PRIVACY POLICY

Last updated April 7, 2026

This Privacy Policy explains how Respontika Inc ("Respontika", "we", "us", or "our") collects and processes personal data in connection with our websites, mobile applications, and related digital services (collectively, the "Services").

Depending on your geographic location and billing arrangements, subscription payments may be processed by our affiliated reseller entity, Spiritika Limited, a company registered in Cyprus. In such cases, Spiritika Limited may act as an independent controller with respect to payment and invoicing data processed for billing and regulatory compliance purposes.

We recognize the importance of privacy and data protection and are committed to processing personal data in accordance with applicable data protection and privacy laws, including, where applicable, the General Data Protection Regulation (GDPR), the UK GDPR, and relevant United States state privacy laws. We apply a risk-based and accountability-based approach to data protection and aim to collect and process only the data that is necessary for defined and legitimate purposes connected with the operation and improvement of our Services.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described in this document, you should not use the Services.

PRIVACY POLICY CONTENTS:

• CONTROLLER IDENTITY AND CONTACT DETAILS
• SCOPE AND APPLICATION OF THIS PRIVACY POLICY
• CATEGORIES OF PERSONAL DATA WE COLLECT
• PURPOSES OF PROCESSING PERSONAL DATA
• HOW WE SHARE YOUR PERSONAL DATA
• INTERNATIONAL DATA TRANSFERS
• DATA RETENTION
• DATA SECURITY MEASURES
• USER RIGHTS AND YOUR PRIVACY CHOICES
• HOW TO EXERCISE YOUR PRIVACY RIGHTS
• IDENTITY VERIFICATION
• ACCOUNT CONTROLS AND SELF-SERVICE OPTIONS
• CHILDREN AND AGE REQUIREMENTS
• CHANGES TO THIS PRIVACY POLICY
• CONTACT INFORMATION

CONTROLLER IDENTITY AND CONTACT DETAILS

For the purposes of applicable data protection law, Respontika Inc acts as the data controller for personal data processed in connection with the Services. This means that Respontika Inc determines the purposes and means of processing your personal data described in this Privacy Policy.

Where certain technical, analytical, hosting, communication, or support functions are provided by third-party vendors, those vendors act as our data processors or independent controllers depending on their role. Where required by law, we enter into appropriate data processing agreements with such providers to ensure that personal data is processed only under documented instructions and subject to appropriate safeguards.

If you have questions about this Privacy Policy you may contact us at:

Business address: 701 Tillery Street Unit 12-1539, Austin, Texas 78702, United States

[email protected]

We may request verification information before responding to privacy requests in order to protect user data from unauthorized disclosure.

SCOPE AND APPLICATION OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data collected through your interaction with our Services across different channels and touchpoints. It covers data collected when you visit our website, use our mobile applications, create an account, complete onboarding questionnaires, purchase subscriptions, receive personalized content, contact customer support, participate in surveys, receive communications from us, or otherwise interact with our infrastructure.

The Policy applies regardless of whether you access the Services through a desktop browser, mobile browser, mobile application, or other digital interface that links to this Privacy Policy. It also applies to communications between you and us by email or through in-app support tools.

This Privacy Policy does not apply to third-party websites, platforms, or services that may be linked from within our Services. Where you follow a link to a third-party resource, their privacy practices will apply independently. We encourage you to review third-party privacy policies before submitting personal data to them.

CATEGORIES OF PERSONAL DATA WE COLLECT

We collect personal data through several channels and in several contexts. The categories of personal data we process depend on how you interact with the Services, what features you use, and what information you choose to provide. We design our data collection flows so that required information is clearly distinguished from optional information wherever feasible.

When you register for an account or otherwise interact with onboarding flows, we may collect identification and profile data such as your email address and account credentials. Credentials are stored in protected and encrypted form. We also process account configuration data, subscription status, and service settings connected to your profile.

Because the Services provide personalized astrological content and forecasts, we process certain birth-related data that you choose to provide. This may include date of birth, time of birth, and place of birth. We may also process related descriptive inputs such as gender, relationship status, and questionnaire responses. This information is used to generate individualized astrological calculations and content outputs tailored to the user. While this information is not treated as special category data under most privacy laws, we recognize that it is personal and profile-related and therefore apply enhanced care in its handling.

When you contact customer support or communicate with us, we process the content of your communications, support tickets, feedback messages, and related metadata. This helps us respond to requests, troubleshoot issues, and improve service quality.

When you make a purchase, payments are processed securely by third-party payment service providers ("PSPs") that handle payment card information on our behalf or on behalf of the applicable merchant of record. We do not collect or store full payment card numbers.

