Data Processing & Privacy Details

Last updated: April 13, 2026

Data Controller

Elixyo SASU, Paris, France — contact@nymero.org

Given the nature and scale of our processing activities, no Data Protection Officer (DPO) is required. For privacy inquiries, contact: privacy@nymero.org

Legal Basis for Processing (GDPR Art. 6)

• Consent (Art. 6(1)(a)): Marketing emails (promotional, monthly, weather), analytics tracking (GA4), partner data sharing (Brevo CRM)
• Contract Performance (Art. 6(1)(b)): Report generation, weather subscription delivery, account management
• Legitimate Interest (Art. 6(1)(f)): Fraud prevention, rate limiting, bot protection (Cloudflare Turnstile), service improvement
• Legal Obligation (Art. 6(1)(c)): Invoice retention (EU VAT Directive, 6-year retention), tax calculation records

Categories of Personal Data Collected

• Identifiers: Email address, name
• Date of birth: Day, month, year (required for numerology calculations)
• Gender: Used for personalized report content
• Geolocation: Country-level only (via Cloudflare headers, not GPS). IP addresses are NOT stored in our database.
• Consent records: Consent flags, timestamp, and country at time of consent
• Attribution data: UTM parameters, ad click IDs (only if cookie consent given and DNT/GPC not active)
• Device tokens: Push notification tokens (optional, with separate consent)

Data Retention Periods

• User accounts: Retained until deletion requested by user
• Quiz sessions: Retained while user account exists
• Marketing events: 90 days (auto-deleted by daily cleanup)
• Idempotency keys: 13 months (prevents duplicate emails)
• Resonance history: 1 year (auto-deleted)
• Weather cache: 7 days (auto-deleted)
• Email queue: 30 days after delivery (auto-deleted)
• Authentication sessions: 24 hours after expiry (auto-deleted)
• Invoices: 6 years (EU VAT Directive requirement, anonymized on account deletion)
• Reports: 1 year after generation (access token expires)

Sub-Processors

We use the following third-party processors to operate our service. Data Processing Agreements (DPAs) are in place with each:

• Cloudflare, Inc. (USA, EU) — Hosting, CDN, DDoS protection, edge computing (Workers). Processes: request metadata, country-level geolocation
• Brevo (Sendinblue) (France) — Email marketing & CRM. Processes: email, name, language, consent flags. Only synced when marketing consent is given.
• Resend, Inc. (USA) — Transactional emails (order confirmation, reports, GDPR requests). Processes: email address only
• LemonSqueezy (Lemon Squeezy, LLC) (USA) — Payment processing (Merchant of Record). Processes: email, payment data. LemonSqueezy handles all payment card data; no card numbers touch our servers.
• Google LLC (USA) — Analytics (GA4). Only loaded after explicit cookie consent. Processes: anonymized usage data, no personal identifiers.
• Bunny.net (BunnyWay d.o.o.) (Slovenia, EU) — Font delivery. No cookies, no tracking.

International transfers (USA) are covered by EU Standard Contractual Clauses (SCCs) included in each processor’s DPA.

Your Rights (GDPR Articles 15–22)

• Right of Access (Art. 15): Request a full export of your data — Dashboard or email privacy@nymero.org
• Right to Rectification (Art. 16): Retake the quiz to update your data, or contact us
• Right to Erasure (Art. 17): Request permanent deletion of all your data via Dashboard or email
• Right to Restriction (Art. 18): Contact us to restrict processing while a dispute is resolved
• Right to Data Portability (Art. 20): Export your data in structured JSON format
• Right to Object (Art. 21): One-click unsubscribe from all marketing emails via link in every email
• Right to Withdraw Consent (Art. 7(3)): Manage granular consent preferences anytime via link in every email

Requests are processed within 30 days. Contact: privacy@nymero.org

Cookies & Tracking

• Essential: Cookie consent preference (localStorage, no server cookies)
• Analytics (GA4): Only loaded after explicit consent. Disabled if you choose “Reject” on cookie banner.
• Marketing (Meta, Twitter pixels): Only loaded after explicit consent. Disabled if you choose “Reject.”
• DNT/GPC: We honor Do Not Track and Global Privacy Control signals. When active, all tracking is disabled and attribution data is not collected.

International Privacy Laws

• GDPR (EU/EEA): Full compliance as described above. Data controller: Elixyo SASU, Paris, France.
• UK GDPR: Equivalent protections apply to UK users.
• CCPA/CPRA (California): We do not sell or share personal information for cross-context behavioral advertising. GPC signal honored as valid opt-out. Contact: privacy@nymero.org
• LGPD (Brazil): Brazilian users have equivalent rights to GDPR. The same data export/deletion mechanisms apply.
• CASL (Canada): Double opt-in required for Canadian users before marketing emails are sent.
• PDPA (Thailand): Thai users have data access, correction, and deletion rights under PDPA. Contact: privacy@nymero.org

Geographic & Jurisdictional Notice

Last updated: March 22, 2026

Entertainment Classification

NYMERŌ is classified as a digital entertainment and self-reflection platform. It does not constitute fortune-telling, divination, psychic prediction, or any form of regulated professional consultation. All content is generated algorithmically for entertainment purposes only. No claim is made regarding predictive accuracy. No guarantee of results of any kind is offered.

