Privacy Policy

Natalore — personal birth chart reading

---

In brief — the six things that matter most

1. We ask for very little. For the Reading we process a first name and birth data (the date; the time and place only if you give them); for the order, an e-mail address. If you wish, you can choose topics for the Reading and ask one question of your own (section 3.6). You enter your billing name and address on Stripe's payment page; Stripe passes them to us for the invoice. We create no user account: you order as a guest.
2. The text of the Reading is generated by our software system, which uses artificial intelligence. The birth chart comes from our own astronomical calculation; from it, the text is written by a large language model provided by Anthropic PBC as our processor. See Chapter 5.
3. The data needed for the Reading leaves the European Union. We transfer the first name, the birth data, the computed chart and — if you gave them — the topics you chose and your own question to the servers of Anthropic PBC (United States of America), on the basis of the standard contractual clauses (SCC) adopted by the European Commission. Your e-mail address, billing data and payment data are not sent there. See Chapter 8.
4. For a two-person reading we process only the other person's first name and birth data. We never send them anything, and we use their details for nothing else. See Chapter 4.
5. We never see your bank card details. Payment takes place on Stripe's own interface; card data never reaches our servers.
6. No advertising or marketing tracking code runs on the site without your consent, and we do not sell your data. If you accept advertising measurement on the consent bar, Meta's advertising measurement code (the Meta pixel) is loaded, and — if you arrived by clicking an advertisement — the campaign parameters and the advertising click identifier of your visit are stored together with your order, linked to it. Without that consent neither happens — see rows 11 and 15 of Chapter 3, section 3.5 and Chapter 14.

This notice is available in Hungarian, English and Spanish. If the language versions differ from one another, the interpretation more favourable to you prevails.

---

1. Introduction — who and what this notice covers

This notice has been drawn up under Article 13 — and, as regards the Second Person of a two-person reading, Article 14 — of Regulation (EU) 2016/679 of the European Parliament and of the Council (the GDPR) and under Act CXII of 2011 on Informational Self-Determination and Freedom of Information (the Hungarian data protection act, the Infotv.).

Who it covers. Anyone who

• visits the website https://natalore.com (the User),
• uses the free preview,
• orders and receives the personal birth chart reading (the Reading) (the Consumer),
• is the other person of a two-person reading, whose first name and birth data were given by the person ordering (the Second Person),
• sends us a customer service enquiry or a withdrawal or termination statement.

The words we use.

What this notice does not contain. Cookies and the data stored in your browser are covered by a separate, detailed notice (see Chapter 14); the contractual terms are set out in the Terms of Service.

Availability and form. This notice is available on the website free of charge; you may read, print and save it at any time (Article 12(1) and (5) GDPR).

---

2. The controller and its contact details

2.1 Data protection officer

We have not designated a data protection officer. None of the cases listed in Article 37(1) GDPR applies: we are not a public authority, our core activities do not require regular and systematic monitoring of data subjects on a large scale, and our core activities do not consist of processing data referred to in Articles 9–10 GDPR on a large scale.

You may address any data protection question or request directly to us at support@natalore.com, or by post to 2100 Gödöllő, Szabó Pál utca 32., Hungary.

---

3. Purposes of processing, data processed, legal bases, retention and recipients

This chapter is the backbone of the notice. Each row describes one distinct purpose of processing.

The hosting provider and server operator is a recipient in every row. All of the processing above takes place on our servers, and the hosting provider and server operator named in row 6 of Chapter 7 is therefore, as a processor, a recipient in every processing operation. The "Recipients" column of the table lists only the further recipients specific to each purpose.

3.1 About the processing based on legitimate interests (Article 13(1)(d) GDPR)

For rows 2, 9, 10, 12, 13, 14 and 16 — and, as regards statements that cannot be linked to any order and the use of the reason given with a guarantee claim to improve the service, row 7 — our legal basis is legitimate interest. The legitimate interest is named in the table. For each such processing operation we carry out a balancing test; we will send you a summary of it on request at support@natalore.com. You have the right to object to these processing operations (Chapter 10).

