Privacy Policy

This Privacy Policy explains what personal data DateMyst.com and the DateMyst mobile app (the “Service”) process, for what purposes and on what legal basis, who receives the data, how long we keep it and what rights you have. It is the information required by Articles 13 and 14 GDPR. The rules for using the Service and concluding contracts are set out in the Terms of Service, and cookies are described in the Cookie Policy.

Version of October 12, 2026. Changes: we state plainly that the IP address and other data collected automatically are personal data, and how long we keep them; we process the date of birth and names given in an order to perform the contract (not on the basis of consent); we send free materials by email without consent to offers, and marketing information only with consent; an unsubscribed address stays on a list of unsubscribed addresses; full list of recipients of data (including Postmark for the mailing list, encrypted backups on Google Drive, OpenStreetMap and OneSignal); what data we send to OpenAI for the chat, tarot and reports (section 6); health data in questions (section 7); profiling in emails (section 11); all retention periods in one place (section 12). Earlier changes: October 8, 2026 – the mobile app, and chat and tarot history visible only to you; October 6, 2026 – advertising pixels and Google Analytics only after consent in the cookie banner, Meta Conversions API; October 2, 2026 – OpenAI and PayPal among recipients of data, Google Ads.

1. DATA CONTROLLER

The controller of your personal data (the “Controller”, “we”) is:

GREXIM Daniel Maciszyn
Sokołowice 112a, 56-400 Sokołowice, Poland
NIP (Polish tax ID): 9112058564
Email: contact@datemyst.com
Contact form: https://datemyst.com/contact

We have not appointed a Data Protection Officer, as we are not required to do so (Article 37 GDPR). For any question about the processing of your data, you can contact us directly by email, through the contact form or by letter to the address above.

2. DEFINITIONS

• GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
• Electronic Communications Law: the Polish Electronic Communications Law of 12 July 2024 (Polish: Prawo komunikacji elektronicznej; Journal of Laws 2024, item 1221).
• User (“you”): a natural person who uses the Service.
• Personal data: any information relating to an identified or identifiable natural person. This includes, for example, the IP address and identifiers stored in cookies, if they can be linked to a specific person.
• Processing: any operation performed on personal data, whether or not by automated means.
• Profiling: any form of automated processing of personal data used to evaluate certain personal aspects of a natural person.
• Consent: a freely given, specific, informed and unambiguous indication of your wishes by which you agree to the processing of your personal data.
• Cookies: small text files stored on your device, described in the Cookie Policy.

3. DATA WE PROCESS

• Data collected automatically: IP address, browser type and operating system, screen resolution, country determined from the IP address (using a local database, without sending the address anywhere), pages visited and time spent on them, the referring page, campaign parameters (UTM), browser language and the visit identifier td_session. The IP address and the visit identifier are personal data – they are not anonymous.
• Account: name or nickname, email address, password (stored as a cryptographic hash), login session data (including the IP address).
• Data for calculations and reports: name, date of birth and, for Human Design, also time and place of birth (with coordinates); another person's data (section 4).
• Orders and payments: product, amount, date, full name, email address, country, payment method and the payment status received from the operator; the text and time of the statements you made at checkout. We do not receive full card or PayPal account details. With your consent to marketing cookies, we also save in the order your IP address, browser data and Meta cookie identifiers (section 11).
• Free materials and the mailing list: email address, name, date of birth (if the material needs it), language, sign-up source, IP address, date of sign-up and confirmation, the text of the consent shown to you and the status (for example “without consent” or “unsubscribed”).
• Quiz: answers, name, email address, date of birth, IP address.
• Sending emails: whether a message was delivered and opened and whether a link in it was clicked (Postmark and an invisible image in the message).
• Correspondence and support tickets: the content of messages, email address, IP address for tickets.
• Artificial intelligence features: questions you type in tarot and in the “Ask your matrix and sky” chat, the answers, the cards drawn and your notes (sections 6 and 12).
• Reviews: rating, text, signature, consent to publication, link to the order.
• Gift: the “for”, “from” and message fields entered by the buyer (they may contain the recipient's name); when the gift is redeemed – the recipient's name, date of birth and email address.
• Mobile app: the DateMyst app for Android uses the same account as the Service. The name and date of birth entered in the app are stored on the phone and sent to our server for calculations (matrix, sky, tarot); when you use the “Ask your matrix and sky” chat, the date of birth is also saved in the account profile. Sign-in uses a code sent by email, and the sign-in token is kept in the phone's encrypted storage. Reminders are local notifications on the phone, with no external notification service. The app shows no ads and contains no analytics or tracking tools. The account can be deleted in the app (Account → “Delete account”) or as described on the “Account deletion” help page.

