Privacy Policy

Last updated: 10 August 2026

This Privacy Policy describes how AI Catalyst, Lda., with registered office in Azeitão, Setúbal, Portugal, tax number (NIF) 518188639 ("we", "us", "Nuvia"), collects, uses, shares and protects personal data of users of the Nuvia Horoscope mobile application (the "App"), available for iOS and Android.

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and other applicable law in Portugal. If you live in the United States, Section 13 contains additional disclosures and rights that apply to you, and Section 14 explains our position on children.

Please read Section 4 carefully. It describes a feature we call the consultant memory, in which the artificial intelligence that writes your readings automatically extracts and stores short personal facts about you from what you write. This is the part of the App that has the greatest impact on your privacy.

1. Who we are and how to contact us

Data controller: AI Catalyst, Lda.
Address: Azeitão, Setúbal, Portugal
Tax number (NIF): 518188639
Privacy contact e-mail: info@aicatalyst.dev

We have not appointed a Data Protection Officer, as we are not required to do so. All privacy requests are handled at the address above.

2. What we collect

We only collect what is listed below. Everything here comes from you, with one exception, set out in 2.8: the e-mail address of a person another user asks us to invite. We do not use any analytics, advertising or crash-reporting toolkit in the App: there is no Google Analytics, no Firebase Analytics, no Sentry, no advertising identifier and no tracking for advertising purposes. The App can read your device model, but it never sends it to us.

2.1 Account data

• Name — the name you type at registration, or the name supplied by Google or Apple if you sign in with them. A name is required before your first reading.
• E-mail address — always required. If you sign in with Apple and choose to hide your e-mail, we receive and store the Apple private relay address instead.
• Password — stored only as a bcrypt hash. We never store your password in readable form. Accounts created through Google or Apple have no password at all.
• Sign-in identifiers — the unique account identifier issued to us by Google or by Apple, and, for Apple accounts, a refresh token that Apple requires us to hold so that we can revoke the sign-in if you delete your account.
• Date of birth — optional at registration, but required before your first reading, because your birth chart is calculated from it.
• Gender — one of male, female or other. Also required before your first reading, so that the interpretation addresses you correctly. It is not used in any calculation.
• Preferred language — Portuguese, Brazilian Portuguese, English, Spanish or French.
• Account status data — whether your e-mail has been verified, e-mail verification and password-reset tokens (stored only as hashes and short-lived), account-deletion confirmation codes (stored only as hashes, valid 15 minutes), and creation and update timestamps.

We do not collect a telephone number. Earlier versions of this Policy said we might; that was incorrect and has been removed.

2.1A Birth data

Your date, time and place of birth are the most sensitive data this App holds. They are what makes a real chart possible: without the time and the place there is no Ascendant, no Midheaven and no houses, and the App tells you so rather than guessing.

• Time of birth, and how precise it is — exact, approximate (with the margin you give us) or unknown. Optional: without it we calculate only what does not depend on it.
• Place of birth — chosen from a list of localities held on our own server. We store the identifier of that locality, its latitude and longitude, and the IANA time zone that applied there on that date. This is where you were born, not where you are now: we do not collect GPS or any live location.
• House system (Placidus or Whole Sign) and the charts calculated from all of the above, stored together with the versions of the ephemeris, the time-zone database and the calculation rules used, so that the same chart can be reproduced exactly.
• If you create a chart for another person — for a compatibility reading, for example — everything above applies to their data too. Section 15 covers what that means.

Birth data is stored encrypted, is never written to our application logs in readable form, and is deleted with your account.

2.2 Session and device data

• Session tokens — stored only as keyed hashes, never in usable form.
• Your IP address and the user-agent string of the app or browser, recorded each time a session is created, so that we can identify and investigate abuse of an account. Please see Section 9 for how long these are kept — it is a long time.
• Push notification token issued by Expo for your device, the platform (only the values "ios" or "android"), and your device's IANA time zone (for example "Europe/Lisbon"), so that notifications arrive at a sensible hour locally. The time zone is a coarse regional indication, not a location: we do not collect GPS or any precise location data.
• A record of which reminder notifications we sent you and when.