3.2 Are you obliged to provide the data? (Article 13(2)(e) GDPR)

Providing the data is not a statutory requirement; it is a requirement necessary to enter into and to perform the contract — with the exception of the billing data, which is required by law (Section 169 of the VAT Act, implementing Article 226 of Directive 2006/112/EC).

3.3 What we expressly do NOT do

• We do not sell or rent your personal data.
• No advertising or social media measurement code runs on the site without your consent. The only such code is Meta's pixel, loaded only after you accept it (section 3.5); there is no Google Ads, TikTok or LinkedIn code, and we use no Google Analytics / Tag Manager, Hotjar or Clarity type solution at all.
• We do not store the browser identifier (user agent). Our own audience measurement uses it, while processing the request, only to calculate the daily visitor identifier and the type of device (Chapter 3 row 14).
• Our outgoing e-mails contain no tracking pixel and no click tracking.
• The visitor's browser loads no external fonts (we serve the typefaces from our own server).
• We ourselves build no advertising profile. Without your consent no behavioural targeting takes place in connection with our website; if you accept advertising measurement, Meta may use the events it receives from our website to deliver advertisements — ours among them — under its own policy (section 3.5).
• We never send anything to the Second Person of a two-person reading, and we use their details for nothing other than producing the Reading that was ordered.

3.4 Processing for a further purpose (Article 13(3) GDPR)

We will process your personal data for a purpose other than those set out above only if we inform you of that purpose beforehand and — where required — ask for your separate consent. In particular: we do not use your birth data, the Second Person's data or your Reading to display testimonials, in case studies or marketing materials, nor to train an artificial intelligence model.

3.5 Advertising measurement with Meta and campaign attribution — only with your consent

The question. Until you decide, a consent bar on the website asks whether you allow advertising measurement. It has two buttons of equal weight, "Reject" and "Accept"; nothing is pre-ticked, and refusing carries no disadvantage. Your answer covers two processing operations: Meta's advertising measurement (row 15 of Chapter 3) and campaign attribution (row 11). Without "Accept" neither takes place: Meta's code is not loaded, and the campaign data of your visit are not stored. The full description — the cookies, the events and the pages on which the code sends nothing — is in section 4.1 and Chapter 8 of the Cookie and Storage Notice.

Joint controllership with Meta (Article 26 GDPR). For the collection of the data listed in row 15 on our website by means of Meta's code, and for their transmission to Meta, we and Meta Platforms Ireland Ltd. (Dublin, Ireland) jointly determine the purposes and means of the processing, and are therefore joint controllers (judgment of the Court of Justice of the European Union in case C-40/17, Fashion ID). Our arrangement is Meta's Controller Addendum, which forms part of Meta's business terms. In essence: we are responsible for informing you (this notice and the Cookie and Storage Notice) and for ensuring that Meta's code is loaded only after your consent; Meta is responsible for its own processing of the data it receives, and for enabling you to exercise your rights in respect of the data Meta stores. After the transmission Meta processes the data as an independent controller, for its own purposes as well (for example to deliver and improve advertising), under its own privacy policy; for that processing Meta alone is responsible. You may exercise your rights in respect of the joint processing against us or against Meta; we forward to Meta any request that concerns it.

Campaign attribution. If you have accepted advertising measurement, the campaign parameters, the advertising click identifiers and the referring page of the first page of your visit are stored in your browser's session storage and sent to our server with your order, where we keep them with the order (row 11). The click identifier is a pseudonymous identifier that can be linked to your particular advertisement click, and with the order it is attached to an identified person — that is why we do it only with your consent. We do not send the data stored with the order on to Meta, Google, Microsoft or TikTok, we build no advertising profile from them, and we do not use them in producing the Reading; they are not written to the operational log. (If Meta's code runs on the page you arrived on, Meta itself receives that page's address together with the parameters in it — Cookie and Storage Notice, section 4.1.)

Withdrawing consent. You may withdraw your consent at any time with the Cookie settings button in the footer. Meta's code then stops (the page reloads if it had been loaded), and the campaign data stored in your browser and Meta's two cookies on our domain (_fbp, _fbc) are deleted at once. Withdrawal does not reach the data already sent to Meta or already stored with an order: Meta keeps the former under its own policy; the latter we erase from your order if you tell us at support@natalore.com that you have withdrawn your consent. Withdrawal does not affect the lawfulness of processing before it (Article 7(3) GDPR).

