Privacy Policy

1. Who is responsible

Mythos operates whatsmythos.com. For the purposes of the EU/UK General Data Protection Regulation, the controller is the operator of this site, reachable at hello@whatsmythos.com.

This policy explains what we collect, why, with whom we share it, how long we keep it and what rights you have. It applies to the website, the oracle conversation, accounts, credits and payments.

2. What we collect

Account data: email address, hashed password, display name (optional), language, sign-up date and account identifiers.

Reading data: the messages you send to the oracle, the generated reading, your archetype scores, card style, credits, invitations and gift links.

Payment data: order ID, purchased credit pack, amount, currency, payment status and the merchant-of-record reference. We do not receive or store your full card number.

Technical data: IP address, browser and device type, pages visited, consent status and security logs. This is processed by our hosting provider and, only with consent, by analytics providers.

Contact data: your name, email and message when you write to us.

3. Purposes and legal bases

We process account and reading data to provide the service (performance of a contract), to manage credits and payments (contract and legitimate interest in preventing fraud), and to comply with legal obligations such as tax and accounting.

We use optional analytics and advertising only with your consent. You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal.

We use security logs under our legitimate interest in protecting the service and its users.

4. Processors and recipients

Supabase — database, authentication and storage of account and reading data.

OpenAI or another configured AI provider — processing of conversation messages to generate the reading.

Cloudflare — hosting, content delivery and security.

Waffo.com Limited — payment processing, tax and invoicing as merchant of record.

Google (Google Analytics 4) and Microsoft (Clarity) — usage analytics, loaded only after consent.

An email delivery provider — processing of contact-form messages.

We do not sell personal data. We disclose data only to the processors above, when required by law, or to protect rights and safety.

5. International transfers

Some providers process data outside the EU/EEA, particularly in the United States. Where required, we rely on Standard Contractual Clauses, an adequacy decision, or the provider’s equivalent safeguards.

6. Cookies, analytics and advertising

Essential cookies and local storage keep you signed in and remember your consent choice. They do not require consent because the service cannot function without them.

Optional analytics cookies from Google Analytics 4 and Microsoft Clarity are loaded only after you accept analytics. We use Google Consent Mode and the Clarity consent signal where applicable. You can decline and still use every feature of the site.

Some content pages may display advertising. Advertising providers such as Google AdSense may set cookies after consent. Advertising is not placed on sign-in, payment, result or dashboard screens, and it does not influence any reading. See “Advertising” below.

7. Advertising disclosure

This site is supported by advertising and paid readings. Advertisements are served by third parties and are visually separate from editorial content. We do not write or endorse the claims in third-party ads.

If you are in the EEA, the UK or Switzerland, personalized advertising requires your consent. You can change your choice by clearing the consent setting in your browser storage, or by contacting us.

8. Retention

Account and reading data are kept until you delete your account or ask us to delete specific readings. You can request deletion at any time.

Payment records are kept for as long as tax and accounting law requires. Consent records are kept for a maximum of 24 months. Security logs are kept for a limited period and then deleted or aggregated.

9. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict or object to processing, and to receive your data in a portable format. You may also withdraw consent and lodge a complaint with your local supervisory authority.

To exercise any right, write to hello@whatsmythos.com. We may need to verify your identity before acting. We respond within the time required by applicable law.

10. Children

Mythos is intended for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

11. Security

We use encrypted connections, separated access roles and established providers. No method of transmission or storage is completely secure. Please use a strong password and do not share sensitive personal, medical or financial information with the oracle.

12. Changes

We may update this policy. Material changes will be announced on the site. The version published here is the version in force. If a change requires consent, we will ask for it.