PRIVACY POLICY

Last Updated: 09/01/2026

This Privacy Policy ("Policy") explains how Eisberg Labs d.o.o. za proizvodnju i usluge ("we", "us", or "our") collects, uses, and protects information from users ("you") of the Kundlio mobile application and related services (collectively, the "App" or "Services").

We are the Data Controller under the EU General Data Protection Regulation (GDPR) for personal data processed through the Services.

1. WHO WE ARE​

Eisberg Labs d.o.o. za proizvodnju i usluge Celjska ulica 3 OIB: 44452565653 Website: https://www.eisberg-labs.com Email: support+kundli@hexagramdreams.com

2. INFORMATION WE COLLECT​

a. App - Anonymous Use​

You can use the Kundlio app without signing in. When you use the app without an account, we and our service providers may automatically collect certain technical and behavioral data, including:

• Device type and operating system
• Unique device identifiers (such as a Firebase installation ID; on iOS, the IDFA subject to App Tracking Transparency consent). Kundlio blocks the Google Advertising ID on Android.
• IP address (used for approximate location and abuse prevention)
• App version, language, theme, chart style, and other in-app preferences
• Behavioral product analytics events about how you use the app - for example, when you create a profile, open a chart, view a daily/monthly/yearly reading, run a compatibility check, or change a setting
• Performance and crash data

Birth date, birth time, and birth location entered for chart calculation are stored locally on your device by default. They are only sent to our servers if you sign in (Section 2b) or when explicitly required to generate an AI-assisted reading (Section 2c).

If you allow location access, your device location is used only to look up a birthplace for a chart. Geocoding happens for the place you enter; we do not track your location in the background.

b. App - Signed-In Use (Optional)​

If you choose to sign in with Apple or Google to sync your profiles and readings across devices, we additionally collect and process:

• Your email address and display name (provided by Apple or Google)
• A unique account identifier (Firebase UID)
• Your saved profiles (name, birth date, birth time, birth location), kundli charts, reading history, questions and answers, notes, and app settings (synced to our cloud database so you can restore them on a new device)
• The date of your first sign-in

c. App - AI Features​

When you request an AI-generated reading, a compatibility interpretation, or ask a question about your chart, the relevant chart context (such as lagna, planetary positions, nakshatra, and running dasha derived from a profile) is sent to our AI provider for processing. We use OpenAI as the primary provider and Anthropic as a fallback. The interpretation is returned to your device and stored in your reading history. We do not send AI prompt text to any analytics provider.

d. App - In-App Feedback​

If you send feedback or a support message from inside the app, the message, your optional email address, the app version, platform, and your subscription customer ID are delivered to our support inbox through Mailgun (EU region).

e. Website​

The Kundlio website (kundli.hexagramdreams.com) may use cookies and analytics to support functionality and understand traffic. These technologies may collect:

• Browser type and version
• IP address and approximate location
• Pages visited and time spent
• Cookies or similar identifiers

You can manage or disable cookies in your browser settings.

3. THIRD-PARTY SERVICES​

We rely on trusted third-party providers to operate, analyze, and improve the Services. Each processes your data as our service provider and under their own privacy policies.

4. ADVERTISING IDENTIFIERS AND TRACKING​

Kundlio does not show ads and does not use your data for advertising.

On Android, the app blocks the Google Advertising ID permission, so no advertising identifier is collected.

Where the app is offered on iOS, we honor Apple's App Tracking Transparency (ATT) framework. When you first open the app, you will be asked whether to allow tracking.

• If you allow tracking, Firebase Analytics is enabled.
• If you decline (or have not yet responded), Firebase Analytics is disabled - no events are sent.
• Anonymized crash reports (Sentry), authentication, subscription management, AI features, and your synced data continue to function regardless of ATT, because they are necessary to provide the Services you have requested. Sentry receives no personally identifiable information.

You can change your ATT decision at any time in iOS Settings → Privacy & Security → Tracking.

5. HOW WE USE INFORMATION​

We use collected information to:

• Provide the Services - calculate your kundli chart, nakshatras, dasha timeline and compatibility, sync your profiles and readings, deliver AI interpretations, manage subscriptions
• Operate and improve the App and website - analyze usage to understand which features are valuable and which are confusing
• Identify and fix technical problems - crash reports and performance metrics
• Communicate with you - respond to support requests
• Comply with legal obligations

Lawful basis under GDPR​

We do not sell your personal data. We do not show third-party ads inside the Kundlio app.

6. SHARING INFORMATION​

We share information only in these cases:

• With Service Providers listed in Section 3, who process data on our behalf
• For Legal Compliance where disclosure is required by law, court order, or government request
• During Business Transfers if our business or assets are sold or merged

Some of these providers (e.g., Firebase, OpenAI, Anthropic) are based in the United States. Where personal data is transferred outside the European Economic Area, we rely on adequacy decisions or Standard Contractual Clauses approved by the European Commission.

7. DATA RETENTION​

• Account data (email, display name, Firebase UID) - retained for as long as your account is active. Deleted on request (see Section 9).
• Synced profiles, charts, and reading history - retained until you delete them or your account.
• Product analytics events (Firebase Analytics) - retained for up to 24 months, then aggregated or deleted.
• Anonymized crash reports (Sentry) - retained for 90 days.
• AI prompt text (OpenAI, Anthropic) - handled per each provider's retention policy. We do not retain a separate copy on our analytics infrastructure.
• Support and feedback email - retained for as long as needed to resolve your request and for our records.
• Logs - operational logs are retained for up to 30 days.

8. YOUR RIGHTS UNDER GDPR​

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights regarding your personal data:

• Right of access - request a copy of the data we hold about you
• Right to rectification - correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") - request deletion of your data
• Right to restriction - limit how we process your data
• Right to data portability - receive your data in a machine-readable format
• Right to object - object to processing based on legitimate interests, including analytics
• Right to withdraw consent - at any time, where processing is based on consent
• Right to lodge a complaint with your local data protection authority. In Croatia, this is the Croatian Personal Data Protection Agency (AZOP).

To exercise any of these rights, email support+kundli@hexagramdreams.com. We will respond within 30 days.

9. ACCOUNT AND DATA DELETION​

You can delete your account and all associated personal data at any time by emailing support+kundli@hexagramdreams.com from the email address linked to your account. We will:

• Delete your account, synced profiles, charts, reading history, and personal identifiers within 30 days
• Instruct our service providers (Firebase, RevenueCat) to delete or anonymize your data
• Retain only what is required by law (e.g., billing records for tax purposes)

If you have not signed in, no account exists to delete; uninstalling the app removes locally stored data.

10. DATA SECURITY​

We use appropriate technical and organizational measures to protect data, including encryption in transit (TLS), encryption at rest for synced data, access controls, and regular security review. You can also lock the app with your device biometrics. However, no method of transmission or storage is completely secure.

11. CHILDREN'S PRIVACY​

Our Services are not directed to children under 13 (or 16 in the European Economic Area). We do not knowingly collect data from children. If we discover such data, we delete it immediately. If you believe a child has provided us with personal data, contact us at support+kundli@hexagramdreams.com.

12. CHANGES TO THIS POLICY​

We may update this Policy periodically. The "Last Updated" date at the top indicates the most recent version. For material changes, we will notify you within the app or by email if you have an account. Continued use of our Services after the effective date means you accept the updated Policy.

13. CONTACT US​

If you have any questions, concerns, or requests regarding this Policy or your personal data, contact us at:

support+kundli@hexagramdreams.com