2.3 Reading content

• The subject of the reading — free text you write, up to 500 characters.
• Your follow-up messages — free text, up to 2 000 characters each, and the interpretations the AI writes in reply.
• A snapshot of your name, date of birth and gender as they were at the moment the reading was created. This snapshot stays attached to that reading even if you later change your profile.
• Which service was used, the calculated chart the reading was based on, the identifiers of the astrological facts handed to the AI, the language, the credits spent, how many of the included follow-up questions you have used, whether the reading was finished, and the relevant timestamps.

2.4 The consultant memory — short personal facts extracted automatically from your messages by the AI. This is described in full in Section 4.

2.5 Purchases and credits

• A ledger of every credit movement: the amount, the reason, the reading it relates to where applicable, and an internal note that may contain the store transaction identifier.
• Store purchase records: product identifier, transaction identifier, store (Apple or Google), whether it was a one-off pack or a subscription, credits granted, subscription period start and end, price in US dollars, price in local currency and the currency code.
• We never receive or store payment card details. Payment is handled entirely by Apple or Google.

2.6 Technical AI logs — for each call to the AI provider we record the model used, the type of call, token counts, response time, whether it succeeded, any error text, an internal request identifier and the account identifier. These logs do not contain the text of your prompts or of the AI's answers.

2.7 Server logs — our servers write operational logs which, for events such as account creation, sign-in with Google or Apple, password-reset requests and outgoing e-mails, currently include your e-mail address in readable form. These logs are held on our own server and are used only for operating and debugging the service.

2.8 Recommendations — if a user recommends the App to someone, we store that person's e-mail address, who recommended them, and the dates on which the invitation was sent, an account was created with that address, and the credits were awarded. This is the only data we collect on purpose about someone who is not a user: it comes from another user, not from the person it is about. Section 15 covers the other case — things you write about other people inside a reading. We use it for four things and no others — to send that person one invitation, to check that the same address is not recommended twice, to award the credits when they make a purchase, and to tell the user who recommended them that the credits have arrived. That last message names the address, because it is the address that user typed; it does not reveal the person's name, what they bought, or anything else about them.

The invitation goes the other way too: it carries your name and your e-mail address to the person you invited, so they can tell who is writing to them and reply if they want to. Nothing else about you is in it — not what you read, not what you bought, not that you have an account at all beyond the fact that you sent the invitation. We never add it to a mailing list, never send a second message, and never share it with anyone except the e-mail provider that delivers the invitation. If the address is yours and you would rather we did not have it, write to info@aicatalyst.dev and we will erase it. How long we keep it is in Section 9.

3. Purposes and legal bases (GDPR)

• Providing the service — performance of a contract, Art. 6(1)(b): creating and running your account, generating readings, holding your reading history, managing credits and subscriptions, sending transactional e-mails (verification, password reset, account-deletion code).
• The consultant memory — performance of a contract, Art. 6(1)(b), as it is part of how the reading feature works; and, where the facts touch on special categories of data such as health, your explicit consent, Art. 9(2)(a), given by choosing to write that information into a reading. You can withdraw it as described in Section 4.
• Security and abuse prevention — legitimate interest, Art. 6(1)(f): keeping the IP address and user-agent of each session, and keeping a record of deleted account e-mail addresses so that the one-off welcome credits cannot be claimed repeatedly by deleting and recreating an account, and checking a recommended address against that record and against our list of users.
• Recommendations — legitimate interest, Art. 6(1)(f): storing the e-mail address of a person a user asks us to invite, sending that person a single invitation, and later matching it against a new account in order to award the credits. Our interest is in growing the App through the people who already use it; we consider it balanced against the recipient's interest because the address comes from someone who knows them, we send one message and never a second, we never add the address to any list, and the recipient can have it erased on request. If you would rather we did not process an address this way, do not enter it.
• Reminder notifications — legitimate interest, Art. 6(1)(f), combined with the notification permission you grant at operating-system level and can revoke at any time. See Section 8.
• Diagnostics and reliability — legitimate interest, Art. 6(1)(f): the technical AI logs and server logs described in Sections 2.6 and 2.7.

