Privacy Policy

1. Data Controller

The data controller is the publisher of the Entre Ciel et Terre website. For any questions regarding your data, you can contact us via the details provided in the legal notice.

2. Data Collected

We collect the following data:

• Registration data: name, email address (via Manus OAuth authentication)
• Reading data: questions asked, hexagrams drawn, AI-generated interpretations, personal notes
• Subscription data: plan type, subscription status, Stripe customer ID (payment data is managed exclusively by Stripe)
• Newsletter data: email address, language preference
• Technical data: IP address (for discovery reading rate limiting), language preference

3. Purpose of Processing

Your data is processed for the following purposes:

• Providing the I Ching reading and interpretation service
• Managing your user account and preferences
• Maintaining your personal reading journal
• Managing your subscription and payments via Stripe
• Sending the newsletter (if subscribed)
• Preventing abuse (IP-based rate limiting)
• Improving the service and fixing errors

4. Legal Basis

• Contract performance: to provide the reading service, manage your account and subscription
• Consent: for newsletter subscription
• Legitimate interest: for service security (rate limiting) and service improvement

5. Data Retention

• Account data: retained while your account is active, then deleted within 30 days of account deletion
• Reading data: retained while your account is active
• Newsletter data: retained until you unsubscribe
• Rate limiting data: automatically deleted after 24 hours

6. Data Sharing

Your personal data is never sold. It may be shared with:

• Stripe: for payment processing (Stripe acts as a data processor and has its own privacy policy)
• AI provider: questions are transmitted to an artificial intelligence service to generate interpretations. Questions are anonymized and not linked to your identity
• Hosting provider: Manus, for the technical operation of the website

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, modification, disclosure or destruction. Communications are encrypted via HTTPS. Passwords are not stored (OAuth authentication).

8. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion of your data
• Right to data portability: receive your data in a structured format
• Right to object: object to the processing of your data
• Right to withdraw consent: withdraw your consent at any time (newsletter)

To exercise these rights, contact us via the details provided in the legal notice. We will respond within 30 days.

You also have the right to lodge a complaint with the CNIL (French Data Protection Authority): www.cnil.fr, or with the supervisory authority in your country of residence.

9. Cookies

The website only uses strictly necessary technical cookies for the operation of the service:

• Authentication session cookie
• Language preference

No advertising, tracking or third-party analytics cookies are used. No consent is required for these technical cookies in accordance with the ePrivacy Directive.

10. Changes

We reserve the right to modify this privacy policy at any time. Changes will be published on this page with the update date. We encourage you to check this page regularly.