Privacy Policy

1. At a glance

• The free result and today's flow are calculated on your device. Your birth details are not sent to our servers for them.
• We store birth details on our servers only for profiles you save after signing in and for paid readings.
• We use no advertising cookies. We use Google Analytics cookies for visit statistics, and you can refuse them.
• Apart from sign-in emails, we send no marketing email or newsletters.
• Deleting your account deletes your birth profiles and reports.

2. Information we process

• Account: email address, sign-in method identifier (magic link or Google), screen language, the time you confirmed you are 18 or older
• Birth profiles: a label ("me", "mum"…), whether it is your own profile, date and time of birth (solar or lunar, leap month), birth city, sex choice, love-reading perspective, calculation settings, and for other people's profiles the time consent was recorded
• Purchases: product, amount, currency, status, Lemon Squeezy order number. We never receive card numbers.
• Reports: the AI-written text, the calculated facts it was written from, model and prompt version, token usage
• AI writing records: the full requests sent to the AI (the calculated saju facts) and the answers it returned while writing a report. Used only by the operator to check quality and cost, and deleted after 30 days.
• Compatibility invites: birth details the invited person enters themselves. The person who invited them sees only the compatibility result, never the birth date or chart letters.
• A partner you enter yourself: birth details you enter when buying flow compatibility, after confirming your partner agreed. Saved to your account as a partner profile with the time of consent, and used to write the reading.
• Support: emails you send to help@sajuwave.com (the sending address and the content) and the operator's replies
• Technical: server logs (request ID, path, response status, timing), error reports, aggregated visit statistics. Server logs and error reports do not contain birth details, email addresses or report text.
• The automated-request check when you ask for a sign-in email (Cloudflare Turnstile): browser and device information, IP address. We receive only the check's result and do not store it.
• Visit statistics (Google Analytics): a cookie identifier, the pages you visit (with identifying values removed from the address), events (for example viewing a free result or tapping share), how you arrived, device and browser information, approximate location. See "Cookies and similar technologies" below.
• To decide whether cookie consent is required where you are, we use the country of the request. The country is not stored.

3. Information kept only on your device

The free result's input, the events you add in "Check against your past", and your theme choice stay in your browser's storage (localStorage, sessionStorage). We never receive them. Clearing the site's data in your browser removes them. One exception: if you tick the box to send your events when buying a Lifetime Reading, only each event's kind and year are stored with that purchase and sent to the AI that writes the reading. Deleting your account deletes them.

When you go to sign in, this tab's input is kept in your browser's storage (localStorage) for 15 minutes so the tab the sign-in link opens can carry on. It is removed once that tab takes it, or after 15 minutes.

Your choice in the cookie settings (accept or refuse) is kept in your browser's storage (localStorage). It is not a cookie and is not sent to us.

4. Purposes and legal bases

• Accounts, birth profiles, today's and this month's flow from your own profile, writing and delivering reports, confirming payments, answering support emails: performance of our contract with you (GDPR Art. 6(1)(b))
• Other people's profiles and an invited person's birth details: consent (GDPR Art. 6(1)(a))
• Security, abuse prevention (the automated-request check), error tracking, aggregated statistics: our legitimate interest in running the service safely (GDPR Art. 6(1)(f))
• Google Analytics visit statistics: our legitimate interest in improving the service (GDPR Art. 6(1)(f)); for visitors in the EEA, the UK and Switzerland, consent (GDPR Art. 6(1)(a))
• Keeping payment records: legal obligation under tax law (GDPR Art. 6(1)(c))
• Users in Korea: Personal Information Protection Act Art. 15(1)4 (contract) and 15(1)1 (consent); security and visit statistics under Art. 15(1)6 (the operator's legitimate interest) [needs review]

5. Processors and international transfers

We use the companies below. Some are outside your country (and outside Korea), so your information is transferred abroad. Transfers happen over encrypted connections when you use the service; retention follows "How long we keep it".

