Effective date: 4 September 2026. This policy replaces all earlier versions.
XuanSeal is operated by LumenNest Labs LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States. We are the data controller for everything described below. Contact: support@xuanseal.com.
We sell digital readings to people in the EU, the UK and worldwide, so this policy is written to the GDPR and UK GDPR standard for everyone, whatever your location.
Chart and reading inputs. Birth date, and — where the tool asks for them — birth time, birth place, gender, a display name, and the question or context you type. These are used to compute the chart or card spread and to generate the reading you asked for. Birth data is submitted in the request body; it is not placed in page URLs, and it never rides our analytics events (event properties beginning with birth are dropped at the source).
Email address. Collected when you create an account, when you buy (including guest checkout), when you ask us to email a free Birth Card profile, and when you opt in to product emails or to the three-letter arcana series. Marketing email is separate and always opt-in — you can unsubscribe from any message, at any time.
The three-letter arcana series. If you tick the separate, unticked box on the free Birth Card form, we send you three letters — the second day, the seventh day and the twenty-first day after you confirm — and then stop. The second letter includes an offer for a paid reading; that is stated on the box before you tick it. The subscription only starts when you click the confirmation link in the free profile email, so a mistyped address never gets the series. To write the letters we keep your email address and the birth date you entered. Every letter carries an unsubscribe link, and unsubscribing takes effect immediately rather than within the ten days the law allows.
Purchase records. Order number, product, amount, currency, status and timestamps. Card details never reach our servers: payments run through Stripe's hosted checkout (older orders may reference Creem, our previous provider). We receive only the outcome of the payment plus the last-four/brand style metadata Stripe returns.
Usage and device data. Pages viewed, the steps you take through a tool or checkout, referrer and campaign parameters, coarse country (derived from your IP at the edge — the full IP address is not written to our event log), device type, browser and language. Your IP address is also used for abuse and rate-limit protection, where it forms part of a stored rate-limit key; that table has no automatic deletion job today (see "How long we keep things").
Support correspondence. Anything you send us by email.
| Name | Type | Lifetime | Purpose |
|---|---|---|---|
xuanseal_consent | Strictly necessary | 180 days | Records your own analytics choice. Set without consent because it exists to honour that choice. |
| Session/auth cookies | Strictly necessary | Session or sign-in period | Keeps you signed in, protects forms, carries checkout back to the right order. |
xuanseal_anonymous_id | Analytics (first-party) | 180 days, renewed on each visit; a copy is also kept in browser local storage with no fixed expiry | A random identifier with no name or email in it. Joins the steps of one browser into one funnel so we can see where the product breaks. Written on arrival, worldwide — it is not yet behind the consent banner; see the note under this table. |
xuanseal_funnel_session | Analytics (first-party, local storage) | 30 minutes of inactivity | Groups one visit's events. |
| Attribution values | Analytics (first-party) | Up to 180 days | Remembers which link or campaign brought you, so we know which pages are worth keeping. |
| Google Analytics 4 | Analytics (third-party) | Set by Google | Aggregate traffic and conversion measurement. |
| Microsoft Clarity | Analytics (third-party) | Set by Microsoft | Session replay and heatmaps used to find broken layouts and dead ends. Clarity masks sensitive content by default — input box content, numbers and email addresses are not uploaded. |
Third-party analytics: in the EU, EEA, Switzerland and the UK we ask first. Google Analytics and Microsoft Clarity do not load, and set no cookies, until you choose "Accept analytics" on the banner. Choosing "Decline" keeps them off, and the site works identically either way. We do not treat third-party analytics as strictly necessary, and we do not use "legitimate interest" as a substitute for that consent.
First-party measurement is not behind that banner yet — and in the EU/EEA/Switzerland/UK that is an open compliance gap, not a settled legal position. The anonymous identifier (xuanseal_anonymous_id), the visit-session id and the attribution values are written when you arrive, everywhere in the world. Outside those regions we rely on legitimate interest. Inside them, storing and reading this kind of identifier normally requires prior consent, and we do not claim legitimate interest cures that: we have logged it as an item to close and expect to bring first-party measurement under the same consent gate at our next release. In the meantime, "Decline" stops the third-party analytics above, and you can email support@xuanseal.com to have first-party measurement stopped for you and the records we hold about you deleted.
