Privacy Policy

Flowind LLC ("Company") recognizes the importance of protecting users' personal information and is committed to handling it appropriately in accordance with applicable laws, including the Act on the Protection of Personal Information (Japan). The Company takes reasonable organizational and technical measures to protect your personal data from unauthorized access, loss, or misuse. This Privacy Policy describes how we collect, use, share, and protect your information when you use the FATE DECODER service ("Service").

1. Information We Collect

We collect the following categories of information:

• Account information: Email address and password (hashed)
• Birth data: Name, date of birth, time of birth, gender, notes, and related profile information entered for chart calculation or AI readings
• Usage data: AI reading messages, generated responses, compatibility results, credit transaction history, subscription status, feature usage logs, authentication logs, and support communications
• Payment information: Payment processing is handled by Stripe, Inc. The Company does not store credit card numbers or bank account details.

2. Purpose of Use

• Providing and operating the Service
• Processing payments and managing credit balances
• Generating chart calculations and AI-assisted interpretations
• Saving AI reading history and providing memory/search features within the Service
• Responding to inquiries and providing customer support
• Improving and developing new features
• Preventing unauthorized use and ensuring security

3. Third-Party Services

We use the following third-party services:

• Google LLC (Firebase Authentication / Identity Platform) — User authentication and account identity management (email/password, Google OAuth sign-in, and TOTP multi-factor authentication)
• Google LLC (Google Analytics) — Aggregated website traffic and usage analytics (visitor counts, page views, referral sources, and device/region information), used to understand and improve the Service
• Stripe, Inc. — Payment processing, customer management, and fraud prevention
• Anthropic (Claude API) — AI-powered chart interpretation and conversation generation
• DeepSeek — AI-powered chart interpretation and conversation generation
• OpenAI — Text embedding for session memory search and related processing
• Cloudflare, Inc. — CDN, DDoS protection, and SSL
• Hetzner Online GmbH — Application and database hosting

Information entered by users, including birth data, profile information, AI reading messages, and related context, may be transmitted to LLM providers to provide AI responses. Each third-party service processes data in accordance with its own privacy policy, data processing terms, and retention rules. The Company does not intentionally transmit such data for purposes unrelated to providing, securing, or improving the Service unless permitted by law or separately agreed by the user.

The Company accesses LLM providers through their API services. Under the API terms of service of each provider as of the effective date of this policy, data submitted via API is generally not used to train their models. However, each provider's data handling practices are subject to its own privacy policy and terms, which the Company does not control. For the latest information, please refer to each provider's published policies.

Because some providers are located outside Japan, user information may be transferred to countries or regions with personal data protection systems different from Japan. We select providers with published privacy and security policies and use them only to the extent necessary for the Service.

4. Data Storage and Security

The Company takes the following measures to protect your personal data:

1. Data is stored on servers operated by Hetzner Online GmbH. Server locations may change as the Service evolves.
2. All communications between users and the Service are encrypted via HTTPS/TLS. Passwords are hashed using industry-standard algorithms and are not stored in plain text.
3. Access to personal data is restricted to authorized personnel and systems on a need-to-know basis. Administrative access requires authentication and is logged.
4. We collect and retain only the minimum information necessary for the purposes described in this policy.
5. Third-party service providers are selected based on their published security and privacy practices, and data is shared with them only to the extent necessary for the Service.
6. While we take reasonable measures to protect your data, no system is completely secure. We cannot guarantee absolute security.

5. Data Retention

We retain personal data for as long as the account is active or as needed to provide the Service, comply with laws, resolve disputes, prevent fraud, and maintain accounting or payment records. Upon account deletion, we will delete or anonymize personal data within 30 days where technically and legally practicable, except where retention is required by law, payment records, security logs, backup retention, or dispute handling.

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Request suspension of use or third-party provision where permitted by applicable law
• Withdraw consent for data processing at any time

To exercise these rights, please contact us at the email address listed on our Legal Notice page.

7. Cookies

The Service uses essential cookies for authentication (session tokens). We also use Google Analytics, which sets cookies to measure aggregated website usage such as visits and page views. These analytics cookies do not identify you personally and are used only to understand and improve the Service. We do not use third-party advertising cookies. For visitors in the EU/EEA, the UK, and Switzerland, analytics cookies are disabled by default and are used only after you give consent via the cookie banner (Google Consent Mode); you can change your choice by clearing this site's cookies. You can also disable cookies in your browser settings or opt out of Google Analytics using Google's browser add-on.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Service after changes constitutes acceptance.