Privacy & Cookie Policy
Last updated: 3 November 2026
1. Who we are
The controller of your personal data for FateNex (https://fatenex.com) is COMNEX LTD, registered in England and Wales, company number 17540341, registered office 128 City Road, London, EC1V 2NX, United Kingdom. Contact for privacy matters: support@fatenex.com (subject "Privacy request"). We are not required to appoint a Data Protection Officer.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | email address, login identifiers, sign-in timestamps | you / our authentication service |
| Chart input data | name or nickname for a chart, date, time and place of birth, gender, time zone; question text and casting time for Qi Men / Liu Yao | you |
| AI conversation data | the questions you ask and the AI interpretations generated | you / the Service |
| Purchase data | products bought, amounts, currency, dates, subscription status, Stripe customer and payment IDs, billing country, the version and time of any cancellation-right waiver you accepted | you / Stripe |
| Technical data | IP address, browser and device type, error reports, security logs | your device |
| Analytics data (only with consent) | pages viewed, feature usage, approximate location derived from IP | your device |
| Communications | emails you send us and our replies | you |
We do not receive or store your full card number; Stripe processes it. Birth details on their own are not special-category data. We do not ask for information about your health, religion, sexual life or other special categories, and the Service does not need it: please do not include it in free-text questions. If you include it anyway, it is processed only as part of generating the answer you asked for and is not used for anything else; you can ask us to delete it. If you enter another person's birth data (for example for a compatibility reading), please make sure they are happy for you to do so.
What you must provide. An email address is required to create an account, and birth or question details are required to produce a chart or interpretation; this is a contractual requirement, and without it we cannot provide those features. Payment details are required only to buy something. Everything else (for example analytics consent) is optional, and refusing it does not affect the Service.
3. Why we use it and our lawful basis (UK GDPR)
| Purpose | Lawful basis |
|---|---|
| Creating and running your account; producing charts, AI interpretations and reports; delivering purchases | Contract |
| Taking payments, managing subscriptions, refunds, preventing payment fraud | Contract; legitimate interests (fraud prevention) |
| Keeping accounting and tax records | Legal obligation |
| Security, abuse prevention, error monitoring and fixing bugs (Sentry) | Legitimate interests (keeping the Service secure and working) |
| Product analytics (PostHog) | Consent — only after you accept analytics cookies |
| Service emails (receipts, changes to terms) | Contract; legal obligation |
| Responding to your enquiries and complaints | Legitimate interests; contract |
We do not sell your personal data, and we do not use your data for automated decisions that have legal or similarly significant effects on you. We do not use your chart data or conversations to train AI models. Our AI providers receive the content needed to generate each answer through their business APIs, under data processing terms, and we use settings under which they may not use it to train models.
4. Who we share it with (processors)
We use the following service providers, who process data on our instructions under contracts:
| Provider | What they do | Data involved |
|---|---|---|
| Authentication service (open-source Supabase Auth / GoTrue; a dedicated instance operated by us for FateNex) | Sign-in and account authentication | Account data |
| Resend (Resend, Inc., United States), email delivery provider | Sending sign-in, verification and password-reset emails | Email address, the email content |
| Stripe (Stripe Payments Europe, Limited; Stripe Payments UK Ltd where applicable; Stripe, Inc.) | Payment processing (cards, Apple Pay, Google Pay), subscriptions, receipts, billing portal, fraud prevention | Purchase data, payment details, billing country, email |
| PostHog (PostHog, Inc., US cloud) | Product analytics, loaded only after you consent | Analytics data (not linked to your name or email) |
| Sentry (Functional Software, Inc.) | Error monitoring | Technical data about errors (no account identifiers) |
| AI model providers: OpenRouter (OpenRouter, Inc., United States), which forwards each request to the upstream model provider we have selected; Anthropic (Claude; Anthropic Ireland, Limited, with processing in the United States); OpenAI (ChatGPT API; OpenAI, L.L.C., United States) | Generating AI interpretations. We restrict OpenRouter to the model providers we have chosen and to providers that do not use your content for training | Chart input data and questions needed for the answer (not your account email or payment details) |
| UCloud (cloud hosting provider; our servers are located in Singapore) | Hosting our servers and database | All data stored by the Service |
| Cloudflare (Cloudflare, Inc.) | Content delivery, DNS and protection against attacks; all website traffic passes through it | Technical data (IP address, requests) |
Stripe also acts as an independent controller for some purposes (for example fraud prevention and meeting its legal obligations); see Stripe's privacy policy at https://stripe.com/privacy. We may also disclose data where required by law, to protect our rights, or to a buyer of our business (you will be told).
5. International transfers
Some providers process data outside the UK, mainly in the United States, the EU and Singapore (where our servers are located). Where data is transferred outside the UK, we rely on UK adequacy regulations (including, where the provider participates, the UK Extension to the EU-US Data Privacy Framework) or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, as included in the provider's data processing terms. You can ask us for details.
6. How long we keep it
- Account and chart data: while your account is open. When you ask us to delete your account, we delete this data within 30 days of your request; copies in backups, if any, are deleted when those backups expire, within a further 90 days. A chart you delete yourself is removed immediately.
- AI conversations and readings: while your account is open, and deleted together with your account as above. Deleting a conversation removes it from your account; to have its stored records erased before then, email us.
- Purchase and transaction records: for the period required by UK tax and company law (generally 6 years from the end of the financial year), even after account deletion.
- Security, server and error logs: up to 90 days.
- Analytics data: kept by PostHog for the retention period of our PostHog plan, after which it is deleted. It is not linked to your name or email, and you can ask us to delete analytics data associated with your device.
7. Your rights
Under UK data protection law you have the right to: access your data; correct it; delete it; restrict or object to processing (including processing based on legitimate interests); data portability; and withdraw consent at any time (this does not affect earlier processing). You can ask us to delete your account by emailing support@fatenex.com from your account email, change cookie choices via Cookie settings in the footer, or email support@fatenex.com. We will respond within one month.
If you are unhappy, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/ (tel. 0303 123 1113). If you are in the EU/EEA you may complain to your local data protection authority.
8. Children
The Service is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
9. Security
We use encryption in transit (HTTPS), access controls and reputable providers. Payment data is handled by Stripe, which is certified to PCI DSS Level 1. No method of transmission is 100% secure.
10. Cookies and similar technologies
We use cookies and similar technologies (including browser local storage). When you first visit, a banner lets you choose Accept All or Necessary Only with equal prominence. Non-essential technologies are not loaded until you accept. You can change your choice at any time via Cookie settings in the footer.
| Type | Provider | Purpose | Consent needed? |
|---|---|---|---|
| Strictly necessary | FateNex / authentication service | Keep you signed in, security, remember your cookie choice, language, time zone (read from your browser so that dates show in your local time; kept only for the current browser session) and display theme; keep checkout and sign-up steps working within a browser tab | No |
| Preferences (local storage) | FateNex | Remember settings you choose, such as chart display settings and reading tone | No |
| Strictly necessary (checkout) | Stripe | Process payments and prevent fraud on the Stripe checkout page | No |
| Error monitoring | Sentry | Detect and fix errors. Our configuration sets no cookies and stores nothing on your device; user details and secret values are stripped from error reports before they are sent | No |
| Analytics | PostHog | Understand how features are used to improve the Service | Yes — only after you accept |
We do not use advertising or cross-site tracking cookies on the website.
11. Changes
We will post updates here and notify you of material changes by email or on the site.