This policy explains what personal data Innaluma collects when you use our website and buy a personalized Human Design reading, why we collect it, who we share it with, and the choices and rights you have. We have tried to write it in plain language, because a privacy policy you cannot read protects no one.
The short version
- We collect your name, email, and birth details (date, time, and place of birth) so we can create and deliver your personalized reading.
- Your reading is generated automatically from your birth data. No one at Innaluma reads your chart by hand, and no one browses your details for any reason other than running your order or helping you with support.
- We take payment through Lemon Squeezy, our Merchant of Record. They handle the card transaction, and we never see or store your full card number.
- We only send you marketing emails if you opt in, and you can unsubscribe from every one of them with a single click.
- We use privacy-preserving, cookieless analytics that set no cookies and do not track you across other sites, so we show no cookie banner and use no advertising cookies or pixels. The only cookie we use remembers your language.
- You can access, correct, download, or delete your data at any time by emailing support@innaluma.com. If your birth details were entered wrong, we regenerate your reading for free.
1. Who we are
Innaluma is a trading name of STARFINITY, SOCIEDAD LIMITADA, a limited company incorporated in Spain (sociedad limitada), tax ID (NIF) B27662683, registered at Rambla del Poblenou 11, 08006 Barcelona.
We are the data controller for the personal data described in this policy, which means we decide why and how it is used.
For any privacy question or request, contact us at support@innaluma.com.
2. What we collect
When you use the free chart tool:
- Your first name (required, so we can address your reading to you).
- Your date, time, and place of birth. As you type your birth place, a search box helps you pick the exact location. The location search converts your pick into the geographic coordinates we need for an accurate calculation.
- Your email address, only if you choose to have your free result sent to you.
When you buy a reading:
- Your first name and email address.
- Your date, time, and place of birth (carried over from the free tool or entered at checkout).
- Order and billing information collected by Lemon Squeezy at checkout (such as your name, email, billing country, and the payment method you use). Lemon Squeezy processes your card details directly. We never receive or store your full card number.
- Your language (English, French, or Spanish).
- Your marketing choice (whether you opted in to our newsletter).
When you contact support:
- Whatever you send us (your email address, your message, and any details you share).
Automatically, when you browse the site:
- Standard technical information such as your device, browser, approximate location, and the pages you visit, along with privacy-preserving, cookieless analytics event data. We use cookieless analytics (Cloudflare Web Analytics) that set no cookies, do not profile you, and do not track you across other sites. We use no advertising cookies or pixels. We never place your name, email, or birth details into analytics.
A note on your birth details
Your date, time, and place of birth are personal data. Combined with the reading we produce, they can suggest things about your personality and the way you live, so we treat them with extra care: we keep only what we need, we do not sell them, we limit who can access them, and we delete them on the schedule described below. We do not use your birth details to profile you for health, medical, or other sensitive purposes, and your reading is meant for self-reflection, not as medical, psychological, legal, or financial advice.
3. Why we use your data, and our legal basis
Under the GDPR, we need a lawful basis for every use of your data. Here is ours.
| What we do | Why | Legal basis |
|---|---|---|
| Create and deliver your personalized reading | This is the service you asked for | Performance of a contract (Art. 6(1)(b)) |
| Take payment, confirm your order, prevent fraud | To complete your purchase | Performance of a contract (Art. 6(1)(b)); legitimate interest for fraud prevention (Art. 6(1)(f)) |
| Keep order and payment records for tax and accounting | We are legally required to | Legal obligation (Art. 6(1)(c)) |
| Send you service emails (order confirmation, your reading, resend of your link) | To deliver what you bought | Performance of a contract (Art. 6(1)(b)) |
| Answer your support requests | To help you | Performance of a contract, or our legitimate interest in supporting customers (Art. 6(1)(f)) |
| Send you marketing emails (newsletter, follow-ups, and reminders if you started but did not finish an order) | Only if you asked us to | Your consent (Art. 6(1)(a)) |
| Measure and improve the site with privacy-preserving, cookieless analytics | To understand and improve the site | Our legitimate interest (Art. 6(1)(f)); no cookies, no cross-site tracking, no advertising |
| Keep the site secure and prevent abuse | To protect you and us | Legitimate interest (Art. 6(1)(f)) |
We do not make decisions about you that produce legal or similarly significant effects through automated processing alone.
4. How your reading is made
We think you should know where your data goes, so here is the journey from form to finished PDF:
- You enter your birth details on our website. The form passes your data straight through; the website itself does not keep a copy.
- At checkout, your birth details travel with your order through Lemon Squeezy so that fulfillment can begin.
- Your order is picked up by our fulfillment automation, which sends your birth details to our own calculation systems to compute your chart, then generates your reading automatically from that chart.
- Your reading is turned into a PDF and stored securely so it can be delivered and re-downloaded.
- We email you a private download link to your reading.
There is no account and no password. Your reading is reached through a private, tokenized download link, so please keep your delivery email.
