Privacy Policy

Your privacy is the foundation of this platform. By the very nature of our services, we receive intimate information from you — date of birth, personal questions, sometimes photographs. The document below tells you exactly what we collect, why, with whom we share this data, and how we protect it. We wrote it as clearly as possible and avoided technical jargon where it was not strictly necessary.

1. Who we are

The controller of personal data under GDPR is NEXUS CONCEPT SRL, registered office at Str. Grădiștei 36, Sat Păulești, Prahova County, postal code 107400, România, Tax ID 52611066, Trade Register no. J2025074790000.

For any request related to your personal data, please contact us at:

• Dedicated GDPR email: contact@nexusgrounds.com
• Data Protection Officer (DPO):

2. What data we collect and why

We collect only the data needed to provide you with the services you order. Below we grouped everything into categories, with the clear purpose of each.

2.1 At account creation

• Full name — so that we can address you personally and personalize interpretations;
• Email address — for authentication, account confirmation, and communication with you;
• Billing address — for invoice generation;
• Password — stored encrypted with bcrypt (a one-way algorithm). Nobody, no NexusGrounds employee, including administrators, can see your password;
• Language preference — to display the interface in Romanian or English;
• Date and time of registration, plus versions of accepted documents (Terms and Privacy Policy) — proof of your consent, as required by Art. 7 GDPR.

2.2 When ordering astrology, numerology, or compatibility services

• Date, time, and place of birth — the only data strictly necessary for our artificial intelligence system to build your chart and generate the interpretation;
• Questions and additional notes you voluntarily provide in the order wizard;
• For compatibility, the birth data of the second person (with their consent).

This data is considered sensitive (Art. 9 GDPR — given its spiritual/philosophical dimension) and is encrypted in our database using an AES-256 algorithm. Even if someone were to gain unauthorized access to the database, the data could not be read without our key.

2.3 For services with photographs (Palm Reading, Coffee Reading)

• The photos you upload — used exclusively for drafting your reading;
• Technical metadata of the photos (size, format, timestamp) — for validation and processing.

Who can see your photos? Your photos are analysed automatically by OpenAI (processor, see section 3) to generate the reading; otherwise only the technical administration team, for platform maintenance. All operators with access have signed confidentiality agreements. Photos are stored in a private area of our servers, inaccessible to the public via direct URL — access is exclusively through secure links with limited duration (60 minutes).

How long are they retained? Your photos are automatically deleted 30 days after your reading is finalized. After this period they no longer exist physically on our servers and cannot be recovered.

2.4 At payment

• Payment is processed entirely through the chosen sub-processor — Banca Transilvania, 3-D Secure or PayPal Europe S.à r.l. (Luxembourg, EU) and or other accredited financial institutions — depending on the payment method selected;
• Your card data never reaches NexusGrounds servers. The chosen payment gateway processes it directly;
• We store only: transaction reference, amount paid, status (paid / failed / refunded), currency, and date — data strictly necessary for invoicing and tax obligations.

2.5 Data collected automatically

• Session cookie nexusgrounds-session — needed to keep you signed in;
• Security cookie XSRF-TOKEN — protects you from CSRF attacks;
• IP address and user-agent — retained for security and to audit your consents. Only if you consent to marketing cookies, we send them to Meta and TikTok together with the conversion events described in section 3.

For full details, see the Cookie Policy.

3. Whom we share your data with

Our policy is clear: we do not sell or rent your data to anyone. Your data only reaches the following categories of recipients: those needed to deliver your service and, only with your marketing consent, the advertising platforms described below.

• OpenAI, L.L.C. (USA) — processor. Generates the conversational assistant's replies and the interpretations, based on the data you provide (messages, birth data, questions and, for coffee and palm readings, the photos). The transfer to the USA relies on the European Commission's Standard Contractual Clauses (see section 9).
• Google LLC (USA), through the Gemini API — processor. Generates part of the interpretations (the V3/V4 versions of the natal chart, coffee reading and palm reading), based on your text data (no photos). The transfer to the USA relies on the Standard Contractual Clauses (see section 9).
• Internal technical team — system administrators who keep the platform functional and secure, plus occasional quality reviews of interpretations. Data access is restricted and logged.
• Banca Transilvania S.A. (Romania, EU) — card payment processor (3-D Secure). Receives your email, phone number, name, amount and transaction reference; you enter your card data directly on the bank's secure page.
• PayPal Europe S.à r.l. (Luxembourg, EU) — PayPal payment processor. Receives your email, amount, and transaction reference. PayPal is a separate controller for your payment data; see their privacy policy.
• Revolut Bank UAB (Lithuania, EU) — Revolut payment processor. Receives your email, amount, and transaction reference. Your payment data only reaches the processor of the payment method you choose; we do not store full card data (PAN, CVV).
• Meta Platforms Ireland Ltd. (Meta Conversions API) and TikTok (TikTok Events API) — only if you consent to marketing cookies. Our server (not your browser — we use no pixels) sends them conversion events: viewing a page or a service, creating an account, subscribing to the newsletter, starting a conversation that came from an ad (without its content or topic), starting an order, paying (including the confirmation received from the payment processor). An event contains: the event type, the page, value and currency, the order or service identifier, an irreversibly hashed internal account identifier, IP address, user-agent, ad click identifiers (fbclid / ttclid) and, if you have an account, your email and phone irreversibly hashed (SHA-256). We never send the content of your conversations or their topic; for ad landing pages, the address we send does not contain the topic. Without consent no event is sent; you can withdraw consent at any time from the cookie preferences.
• Hosting provider (server infrastructure) — EU data center.
• Transactional email provider (account notifications, email confirmation) — with EU servers.

If state authorities formally request, through a well-founded legal request, that we disclose certain data, we are legally obliged to comply. We always ask for the legal basis and strictly respect the scope of the request.