Depending on your geographic location, billing country, or transaction structure, either Respontika Inc or our affiliated reseller entity, Spiritika Limited, may act as the merchant of record for your transaction. The merchant of record is responsible for billing, invoicing, tax calculation, and financial reporting related to the transaction.

In connection with your purchase, we may receive limited transaction metadata from the PSP or merchant of record, such as truncated card numbers, card brand, issuing bank, card country, expiration date, and transaction status identifiers, which are used for accounting, fraud prevention, customer support, and compliance purposes.

In addition to data you provide directly, we collect technical and usage data automatically when you use the Services. This includes device and connection information such as IP address, device type, operating system, application version, language settings, approximate region, browser characteristics, and interaction events. We also collect log and diagnostic data such as timestamps, feature usage, navigation flows, crash reports, and performance metrics. This information helps us maintain security, ensure system stability, and understand how the Services are used in practice.

We may also process approximate location information derived from IP address and, where you explicitly allow device permissions, more precise location signals. Location processing is used for regionalization, analytics, fraud prevention, and service optimization.

We do not use your personal data to make automated decisions that produce legal or similarly significant effects about you. We use the information you choose to enter into the App or Services to generate a personalized profile and related astrological content based on your inputs. This processing is automated and rule-based, and is used only to provide personalized informational and entertainment content within the Services.

The generated content is for informational and entertainment purposes only and should not be relied upon as the basis for legal, financial, medical, or other important decisions.

PURPOSES OF PROCESSING PERSONAL DATA

We process personal data only where there is a defined and legitimate purpose connected to the operation, delivery, protection, or improvement of the Services. Different categories of personal data are processed for different purposes, and not all data is used for all purposes.

We process account and identity data in order to create and maintain user accounts, authenticate users, enable secure login, and provide account-based features. Without this processing, account-based services cannot function properly.

We process birth data, questionnaire responses, and profile inputs in order to generate personalized astrological charts, interpretations, forecasts, and related content outputs. This processing is necessary to deliver the core functionality of the product and to tailor the experience to each individual user.

We process technical, device, and usage data to operate, maintain, secure, and optimize the Services. This includes monitoring performance, detecting errors, preventing abuse, investigating incidents, and improving product design and usability. Usage analytics also helps us understand which features are valuable and which require improvement.

We process communication data to respond to user inquiries, provide customer support, handle complaints, and communicate service-related information. This may include messages about account status, subscription status, technical issues, policy updates, and security notices.

We process payment-related metadata to verify transactions, maintain financial records, prevent fraud, handle refunds and disputes, and comply with accounting and legal obligations. Full payment credentials are processed by specialized payment processors rather than by us directly.

Where permitted by law, we process contact data and interaction data for marketing and promotional communications. This includes sending newsletters, feature updates, educational content, and promotional offers. Marketing communications are sent in accordance with applicable consent and opt-out requirements.

We may also process personal data where necessary to comply with legal obligations, respond to lawful requests from authorities, enforce our legal rights, resolve disputes, and prevent misuse of the Services.

Legal bases for processing (EEA and UK users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data only where we have a valid legal basis under applicable law.

Where processing is necessary to provide the Services you requested, including account creation, personalized astrological outputs, and subscription features, the legal basis is performance of a contract or steps taken at your request prior to entering into a contract. Without this processing, we cannot deliver the requested functionality.

Where you have actively agreed to specific processing activities, such as receiving marketing communications or allowing non-essential tracking technologies, the legal basis is consent. You may withdraw consent at any time, and withdrawal does not affect processing already carried out before withdrawal.

Certain processing activities are based on our legitimate interests in operating and improving the Services, provided those interests are not overridden by your rights and freedoms. This includes service security, fraud prevention, internal analytics, product improvement, and system diagnostics. When relying on legitimate interests, we apply balancing tests and data minimization measures.

We may also process personal data where necessary to comply with legal obligations, such as financial recordkeeping, regulatory compliance, and lawful disclosure requirements.

Marketing communications and consent model

We may send users communications relating to the Services, including both service messages and, where permitted, marketing messages. Service communications include transactional and operational messages such as account confirmations, subscription notices, security alerts, and policy updates. These communications are considered necessary for service delivery and are not dependent on marketing consent.

Marketing communications may include newsletters, product updates, educational materials, and promotional offers. The legal basis and delivery model for marketing communications depend on the user's jurisdiction.

For users in jurisdictions that require prior consent for electronic marketing, including the European Union and the United Kingdom, we send marketing messages only where we have obtained appropriate consent or where another lawful basis specifically permitted by law applies. Consent mechanisms are designed to be separate from acceptance of general service terms.