We do not process your data for advertising, for profiling for advertising, or for personalised pricing.

4. The consultant memory — facts the AI stores about you

To make readings feel continuous, the AI that writes your readings can notice short personal facts from what you write and store them, so that the next reading knows who it is talking to. Those facts are then included in every subsequent reading and sent to our AI provider along with the rest of the prompt.

This is off unless you turn it on. It is disabled by default for every account. Turning it on requires an explicit confirmation in the App, in Account › Personal information, after the same explanation you are reading here. While it is off, nothing new is stored and nothing already stored is sent to the AI.

What kind of facts. The AI is instructed to record things such as likes and dislikes, people around you, work, health, places you have been, things you want, habits and personality traits. Real examples of the format used are: "her father died in 2024", "does not eat meat", "sleeps badly", "has an older sister", "is having physiotherapy on her knee".

This means the memory can contain sensitive information — including information about your health, your family and relationships, your beliefs, and information about other people who never agreed to anything. We ask you to keep this in mind when you write. If you would rather nothing were remembered, avoid putting such details in the subject of a reading or in your messages.

Limits. A maximum of 20 facts are kept for each account. Each fact is at most 45 characters and 8 words. At most 3 new facts can be added per message. When the limit of 20 is reached, the oldest facts are dropped.

How long they last. Indefinitely, for as long as your account exists. They have no expiry date. They disappear only when the AI itself decides a fact is no longer accurate, when they are pushed out by the 20-fact limit, when you ask us to delete them, or when you delete your account.

How to see or delete them. In the App, go to Account › Personal information. There you can turn the feature on or off, read the full list of what has been stored, delete any single item, or delete everything — immediately, and without asking us. Each deletion asks for confirmation first. Two things are stored for each item: the short fact, and the message you wrote that it came from. The message is kept so that the AI can answer you with your own words instead of guessing at what you meant. The list in the App shows the facts; if you also want to see the stored messages, write to us and we will send them. Deleting a fact deletes its message with it. You can also write to info@aicatalyst.dev from the e-mail address on your account if you prefer that we do it. Deleting your account (Section 10) erases them immediately and permanently.

5. Artificial intelligence: what is sent, and what it does

Interpretations are generated by large language models operated by OpenAI. For each reading and each follow-up message, the following is transmitted to OpenAI:

• your name, your date of birth written out in the prompt, and your gender;
• the subject you wrote for the reading;
• all of the stored consultant-memory facts (up to 20), in every call;
• the recent conversation history of that reading (up to 12 messages or 12 000 characters);
• the astrological facts our engine calculated — positions, signs, degrees, houses, angles and aspects — the service, and the language of the reading.

The AI returns the interpretation text and, separately, any facts to add to or remove from the consultant memory. We store the interpretation as part of the reading, and we apply the fact changes as described in Section 4.

An honest note on model training. A previous version of this Policy stated that we contractually instruct our providers not to use this data to train their models. We rely on the standard business terms of our AI provider, under which data submitted through the API is not used to train its models. We do not currently use any additional zero-data-retention configuration, which means the provider may retain the content of these calls for a limited period for abuse monitoring, in line with its own policies.

The readings are text. There is no automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR: nothing the AI writes affects your rights, your access to the service, your prices or your credits.

