Privacy Policy

Last updated: August 7, 2026

Fuyu Culture Co., Ltd. (hereinafter “the Company”, “we”; Tax ID 90121032) takes your personal data protection seriously. This policy describes how we collect, use, store, and share your personal data through Misstarot, LifeGrid, and our website (fuyuculture.com, misstarot.app, and subdomains). It is drafted in compliance with Taiwan’s Personal Data Protection Act and the EU General Data Protection Regulation (GDPR).

1. Data Controller

2. Data We Collect

2.1 Misstarot App / Website

• Account data: email, nickname, username, third-party login identifiers (Google, Apple)
• Profile picture (optional): if you upload an avatar, it is stored in our database so it can sync across your devices
• Push notification data: push token (a device identifier string used to deliver notifications) and your notification preferences
• Personal data (optional): birth date, birth time, birth place, gender, occupation (for astrology computation and personalized interpretation)
• Service usage: reading history, draw history, saved interpretations, AI conversation content. Full transcripts of Talk Readings are stored separately in our database and accessed only by authorised staff for customer support, safety and well-being purposes; in the app you see an AI summary of each talk, and you can download your own full transcript file at any time
• Personalised memory (optional): to make your readings feel more personal over time, the AI distils a short personal-context summary from your readings and talks (e.g. themes you have been focused on and how you like to be spoken to). It is linked to your account, used only to generate your own readings, never shared with third parties, and records no card details or information identifying other people. You can turn off “Let Miss Tarot remember our talks” in the app’s personal settings at any time: we then stop reading and updating the summary. The summary itself is retained (so it can pick up seamlessly if you re-enable the feature later) and is deleted with your account; you may also contact us to have it deleted earlier
• Subscription / billing: subscription status, subscription date, platform order ID (no credit card data — handled by Apple/Google)
• Device data: device model, OS version, language, device identifier (used to distinguish devices and to carry guest-mode data over when you sign up), IP address (retained max 30 days for fraud prevention)
• App usage records: how you use features and browse screens in the app (e.g. card draws, viewing readings, time spent on each screen and usage sessions), linked to your account, used solely to improve product features and user experience, never shared with third parties
• Regional usage statistics (county level): with your location permission granted, the app records the county you are in when using the weather feature (county name only, no precise location or coordinates) to understand regional usage. Raw records are aggregated into non-identifiable county statistics and deleted within 7 days
• Personal region log (separate opt-in, off by default): you may enable “Send regional usage statistics” in your profile. When enabled, at most one record of your county per day (no precise location) is linked to your account, never shared with third parties, and used only for our operational analysis. You may turn it off anytime; related records are deleted within 90 days after opt-out

2.2 LifeGrid App

• We never receive any of your data. Everything you enter in the app (such as name, phone number, birth date, life events and ratings) is stored only on your device and is never uploaded to any server, so the Company cannot read it.
• Consequently we do not collect, use or share this data in any way; backing it up or deleting it is entirely under your control on the device.

2.3 fuyuculture.com Website and misstarot.app Web Version

• Analytics: collected via Google Analytics 4 (measurement ID G-3HS998QVW1 for fuyuculture.com, G-XEXW0L9NKH for the misstarot.app web version). This service writes cookies in your browser to measure visits, traffic sources and page usage. See our Cookie Policy
• Contact form: sent to our inbox, used solely to reply to you

3. Purposes of Use

4. Third-party Services & Data Sharing

We do not sell your personal data to any third party. To deliver our service, we use the following processors:

5. Data Storage & Retention

• Storage location:
  • Account and service data are stored on Render’s servers and PostgreSQL database located in Singapore (with automated backups)
  • Static content for the website and web version is hosted and delivered by Cloudflare Pages
• Retention:
  • Account data: until account deletion
  • 90 days after deletion (grace period during which signing in again restores the account, then permanent deletion)
  • Talk Reading transcripts: retained for at least 3 months, and at most until account deletion (removed as part of the account-deletion process)
  • Personalised memory summary: retained until account deletion (turning the memory feature off stops reading and updating it, but the summary is kept; contact us to have it deleted earlier)
  • Transaction records: 7 years per tax law
  • System logs: 30 days
  • Regional usage statistics: raw records aggregated into de-identified county statistics within 7 days (statistics contain no personal data and are retained long-term); personal region logs deleted within 90 days after you opt out
  • Marketing consent withdrawal: stop using immediately, retain proof of withdrawal for 3 years

6. Your Rights

Under Taiwan’s PDPA and GDPR, you have the following rights:

1. Access: know what data we hold about you
2. Rectification: correct inaccurate or outdated data
3. Erasure (right to be forgotten): request permanent deletion
4. Data portability: obtain a portable copy of your data
5. Withdraw consent: for consent-based processing, withdraw at any time
6. Object: object to specific data processing
7. Reject automated decision-making: request human intervention

To exercise:

• In-app: Profile → Settings → Privacy Management
• Email: service@fuyuculture.com
• We will respond within 30 days

7. Children’s Protection

Our services are not designed for children under 13, nor do we knowingly collect data from children under 13. If you discover an underage child has used our service without guardian consent, please contact us — we will delete their data immediately.

8. Cookies & Similar Technologies

See Cookie Policy.

9. Data Security

We implement industry-standard measures:

• HTTPS site-wide (TLS 1.3)
• We do not store your password. Sign-in is always handled by a third-party account (Google, Apple); we never receive or retain your password for those platforms
• Encrypted API token storage
• Regular security reviews
• Minimum-access principle for employee data access

No system can guarantee 100% security. In the event of a data breach, we will notify the relevant authorities and affected users within 72 hours.

10. Cross-border Data Transfers

Some processors are headquartered overseas, including Firebase and Google Analytics (US), Google Gemini (US), Anthropic (US), OpenAI (US), Render (servers in Singapore), Cloudflare (US) and RevenueCat (US). We only select processors that meet GDPR Standard Contractual Clauses (SCCs) or equivalent protection levels.

11. Policy Changes

When this policy changes, we will:

1. Update “Last updated” on this page
2. Notify users via in-app popup or notification
3. For significant changes (affecting data collection scope): 30 days’ notice via registered email

12. Contact

For questions about this policy or to exercise your rights:

• Email: service@fuyuculture.com
• Address: No. 3, Sec. 2, Zhongshan Rd., Sanzhi Dist., New Taipei City, Taiwan
• Representative: Yi-Lung Chung

If you believe our data processing violates regulations, you may file a complaint with:

• Taiwan: National Development Council / Personal Data Protection Office
• EU: your local Data Protection Authority (DPA)

This is an AI-assisted draft. The final version will be reviewed by legal counsel before publication.