For users in jurisdictions that allow opt-out marketing models, including parts of the United States, we may send marketing messages where permitted by law, provided that every message includes a clear and effective unsubscribe mechanism. Users may opt out at any time, and opt-out requests are honored promptly.

We maintain suppression lists to ensure that users who unsubscribe from marketing communications are not contacted again for marketing purposes, except where they later opt back in.

Targeted advertising and sharing of personal information

We may use advertising, analytics, and attribution technologies, including pixels and similar tools provided by third-party partners (such as Meta/Facebook, Snap, Axon, and similar advertising platforms), to measure performance, optimize marketing campaigns, and understand user interactions with our Services.

Through these technologies, we may disclose certain categories of personal data to advertising partners, including:

• Identifiers (such as online identifiers, device identifiers, cookie IDs, and IP address);
• Internet or electronic network activity information (such as interaction events and usage data);
• Approximate geolocation data.

These disclosures may constitute "sharing" of personal information for cross-context behavioral advertising under California law and may be considered "targeted advertising" under the laws of Colorado, Virginia, and other U.S. states.

We do not sell personal information in exchange for monetary compensation. However, as described above, we may share certain personal data with advertising partners for marketing and advertising optimization purposes.

You may opt out of targeted advertising or sharing of personal information by using the Your Privacy Rights Request Form available on our website, adjusting your cookie preferences, enabling Global Privacy Control (GPC) where supported, or through applicable device-level advertising settings.

Scope and categories of personal data / CCPA Categories

Sensitive personal information (California disclosure)

Under California law, certain information may be considered "Sensitive Personal Information." We may collect precise geolocation data when you enable location permissions on your device. We may also collect imprecise location data based on your IP address.

Precise geolocation data is used only to provide and improve the Services, maintain security, prevent fraud, and for related operational purposes described in this Privacy Policy.

We do not sell or share Sensitive Personal Information for cross-context behavioral advertising.

You may control the collection of precise geolocation data at any time through your device settings.

Use of Cookies and Similar Technologies

We use cookies and similar technologies on our website and, where applicable, tracking technologies and SDKs in our mobile applications to support core functionality, analytics, performance measurement, and marketing activities. These technologies may be provided by us or by third-party partners.

Detailed information about the types of cookies and tracking technologies we use, their purposes, retention periods, and available user controls is provided in our separate Cookie Policy. Where required by applicable law, non-essential cookies and similar technologies are used only with your consent.

You can manage your cookie preferences through our consent tools and your browser settings. Device-level permissions and operating system settings may also allow you to control certain mobile tracking technologies.

HOW WE SHARE YOUR PERSONAL DATA

We do not authorize third parties to use your personal data for their own independent purposes except as described in this Privacy Policy.

We do not sell your personal data. We share personal data with third parties only where this is necessary and proportionate for defined purposes and subject to appropriate safeguards.

Personal data may be shared with third parties only in the following cases:

• where it is necessary to provide and operate the Services;
• where it is necessary for our legitimate business interests, such as security, fraud prevention, analytics, and service improvement;
• where it is necessary to comply with legal obligations or lawful requests of authorities;
• where it is necessary to establish, exercise, or defend legal claims;
• where you have given consent for specific sharing activities;
• with affiliated entities, including Spiritika Limited, where necessary to process subscription payments, billing operations, tax compliance, and related financial reporting;
• in connection with a merger, acquisition, corporate reorganization, sale of assets, financing, or similar transaction, including during due diligence processes, provided that appropriate safeguards are applied in accordance with applicable data protection laws.

Where Spiritika Limited processes payment and billing data as merchant of record, it does so as an independent controller for those financial processing purposes.

Because we rely on specialized infrastructure, analytics, communication, support, and payment providers to operate the Services, certain personal data is processed by third-party service providers acting on our behalf under contractual data processing agreements. These providers are not permitted to use personal data for their own unrelated purposes.

Where our service providers are located in other countries, personal data may be transferred internationally subject to appropriate legal safeguards, including data processing agreements and approved transfer mechanisms where required by applicable data protection laws. We implement reasonable technical and organizational security measures designed to protect personal data during transfer and processing.

The categories of third parties with whom we may share personal data include service providers in the areas of cloud infrastructure, analytics, customer support, communications delivery, marketing measurement, and payment processing.

Details of the main third-party providers we use are listed below.

INTERNATIONAL DATA TRANSFERS

Because Respontika Inc is incorporated in United States and we use international infrastructure and service providers, personal data may be transferred to and processed in countries other than the country in which you are located, including United States and other jurisdictions where our service providers operate.