6. Who else receives your data

We do not sell your data and we do not share it for advertising. We use the following providers, and only for the purposes stated:

• OpenAI, L.L.C. (United States) — receives everything listed in Section 5, to generate readings and maintain the consultant memory.
• RevenueCat, Inc. (United States) — purchase validation. It receives only your numeric account identifier, and returns transaction, product, store, date and price information. It receives no name, no e-mail and no reading content.
• Expo (650 Industries, Inc.) (United States) — delivery of push notifications. It receives your device push token and the title and body of the notification, which are short generic reminder texts containing no reading content.
• Apple Inc. and Google LLC — as the operators of Apple Push Notification service and Firebase Cloud Messaging, they carry out the final delivery of notifications to your device. As identity providers, they verify sign-in with Apple or Google, returning the account identifier, e-mail address and verification status, and for Google the name. As app stores, they process all payments and provide us with purchase confirmations.
• Our e-mail (SMTP) provider — receives your e-mail address and the content of transactional messages: verification links, password-reset links, the six-digit account-deletion code, and recommendation invitations (Section 2.8). These e-mails are sent in the language chosen in the App; an invitation is sent in the language of the person who asked us to send it.

Hosting. The App's backend and database run on a server operated by us in the United States. Contrary to what an earlier version of this Policy said, we do not use Google Cloud and we do not use any third-party analytics service.

Our own staff. A small internal administration area allows authorised personnel of AI Catalyst to see account names, e-mail addresses, credit balances, the number of readings and the subject line of each reading, for support and abuse investigation. It does not display the messages within a reading, nor the consultant-memory facts.

We may also disclose data where we are legally obliged to do so, or to establish, exercise or defend legal claims.

7. International transfers

Your data is stored in the United States, on a server we operate there. OpenAI, RevenueCat, Expo, Apple and Google are also established in the United States. If you are in the European Economic Area or the United Kingdom, this means that all of your data — your account, your readings, the messages in them and your consultant-memory facts — is transferred outside the EEA and processed there, and not only when a third party receives it.

These transfers take place under the Standard Contractual Clauses approved by the European Commission, and, where the provider is certified, under the EU–US Data Privacy Framework adequacy decision. You may request a copy of the relevant safeguards by writing to info@aicatalyst.dev. This applies to everything, all of the time — not only to the content of a reading at the moment it is generated.

8. Notifications

We send three kinds of notification. Two are reminders about the App itself: one if you have not done a reading for three days, repeating every three days; and one if you have a reading you have not finished, at most once a day and never more than five times while you have unfinished readings. They are sent at around 7 p.m. in your device's time zone. The third is not a reminder: if someone you recommended makes their first purchase, we tell you that the credits have arrived, naming the address you gave us. It is sent once, when it happens.

We keep a copy of every notification we send you — its text, the date, and whether you have read it — so that the App can show you a list of them. It holds the last hundred; older ones fall off. Nothing in it leaves our server, and it is deleted with your account. We send no promotional or marketing notifications, and no marketing e-mail to our users. There is one message we send to someone who is not a user: the recommendation invitation described in Section 2.8. It goes out once, only to an address a user has typed for that purpose, and it is never followed by a second message.

Notifications depend on the permission you grant to the App at operating-system level. You can switch them off at any time in the App settings, which also deletes that device's push token from our servers, or in your device's own settings. Signing out also removes the token. The setting is per device, not per account.

9. How long we keep things

• Account data, readings, messages, consultant-memory facts, credit ledger, purchase records — for as long as your account exists. Readings you delete in the App are marked as deleted and hidden from you, but their text remains in our database until the account itself is deleted.
• Session records, including your IP address and user-agent — sessions are configured with a very long lifetime (approximately ten years) and the records are purged seven days after a session expires or is revoked. In practice this means an IP address may remain on file for close to ten years unless you delete your account or sign out. We are reviewing this retention period and intend to shorten it.
• E-mail verification links, password-reset and account-deletion codes — the verification link expires after twenty-four hours, and the codes themselves after one hour and after fifteen minutes, respectively; the record that a request was made remains until the account is deleted.
• Technical AI logs and server logs — these currently have no automatic deletion schedule. Server logs are rotated by the operating system according to available space.
• Deleted-account e-mail addresses — kept indefinitely. See Section 10.
• Notifications we sent you (Section 8) — the last hundred, kept until you delete your account.
• Recommended e-mail addresses (Section 2.8) — kept while the recommendation may still be awarded, and kept indefinitely once it has been, so that the same address cannot be recommended twice. If the user who gave us the address deletes their account before the recommendation is awarded, the address is deleted with it. Either of you may ask us to erase it at any time.

