Wilmington, Delaware, United States
Who we are and what this covers
This Privacy Policy explains how Inlito collects, uses, shares, and protects your personal data when you use the Inlito app (app.inlito.ai), website, and related services (the "Service"). Inlito, Inc., a Delaware corporation, Wilmington, Delaware, United States ("Inlito", "we", "us", "our") is the controller of your personal data.
The information we collect
- Birth details — your birth date, time, and place, used to calculate your chart. This is the core input for every Reading and Report.
- Name details — the name you provide, used to calculate numerology parameters.
- Chart & profile parameters — the astrological, Human Design, Jyotish, numerology, and BaZi values we derive from your birth details.
- Account details — your email address and the one-time verification codes used to sign you in.
- Your Content — anything you submit, such as a question to Ask the Astrologer, or birth details you enter for another person (for example in relationship lenses).
- Payment information — processed by Stripe. We receive confirmation and limited transaction details; we do not store your full card number.
- Usage, device & diagnostic data — for example IP address, device/browser type, pages and features used, and error/diagnostic data used to keep the Service running.
How we use your data, and our legal basis
Where the GDPR applies, we rely on the following bases:
| Purpose | Data used | Legal basis |
|---|---|---|
| Calculate your chart and generate Readings and Reports | Birth details, name details, chart & profile parameters | Contract — Art. 6(1)(b) |
| Provide Ask the Astrologer and relationship lenses | Your Content | Contract — Art. 6(1)(b); if you include special-category information, your explicit consent — Art. 9(2)(a) |
| Create and operate your account and sign you in | Email, verification codes | Contract — Art. 6(1)(b) |
| Take payment and keep required records | Transaction data | Contract — Art. 6(1)(b); legal obligation for accounting records — Art. 6(1)(c) |
| Send transactional emails (codes, receipts, service notices) | Contract — Art. 6(1)(b) | |
| Send marketing, if you opt in | Consent — Art. 6(1)(a) | |
| Improve and secure the Service, prevent fraud | Usage, device, diagnostic data | Legitimate interests — Art. 6(1)(f); consent for non-essential cookies |
| Comply with legal, tax, and regulatory obligations | Transaction and account data | Legal obligation — Art. 6(1)(c) |
Automated processing and AI
Your Readings, Reports, and responses are generated by automated systems — including a third-party AI provider — applied to your chart and profile parameters and to any question you ask. This involves profiling (deriving personality-style parameters from your birth details), but the output is informational only: it does not produce legal effects or similarly significantly affect you, and we do not make automated decisions about your access, pricing, or eligibility. Ask the Astrologer responses are AI-generated, not written or reviewed by a human astrologer, and no person reads your questions as part of normal operation (our team may access Content only for support, safety, or legal reasons as described in this policy). You can ask for human review of any output by contacting privacy@inlito.ai.
Who we share data with
We share data only with service providers ("processors"), acting on our instructions, and with authorities where legally required. Our main providers are:
We do not sell your personal data, and we do not share your birth details, profile parameters, or Content with third parties for their own purposes.
- Stripe — payment processing (acts as an independent controller for payment data). stripe.com/privacy
- Supabase — database hosting and storage of your account and app data (processor).
- Resend — transactional email delivery (processor).
- Anthropic — AI generation of Readings, Reports, and responses (processor). Under Anthropic's commercial terms, inputs and outputs are not used to train its models.
- Cloudflare R2 / Google Cloud Storage — file and report storage (processor).
- Sentry — error and performance monitoring; may capture technical/diagnostic data (processor).
- Inngest — background job orchestration (processor).
- Hosting / infrastructure — cloud hosting providers used to run the Service (processor).
- Google Analytics 4 and PostHog — consent-based website and product analytics (processors).
- Authorities / legal successors — where required by law, or in a merger, acquisition, or sale of assets, subject to the same protections described here.
International data transfers
Several of our providers are based in the United States or otherwise outside the EEA/UK, so your data may be transferred to and processed there. Where we transfer personal data internationally, we rely on appropriate safeguards — such as the EU–US Data Privacy Framework (where the recipient is certified) and/or the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant).
How long we keep it
| Data type | Retention |
|---|---|
| Birth details, name details, chart & profile parameters | While your account is active, or 3 years after your last interaction, whichever is longer; sooner on request |
| Readings, Reports, Ask the Astrologer Content | Same as above |
| Email address | Same as above, or until you unsubscribe / delete your account |
| Payment & transaction records | 6 years as required by applicable US tax and accounting law |
| Usage / analytics data | For the period configured in our analytics providers and no longer than necessary for product analytics; accessible browser identifiers are cleared when you withdraw consent |
| Support communications | 2 years after the matter is resolved |
After the applicable period, data is deleted or irreversibly anonymised.
Your rights
Depending on where you live, you have some or all of these rights:
- Access (Art. 15) — a copy of the personal data we hold about you.
- Rectification (Art. 16) — correction of inaccurate or incomplete data.
- Erasure (Art. 17) — deletion, subject to legal retention obligations.
- Restriction (Art. 18) — limiting how we use your data while a matter is resolved.
- Portability (Art. 20) — receiving certain data in a portable format.
- Objection (Art. 21) — objecting to processing based on legitimate interests, and to marketing at any time.
- Withdraw consent — at any time, without affecting prior processing.
- Complain — to your local supervisory authority (in the EU, the authority of your member state).
To exercise any right, contact privacy@inlito.ai. We may need to verify your identity, and we will respond within the time the law requires. California residents have rights to know, delete, correct, and opt out of "sale"/"sharing" of personal information; we do not sell personal information, and we will not discriminate against you for exercising your rights.
Cookies
We use cookies and similar technologies (including local storage used to keep you signed in). See our Cookie Policy for details and how to manage them.
Children
The Service is intended for adults 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact privacy@inlito.ai and we will delete it.
Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit (TLS/HTTPS) and at rest, access controls, and monitoring. No system is completely secure and we cannot guarantee absolute security. If a breach affects your rights, we will notify you and the relevant authority as required.
Changes to this policy
We may update this policy from time to time. For material changes we will provide reasonable notice — for example an in-app notice or email, and a new "Last updated" date.
Contact
Inlito, Inc. · Wilmington, Delaware, United States · privacy@inlito.ai
EU/UK representative (GDPR Art. 27): CONFIRM: to be appointed — name & address.
Policy read. Sky's still yours.
If anything here is unclear — a source, a right, a choice — write to us. A person reads every message.