3.6 The topics chosen and your own question

What this is. When ordering you may — if you wish — choose up to five topics that the Reading gives more weight to (love, work and calling, family, self-knowledge, life direction), and ask one question of your own of up to 300 characters, which the Reading answers in a separate section. Neither is required (section 3.2).

What we use them for. Solely for writing your Reading (Chapter 3 row 1; legal basis: Article 6(1)(b) GDPR). We store the topics and the question with the order and, to write the Reading, transmit them — together with the birth data — to the provider of the language model, Anthropic PBC (sections 5.3 and 8.1). We do not use them for any other purpose — not for marketing, profiling or model training. Our cookieless audience measurement records only the codes of the topics chosen and, of the question, only whether one was given; never its text (Chapter 3 row 14). Neither reaches Meta.

Retention. For as long as the birth data and the Reading: 2 years from delivery of the Reading. You may ask for their erasure at any time (Chapter 10).

Please do not include special category data. Please do not write in your question any data concerning health, religious or philosophical beliefs, political opinions, sex life or sexual orientation, or racial or ethnic origin (special category data under Article 9 GDPR), and do not name another person by surname or any other identifying detail. Such data are not needed to write the Reading, and we do not ask for them. If your question nevertheless contains such data, they may reach the provider of the language model together with the question; even then we use them solely to answer the question and keep them for the period above. To a health, legal or financial question the Reading answers only within the limits of the service and gives no advice (point III.6 of the Terms).

3.7 Claiming the satisfaction guarantee

You can claim the guarantee under point IX.12 of the Terms with the "Don't recognise yourself in it?" link at the bottom of your private web reading page, through the withdrawal form or by e-mail. To decide on the claim, the system checks the order, the date of delivery and whether a guarantee refund has already been made to that e-mail address; the refund is approved by the Provider, so the decision is not based solely on automated processing (Chapter 3 row 7).

The optional reason. On the reading page you may, if you wish, write in your own words what did not fit. We use that text to handle the claim (Article 6(1)(b) GDPR) and to improve the service — to understand what we should do better (Article 6(1)(f), legitimate interest; you may object, Chapter 10). We do not send it to the provider of the language model, to the Studio CRM or to our audience measurement, and approval of the claim does not depend on it. Retention: as for withdrawal statements (5 years). Please do not include special category data here either (section 3.6).

---

4. The Second Person of a two-person reading — a separate chapter

A two-person reading compares the birth charts of two people. One of them is the person ordering; the data about the other — the Second Person — is given by the person ordering. Because we receive the Second Person's data not from them but from the person ordering, we explain the processing that concerns them separately in this chapter (Article 14 GDPR).

4.1 What data we process and where it comes from

A first name and birth data are not special categories of personal data under Article 9 GDPR.

4.2 What we do not do in relation to the Second Person

• We never send them any message — nor could we, as we do not know their contact details.
• We use their data for nothing other than producing the two-person reading that was ordered: we do not use it for marketing, we do not sell it, and we do not combine it with data from any other source.
• We deliver the Reading only to the person ordering, and we do not publish it.

4.3 The legal basis of the processing

We process the Second Person's data on the basis of Article 6(1)(f) GDPR: the person ordering and we have a legitimate interest in the two-person reading requested by the person ordering being produced. In our view that interest does not disproportionately affect the interests and rights of the Second Person, because

• the data is kept to the strict minimum: a first name and birth data, without a surname or contact details;
• the data is given by someone who knows the Second Person and who declares, when ordering, that they are entitled to give it (section 4.6);
• we use the data solely to produce the Reading, only the person ordering receives the Reading, and we do not contact the Second Person;
• the Second Person may object to the processing at any time and may ask for their data to be erased (section 4.5).

We will send a summary of the balancing test on request at support@natalore.com.

4.4 How we inform the Second Person (Article 14 GDPR)

We hold no contact details for the Second Person and therefore cannot inform them directly and individually. Asking for their contact details would mean processing more data than the service itself requires, and tracing them would involve a disproportionate effort (Article 14(5)(b) GDPR). We therefore provide the information by publishing this notice, which is publicly available to anyone, and we ask the person ordering to tell the Second Person about the order and about this notice themselves.

