PRIVACY POLICY

1. Data Controller and Contact Information

1.1 Applicable Controller

PMC Baltic FZ-LLC, Legal entity code 104086952900001, is the default data controller responsible for personal data processed in connection with the Services, unless a different controller is identified for a specific processing activity or regional notice.

Registered address: Compass Building, SFFO0507, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, 10055, UAE

Email: hello@nocturnum.app

1.2 Contracting Party, Seller, Merchant of Record and Payment Roles

The data controller may differ from the Seller, contracting party, Merchant of Record, billing entity, payment processor, gateway, acquiring partner, or payment administrator for a particular transaction.

A Seller, Merchant of Record, or payment provider may process transaction data needed to accept payment, issue transaction records, administer subscriptions, process refunds or reversals, prevent fraud, and respond to payment disputes. Handling a payment does not by itself make that entity the controller of all Nocturnum data.

1.3 Service Providers and Regional Notices

Service providers may support technical operations, hosting, databases, authentication, analytics, advertising, payments, email, finance, compliance, customer support, security, risk management, or administration. Where another entity acts as a separate or joint controller for a specific activity, the applicable notice or supplement may identify that role.

Additional regional privacy notices or supplements may apply where required by law and may govern the specific local privacy matter they address.

2. Categories of Personal Data

2.1 Data You Provide

Depending on how you use the Services, we may process:

• email address and account information;
• quiz and questionnaire answers used to generate personalized readings, interpretations, insights, or recommendations;
• palm images where collected in the Witch Power Reading experience;
• support communications, complaints, cancellation, refund, or dispute requests and supporting evidence;
• feedback and other information you choose to submit; and
• information used to verify a privacy-rights request where applicable.

2.2 Automatically Collected Data

When you use the Services, we may process technical and usage information including:

• IP address, browser, operating system, device and user-agent information;
• language, time zone, referrer information, and approximate location inferred from IP where used;
• session and browser identifiers;
• pages, quiz or funnel steps, events, timestamps, content-access or progress information, and related metadata;
• login attempts, security events, and technical logs; and
• campaign, advertising, attribution, or conversion identifiers where the relevant technologies are used.

Essential technical and security data may be processed differently from optional analytics or advertising data where consent or opt-out requirements apply.

2.3 Payment and Transaction Data

Payments may be processed through third-party payment providers, including different payment routes depending on the checkout. Nocturnum does not generally receive or store complete payment-card details where those details are handled directly by the payment provider.

We may receive limited payment and transaction metadata such as processor customer or transaction identifiers, secure payment tokens, payment-method information, limited card information where provided by the payment provider, amount, currency, timestamp, payment status, subscription status, refund or reversal status, and dispute or chargeback information where relevant.

2.4 Data Received from Third Parties

Where relevant, we may receive data from payment providers, acquiring partners, banks or card networks, analytics and advertising or attribution providers, hosting and database providers, email providers, and other service providers used to operate the Services. We do not assume that every third party provides every category of information described in this Policy.

2.5 Personalization and Profiling Data

Nocturnum may use automated processing to generate personalized readings, archetypes, recommendations, insights, or content segments based on quiz answers or similar inputs.

Depending on the experience, personalization may relate to astrology and personality patterns, relationships and compatibility, personal tendencies or emotional patterns, life themes or symbolic archetypes, past-life or spiritual interpretations, personal guidance, or recommended content.

This profiling is intended to personalize the Services and is not intended to produce legal effects concerning you or similarly significantly affect your legal rights.

3. Purposes and Legal Bases

We process personal data only for purposes supported by an appropriate legal basis under applicable law. Depending on the activity and jurisdiction, we may process data to:

• provide quizzes, personalized results, readings, reports, recommendations, accounts, member access, subscription features, progress tracking, and customer support under a contract or to take steps at your request before entering into a contract;
• personalize readings, interpretations, archetypes, insights, recommendations, and content using consent or another appropriate legal basis where permitted;
• process payments, administer subscriptions, handle refunds or reversals, maintain accounting records, and comply with legal obligations;
• protect accounts, prevent fraud and abuse, secure authentication, and manage risk based on legitimate interests or legal obligations where applicable;
• analyze and improve the Services, measure funnel performance, and identify technical or usability issues using consent where required or another lawful basis where permitted;
• send transactional and service communications necessary for the Services or legal compliance;
• send marketing communications where permitted by law, using consent where required;
• measure advertising, attribution, campaign performance, and conversions where used and permitted, subject to applicable consent or opt-out requirements; and
• establish, exercise, or defend legal claims and resolve refunds, complaints, payment disputes, chargebacks, and alleged unauthorized transactions.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not retroactively invalidate processing that was lawful before withdrawal.

Where processing is based on legitimate interests, we consider whether our interests are proportionate and whether your rights and interests override those interests.

4. Cookies, Tracking and Privacy Controls

The Services use cookies, local storage, session storage, pixels, analytics technologies, advertising technologies, and similar tools for strictly necessary functionality, functional or quiz-recovery features, performance or analytics, and targeting or advertising purposes where applicable.

Nocturnum does not currently provide a unified in-site Cookie Settings panel that controls all non-essential integrations. Browser controls and provider-specific controls are available, and the optional PostHog replay integration separately checks any saved consent choice and its configured settings.

Where applicable law requires consent or another privacy choice before non-essential processing, those legal requirements remain applicable and are not waived by this Policy.

Further information is provided in the Cookie Policy.

5. Payments, Subscriptions, Refunds and Disputes

Transaction data may be processed to administer purchases and subscriptions, confirm access, handle failed payments, process refunds or reversals, prevent fraud, maintain accounting records, investigate allegedly unauthorized transactions, respond to payment-provider or card-network disputes, and manage chargebacks.

