This notice has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.
The data controller is not required to appoint a data protection officer and therefore has not appointed one.
| Data category | Purpose | Legal basis | Retention |
|---|---|---|---|
| E-mail address, hashed password, the fact and time of e-mail confirmation | Creating and operating the user account, signing in | Performance of a contract — Article 6(1)(b) GDPR | Until the account is deleted |
| Full name at birth, date of birth | Producing the analyses; the service cannot be provided without this data | Performance of a contract — Article 6(1)(b) | Until the account is deleted |
| The text of the questions asked and of the analyses produced | Providing the service and allowing analyses to be read again | Performance of a contract — Article 6(1)(b) | Until the account is deleted |
| For relationship analyses, the other person's name and date of birth | Producing the compatibility analysis | Legitimate interest — Article 6(1)(f); the user is responsible for the lawfulness of providing this data | Until the account is deleted |
| Credit balance, credit transactions | Accounting for the service | Performance of a contract — Article 6(1)(b) | Until the account is deleted |
| Purchase data, name and billing address, payment identifiers | Fulfilling the order, invoicing | Performance of a contract and legal obligation — Article 6(1)(b) and (c) | Accounting documents: 8 years (Section 169 of Act C of 2000) |
| IP address, technical log data | Preventing abuse and automated abusive use, operating the service | Legitimate interest — Article 6(1)(f) | Up to 12 months |
| Customer support correspondence, complaints | Complaint handling | Legal obligation — Article 6(1)(c), Section 17/A of the Hungarian Consumer Protection Act | 5 years |
We collect the data directly from the data subject, during registration and use of the service. In the case of a relationship analysis, the other person's data is provided by the user; the user is therefore responsible for ensuring that they are entitled to do so.
The data controller uses the following data processors:
| Data processor | Activity | Data concerned |
|---|---|---|
| Rackhost Zrt. 6000 Kecskemét, Sosztakovics u. 3. II/6., Hungary | Web hosting | Technical data relating to the operation of the website |
| Hostinger International Ltd. Cyprus / EU | Server operation (workflow automation system) | Data transmitted for the processing of the analyses |
| Supabase Inc. USA / EU data centre | Database services | Account, analysis, credit and payment record data |
| OpenRouter, Inc. USA | Brokering access to artificial intelligence | The name, date of birth and question required for the analysis |
| Google LLC / Google Ireland Ltd. | Language model (Gemini) | The data required for the analysis |
| Stripe Payments Europe, Ltd. Ireland | Online payment processing | Name, e-mail address, billing address, payment data |
| KBOSS.hu Kft. (Számlázz.hu) Budapest | Electronic invoicing | Name, billing address, e-mail address, purchase details |
Bank card details are processed exclusively by the payment service provider; the data controller neither sees nor stores them.
When the analyses are produced and when certain technical services are used, data may be transferred outside the European Economic Area, primarily to the United States of America. The lawfulness of such transfers is ensured by an adequacy decision of the European Commission or by the standard contractual clauses adopted by the European Commission and concluded with the service providers.
By its very nature, the service generates text automatically with the assistance of artificial intelligence. However, this does not produce legal effects concerning the data subject or similarly significantly affect them, as the service is provided for informational purposes only. Automated decision-making within the meaning of Article 22 GDPR therefore does not take place.
The application does not use marketing or analytics cookies. For its operation it uses only the browser's local storage (localStorage, sessionStorage), in which it stores the sign-in session, the current result and the pending question. This data remains in the browser, is deleted when you sign out or close the application, and does not require separate consent.
To confirm registration, the data controller stores a single-use, randomly generated identifier, which is deleted at the moment of confirmation.
The data controller transmits data over an encrypted connection (HTTPS), protects the database with access restrictions (row level security), and stores passwords solely as salted, one-way hashes — passwords cannot be decrypted. The administration interface is password protected, and authentication takes place exclusively on the server.
You are entitled at any time:
You can send your request to info@opusnumerology.com. The data controller will comply with the request within one month at the latest, or, in justified cases, will inform you of an extension of this deadline.
If the account is deleted, the personal data and analyses belonging to the account are permanently erased, with the exception of data that the data controller is required by law to retain (in particular accounting documents).
If you believe that your rights have been infringed in connection with the processing of your data, we ask you first to contact the data controller directly. You may also lodge a complaint with the supervisory authority or bring an action before the courts.
Court proceedings may also be brought before the regional court with jurisdiction over your place of residence or stay.
The data controller reserves the right to amend this notice. The version in force at any given time is continuously available on the website.
← Back to the application