4.5 The Second Person's rights and how to exercise them

If you know or suppose that someone has given your details for a two-person reading, you too have the rights set out in Chapter 10 — in particular the rights of access, rectification, erasure and objection. You may send your request to support@natalore.com or by post to 2100 Gödöllő, Szabó Pál utca 32., Hungary.

The limits of identification. Because we process only a first name and birth data about the Second Person, we first have to find the order concerned before we can act on a request. Please give us your first name and date of birth and — if you know them — the e-mail address of the person who ordered or the approximate time of the order. We ask only for as much data as is strictly necessary for identification. If the order cannot be identified unambiguously from the data given, we will tell you so (Articles 11(2) and 12(2) GDPR).

The limit of erasure. Erasure does not extend to the copy of an already delivered Reading held by the person who ordered it (e-mail, PDF), because that copy is not under our control.

4.6 The declaration of the person ordering

When ordering a two-person reading, the person ordering declares — by accepting the Terms of Service — that they are entitled to give the Second Person's first name and birth data. Please order a two-person reading only with the details of a person from whom, or with whose knowledge, you know those details.

---

5. Use of artificial intelligence (Article 13(2)(f) GDPR and Article 50 of the AI Act)

5.1 How the Reading is produced

The text of the Reading is generated by the Provider's own software system, which uses artificial intelligence: from the astronomical calculation of the birth chart and the interpretive principles of the classical astrological tradition, the text is written by a large language model ("Claude") provided by Anthropic PBC as our processor. The model version used may change as the service develops; the logic of the system described here does not. The Provider uses the model as a deployer within the meaning of Regulation (EU) 2024/1689 on artificial intelligence (the AI Act).

5.2 How the system works — meaningful information about the logic involved

Human involvement. The text of the Reading is not written or reviewed by a human before delivery. The system is operated and supervised by the Provider.

5.3 What the provider of the model receives, and what it does not

It receives: the first name, birth data and computed birth chart of the person the Reading is about — for a two-person reading, of both people — together with the kind of relationship, the language of the Reading and — if you gave them — the topics you chose and your own question (section 3.6).

It does not receive: your e-mail address, your billing name and address, your order identifier, your IP address or your payment data. The request sent to the model does not contain them.

The safeguards for the transfer, Anthropic's retention rules and the exclusion of model training are set out in section 8.1.

5.4 Automated decision-making (Article 22 GDPR)

The Reading is produced by automated processing and describes personal characteristics and inclinations on the basis of birth data; to that extent it involves profiling (Article 4(4) GDPR). It does not, however, constitute a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22(1) GDPR: the Reading is reading matter for self-reflection and entertainment; it restricts no right, excludes you from no service, and is not a credit, insurance, employment or official decision.

The significance and the envisaged consequences of the Reading. The Reading describes inclinations and possibilities on the basis of the birth chart — and so does the answer to your own question; it predicts no events and guarantees no outcome. It does not constitute medical, psychological, financial or legal advice, a diagnosis or a treatment recommendation, and it is not suitable for deciding any such question.

5.5 Human review

If you object to the content of the Reading, your request is examined by a natural person and the Provider replies in writing within 30 days of receiving it.

---

6. The free preview, the place search and contact by e-mail

6.1 The free preview is produced in your browser

The free birth chart preview runs entirely in your browser: it is your browser that calculates the chart. The data you enter for the preview (first name, date, time and place of birth) does not reach our servers for the purposes of the preview, and we do not store it there. Your browser keeps your answers in its session storage (sessionStorage) so that they are not lost if you reload the page or return from the payment page; this data is deleted when you close the tab and upon successful payment (see Chapter 14). The data — and any topics you choose — reach us only if you place an order; our cookieless measurement records the codes of the topics chosen regardless, without a name or any other data (Chapter 3 row 14).

6.2 The place search

When you type in the place-of-birth field, your browser sends the text you have typed (80 characters at most) to our own server, which returns the matches from a gazetteer held in its memory. We do not store the text you type and do not pass it on to any third party: we use no external mapping or geolocation service.