4. THIRD-PARTY DATA (INCLUDING CHILDREN)

For the Partnership Matrix, the Child Matrix and similar services, you enter another person's data – usually their name and date of birth. By entering it, you confirm that you are entitled to provide it (for example as a parent or legal guardian of a minor) or that you have that person's consent. We process this data only to prepare the analysis you ordered and to show it in your Account: we save it in your Account as a separate profile and in the order. We delete the profile together with your Account, or earlier at your request; the data in the order – after the period stated in section 12. The source of this data is you (Article 14 GDPR). The same applies to the recipient's name that a buyer writes on a Gift card.

5. PURPOSES AND LEGAL BASES OF PROCESSING

• Account – creating and running the Account, logging in (with a password or a code sent by email), access to purchased content and history. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Orders – calculations and reports (name, date of birth and, for Human Design, also time and place of birth; another person's data for the Partnership Matrix or Child Matrix), payment, order confirmations, handling Gifts, withdrawals and complaints. Legal basis: performance of a contract (Article 6(1)(b) GDPR). We process the date of birth because without it we cannot prepare the analysis you ordered – we do not ask for separate consent.
• Free materials by email (for example a PDF with your matrix, a sample of the e-book, a quiz result, a tarot reading for guests, the card of the day, your year arcanum, an answer to a question to your matrix, the free “Your week”) and the one-time discount code included with them. Legal basis: performance of a contract for a free service you request (Article 6(1)(b) GDPR).
• Subscription, online tarot and the “Ask your matrix and sky” chat – including the history of questions and answers in the Account. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Health data – section 7.
• Mailing list and marketing information – materials about the Destiny Matrix, offers, discount codes, news, birthday wishes with a code. Legal basis: consent (Article 6(1)(a) GDPR), which is also required by Article 398 of the Electronic Communications Law. You can withdraw consent at any time with the link in every message.
• Service messages – confirmations, payment information, changes to the Terms and to this Privacy Policy. Legal basis: performance of a contract and legal obligations (Article 6(1)(b) and (c) GDPR).
• Review requests and publication of reviews – a one-time request for a review after a purchase: our legitimate interest in learning what customers think (Article 6(1)(f) GDPR; you can object with the link in the message). Publication of a review on the website: the author's consent (Article 6(1)(a) GDPR).
• Tax and accounting obligations – invoices and sales records. Legal basis: legal obligation (Article 6(1)(c) GDPR).
• Contact and support tickets (form, email, ticket system). Legal basis: our legitimate interest in replying to your message (Article 6(1)(f) GDPR) and, if the matter concerns a contract, its performance (Article 6(1)(b) GDPR).
• Security, preventing abuse, proof of consents, the list of unsubscribed addresses, establishing, pursuing and defending claims. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
• Our own visit and sales statistics (page views with the IP address, the visit identifier td_session, traffic source and campaign parameters, country determined from the IP address). Legal basis: legitimate interest in developing the Service and assessing the effectiveness of our activities (Article 6(1)(f) GDPR).
• Tailoring the content of emails to people on the mailing list (section 11). Legal basis: legitimate interest in direct marketing (Article 6(1)(f) GDPR); you can object at any time.
• Analytics and marketing cookies, advertising pixels, sending purchase events to Meta and Google from our server. Legal basis: consent in the cookie banner (Article 6(1)(a) GDPR, Article 399 of the Electronic Communications Law).

Providing data is voluntary, but without an email address and the data needed for the calculations you cannot place an order or receive free materials.

6. ARTIFICIAL INTELLIGENCE (OPENAI)

Some content is created for you by an OpenAI language model. We send only the data needed for the feature:

• “Ask your matrix and sky” chat – the question, your age (calculated from your date of birth), your matrix and Human Design results, today's sky and the key dates of the week and month, your recent tarot cards with questions, and up to 6 previous messages from the same conversation from the last 7 days;
• a guest's question on the free result – the question and the energies calculated from the date of birth; we do not save such a question;
• tarot – the question and the cards drawn; for logged-in Users also the age and the matrix arcana (without the name), and with the Subscription – the sky on that day;
• the “Your week”, “Your month” and “Your year” reports (including the free “Your week”) – name, date, time and place of birth;
• personalized parts of reports – name and date of birth; the interpretation of eclipses – date of birth.