• Supabase Inc. (US company): database and sign-in. Data is stored in the Tokyo region, Japan. Transferred: account, birth profiles, purchases, reports.
• Vercel Inc. (US): hosting, server functions, visit statistics, AI request routing (AI Gateway). Location: US and other Vercel regions [server functions to be pinned to Tokyo (hnd1), next to the database]. Transferred: request contents, technical information.
• Lemon Squeezy (US, part of Stripe): payment, receipts, tax and refunds as Merchant of Record. Transferred: email, payment details, purchase history. Lemon Squeezy's own privacy policy also applies.
• AI model provider (Anthropic PBC, US, reached through Vercel AI Gateway): writing report text. Transferred: chart facts calculated from the birth details (chart letters, elements, yearly scores), screen language, and whether the profile's owner is a minor. Never names, emails or free text. Requests ask for zero data retention and no training on the data.
• Resend Inc. (US): sign-in emails. Transferred: email address.
• Google LLC (US): visit statistics (Google Analytics) and the operator's support mailbox (Gmail). Transferred: the visit statistics above, support emails. Set up so that nothing is used for advertising or ad personalisation.
• Cloudflare, Inc. (US): the domain's DNS, forwarding mail sent to help@sajuwave.com to the operator's mailbox (Email Routing), and the automated-request check on sign-in email requests (Turnstile). Transferred: support emails; browser, device information and IP address during the check.
• Functional Software Inc. (Sentry, US): error tracking. Transferred: error details, browser and device information. Request bodies, cookies, email and IP addresses are removed before sending.

6. If you do not want your information transferred

You can use only the free result without an account or purchase. It is calculated on your device, so no birth details are transferred. You can also refuse visit statistics in "Cookie settings". Paid readings, accounts and compatibility invites cannot be provided without the transfers above.

7. How long we keep it

• Account, birth profiles, reports: until you delete your account. [Needs review] Accounts with no sign-in for 3 years are deleted after 30 days' notice.
• Payment records: for the period tax law requires [to be confirmed with our tax adviser; 5 years expected under Australian rules]. These remain after account deletion for that period.
• Server logs: the hosting provider's retention period [to be confirmed]
• Error reports: the retention period of our Sentry plan [to be confirmed]
• AI writing records: 30 days from writing. Deleted at once if you delete your account.
• AI model provider: not retained after the request (zero data retention)
• Visit statistics (Vercel): only aggregated values that do not identify anyone
• Visit statistics (Google Analytics): the cookies expire after 13 months. Google's records are deleted after [to be set · 14 months expected].
• Support emails: kept for [needs review · 3 years expected, as a dispute-handling record] after the matter is closed, then deleted.

8. Your rights and deletion

• You can delete your account yourself in account settings. Birth profiles and reports are deleted at once; copies in backups expire when the backup does.
• You can ask for access, correction, deletion, restriction, objection or a copy of your data (portability) at help@sajuwave.com. We respond within 30 days.
• You can withdraw consent; we then delete the profile concerned.
• You can complain to a data protection authority: Korea's Personal Information Protection Commission, Australia's OAIC, or the authority in your EU or UK country.

9. Cookies and similar technologies

Necessary cookies: the cookie that keeps you signed in. If you block it, you cannot sign in.

Visit statistics cookies: Google Analytics' _ga and _ga_<ID>. They tell a returning visit from a new one and count which pages and features are used, nothing else. They expire after 13 months. Advertising, ad personalisation and Google signals are off, and the cookies are never linked to your account.

What Google never receives: birth details, chart letters, email addresses, or identifying values in addresses, such as invite links and order numbers. Page addresses are sent with these values removed, and of the values after an address only the campaign tags (those starting utm_) are kept. The previous page's address is cut to the site's name (for example naver.com).

How to refuse: choose "Refuse" in "Cookie settings" at the bottom of the site. Visit statistics then stop and the _ga cookies are deleted. You can also block cookies in your browser. The service works the same either way. In the EEA, the UK and Switzerland these cookies are not used until you agree.

Vercel Web Analytics counts page views without cookies. Visitors are told apart by a hash of the request that is discarded after 24 hours. It still counts visits that refused cookies.

10. Children

The service is not directed at people under 18, who cannot create an account or buy. A parent or guardian may create a birth profile for their child; we do not collect the child's contact details.

11. Security

• All traffic is encrypted with HTTPS.
• Row-level security in the database lets each user read only their own data.
• Secret keys are kept only in server environment variables, accessible to the operator alone.
• The operator may open a written reading and its birth details only to check its quality and rewrite it. Every opening is logged.

12. Privacy contact

Privacy officer: the operator of Saju Wave, contact: help@sajuwave.com

Send questions, requests about your data and complaints to the contact above.

13. Changes to this policy

We post changes on the site 7 days before they take effect (30 days for significant changes).

This policy takes effect on 15 November 2026.