6.3 Contact by e-mail

We send no newsletter and no advertising e-mail, and we collect no e-mail address for such a purpose. You receive e-mail from us only in connection with your order: the order confirmation, the message delivering the Reading and the invoice, the acknowledgement of a withdrawal or termination statement if you make one, and our customer service reply to your enquiry.

---

7. Processors and recipients — itemised list

Without your consent, Meta is not a recipient of your data. In that case your browser sends it no request at all, because Meta's code is not loaded (in detail: Cookie and Storage Notice, section 4.1).

Google is not a recipient of your data either. There is no Google advertising or analytics code on the website, and we serve the website's typefaces from our own server, so your browser sends no request to Google. The PDF of the Reading is produced with fonts installed on our server; while it is being produced the system makes no external network request of any kind.

We conclude a processing agreement under Article 28 GDPR with our processors and bind them to confidentiality and to the application of appropriate security measures. Beyond this, we disclose data to an authority or a court only where required to do so by law.

---

8. Transfers to a third country

8.1 Anthropic PBC (United States of America) — standard contractual clauses (SCC)

To produce the Reading we transfer the first name, birth data and computed birth chart of the person the Reading is about — for a two-person reading, of both people — and, if you gave them, the topics you chose and your own question to Anthropic PBC (San Francisco, United States of America), which supplies the artificial intelligence service known as Claude as a processor. The United States qualifies as a third country.

Important. This data therefore does not remain within the European Union. There is no European data residency option on Anthropic's first-party Claude API.

8.2 Stripe — adequacy decision and standard contractual clauses

Payment is handled by Stripe. Stripe is a certified participant in the EU–U.S. Data Privacy Framework, and therefore the primary legal basis for the transfer to the United States is the adequacy decision under Article 45 GDPR; Stripe supports this, on a supplementary basis, with the standard contractual clauses under Article 46(2)(c) GDPR. The safeguards are available among Stripe's legal documents at https://stripe.com/legal; you may also request a copy from us at support@natalore.com.

Anthropic and Stripe rely on different safeguards: SCC in the case of Anthropic, and an adequacy decision (DPF) together with SCC in the case of Stripe. We do not conflate the two.

8.3 The other recipients

The recipients listed in rows 3 and 4 of Chapter 7 (the invoicing service provider and NAV) process the data in Hungary, that is, within the European Economic Area; no transfer to a third country takes place in their case.

The recipients listed in rows 5–8 of Chapter 7 (the operator of the mail server, the hosting provider and server operator, Studio CRM and — once switched on — the audience measurement provider) process the data in the country indicated in Chapter 7. Should any of them process the data outside the European Economic Area, we apply a safeguard under Chapter V GDPR to that transfer and supplement this chapter accordingly.

8.4 Meta (United States of America) — only with your consent

This section applies only if you have accepted advertising measurement. Without consent your browser sends Meta no request at all, so no transfer takes place.

---

9. Retention periods

9.1 Summary table

9.2 Statutory limits on erasure

Your erasure request does not extend to data that we are required by law to retain, or that are necessary for the establishment, exercise or defence of legal claims (Article 17(3)(b) and (e) GDPR):

In these cases, instead of erasure — and in so far as the statutory obligation does not extend to the data concerned — we apply anonymisation or restriction of processing.

9.3 The technical limits of erasure today — stated openly

In the interest of the fair and transparent processing required by Article 5(1)(a) GDPR, we record that fulfilling an erasure request is not automated today and is subject to the following limits:

If you request erasure, we set out these limits item by item in our reply to you.

---

10. Your rights and how to exercise them

10.1 What rights you have

If you are the Second Person of a two-person reading, you have the same rights; section 4.5 explains the particular features of exercising them.

10.2 How to exercise them

You may send your request

• by e-mail to support@natalore.com,
• by post to 2100 Gödöllő, Szabó Pál utca 32., Hungary.

The request is free of charge. Where we have reasonable doubts concerning the identity of the person making the request, we may ask for additional information necessary to confirm your identity (Article 12(6) GDPR) — in which case we ask only for as much data as is strictly necessary for identification.