4. Your rights (GDPR)

The European regulation grants you a set of rights over your data. You can exercise them at any time — we strive to respond within a maximum of 30 days.

• Right of access (Art. 15) — you can see what data we hold about you. Much of it is accessible directly from your account (overview, experience history, settings); for a complete view, write to us.
• Right of rectification (Art. 16) — you can correct or update incomplete or incorrect data from the Settings section of your account.
• Right to erasure — "to be forgotten" (Art. 17) — you can delete your account at any time from Settings → Security. We immediately anonymize your name and email, decouple interpretations from your identity, and close sessions. The only data retained is financial (7 years tax obligation) — legally required.
• Right to restriction (Art. 18) — you can ask us to "freeze" the processing of certain data while we investigate a concern.
• Right to portability (Art. 20) — on request, by email to contact@nexusgrounds.com, we send you your data in a structured format within 30 days at most, to transfer it to another controller or for your personal use.
• Right to object (Art. 21) — you can unsubscribe from the newsletter at any time and withdraw the optional consent for marketing cookies from the cookies page.
• Right not to be subject to solely automated decision-making (Art. 22) — your interpretations are generated by our artificial intelligence system, based on the data you provide. These interpretations are symbolic tools for personal reflection and DO NOT constitute decisions producing legal effects on you (e.g., credit scoring, recruitment, medical decisions) or significantly affecting you in a similar manner. To exercise this right (request human review or contest), contact us at contact@nexusgrounds.com.

To exercise any of these rights, write to contact@nexusgrounds.com.

Right to lodge a complaint — if you are dissatisfied with how we process your data, you can always contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro, tel. +40 318 059 211, email anspdcp@dataprotection.ro.

5. How long we retain your data

6. How we protect your data

Security is not a detail — it is a priority. Here are, briefly, the measures we take:

• Passwords — stored with the bcrypt algorithm (12 rounds); they are one-way hashes that nobody can reverse. If you forget your password, we reset it, we do not "recover" it.
• Encryption at rest for personal data — the most sensitive information (date of birth, time, place, names introduced in orders) is encrypted in the database with AES-256, using the platform's private key. Even if someone physically extracted the database, the data would appear as unreadable random text.
• Encryption in transit — all connections with the platform are protected through HTTPS with an up-to-date TLS certificate. Your data never travels "in the clear" between your browser and our servers.
• Photos in private storage — stored on a separate volume, inaccessible through public URL. Access is exclusively through temporary links, cryptographically signed, with 60-minute expiration.
• Restricted access — only employees who need access to a specific type of data have permissions for that data. Each access is logged.
• Encrypted backups — kept in a separate EU location.

If — despite all these measures — a security breach that could affect your rights were to occur, we will notify you directly within a maximum of 72 hours, together with the competent authority (ANSPDCP), as required by Art. 33-34 GDPR.

7. Cookies

We use cookies strictly necessary for the platform to work. We do not use Google Analytics and we do not load third-party pixels or tracking scripts in your browser (Meta Pixel, TikTok Pixel). The only optional category is marketing: with your consent, our server sends Meta and TikTok the conversion events described in section 3. Full details, including how to manage your preferences, in the Cookie Policy.

8. The conversational AI assistant

The platform includes a conversational AI assistant ("Nexus") available on the homepage. When you use it, we collect: the messages you write to it, a technical visitor identifier (the nexus_chat_guest cookie, valid for 90 days) and technical data about response generation (model used, amount of text processed, cost). Messages are stored encrypted.

Legal basis: operating the current conversation relies on our legitimate interest in providing the service you request (Art. 6(1)(f) GDPR). Keeping conversations in your account (the assistant's "memory") happens exclusively on the basis of explicit consent (Art. 6(1)(a)) — the optional checkbox at account creation. Without that consent, your conversations as a logged-in user are not stored permanently.

Retention: conversations of visitors without an account are automatically deleted 30 days after the last message. Conversations attached to your account are kept until you delete them, withdraw your consent or delete your account — deleting the account permanently deletes all conversations.

The assistant's memory: if you give the separate memory consent, the assistant can keep information from your conversations (for example, context you mentioned) to use it in new conversations. You can view, correct or delete it from your account; it is kept until you withdraw your consent or delete your account.

Processor: to generate responses, the content of your messages is transmitted to OpenAI, L.L.C. (USA), acting as a processor, on the basis of the European Commission's Standard Contractual Clauses. OpenAI does not use this data to train its models, per its API policy.

The assistant is an artificial-intelligence program intended for entertainment and reflection: it does not provide medical, psychological, legal or financial advice and may generate inaccurate information.

9. International data transfers

Your data is stored on servers within the European Union. The payment processors are in the EU: Banca Transilvania S.A. (Romania), PayPal Europe S.à r.l. (Luxembourg) and Revolut Bank UAB (Lithuania).

Transfers outside the EU: to generate the assistant's replies and the interpretations, the necessary data is sent to OpenAI, L.L.C. (USA) and Google LLC (USA, Gemini API), as processors, on the basis of the Standard Contractual Clauses approved by the European Commission. The conversion events sent to Meta and TikTok with your consent may also be processed outside the EU by these recipients.

10. Changes to the Privacy Policy

If we substantially update this Policy, we notify you by email and via a visible banner in your account with at least 30 days before it takes effect. Old versions are preserved in our consent register, so that you can always see what you accepted and when.

Current version: 1.3, in force since October 15, 2026.

11. Contact

• GDPR email: contact@nexusgrounds.com
• General support: contact@nexusgrounds.com
• Supervisory authority: ANSPDCP (dataprotection.ro)

Ultima actualizare: October 15, 2026
Versiune: 1.3