The descriptions in PDF reports were written in advance, without using Users' data. Questions that indicate a crisis (suicidal thoughts, self-harm) are not sent to OpenAI – instead of an answer, we show helpline numbers. For logged-in Users, such a message is saved in the chat history (visible only to you) with a crisis flag; we see only the number of such cases. Content created by artificial intelligence is not used to make decisions that produce legal effects concerning you (Article 22 GDPR). OpenAI processes the data on our behalf under a data processing agreement. The party to the agreement on OpenAI's side is OpenAI Ireland Ltd (Dublin). OpenAI keeps data from requests for up to 30 days, solely to detect abuse, and does not use it to train models.

7. HEALTH DATA IN QUESTIONS

The chat and tarot are not meant for conversations about health and do not give medical advice. Please do not include information about your health or anyone else's (for example illnesses, medicines or pregnancy) in your questions. If you do, this is special category data (Article 9 GDPR). We then process it only to answer your question and to save it in the history that only you can see – on the basis of your explicit consent (Article 9(2)(a) GDPR). When a question is about health, we ask for this consent in a separate window before sending it; without consent, the question is not sent and you can change it. We do not use this data for advertising, profiling or any other purpose. The question goes to OpenAI like other questions (section 6). You can delete such a message at any time (individually or with the whole history) – we delete its content immediately. You can withdraw your consent at any time in your account settings (or by email to the address in section 1) – we then delete conversations and readings with questions about health from your history.

8. COOKIES AND THIRD-PARTY SCRIPTS

• Necessary (no consent needed): logging in and keeping the session, cart and checkout, security, remembering your choices in the cookie banner. Without consent, we also save the visit identifier td_session (30 days), which we use to count visits and the path to purchase in our own statistics – it is described in the Cookie Policy.
• Analytics (only with consent): visit statistics (Google Analytics) and heatmaps and session recordings (Microsoft Clarity; Clarity masks the text you type in forms).
• Marketing (only with consent): measuring the effectiveness of ads and tailoring ads on other platforms (Meta (Facebook, Instagram), Google Ads, TikTok).
• Payments: the payment takes place on the operator's page (Stripe, PayPal).
• Loaded without consent because they are needed to display a page or for a form to work: place suggestions in the “place of birth” field from OpenStreetMap Nominatim – your browser sends the place name you type and your IP address.

You can change or withdraw your consent to analytics and marketing cookies at any time with the “Cookie Settings” link at the bottom of every page. Refusing these cookies does not limit any feature of the Service. Blocking necessary cookies in your browser may stop some features from working properly (for example logging in, the cart or checkout). The full list of cookies (names, purposes, duration) is in the Cookie Policy.

9. RECIPIENTS OF DATA

We do not sell personal data. The following entities may receive data, only to the extent needed for the purpose concerned. Most of them process data on our behalf under a data processing agreement (Article 28 GDPR):

• Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) – hosting: the server running the Service and the database, and backups of the whole server. Servers in Germany (EEA). Hetzner privacy policy
• Google (Google Drive) – storing backups of the database and files. We encrypt the backups before sending them with a key known only to us, so Google has no access to their content.
• ActiveCampaign, LLC (Postmark) – sending all emails: transactional ones (confirmations, reports, login codes) and messages from the mailing list. Data: email address, name, content of the message; Postmark records delivery, opening of the message and clicks on links. Postmark privacy policy
• Stripe – payments by card, Google Pay, Apple Pay, PayPal and other methods on the Stripe checkout page, and the Subscription.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. – if you pay with PayPal, it processes your data as an independent controller, under its own privacy policy.
• OpenAI – creating content with the help of artificial intelligence (section 6).
• OpenStreetMap Foundation (Nominatim) – searching for places: your browser sends the place name you type and your IP address, and our server (Human Design calculations) sends only the name of the place of birth.
• Google (Google Analytics, Google Ads), Microsoft Corporation (Microsoft Clarity), Meta Platforms Ireland Ltd. (Meta Pixel and Conversions API), TikTok – only with your consent in the cookie banner (sections 8 and 11).
• inFakt – Polish online invoicing and accounting system. Data: name, address, tax ID, email address, transaction data. Data is stored on servers in Poland (EEA).
• OneSignal, Inc. – notifications about new orders in our admin app: the buyer's first name or the beginning of their email address, the amount and the country of the order.
• Google (Gmail) – notifications about messages that could not be delivered (the recipient's email address) go to our mailbox. Error reports of the Service are sent without personal data.
• Our accounting office – to the extent needed for bookkeeping and tax settlements.
• People authorized by us (for example a partner with access to the admin panel), who are bound by confidentiality.
• Public authorities, where required by law.

