact

We may update this policy when our service or the law changes. The date at the top shows the latest version; if a change is significant, we will tell account holders by email before it takes effect.

Questions about this policy: support@sacredavatar.com.