Privacy Policy

This document explains what data is collected by the "Elazar" app and on elazar.app, for what purpose, on what legal basis, and what your rights are. It is written to be understood, not to be long.

1. Who is responsible for your data

The data controller is ArkaDigital, which operates the Elazar app and the elazar.app website. For any privacy matter, including access, correction, export or deletion requests: support@elazar.app.

As of the date of this document we are not required to appoint a data protection officer or to register a database under Amendment 13 to the Israeli Privacy Protection Law. We will reassess this as the service grows and update this document accordingly.

2. Data we collect

Information you provide: name, birth date, birth time and place (optional), preferred form of address, onboarding answers, chat messages with Elazar, dreams you choose to share, and details of close people you add (name, birth date, nature of the relationship).

Information generated for you: your birth chart, life path number and personal cycles, readings, and "memories" — a summary of things you have shared, stored so that Elazar remembers you from one conversation to the next.

Technical data: an internal user identifier, interface language, a push notification token (if you opted in), and basic product events (for example screen opened, message sent) used to improve the product. We do not collect location, contacts or photos.

On elazar.app: the website uses Google Analytics 4 to measure traffic, which involves cookies and browser identifiers. If you enter birth dates into the free calculators on the site, the calculation runs in your browser and the data is not stored by us. If you leave an email address for the waiting list, we store it solely to notify you at launch.

3. Especially sensitive data

Some of the information you provide may qualify as "especially sensitive data" under Amendment 13 to the Israeli Privacy Protection Law, and as a "special category of personal data" under Article 9 of the GDPR — in particular information that may reveal religious or philosophical beliefs, and insights in the nature of a personality assessment.

We process such data solely on the basis of your explicit consent, given at signup through a separate and specific opt-in and not as part of a general acceptance of these terms. You may withdraw consent at any time from the Profile screen; the consequence is that we can no longer provide the personal readings, and your account will either revert to basic use or be deleted, at your choice. Withdrawal does not affect the lawfulness of processing carried out beforehand.

4. Why we process, and on what basis

We process data only for the purposes listed here, and for no other purpose:

To provide the service — calculating your chart and numbers, running the conversation, storing your history. Legal basis: performance of our contract (GDPR Article 6(1)(b)), and for especially sensitive data, explicit consent (Article 9(2)(a)).
To manage your account and subscription — authentication, subscription validation, support. Basis: performance of the contract and legal obligations.
To send notifications — only if you opted in. Basis: consent.
To improve the product — aggregate usage data. Basis: our legitimate interest in improving the service, balanced against your right to privacy, and without using conversation content for this purpose.
To secure the service — preventing abuse and quota circumvention. Basis: legitimate interest.

5. What happens if you do not provide data

Providing your data is voluntary and not a legal obligation, but parts of the service depend on it. Without a birth date we cannot calculate a chart or numbers, so we cannot provide the core service. Birth time and place are optional — without them the astrological calculation is less precise, but the service works. Without notification permission you simply will not receive notifications. Declining to provide details about close people means that feature is unavailable.

6. AI processing

Elazar's replies are generated by large language models from third-party providers (Anthropic and OpenAI, via OpenRouter). To generate a reply, your conversation content and spiritual profile are sent to these providers. Per the providers' terms, this data is not used to train their models, is used solely to generate your reply, and is never sold or used for advertising. Under their data processing agreements these providers are committed to a level of protection equal to the one described here, including encryption, purpose limitation and deletion.

No automated decisions with legal effect. Elazar does not make decisions for you and does not carry out profiling that produces legal effects or similarly significant effects within the meaning of Article 22 of the GDPR. The content is material for reflection only.

7. Sub-processors

We use the following providers, each strictly for the stated purpose: Supabase (authentication and database, EU servers), Fly.io (server hosting, Frankfurt), OpenRouter / Anthropic / OpenAI (AI reply generation), RevenueCat (subscription management), Apple and Google (payment processing and push notifications), and Google Analytics (website traffic measurement). Payment details (credit card) are processed by Apple or Google only and never reach us. All sub-processors are bound by data processing agreements that give your data the same or equal protection as this policy.

8. Transfers outside Israel and the EU

Data is stored on servers in the European Union. However, some sub-processors — primarily the language model providers — also process data in the United States. Those transfers are made on the basis of the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, and in accordance with the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations. The transfer also rests on your consent to AI processing, given at signup.

9. Retention and deletion

Data is kept while your account is active. Deleting your account — from the Profile screen in the app or by email request — permanently erases all of your data from our production servers: profile, conversations, memories, dreams, tracked people and energy balance.

After deletion, copies remaining in periodic backups are fully erased within 30 days at most. Records we are legally required to keep — for example accounting records of transactions — are retained for the period prescribed by law, separately and without the spiritual profile. Technical system logs are kept for up to 90 days. A waiting-list email address is deleted no later than 12 months after launch or upon an unsubscribe request, whichever comes first.

10. Security and security incidents

All communication is encrypted (TLS), data access is protected by a personal token, and no user can read another user's data. If a serious security incident occurs that may affect your rights, we will notify the Israeli Privacy Protection Authority and the relevant EU supervisory authority as required by law, and will notify you directly without undue delay where there is a high risk to your rights.

11. Minimum age

The app is intended for ages 16 and up. We do not knowingly collect data from children below that age. If we learn that such data has been collected, we will delete it immediately. A parent or guardian who believes their child has provided us with data is welcome to contact us and we will address it promptly.

12. Your rights

Under the Israeli Privacy Protection Law and the GDPR you have the following rights: access to the data held about you; rectification of inaccurate data; erasure; portability — receiving your data in a machine-readable format; restriction of processing; objection to processing based on legitimate interest; and withdrawal of consent at any time.

To exercise any of these: support@elazar.app. We respond within 30 days at most, and usually much sooner. If you are not satisfied with our handling, you may lodge a complaint with the Israeli Privacy Protection Authority, or with the data protection supervisory authority in your country of residence in the EU.

13. Cookies on the website

The website uses Google Analytics cookies for traffic measurement only. They are not used for advertising and do not identify you personally. The site does not use advertising cookies, social network pixels or remarketing.

If you are browsing from the European Union, the European Economic Area, the United Kingdom or Switzerland, no measurement cookies are stored until you accept them in the banner shown when you arrive. Until you accept, and if you decline, Google Analytics receives anonymous aggregate measurement only, with no cookies and no device identifier. Declining does not affect your use of the site in any way, and you can change your choice at any time by clearing site data in your browser.

Elsewhere in the world measurement is enabled by default, and you can block cookies in your browser settings; blocking them will not affect your use of the site.

14. Changes to this policy

If we materially update this policy we will announce it in the app and on the website at least 14 days in advance, and the update date will appear at the top of this document. Continued use after the update takes effect constitutes acceptance of the new version. If the change concerns processing based on your consent, we will ask for fresh consent.