When you pay online, payment data goes directly to the payment operator – Stripe or PayPal.

10. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Some recipients process data outside the European Economic Area, mainly in the United States. In that case, the transfer is based on:

• an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework, Article 45 GDPR) – for companies certified under the Data Privacy Framework: Google LLC (Analytics, Ads, Google Drive, Gmail), Meta Platforms, Inc., Microsoft Corporation (Clarity), Stripe, Inc., ActiveCampaign, LLC (Postmark), OneSignal, Inc.;
• standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR) – OpenAI (transfer from OpenAI Ireland Ltd to OpenAI, L.L.C. in the United States), TikTok;
• the European Commission's adequacy decision for the United Kingdom (renewed on December 19, 2025, valid until December 27, 2031) – OpenStreetMap Foundation.

You can get a copy of these safeguards (for example the contractual clauses) by writing to the address in section 1.

11. PROFILING AND AUTOMATED DECISIONS

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). We do use simple profiling:

• Ads (only with consent to marketing cookies): advertising partners (Meta, Google, TikTok) analyze your activity in the Service to tailor ads. With this consent, we also send Meta, directly from our server (Conversions API), information about a mailing list sign-up or a purchase (event type, order value, SHA-256 hashes of the email address and country, IP address, browser data and Meta cookie identifiers). With consent to analytics cookies, we send purchase information (order number, value, products, the identifier from the cookie) from our server to Google Analytics. Without consent, we do not send such data. We do not send customer lists or email addresses to Meta or Google to build advertising audiences.
• Emails (only to people with consent to marketing information): we tailor the content to your purchase history (for example we recommend a report you do not have yet and do not send offers for a product you have already bought), your language, the sign-up source, your date of birth (birthday wishes), whether you opened an earlier message (for example a reminder for people who opened an offer and have not bought yet) and the type of device determined from the browser data at sign-up (for example so that we do not send news about the Android app to iPhone users). Legal basis: legitimate interest (Article 6(1)(f) GDPR). You can object at any time (Article 21(2) GDPR) – we then stop.
• Prices: the checkout automatically applies discounts for people who bought something earlier or had a Subscription, and the price level and currency depend on the country determined from your IP address (regional prices; Terms of Service §5a).
• Country from the IP address – for our own statistics and to choose the currency and price level.

12. RETENTION PERIODS

• Account and data in the Account (profiles, including another person's data, reports, settings) – until the Account is deleted.
• “Ask your matrix and sky” chat history – until you delete it, at most 12 months (older conversations are deleted automatically).
• Tarot readings – until you delete them or your Account, at most 12 months (older readings are deleted automatically, like chat conversations).
• Answers reported with the “Report answer” button – at most 12 months.
• Orders, invoices and accounting data (including the statements made at checkout) – 5 years from the end of the calendar year in which the tax payment deadline expired (Article 86 § 1 in conjunction with Article 70 § 1 of the Polish Tax Ordinance, Polish: Ordynacja podatkowa), also after the Account is deleted; in the event of a dispute – until it ends. The IP address, browser data and cookie identifiers saved in the order with your consent to cookies are deleted after 90 days; only the consent status remains.
• Free materials without consent to marketing information – 12 months from sign-up, then the record is deleted automatically.
• Mailing list – until you withdraw consent (unsubscribe) or until the address permanently rejects messages. After you unsubscribe, we keep the email address with the date and source of unsubscribing on the list of unsubscribed addresses, so that we do not send marketing information to it again (Article 6(1)(f) GDPR). We keep the proof of consent (the text of the consent, the date, the IP address) for up to 5 years after it is withdrawn, in case of an inspection or a dispute. When you unsubscribe, we delete your name and date of birth from the record.
• Reviews – published: until deleted at the author's request; unpublished: 3 years from submission, then deleted automatically.
• Correspondence, support tickets and complaints – until the matter is closed, and then until the limitation period for related claims expires (Article 118 of the Polish Civil Code).
• Data in the event of a breach of the Terms – no longer than 3 years from the breach or suspected breach.
• Visit statistics (page views with the IP address, the visit identifier, ad measurement events, traffic sources, quiz entries) – we delete the IP address after 30 days (only the country remains) and the other statistical data after 26 months.
• Consent to health data (the text of the consent and the date) – while it is valid, and after it is withdrawn or the Account is deleted, 5 years as proof of consent; consents of people without an Account – 12 months.
• Record of your choice in the cookie banner (with a truncated IP address) – 2 years.
• Server logs – 14 days.
• Backups – daily database backups on the server: 14 days; backups made before deployments and backups on Google Drive: 90 days. Data deleted from the Service disappears from backups when those backups expire.
• Cookies – as stated in the Cookie Policy.