10.3 Time limits

• We inform you of the action taken on your request without undue delay and in any event within one month of receipt (Article 12(3) GDPR).
• That period may be extended by two further months where necessary, taking into account the complexity and number of the requests; we inform you of any such extension and of the reasons for it within the original one month.
• If we take no action on your request, we inform you within one month at the latest of the reasons for that and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy (Article 12(4) GDPR).
• If we rectify or erase your data or restrict the processing, we communicate this to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort (Article 19 GDPR).

10.4 What you should know about exercising your rights

We fulfil requests manually, with staff involvement; there is currently no self-service download or deletion function on the website. This does not affect the time limits for fulfilment set out above.

---

11. Data security (Article 32 GDPR)

The measures below describe the position today. We list only measures that are actually in operation.

11.1 What we apply

11.2 What we do not apply — so as not to create a false impression

• The application uses no encryption at rest: we do not encrypt the database fields — including the birth data and the text of the Reading — at application level.
• There is no access log recording which member of staff viewed which Reading or birth data in Natalore's database; only those members of the Provider's staff who are authorised to operate the system have access to the database.

11.3 Personal data breach

In the event of a personal data breach we act in accordance with Article 33 GDPR and, where the breach is likely to result in a high risk to your rights and freedoms, we also inform you under Article 34 GDPR — without undue delay.

---

12. Remedies: supervisory authority and courts

12.1 Complaint to the supervisory authority (Article 77 GDPR)

If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with the supervisory authority:

If your habitual residence is in another Member State of the European Union, you may also lodge your complaint with the supervisory authority of that Member State.

12.2 Judicial remedy (Article 79 GDPR; Section 23 of the Infotv.)

If your rights are infringed you may bring an action before the courts. In Hungary such proceedings fall within the competence of the regional court (törvényszék) and may — at your choice — also be brought before the regional court of your place of residence or stay. Court proceedings are available alongside, and independently of, a complaint to the supervisory authority.

You may also claim compensation for an infringement (Article 82 GDPR).

---

13. Minors

Our service may be used only by persons who have reached the age of 18. We do not knowingly collect personal data from persons under the age of 18, and we do not offer the service to them.

A Reading may, however, be based on another person's birth data: the person ordering may give the data of the Second Person of a two-person reading or, as a parent or legal guardian, the data of their own child. In that case the minor is neither the person ordering nor a party to the contract; we process their data in the same way as described in Chapters 3 and 4.

If we become aware that a person under the age of 18 has given us data as the person ordering, we erase the data without delay — except for data that we are required by law to retain (section 9.2).

If you are a parent or legal guardian and you believe that your child has given us data without your consent, or that someone else has given your child's data without your knowledge, please let us know at support@natalore.com.

---

14. Cookies and data stored on your terminal equipment

For the operation of the website we use only a cookie that is strictly necessary, and without your consent there is no other cookie on our own domain. If you accept advertising measurement, Meta's code also sets two cookies on our domain (_fbp, _fbc). That is not the whole picture, however: the questions and the ordering process also place data in your browser's storage — including your first name, your birth data, your e-mail address and — if you give it — your own question.

Cookies:

Information stored on your terminal equipment that does not qualify as a cookie (the first three in the browser's session storage — sessionStorage — and therefore deleted when you close the tab; the last one in local storage — localStorage):

No consent is needed for the strictly necessary cookies and storage. For Meta's advertising measurement code and cookies, and for storing the campaign data of your visit (rows 11 and 15 of Chapter 3), we ask for your consent in the consent bar; refusing it carries no disadvantage, and you can withdraw it at any time with the Cookie settings button in the footer (section 3.5).

During card payment, Stripe's own cookies are created on Stripe's own domain (not on ours).

The list above is based on the code of our own application. If a content delivery network or a web application firewall (CDN/WAF) is ever placed in front of the website, it may set its own cookie on our domain; in that case this chapter and the Cookie and Storage Notice will need to be supplemented.

Detailed information: Cookie and Storage Notice.

---

15. Changes to this notice

We may amend this notice from time to time — because of a change in the law, guidance from an authority, or a change in the service. We publish the version in force on the website, indicating the version number and the date of entry into force. In the event of a material change, we inform those data subjects whose contact details we hold before the change takes effect.

---

Version: 1.2 · Effective: 9 October 2026