Changing your choice. Cookie settings in the footer reopens the banner; the new choice applies from the next page load, and it controls the third-party analytics above. Because the anonymous identifier is also mirrored in your browser's local storage, clearing cookies alone can restore it — to remove it fully, clear site data for xuanseal.com in your browser, or email us and we will delete the associated records.
| What we do | Basis |
|---|---|
| Compute your chart, generate and deliver the reading you bought or requested, run your account, handle refunds and support | Art. 6(1)(b) — performance of a contract with you |
| Load Google Analytics and Microsoft Clarity for visitors in the EU/EEA/Switzerland/UK; send marketing email; send the three-letter arcana series | Art. 6(1)(a) — your consent (withdrawable at any time) |
| First-party funnel measurement and the anonymous identifier behind it — worldwide, including the EU/EEA/Switzerland/UK, and not currently gated by the consent banner; abuse and rate-limit protection (your IP address is part of the rate-limit key); securing the service | Art. 6(1)(f) — legitimate interests in running a working, non-abused product. You have the right to object: email support@xuanseal.com and we will stop and delete on request |
| Keeping order, payment and tax records | Art. 6(1)(c) — legal obligation |
We are a small operation and we tell you the real state of our systems rather than an aspiration:
You can shorten any of the above for your own data by asking us to delete it (see below).
Our servers and processors are in the United States. The transfer mechanism is not the same for every processor, so it is stated per row below instead of claimed in one sentence. Where a processor publishes a data processing agreement, we rely on the Standard Contractual Clauses (with the UK Addendum where applicable) in that agreement.
One is still being put in place: our AI model processing provider's data processing agreement and Standard Contractual Clauses are not yet finalised. Until they are, what we send there is limited to what generating your report requires — the birth date and chart or spread inputs, plus your question text. No name, no email address, no account id, no payment data.
Provider terms were reviewed on 3 September 2026:
| Processor | Role | Transfer mechanism |
|---|---|---|
| Vercel | Hosting and edge delivery | Data processing agreement stating the Standard Contractual Clauses — https://vercel.com/legal/dpa |
| Neon | Managed PostgreSQL database | Handled under the provider's published data processing terms and transfer mechanism — https://neon.com/dpa |
| Stripe | Payments and billing | Data processing agreement stating the Standard Contractual Clauses and the EU–US Data Privacy Framework — https://stripe.com/legal/dpa |
| Resend | Transactional and product email | Data processing agreement stating the Standard Contractual Clauses and the EU–US Data Privacy Framework — https://resend.com/legal/dpa |
| AI model processing provider (United States) | Generates the text of your reading | Data processing agreement and Standard Contractual Clauses still being put in place. Until then we send only the birth date, chart or spread inputs and your question text — no name, no email address |
| Google Analytics 4 (loaded only with consent in the EU/EEA/Switzerland/UK) | Handled under the provider's published data processing terms and transfer mechanism — https://business.safety.google/adsprocessorterms/ | |
| Microsoft | Clarity session replay (loaded only with consent in the EU/EEA/Switzerland/UK) | Handled under the provider's published data protection addendum and transfer mechanism — https://learn.microsoft.com/en-us/clarity/faq |
We do not sell personal data, and we do not use your chart inputs or readings to train models of our own.
If you are in the EEA or the UK you have the rights of access, rectification, erasure, restriction, portability, and objection (including to processing based on legitimate interests), plus the right to withdraw consent at any time without affecting what happened before. Similar rights exist under several US state laws; we apply this process to everyone who asks.
How to exercise them: email support@xuanseal.com from the address you used with us, or quote your order number if you bought as a guest — that is how we verify identity, and we ask for nothing more than is needed to match you to your records. We reply within 30 days. If we cannot identify you from what you provide, we will say so rather than guess.
You may also complain to your local supervisory authority (in the UK, the Information Commissioner's Office).
XuanSeal is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, email us and we will delete it.
Data is encrypted in transit, access to production data is limited to the operator, and payment credentials never touch our systems. No service can promise absolute security; we limit what we collect so there is less to lose.
We will update the effective date above and publish the new version here. Material changes affecting how we use data you already gave us will be announced by email where we have an address for you.
