Privacy policy

Effective from 14 October 2026

Controller and contact

The controller of personal data is Marestal OÜ (registry code 17410914, address Uusna tee 17-6, Uusna küla, Viljandi vald, 70102 Viljandi maakond), which provides the HEKTA service. Questions and requests: info@hekta.ee.

Why we process data and on what basis

Performance of a contract (GDPR Art. 6(1)(b)): the account, login, readings and their history, buying and using credit, and service messages (e.g. the credit expiry reminder).

Legal obligation (Art. 6(1)(c)): keeping purchase and receipt data under the Accounting Act.

Legitimate interest (Art. 6(1)(f)): security of the service and preventing abuse (rate limits, technical logs, backups) and limiting the free daily card to one card a day.

We do not use your data for advertising, do not sell it and do not profile you.

What we keep about your account

When you log in, we store your email address and your language preference (et, en or ru). The email address is needed for the account; an account cannot be created without it.

We also store the time you agreed to the terms and the privacy policy, and the version of those texts.

If you log in with Google, we link your Google user ID to the account. Google gives us only your email address and its verified status.

Login link and session tokens are kept in the database only as hashes, not in a usable form.

Your email address and reading history (question, cards and interpretation, summary, step and follow-ups) are stored encrypted in the database, and the encryption key is kept separately from the database and the backups. Encryption does not protect you if someone gains access to the server system itself, where the key is located.

Reading history

When you are logged in, for each reading we store the topic, the question (as phrased for the reading), the cards drawn, the interpretation, the summary, the step, follow-up questions with their answers, and the time.

The interpretation may mention signs derived from your birth chart (for example the Sun or Moon sign). These are part of the interpretation and are stored with it.

You can see the history in your account view and delete individual readings there.

My soul path: in your account view you can write your own thoughts, favourite sentences and later additions, on their own or with a reading. We store them encrypted together with the chosen topic, the time and the link to the reading. Only you can see them; we do not send them to artificial intelligence or use them to create readings. You can edit or delete an entry at any time; if you delete a reading, your entry stays without the link to the reading. Deleting your account also deletes your soul path entries.

Reader's memory (with your consent, off by default): if you turn it on in your account view and choose "Continue" for the same topic, we also send OpenAI the question and summary of your previous reading on that topic with the new reading. You can withdraw consent at any time.

Please do not write health data, other people's personal data or other sensitive information in your questions. If you do, we process it only to make the reading and to show your history to you, and you can delete that reading at any time.

Birth details

Without logging in, birth details entered in the reading form (date, time, place) are not stored on our server: they stay only in your browser and reach the server only with a reading request.

Birth profile: when you are logged in, we store your birth details and the birth chart summary encrypted in your account the first time you enter them, so you do not have to enter them again, can read your birth chart later and readings are more personal. You can edit or delete the profile in your account view at any time.

During the reading they are kept in server memory and disappear from there within 6 hours at the latest.

The birth chart summary is kept briefly in server memory together with the birth details it was made from, so that the same request is not repeated.

If you run out of credit and we send you to buy more, your browser keeps the birth details, the current step and the state of the reading temporarily in the browser's sessionStorage so you can return to the same place after buying. It stays in your browser (it is not sent to the server) and is removed when you return or close the tab.

Service providers we send data to

Hetzner Online GmbH (Germany): the server and database are in Hetzner's data centre in Finland (European Union).

OpenAI (USA): the text of the reading and the birth chart summary is created with OpenAI, so we send OpenAI your question and the birth chart and card data. In a web voice call, the call audio also goes from your browser to OpenAI and OpenAI turns your speech into text. OpenAI does not use data sent through its API to train its models and keeps it for up to 30 days for abuse monitoring. Data is transferred to the USA under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Anthropic (USA): instead of OpenAI, the text of the reading and the birth chart summary may be created with Anthropic's Claude model. In that case we send Anthropic the same data: your question and the birth chart and card data. Anthropic does not use data sent through its API to train its models. Data is transferred to the USA under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Azure (Microsoft, data centre in Sweden): the reader's text is sent sentence by sentence to Azure text-to-speech to produce the voice.