Where reasonably necessary, we may retain and use order records, checkout or acceptance records, transaction terms, delivery or access logs, cancellation records, usage status, support and refund communications, payment-provider records, fraud indicators, and chargeback history to resolve disputes, establish amounts owed, enforce applicable policies, and establish, exercise, or defend legal claims.

This Privacy Policy does not determine whether a refund or Money-Back Guarantee claim is eligible.

6. Storage, Retention, Deletion and International Transfers

6.1 Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to legal, accounting, tax, fraud-prevention, security, dispute, chargeback, refund, regulatory, and limitation-period requirements.

• abandoned quiz sessions without a purchase: up to 90 days;
• purchased sessions, account data, content progress, and entitlements: generally for the duration of the account relationship, subject to lawful extensions;
• orders and payment records: up to 7 years where required for tax, accounting, payment, or legal obligations;
• funnel behavior events associated with non-purchased sessions: up to 90 days;
• funnel behavior events associated with purchased sessions: up to 2 years;
• OTP login attempts: up to 30 days; and
• support, refund, dispute, fraud, security, and chargeback evidence: for as long as reasonably necessary for the relevant purpose and any applicable legal or limitation period.

Retention may be extended where reasonably necessary or legally required for an open or anticipated dispute, refund, chargeback, fraud investigation, accounting or tax requirement, regulatory matter, security investigation, or legal claim. De-identified information may be retained while it remains non-identifying, subject to applicable law.

6.2 Deletion and Account Closure

A valid deletion request is handled subject to applicable law and lawful retention exceptions. Closing or deleting an account does not necessarily require immediate deletion of every transaction, accounting, consent, fraud, security, support, dispute, refund, chargeback, or legal-claim record that we are permitted or required to retain.

When personal data is no longer required, it will be deleted or de-identified in accordance with the applicable retention framework.

6.3 International Transfers

Some service providers may process personal data outside the European Economic Area, the United Kingdom, or another jurisdiction that restricts international transfers.

Where applicable law requires safeguards for an international transfer, we use legally recognized mechanisms as applicable, which may include adequacy mechanisms, Standard Contractual Clauses, or other lawful transfer tools.

Transfer arrangements may vary by service provider, processing activity, and region. This Policy does not claim participation in a specific transfer framework unless that participation has been separately verified.

7. Recipients and Service Providers

The Services currently use or integrate with the following provider categories and named providers for relevant functions:

Depending on the specific activity, a provider may act as our processor or service provider, or may independently determine certain purposes and means of processing under its own privacy notice.

We may also disclose personal data to banks and card networks, professional advisers, insurers, accountants, courts, regulators, public authorities, law-enforcement bodies, or parties involved in a merger, acquisition, reorganization, financing, or sale of the business where permitted or required by law.

8. Privacy Rights and Choices

Depending on applicable law and your location, you may have rights concerning your personal data, including rights to:

• request access to personal data and receive a copy;
• request correction of inaccurate or incomplete data;
• request deletion, subject to lawful exceptions;
• request restriction of certain processing;
• object to certain processing, including direct marketing and certain processing based on legitimate interests;
• withdraw consent where processing is based on consent, without affecting prior lawful processing;
• receive certain personal data in a structured, commonly used, machine-readable format where portability applies;
• request appropriate human review or contest certain automated processing where applicable law provides that right; and
• lodge a complaint with a competent supervisory authority.

We may need to verify your identity or authority before acting on a privacy-rights request.

Privacy-rights requests may be submitted to hello@nocturnum.app.

Where the GDPR applies, we generally respond to a valid request within one month. Where permitted by law, this period may be extended by up to two further months for complex or numerous requests, and we will inform you of the extension.

Where permitted by law, a reasonable fee may be charged or a request may be refused if it is manifestly unfounded or excessive.

8.1 Marketing Choices

Where marketing communications are sent, you may use the unsubscribe mechanism provided in the message or contact us to exercise an applicable marketing choice.

Opting out of promotional marketing does not stop necessary transactional, account, billing, subscription, security, support, policy, or legal communications.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

No method of transmission or storage can be guaranteed to be completely secure.

Security and incident-related records may be retained where reasonably necessary to investigate, prevent, document, or respond to security incidents and to meet legal obligations.

10. Third-Party Services

Payment providers, analytics and advertising services, hosting providers, email providers, authentication providers, and other third parties may independently process some information under their own privacy notices.

This Privacy Policy describes processing controlled by or carried out on behalf of the controller identified above in connection with Nocturnum. A request concerning data controlled solely by a third party may need to be directed to that third party.

11. Eligibility and Children

The Services are not intended for anyone who cannot lawfully use the Services or enter into a binding agreement without any authorization required by applicable law.

We do not knowingly collect personal data from children in violation of applicable law.

If you believe that a child has provided personal data in circumstances that are not permitted by applicable law, contact hello@nocturnum.app so that we can investigate and take appropriate action.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Services, technology, vendors, payment infrastructure, business practices, group operations, or legal requirements.

Where applicable law requires additional notice or consent for a material privacy change, we will provide that notice or obtain the required consent.

The "Last updated" date at the top of this Policy indicates the date of the most recent revision.

13. Contact Information

Email: hello@nocturnum.app

Operator / default contracting entity: PMC Baltic FZ-LLC

Legal entity code: 104086952900001

VAT: 104086952900003

Registered address: Compass Building, SFFO0507, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, 10055, UAE

14. Related Policies and Document Hierarchy

This Privacy Policy should be read together with the applicable commercial and service policies. It governs personal-data processing and does not create or expand any commercial entitlement to a refund, cancellation, reimbursement, subscription benefit, or Money-Back Guarantee.

• Cookie Policy
• Terms of Service
• Subscription Terms - Past Life Reading
• Money-Back Policy - Past Life Reading