User Responsibility

BY ACCESSING OR USING THIS SERVICE, YOU ACKNOWLEDGE AND AGREE THAT: (1) ALL CONTENT IS PROVIDED FOR ENTERTAINMENT AND SELF-REFLECTION PURPOSES ONLY; (2) YOU ARE SOLELY RESPONSIBLE FOR ANY DECISIONS MADE BASED ON THIS CONTENT; (3) THIS SERVICE DOES NOT CONSTITUTE PROFESSIONAL, MEDICAL, FINANCIAL, LEGAL, OR PSYCHOLOGICAL ADVICE; (4) NO GUARANTEE OF ACCURACY, RELIABILITY, OR RESULTS IS OFFERED; AND (5) YOU ARE RESPONSIBLE FOR VERIFYING THAT YOUR USE OF THIS SERVICE COMPLIES WITH ALL APPLICABLE LAWS IN YOUR JURISDICTION.

Service Availability by Region

This Service is designed for international availability. However, laws regarding digital entertainment, numerology, and related content vary by jurisdiction. This Service is not available and is geo-blocked in the following regions where local laws may restrict such content:

• Saudi Arabia — Restricted under local law
• United Arab Emirates — Restricted under local law
• Qatar, Kuwait, Bahrain, Iran — Restricted under local law
• China — Restricted per 2025 regulatory guidance on digital divination services
• Nigeria — Restricted under Criminal Code provisions
• Russia — Restricted under divination service regulations; data localization requirements (PDPA)
• Turkey — Restricted under 2025 draft regulation on digital fortune-telling
• Myanmar — Restricted due to regulatory uncertainty

If you reside in a jurisdiction where services of this nature are restricted, prohibited, or require specific licensing, you must not use this Service. It is your sole responsibility to determine whether your use of this Service is lawful under the laws of your jurisdiction.

United States — State-Specific Notice

Certain U.S. states maintain statutes that may restrict activities characterized as “fortune-telling” for monetary consideration. NYMERŌ is classified as digital entertainment content and does not claim predictive accuracy or supernatural ability. Nevertheless, if you reside in any of the following states, please review the applicable statutes before using this Service:

• Oklahoma — Okla. Stat. tit. 21, §21-931 restricts fortune-telling for a fee
• Wisconsin — Wis. Stat. §947.02(4) classifies fortune-telling under vagrancy provisions

By using this Service from these states, you acknowledge that: (a) you have reviewed the applicable state law; (b) you understand that NYMERŌ is classified as digital entertainment, not fortune-telling; (c) you accept full responsibility for your decision to use this Service; and (d) you waive any claim against Elixyo SASU arising from your use of this Service in a jurisdiction where such use may be restricted.

Australia — State-Specific Notice

• Northern Territory — Fortune-telling may be restricted under local law
• South Australia — Fortune-telling with intent to defraud is a criminal offense

If you reside in the Northern Territory or South Australia, the same user responsibility provisions apply as stated above.

European Union, United Kingdom & International

In the EU, UK, and other jurisdictions where this Service is available, NYMERŌ complies with applicable consumer protection regulations (EU Consumer Rights Directive, UK Consumer Contracts Regulations) and data protection laws (GDPR, UK GDPR, CCPA, LGPD). All content is classified as digital entertainment content. The “entertainment purposes only” disclaimer is a legally binding term of use.

California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at contact@nymero.org or use the “Do Not Sell My Info” link in the footer. We will respond within 45 days.

Categories of personal information collected: identifiers (email, name), internet activity (pages visited), geolocation (country-level), and date of birth. We do not collect sensitive personal information as defined by CCPA.

Apple iOS App — Additional Terms

When you access NYMERŌ through the Apple iOS application, the following additional terms apply:

• In-App Purchases — Premium reports and subscriptions purchased within the iOS app are processed through Apple’s In-App Purchase system. Apple’s standard terms and refund policies apply to these transactions in addition to our own refund policy.
• Entertainment Classification — The NYMERŌ iOS app is classified as an educational and lifestyle application. All content — including personality profiles, daily forecasts, and reports — is generated algorithmically using the Pythagorean mathematical system and real-time astronomical data from NASA public APIs. No supernatural, psychic, or paranormal claims are made.
• Data Processing — Your personal data (name, date of birth, email) is processed on our servers to generate your personalized profile. No personal data is shared with third-party AI services or used for cross-app tracking. The Facebook Pixel is disabled in the iOS version of the app.
• Apple is not responsible — Apple Inc. is not a party to these Terms of Service, has no obligation to furnish any maintenance or support for the app, and is not responsible for any claims relating to the app, including product liability, legal compliance, or intellectual property.

Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, ELIXYO SASU SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATED TO YOUR USE OF THIS SERVICE, INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF PROFITS, GOODWILL, DATA, OR OTHER INTANGIBLE LOSSES, REGARDLESS OF WHETHER WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR SOLE AND EXCLUSIVE REMEDY IS TO DISCONTINUE USE OF THE SERVICE.