Where personal data originates from the European Economic Area or the United Kingdom and is transferred to a country that has not been recognized as providing an adequate level of data protection, we implement appropriate safeguards as required under applicable data protection laws. These safeguards may include Standard Contractual Clauses approved by the European Commission or the UK authorities, together with supplementary contractual, organizational, and technical measures where appropriate.

Where Spiritika Limited processes billing and invoicing data in its capacity as merchant of record, such processing takes place within the European Union regulatory framework.

We assess cross-border transfer risks and apply a combination of contractual, organizational, and technical protections designed to safeguard personal data during international processing. You may contact us for additional information about the transfer safeguards applicable to your data.

DATA RETENTION

We retain personal data only for as long as it is reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods vary depending on the type of data and the context in which it was collected.

Account and profile data are generally retained while your account remains active. If you create an account but do not complete a purchase or activation flow, your data is typically retained for approximately 30 days and then deleted or anonymized. For active subscribers, personal data is retained for the duration of the subscription and until the account is deleted by the user, subject to applicable legal retention obligations.

Subscription and transaction records are retained for accounting, tax, and financial reporting obligations for the period required by applicable law. Support communications are retained for a limited period to ensure continuity of service and proper handling of complaints and disputes.

Technical logs and security records are retained for limited operational and security monitoring periods. Analytics data is typically retained in aggregated or pseudonymized form according to provider retention settings and contractual arrangements.

When retention periods expire, we delete, anonymize, or irreversibly de-identify personal data where reasonably feasible. Some data may remain in secure backup systems for limited periods until overwritten in the normal backup cycle.

DATA SECURITY MEASURES

We implement technical and organizational security measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. These measures are designed based on risk level, data sensitivity, and processing context.

Security controls include encrypted transmission channels, encryption of sensitive data at rest where appropriate, access controls based on role and necessity, authentication safeguards, infrastructure firewalls, monitoring systems, and incident detection mechanisms. Access to personal data is limited to authorized personnel and contractors who require access for legitimate operational purposes and who are subject to confidentiality obligations.

We also rely on reputable infrastructure and service providers that maintain their own security certifications and compliance programs. While we take reasonable steps to protect personal data, no method of transmission or storage is completely secure, and absolute security cannot be guaranteed.

In the event of a data security incident affecting personal data, we will act in accordance with applicable breach notification laws.

USER RIGHTS AND YOUR PRIVACY CHOICES

Depending on your location and applicable law, you may have certain rights and choices regarding your personal data. These rights are subject to legal limitations and may not apply in all circumstances.

Privacy Rights (EEA, UK and similar jurisdictions)

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, your rights may include:

• the right to access personal data we hold about you and obtain a copy of it;
• the right to request correction of inaccurate or incomplete data;
• the right to request deletion of personal data where there is no valid legal basis for continued processing;
• the right to request restriction of processing in certain circumstances;
• the right to receive personal data in a portable format where processing is based on consent or contract and carried out by automated means;
• the right to object to processing based on our legitimate interests;
• the right to object at any time to processing for direct marketing purposes;
• the right to withdraw consent at any time where processing is based on consent (without affecting prior lawful processing);
• the right not to be subject to decisions based solely on automated processing producing legal or similarly significant effects, where applicable.

You also have the right to lodge a complaint with your local data protection authority if you believe that your personal data has been processed in violation of applicable data protection laws. We encourage you to contact us first so that we may address your concerns directly.

Additional Rights for U.S. Residents

For users located in the United States, and depending on your state of residence, your rights may include:

• the right to know what categories of personal data we collect and use;
• the right to access personal data about you;
• the right to request deletion of personal data;
• the right to correct certain inaccuracies;
• the right to opt out of targeted advertising, certain data sharing, or profiling with significant effects, where applicable.

We will not discriminate against users for exercising their privacy rights.

Your Privacy Choices and Controls

You may exercise your rights and manage your data through the following controls:

• Account information. You may update or correct your profile information through your account settings where available, or by contacting us.
• Access and portability. You may request access to your personal data and, where applicable, receive it in a portable, machine-readable format.
• Deletion. You may request deletion of your personal data. In some cases, we may retain certain data where required for legal compliance, security, fraud prevention, dispute resolution, or enforcement of legal rights.
• List of third-party recipients. In certain jurisdictions, you may request information about third parties to whom we disclose personal data. Details about advertising and analytics partners using cookies or similar technologies are available through our Cookie Settings tool. Categories of recipients are also described in the "How We Share Data" section of this Privacy Policy.
• Targeted advertising — website. You may opt out of website-based targeted advertising by using our cookie or tracking preference tools.
• Targeted advertising — mobile apps. You may opt out of app-based targeted advertising through your mobile device privacy or advertising settings.
• Geolocation data. You can disable location access for mobile apps through your device settings.
• Marketing emails. You may unsubscribe from promotional emails at any time using the unsubscribe link in the message. We may still send service-related communications.
• Promotional text messages. You may opt out of promotional SMS messages by replying "STOP."
• Consent-based processing. Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect prior lawful processing and may affect availability of certain features.
• Objection or restriction. Where permitted by law, you may object to certain processing or request restriction of processing.