10. Deleting your account, and what survives it

You can delete your account at any time in the App settings. We send a six-digit confirmation code to your e-mail, and once you confirm, deletion is immediate and permanent — not, as an earlier version of this Policy said, within 30 days. If you signed in with Apple, we also revoke that sign-in with Apple at the same time.

Deletion erases: your account record, all sessions, all readings and all messages within them, all consultant-memory facts, your credit ledger and remaining credits, your purchase records, your push devices and notification history, and any pending reset or deletion codes.

Four things survive, and you should know about them:

• Your e-mail address, in readable form, kept indefinitely in a list of deleted accounts. It serves two purposes, and no others: stopping the same address from claiming the 5 free welcome credits again by deleting and recreating an account, and stopping that address from qualifying as a recommendation (Section 2.8). It is never used to contact you and is never shared. If you want it removed as well, write to us and we will erase it, on the understanding that we may then decline to grant welcome credits to a new account.
• Technical AI log rows (Section 2.6), which retain the numeric account identifier of an account that no longer exists. They contain no reading content and no contact details.
• Recommendations already awarded (Section 2.8), which keep the recommended address so that it cannot be recommended again, and a numeric account identifier that no longer points to an account. Recommendations not yet awarded are deleted with your account.
• Server log entries (Section 2.7), which may contain your e-mail address, until those logs are rotated.

11. Your rights under the GDPR

If you are in the European Economic Area or the United Kingdom, you have the right to access your data, to rectify it, to erase it, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.

In practice:

• Access and portability — the App does not yet have an export function. Write to info@aicatalyst.dev from your account e-mail address and we will send you a copy of your data, including your readings, your messages and your consultant-memory facts, in a machine-readable format, normally within 30 days.
• Rectification — you can change your name, date of birth, gender and language in the App. To correct a consultant-memory fact or anything inside a past reading, write to us.
• Erasure — you can delete your account in the App, subject to Section 10. To erase individual facts or readings without deleting the account, write to us.
• Objection — you can object to processing based on our legitimate interests, including the retention of your deleted-account e-mail address.

We do not charge for these requests and we do not treat you differently for making one. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Protecção de Dados — www.cnpd.pt — or with the authority in your country of residence.

12. Security

Communications with our servers are encrypted with TLS. Passwords are stored as bcrypt hashes; session tokens, password-reset tokens and account-deletion codes are stored only as cryptographic hashes, never in usable form. Access to the production database and to the administration area is restricted to authorised personnel.

No system is entirely free of risk. In the event of a personal data breach that poses a risk to individuals, we will notify the CNPD and the affected users as required by law, and will comply with the equivalent notification laws of US states where applicable.

13. Additional notice for residents of the United States

This Section applies if you reside in the United States. It supplements the rest of this Policy and is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and under comparable state privacy laws, including those of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Where a state law uses different terms, such as "consumer health data", "targeted advertising" or "profiling", we apply this Section to the equivalent concept.

