Privacy Policy
Last updated: 13 July 2026 · Policy version 2026-07-13
This policy explains what personal information NebulaMap / 星圖命理 ("we", "us", "the Service") collects, why, how it is protected, where it is sent, how long it is kept, and the rights you have. The Service produces a Zi Wei Dou Shu (紫微斗數) chart and an AI-generated guidance report. The report is for self-reflection and entertainment only ("僅供參考"): it is not medical, financial, psychological, or legal advice, and it does not predict a fixed outcome for any exam, diagnosis, investment, or legal matter. For example, our study/exam-luck reading describes tendencies and does not guarantee a result, and our home/property reading covers timing and suitability only, never investment advice.
This English text is the master version. Localized versions (繁體中文 / 日本語) are available via the language selector.
1. Who is responsible
The data controller is NebulaMap Advisory, a sole proprietorship registered in British Columbia, Canada, which operates NebulaMap / 星圖命理. The owner of NebulaMap Advisory acts as the designated Privacy Officer responsible for the protection of personal information, including for the purposes of Quebec's Law 25. For any privacy request, contact: support@nebulamap.com. The Service is available only in selected markets and may not be available in your region.
2. What we collect
| Data | Why | Required? |
|---|---|---|
| Date of birth, hour of birth, sex at birth, calendar type, optional birthplace | To compute your astrological chart. These are the core inputs. | Yes (birthplace and hour are optional) |
| Name / nickname (a nickname is fine) | To personalize the report and email greeting, and to address you in newsletters if you opt in. | Yes |
| Email address | To email you the link to your finished report, and, only if you opt in, to send occasional newsletters. | Yes |
| Marketing opt-in & consent record | Only if you tick the optional box: records that you agreed to receive newsletters, with a timestamp, so we can email you and demonstrate your consent. | No (optional) |
| Your consent record | A timestamp and policy version recording that you agreed to this policy. | Yes |
| Account sign-in email | Only if you choose to sign in to keep a paid report and any follow-up-question credits: we email a one-time sign-in link to this address. See Section 3. | Only if you sign in |
| Follow-up questions you ask | If you ask a follow-up question on a paid report, the question and its answer are stored with that report so you can see your own question history. | Only if you ask one |
| Payment data | Handled entirely by a third-party PCI-DSS-compliant payment processor if you purchase a paid tier, we never receive or store your card number. | Only for purchases |
| Technical data | IP address and request metadata, used transiently for rate-limiting and abuse prevention. | Automatic |
We treat your birth information as sensitive and handle it with heightened care, even where local law may not strictly classify it as such. We do not collect race, religion, health records, biometric, or government-ID data.
3. Accounts, coupons, and follow-up-question credits
Passwordless sign-in. To keep a paid report past its device, or to keep unused follow-up-question credits, you may sign in with an account tied to your email address. There is no password: we never ask you to create one, and we never store one, so there is nothing to leak if our systems are ever breached. Signing in works by emailing you a one-time link (valid for 30 minutes); once you use it, your browser stays signed in for up to 30 days.
Coupons (promotional discounts). From time to time we grant a promotional discount coupon to an eligible email address (for example, for a new newsletter opt-in, for a report rating left with a comment, or as part of an upgrade offer). A coupon is a discount off a specific future purchase, never stored monetary value: it is not a gift card, wallet balance, or prepaid credit, it cannot be redeemed for cash, and it cannot be transferred to another person or email address. Each coupon is single-use, tied to the email address it was granted to, scoped to a specific purchase, and expires a set number of days after it is granted (7 to 14 days depending on the coupon).
Follow-up-question credits. A Royal or Imperial report includes a set number of follow-up-question credits. Credits included with a purchase expire 90 days from the day they are granted; credits you buy individually never expire. A credit is only spent once your question is successfully answered and saved, so a failed attempt never consumes one.
4. Why we may process this (legal bases)
We rely on your explicit, opt-in consent, given when you tap a report option to generate your reading, and on the necessity of processing to deliver the report you request. You may withdraw consent at any time by contacting us; in any event, your report and the data stored with it are deleted automatically (see Section 7) or on your own request if you hold an account. Withdrawal does not affect processing already carried out. If you tick the optional marketing box, we also rely on your separate opt-in consent to send newsletters and similar marketing messages (such as an occasional discount-coupon announcement); you can withdraw it anytime by unsubscribing (see Section 8), and doing so does not affect your reports or your account. Some emails are transactional rather than marketing (your report link, your account sign-in link, and a notice that a coupon has been granted or is about to expire) and are sent because they are necessary to the service you asked for; they do not depend on the marketing opt-in and are not affected by unsubscribing from it.
5. Cross-border transfer to our AI provider
To generate your report, your computed chart is sent to a third-party AI provider located in the United States, which returns the written analysis. Your name and email address are not sent to the AI provider. The data sent is derived from your birth details and is processed solely to produce your report. Under our contract with this provider, the data is protected by contractual safeguards, is used only to generate your report, is not used to train any AI models, and is retained only briefly before deletion. This is an international transfer of personal data outside your country: the United States does not hold an EU-style national adequacy recognition, so we rely on your consent together with these contractual safeguards as the basis for the transfer.