Google (login): when you log in with Google, we receive from Google only your email address and its verified status. Google's own processing follows Google's privacy policy.

Elkdata OÜ (Estonia): the email service we use to send login links and service messages.

Maksekeskus AS (Estonia): credit purchase payments are processed by Maksekeskus. See "Payments and purchase data".

Payments and purchase data

When you buy credit, we create a transaction at Maksekeskus and send you to the Maksekeskus payment page. We send Maksekeskus the order number, amount, currency, your email address, language and IP address. We do not see or store card or bank details.

In our database we keep, for each purchase, the order number, amount, credits, purchase and payment time, the Maksekeskus transaction ID and receipt data (receipt number, seller details). In the ledger we keep every credit movement: purchase, spending, return and refund, with its time.

For a refund request we keep the request, the calculated credit and amount, and its status.

With each purchase we also save a record: the version of the terms, the time you confirmed the purchase and the credit validity shown to you before payment (months and date).

When you delete your account, the credit ledger is deleted, but the purchase, record, receipt and refund request data stay with the order for accounting without a link to your account; the record itself contains no personal data. Retention period: 7 years from the end of the financial year (Accounting Act).

Emails

We send the login link by email through our email provider's SMTP server. The email contains only the login link.

We also use your email address for the credit expiry reminder: 30 days before credit expires we send you an email about it.

We do not send marketing emails.

Cookies and browser storage

We use only a strictly necessary session cookie that keeps you logged in. It is valid for 30 days or until you log out.

When you log in with Google, we also use a temporary cookie that is valid for 10 minutes.

For the free daily card we put the cookie hekta_paev on your device: a random identifier valid for 1 year. In the database we keep only its hash together with the day, the card drawn, the language and the text, so that the same device gets one card a day. When you are logged in, the daily card is also linked to your account. These records are kept for about 2 days. The cookie is needed to limit the daily card; no login is asked for the daily card.

We use no other cookies or tracking tools (analytics, advertising), so there is no cookie banner. Fonts and images are loaded from our own server.

The browser's localStorage keeps your language, voice and sound settings and the birth data you last entered (date, time, country, place), so you don't have to enter them again next time. They stay on your device and reach our server only when you get a reading. You can delete them with the “Forget” link next to the form.

We use your IP address for rate limiting (login, daily card): the server reads it and keeps it briefly in memory only; it is not stored in the database.

To count visits (legitimate interest), the server makes a hash of your IP address and browser identifier together with a random salt that changes every day and is kept only in server memory. The IP address is not stored and visits on different days cannot be linked. Next to the hash we keep the page opened, the source (e.g. google) and the device type for 90 days.

Retention, deletion and backups

We keep account data and reading history for as long as you have an account. You can delete your account in your account view. This deletes the account and your data: email, linked Google account, sessions, reading history and the credit ledger. Purchase data is the exception, see "Payments and purchase data".

Backups of the database are made. Deleted data stays in the backups until they are replaced by newer ones. Backup retention period: up to 14 days.

Logs

The web service's server log keeps technical errors. We do not deliberately write questions asked on the web, reading content or birth details there, but an error message from a service provider may contain part of the request. Log retention period: up to 30 days.

Your rights

You have the right to information about your data and a copy of it, to have incorrect data corrected, to have your data deleted, to restrict processing and to data portability, and to object to processing based on legitimate interest.

You can do much of this yourself in your account view (viewing and deleting history, deleting the account). For other requests write to info@hekta.ee. We reply within one month at the latest.

If you believe we are violating your rights, you can contact the Estonian Data Protection Inspectorate (www.aki.ee, info@aki.ee) or a court.

Automated decisions and age

The text of a reading is created by artificial intelligence, but we make no automated decisions about you that would have a legal or other significant effect on you.

The service is intended for people aged 18 and over.

Changes

If the privacy policy changes, we update this page and its date. We inform logged-in users of significant changes on the site or by email.