13.1 Categories of personal information we collect

• Identifiers — name, e-mail address, internal account number, Google or Apple account identifier, push notification token, IP address. Source: you, and Apple or Google if you sign in with them. Retained as described in Section 9.
• Identifiers of people who are not users — the e-mail address of a person a user asks us to invite (Section 2.8). Source: another consumer, not the person themselves. Retained as described in Section 9.
• Customer records information (Cal. Civ. Code §1798.80) — name and e-mail address, in a form associated with your account.
• Protected classification characteristics — date of birth (and therefore age) and gender, both required before your first reading because they are used in the reading text.
• Commercial information — credit purchases and subscriptions, transaction identifiers, products bought, amounts paid and currency, credit balance and credit history.
• Internet or other electronic network activity information — user-agent string, device platform, device time zone, records of readings started and finished and of notifications sent.
• Geolocation data — none. We do not collect precise geolocation. Your device's time zone gives only a coarse regional indication.
• Audio, electronic, visual or similar information — none. We have no access to your microphone, camera, contacts, photos or calendar.
• Professional or employment information, and education information — not collected as such, but may incidentally appear if you write about your work in a reading, and may then be stored as a consultant-memory fact.
• Inferences — the consultant-memory facts described in Section 4, which the AI derives from what you write in order to build a profile of your preferences and circumstances for use in future readings.
• Sensitive personal information — your account credentials, and any information you choose to write into a reading that reveals health, sexual orientation or sex life, religious or philosophical beliefs, racial or ethnic origin, or union membership, together with any consultant-memory fact derived from it. We do not ask for this information and we do not need it; it reaches us only because you write it.

The business and commercial purposes for which we collect each of these categories, and the categories of third parties to which we disclose them for a business purpose, are set out in Sections 3, 5 and 6. In the twelve months preceding the date of this Policy, we disclosed personal information for business purposes only to the providers named in Section 6.

13.2 We do not sell or share your personal information

We do not sell personal information, and we have never sold it. We do not share it for cross-context behavioural advertising or targeted advertising. We do not disclose personal information to data brokers. We do not receive money or any other valuable consideration in exchange for personal information. This applies equally to consumers we know to be under 16, whose information is never sold or shared under any circumstances.

We do not use or disclose sensitive personal information for any purpose other than those permitted by the CCPA without a right to limit — namely, performing the service you asked for, security, and ensuring the service works as intended. Because of this, the right to limit the use of sensitive personal information does not currently give you anything you do not already have, but you may still exercise it and we will honour it.

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

13.3 Your rights

• Right to know / access — to obtain the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclosed it.
• Right to delete — to have your personal information deleted, subject to the exceptions in Section 10 and to legal exceptions.
• Right to correct — to have inaccurate personal information corrected, including consultant-memory facts.
• Right to data portability — to receive a copy in a portable, readily usable format.
• Right to opt out of sale, sharing and targeted advertising — we do none of these, so there is nothing to opt out of, but you may still tell us and we will record your preference.
• Right to limit the use of sensitive personal information — as described in 13.2.
• Right to opt out of profiling with legal or similarly significant effects — we do no such profiling. If you do not want the consultant memory used at all, tell us and we will erase your facts; note that we cannot currently switch the feature off permanently for a single account, so if you continue to use readings, new facts may be recorded and you may need to ask again.
• Right to non-discrimination — we will not deny you service, charge you a different price, give you a lower quality of service, or penalise you in any way for exercising any of these rights.
• Right to appeal — if you are in a state that provides for it (for example Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas or Virginia) and we decline your request, you may appeal by replying to our decision. We will respond within 45 days, or 60 days where the law allows, and will tell you how to contact your state Attorney General if you remain dissatisfied.

13.4 How to exercise these rights

Use the account deletion function in the App settings, or write to info@aicatalyst.dev stating which right you wish to exercise. We verify requests by requiring you to write from the e-mail address registered on the account, and, where the request concerns specific pieces of information or sensitive information, by asking you to confirm details we already hold, such as the date of account creation or a recent purchase. We do not use the information you give us for verification for any other purpose.

We respond within 45 days, extendable once by a further 45 days where reasonably necessary, and we will tell you if we need the extension. There is no charge. An authorised agent may make a request on your behalf if they provide written permission signed by you; we may still contact you directly to confirm.