5. Who we share your data with
We do not sell your personal data. We share it only with the service providers ("processors") that make Innaluma work, and only for the purposes described above. Each is bound by a data processing agreement. We describe our providers below by the function they perform. We can provide the current list of named sub-processors on request at support@innaluma.com.
| Provider | What they do for us | Data they handle | Location |
|---|---|---|---|
| Cloudflare | Hosts our website (static pages + serverless Worker), stores your finished reading file so it can be delivered and re-downloaded, and provides cookieless Cloudflare Web Analytics | Page requests, aggregate analytics (no cookies, no birth details), your reading file | US/EU (global edge) |
| Lemon Squeezy | Our payment provider and Merchant of Record (the seller of record for your purchase); also carries your birth details as order data to start fulfillment | Name, email, birth details (as order data), billing and card details (they handle card data; we never see full card numbers) | United States |
| Order-processing automation | Receives your order and coordinates producing your reading | Name, email, birth details, your finished reading | European Union |
| Order record, cloud processing & support inbox | Keeps a private order record, provides cloud services used to prepare your reading, and hosts our support mailbox | Order ID, email, status; reading-preparation data; support messages | US/EU |
| Document generation | Converts your reading into a downloadable PDF | Your reading content (name, birth details, text) | European Union |
| Email delivery | Sends your order and delivery emails | Name, email, your download link | US/EU |
| Email marketing platform | Sends optional marketing emails, only if you opt in | Email, first name, language (no birth details) | United States |
| Location search | Powers the birth-place search box in your browser as you type | The place text you type | United States |
We may also disclose data if the law requires it, to enforce our terms, or to protect our rights, safety, or property.
6. Cookies and analytics
We do not use advertising cookies, tracking pixels, or cross-site tracking, and we do not show a cookie banner, because our analytics set no cookies. The only cookie we use is a strictly-necessary one that remembers your language (innaluma_locale), and it needs no consent.
For analytics we use one cookieless, privacy-preserving tool, Cloudflare Web Analytics, which measures aggregate usage (pages viewed, referrers, and approximate country) without setting cookies, without storing anything on your device, and without tracking you across other websites. Because no information is stored on or read from your device, no consent banner is required. Our lawful basis is our legitimate interest in understanding and improving the site (Art. 6(1)(f)). We never put your name, email, or birth details into analytics.
7. How long we keep your data
| Data | How long |
|---|---|
| Birth details entered on the site | Not stored on the website; passed straight through to fulfillment |
| Your reading PDF and the data used to generate it | 90 days |
| Order and payment records | For as long as tax and accounting law requires. As our Merchant of Record, Lemon Squeezy retains these (commonly 6 to 10 years, depending on country) |
| Order log (order ID, email, status) | 24 months |
| Support emails | 24 months |
| Marketing list | Until you unsubscribe or ask us to delete you |
| Analytics data | Aggregate, cookieless analytics: Cloudflare Web Analytics retains roughly 30 days. No individual profiles are created. |
When a retention period ends, we delete or anonymize the data. Payment records that we are legally required to keep are an exception, and we will tell you if that applies to an erasure request.
8. Where your data goes (international transfers)
Some of our providers are based in the United States (for example Lemon Squeezy, our payment provider, and some cloud and email services). When your data is transferred outside the European Economic Area, we rely on the safeguards the GDPR allows: the EU Standard Contractual Clauses, and, where the provider is certified, the EU-US Data Privacy Framework.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Correct data that is wrong or incomplete. If your birth details were entered incorrectly, tell us and we will regenerate your reading for free.
- Delete your data ("right to be forgotten").
- Restrict or object to how we use your data.
- Receive a copy of your data in a portable format, or ask us to transfer it.
- Withdraw consent to marketing at any time, without affecting anything we did before you withdrew it.
To exercise any of these, email support@innaluma.com. We may need to confirm you own the email address on the order before we act, to protect your data.
You also have the right to complain to a supervisory authority. Because Innaluma is operated by a company established in Spain, our lead supervisory authority is the Spanish AEPD (Agencia Española de Protección de Datos, aepd.es). You can also complain to the data protection authority of the place where you live or work in the EEA. We would appreciate the chance to resolve your concern first.
10. Children
Innaluma is intended for adults. Our service is not directed at anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us their data, contact support@innaluma.com and we will delete it.
11. How we protect your data
We use encrypted connections, access controls, and providers who commit to appropriate security. We keep your birth details only where they are needed to run your order, and no one accesses them except to fulfill your order or help you with support. No system is perfectly secure, but we take the care your data deserves.
12. Changes to this policy
We may update this policy as our service or the law changes. The date at the top shows the latest version. If we make a material change, we will post a notice on the site and email affected customers.
13. Contact us
Innaluma, a trading name of STARFINITY, SOCIEDAD LIMITADA (NIF B27662683) Rambla del Poblenou 11, 08006 Barcelona Email: support@innaluma.com