If we decline to take action on your request, you may appeal our decision by contacting us using the contact details provided in this Privacy Policy. We will review your appeal in accordance with applicable law and inform you of the outcome within the required timeframe. If your appeal is denied, you may have the right to contact relevant authority.

Not all the rights above are absolute, and they do not apply in all circumstances. We may limit or deny a request because the law permits or requires us to. We will not discriminate against individuals who exercise a privacy right.

HOW TO EXERCISE YOUR PRIVACY RIGHTS

You may exercise applicable privacy rights by contacting us using the contact details provided in this Privacy Policy or by submitting a request through our Your Privacy Rights Request Form available within the Services or on our website. Requests may include access to personal data, correction of inaccurate data, deletion requests, restriction requests, objection to certain processing, portability requests where available, and marketing opt-out requests. If the form does not include an option that matches your request, you may contact us directly by email at [email protected].

Requests should describe your request with sufficient detail to allow us to properly understand, evaluate, and respond. We may use a request form or other structured intake process to ensure accurate handling. Submitting a request does not automatically guarantee fulfillment, as certain legal exceptions and retention obligations may apply.

We respond to privacy requests within the timeframes required by applicable law. Where permitted, we may extend the response period when requests are complex or numerous, and we will notify you if an extension is needed.

There is generally no fee for submitting a privacy rights request. However, where requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline the request where permitted by law.

IDENTITY VERIFICATION

To protect users against unauthorized data disclosure or deletion, we may need to verify the identity of the person submitting a privacy request. Verification may involve confirming control of the email address associated with the account, requesting confirmation through the account interface, or asking for additional information and documentation necessary for verification.

We will request only the minimum information necessary for verification and will use it solely for that purpose. If identity cannot be reasonably verified, we may be unable to fulfill certain requests, particularly access or deletion requests involving sensitive account data.

Where requests are submitted through authorized representatives, we may require proof of authorization and separate identity verification of the user.

ACCOUNT CONTROLS AND SELF-SERVICE OPTIONS

Where available, users may review, update, or delete certain personal data directly through their account settings. Account interfaces may allow profile updates, preference changes, and account deletion requests. Using self-service controls helps ensure faster and more accurate updates.

If you request account deletion, we will deactivate or delete your account data from active systems within a reasonable period, subject to retention obligations and technical backup cycles. Some data may be retained where necessary for fraud prevention, legal compliance, dispute resolution, or enforcement of legal rights.

CHILDREN AND AGE REQUIREMENTS

The Services are intended for use only by individuals who are considered adults under the laws of their country of residence. We do not knowingly collect personal data from individuals who are not legally recognized as adults in their jurisdiction.

By using the Services, you represent that you meet the age of majority requirement applicable to you or that you are a parent or legal guardian providing consent where such use is legally permitted. If we become aware that personal data has been collected from a person who does not meet the applicable age requirement without valid authorization, we will take reasonable steps to delete such data.

If you believe that a minor may have provided personal data to us, please contact us so that we can investigate and take appropriate action.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in legal requirements, technology, business practices, or service features. When we make changes, we will update the "Last updated" date at the top of this Policy.

If we make material changes that affect how we collect, use, or disclose personal data, we will provide additional notice through the Services, by email where appropriate, or by other prominent means before the changes take effect. Where required by applicable law, we will obtain your consent for material changes that affect previously collected personal data.

We encourage users to review this Privacy Policy periodically to remain informed about how personal data is processed.

CONTACT INFORMATION

If you have questions about this Privacy Policy, our data practices, or your privacy rights, you may contact us at:

Business address: 701 Tillery Street Unit 12-1539, Austin, Texas 78702, United States

[email protected]

To exercise your privacy rights, you may submit a request by completing our Your Privacy Rights Request Form available on our website or within the Services.

If you require this Privacy Policy in an alternative format due to a disability, please contact us at [email protected], and we will make reasonable efforts to provide it in an accessible format.