13.5 Global Privacy Control

Nuvia Horoscope is a native mobile application and does not operate a website that receives browser-based opt-out preference signals. Because we do not sell or share personal information, there is nothing for such a signal to switch off. If we ever receive a Global Privacy Control or equivalent signal from you, we will treat it as a valid opt-out request and process it as described above.

13.6 California "Shine the Light"

We do not disclose personal information to third parties for those third parties' own direct marketing purposes.

13.7 Notice on financial incentive

We operate two programmes that give you something of value, and both are financial incentives under the CCPA.

Welcome credits. New accounts receive 5 free credits once. As explained in Section 10, we keep the e-mail addresses of deleted accounts indefinitely in order to prevent the same person from claiming those credits repeatedly. You may ask us to erase that record at any time; if you do, we may decline to grant welcome credits to any future account you create.

Recommendations. If you give us the e-mail address of someone who does not use the App, and that person creates an account with that address and makes a purchase, you receive 10 credits and they receive 10 credits. You join by typing an address in the App; there is nothing to sign. Each recommendation pays once, however much that person later buys, and there is no limit on how many people you may recommend in total, though we accept only a few invitations per hour from each account, so that the feature cannot be used to test addresses in bulk. You leave simply by not recommending anyone; nothing is required of you, and no part of the App is withheld if you never use it. You may ask us at any time to erase an address you gave us, at info@aicatalyst.dev, and the person whose address it is may ask the same.

How we value it. A credit is worth what it costs in the App: the reasonable value of the incentive is the price of the smallest credit pack divided by the number of credits in it, multiplied by the credits given. That value reflects what it costs us to serve those readings — the AI calls they pay for — and not any value we place on your personal information, which we do not sell.

14. Children

Nuvia Horoscope is not directed to children. The minimum age to use the App is 16, or a higher age if the law of your country of residence requires it for the processing described here. We do not knowingly collect personal information from anyone under that age, and, in line with the United States Children's Online Privacy Protection Act ("COPPA"), we do not knowingly collect any personal information from children under 13.

We ask for a date of birth at registration, but we should be clear that the App does not currently perform an automated age check on it, and a date of birth indicating an age below the minimum is not presently rejected. We are correcting this.

If we learn that we hold personal information belonging to someone below the minimum age, we will delete the account and all associated data, including any consultant-memory facts, without delay and without requiring a formal request. If you are a parent or guardian and believe your child has created an account or provided us with personal information, write to info@aicatalyst.dev and we will act on it promptly, and confirm to you once it is done. We never sell or share the personal information of anyone under 16.

15. Nature of the service, and information about other people

Readings are generated for entertainment and self-reflection. They are not medical, psychological, legal or financial advice.

Please bear in mind that whatever you write into a reading is stored, is sent to our AI provider, and may be turned into a consultant-memory fact. This includes anything you write about your health or about other people. If you write about a third party, you are providing us with their personal data, and we ask you not to include information about identifiable third parties that they would not want recorded. If someone believes we hold information about them that came from another person's reading, they may write to info@aicatalyst.dev and we will locate and erase it.

The same applies when you recommend the App to someone (Section 2.8). Typing their address gives us the personal data of a person who has no account and has agreed to nothing, so please only enter the address of someone you would be comfortable telling that you did it. We write to them once, we say who gave us the address — with your name and your e-mail address, so they know who it is — and we tell them how to have it erased. If you received such an invitation and want your address removed, write to the same address and it is gone.

16. Changes to this Policy

We may update this Privacy Policy. Where the changes are significant, we will tell you through the App before they take effect. The date of the last update appears at the top of this document.

17. Contact

For any question about privacy and data protection, or to exercise any right described above, write to info@aicatalyst.dev, or to AI Catalyst, Lda., Azeitão, Setúbal, Portugal.