Chat and tarot history: We save the questions and answers from the “Ask your matrix and sky” chat and your tarot readings in your Account to show you their history. Only you can see it – we do not read it, and our admin panel shows only numbers. You can delete it at any time (one item at a time or all of it) – we delete the content immediately. The exception is an answer you report with the “Report answer” button: it is sent to us for review together with the reason for the report, linked to the Account (without the email address), and we keep it for no longer than 12 months.

13. YOUR RIGHTS

• Right of access – you can get access to your personal data and a copy of it (Article 15 GDPR).
• Right to rectification – you can ask us to correct inaccurate or incomplete data without undue delay.
• Right to erasure – you can ask us to delete your personal data without undue delay. Erasure means deleting the data or anonymizing it irreversibly. It does not cover data we must keep under the law (for example orders for the period stated in section 12) or to defend against claims.
• Right to restriction of processing – in the cases set out in Article 18 GDPR.
• Right to data portability – you can receive the data we process on the basis of consent or a contract in a structured, commonly used and machine-readable format.
• Right to object – you can object to processing based on our legitimate interest (Article 21 GDPR). We always respect an objection to direct marketing, including the related profiling (section 11).
• Right to withdraw consent – you can withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal: consent to the mailing list – with the link in every message; consent to cookies – with the “Cookie Settings” link at the bottom of the page; consent to health data – in your account settings (section 7); consent to the publication of a review – by email.
• Right to lodge a complaint – with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority of the EU Member State where you habitually reside.

To exercise these rights, just write to the address in section 1. We reply without undue delay and no later than within one month (Article 12(3) GDPR). We may ask you to confirm your identity, for example with a message from the email address linked to your Account. Users residing outside the European Union can exercise the same rights in the same way.

14. CALIFORNIA PRIVACY RIGHTS (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know: what personal information we collect and how it is used;
• Right to delete: request deletion of your personal information;
• Right to opt out: opt out of the sale of personal information (we do not sell personal data);
• Right to non-discrimination: we will not discriminate against you for exercising your rights.

To exercise your CCPA rights, email us at contact@datemyst.com.

15. MINORS

The Service is intended for persons aged 18 or over. Data of minors (for example a child's date of birth for the Child Matrix) may only be provided by their parent or legal guardian and is processed only to prepare the requested analysis (section 4).

16. SECURITY

We protect data with appropriate technical and organizational measures: the connection to the Service is encrypted (HTTPS), only authorized people have access to data and only to the extent they need, the admin panel requires two-factor authentication, backups sent outside the server are encrypted, and passwords are stored as a cryptographic hash, from which the password practically cannot be read. Cookies cannot be used to read other data from your device.

17. EXTERNAL LINKS

The Service may contain links to third-party websites. We are not responsible for their content or privacy practices.

18. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy is information about how we process data, not a contract – you do not need to accept it. We change it when the law, the way the Service works, the recipients of data or the retention periods change.

We inform Account holders and people on the mailing list by email about changes concerning the processing of personal data before the changes take effect. If a change means processing data for a new purpose that requires consent, we will ask for new consent.

Changes are published on this page. Previous versions are available on request.

Last updated: October 12, 2026.