6. How your data is protected
All traffic is encrypted in transit (HTTPS/TLS). Stored reports are held in an access-controlled datastore reachable only by the Service. Reports are addressed by an unguessable random identifier; anyone with your report link can view that report, so treat the link as private. If you hold an account, your sign-in session is protected by a signed, secure browser cookie and no password ever exists to be guessed, phished, or leaked. We apply security headers, input validation, and per-IP rate limiting, and we restrict who can access production systems. No system is perfectly secure, but we work to protect your information.
7. How long we keep it
Free reports (and the birth details, name, email, and question stored with them) are automatically and permanently deleted after 7 days. A free report you have used or purchased a Follow-up Question on is instead retained until you delete it, exactly like a paid report (see the next sentence); a free report kept only because a rating earned you a Follow-up Question credit you have not yet used still follows the normal 7-day schedule. Paid reports kept under an account are retained until you delete them, either individually or by deleting your whole account, at which point they are permanently erased; we do not otherwise delete a paid or retained report on our own initiative. IP-based rate-limit counters expire within about 2 days. Payment records are retained by our payment processor and by us only as required for tax and accounting law. Coupon and follow-up-credit records are kept for as long as your account exists (so the single-use and expiry rules in Section 3 can be enforced) and are deleted when you delete your account. If you opted in to newsletters, your name and email stay on our subscriber list until you unsubscribe; we also remove a subscriber automatically after 24 months of no interaction with our emails. Unsubscribing or this 24-month removal does not affect any report or account.
8. Your rights and how to exercise them
Depending on where you live, you have rights to access, correct, delete, or obtain a copy of your data, to withdraw consent, and to object to or restrict processing.
- Automatic deletion (free reports): a free report and its data are erased automatically within 7 days, with no action needed from you, unless you have used or purchased a Follow-up Question on it (see Section 7).
- Self-serve deletion (accounts): if you sign in, your account page lets you delete any single saved report, or delete your entire account (every saved report, plus your coupon and credit records) at any time. This is immediate and cannot be undone; it does not cancel a newsletter subscription (a separate consent, see below) and does not affect payment records held by our payment processor.
- Unsubscribe: if you opted in to newsletters, every newsletter includes a one-click unsubscribe link, or email us and we remove you promptly.
- Other requests: email support@nebulamap.com and we will respond within the timeframe your local law requires.
You also have the right to lodge a complaint with your local data protection authority.
9. Sharing
We do not sell your personal information. To measure our advertising and reach people likely to be interested in the Service, we use Google Ads conversion tracking and remarketing, provided by Google LLC (United States). Through the Google tag on our site, limited event and device data (such as advertising-cookie identifiers, pages viewed, and whether a free or paid report was generated, including the purchase amount for a paid report) is shared with Google for this purpose. We do not share your name, email address, birth details, or report content with Google. Aside from this advertising measurement, we share data only with the categories of service providers needed to run the Service: our third-party AI provider (Section 5), our cloud hosting and storage provider, our email-delivery provider, and a third-party payment processor.
10. Children
The Service is intended for adults. If you are not yet of the age of majority where you live, you may use it only with the consent of a parent or guardian. We do not knowingly collect personal information from minors, anyone below the age of majority (or other minimum age) that applies where they live, without verified parental or guardian consent; if you believe a minor has used the Service, contact us and we will delete the data.
11. Cookies and local storage
Functional storage: we use your browser's local storage only for functional preferences (chosen language and currency), to resume an in-progress report, and to pre-fill your birth details if you return later to upgrade. This data stays on your device and is not sent to or stored by us.
Account session cookie: if you sign in, we set one first-party, security-only cookie (signed, HttpOnly, and sent only over HTTPS) so the Service recognizes you are signed in. It is strictly functional: we do not use it for advertising, analytics, or tracking across other sites, and it lasts up to 30 days or until you sign out.
Advertising and measurement cookies: our Google Ads tag sets cookies used to attribute conversions and to build remarketing audiences (for example Google's conversion and remarketing cookies). We use Google Consent Mode: because the Service is offered only in the United States, Canada, Japan, and Taiwan, these cookies are enabled by default in those markets; for visitors in the EEA, the United Kingdom, and Switzerland (where the Service is not offered), advertising and analytics storage is denied by default. You can also control or block these cookies in your browser settings, or opt out of personalized advertising via Google's Ads Settings (myadcenter.google.com).
12. Changes
If we make material changes we will update the date and version at the top of this page. Continued use after a change means you accept the updated policy.
This Privacy Policy is written in English. Any translation is provided for convenience only; in the event of any conflict or inconsistency between a translated version and the English version, the English version governs.
13. Contact
Questions or requests: support@nebulamap.com.
Mailing address: NebulaMap Advisory, 329 Howe St, Unit #298, Vancouver, BC V6C 3N2, Canada.