Privacy Policy
Privacy at a glance
- We use the information needed to create a preview, take an order, create and securely deliver a report, provide support, and meet legal obligations.
- A report uses an adult subject’s birth date and an optional name or alias. We do not ask for gender, health information, government identifiers, employment details, or free-text personal history.
- Reports are generated automatically using our interpretive method and automated tools, including artificial intelligence. They are intended for personal reflection and entertainment, not as factual or professional assessments.
- We do not sell personal information, and we do not use report information for targeted advertising.
- A person who is the subject of a report may contact us to ask about access, objection, restriction, correction, or deletion.
The sections below provide the complete details.
1. Who controls your information
APEX SOLUTIONS EOOD, company number 207775650, VAT number BG207775650, registered at 67 Vitosha Blvd., office 4, 1000 Sofia, Bulgaria, is the controller for The Tell’s product and report processing. Contact: care@thetell.life.
Payments are processed by Stripe, our payment provider, which also processes payment, fraud-prevention, and transaction records under its own privacy notice. We do not receive full card details.
2. Scope
This Policy covers visitors, people who request a free preview, buyers, gift recipients when that feature is offered, and adults who are the subject of a report. It also explains automated report generation and information obtained from someone other than the report subject.
3. Information we process
- Contact and order data: email address, the country and US state derived from your IP address, order ID, time, billing country and postal code, product, price, consent and policy-version records, and support messages.
- Report-subject data: exact birth date and an optional name or alias. For a report about another adult, the source is the buyer.
- Preview data: the email address, birth date, and optional first name entered for a free preview, and the preview we generate. The preview is shown on screen; we do not email it. We use the email address to keep your preview available to you if you later sign in or order, and to limit the number of free previews per person.
- Generated data: the report or preview, internal generation fields needed to produce it, quality/error status, and technical metadata. A report may contain inferred themes and may be personal data about its subject.
- Payment and tax data: status, merchant/receipt identifiers, refund/chargeback status, location evidence needed for tax, and limited billing metadata received from the payment provider.
- Technical and security data: IP address, timestamps, device/browser data, download-link events, security logs, and strictly necessary cookies.
- Preference data: optional choices, such as a separately selected adult-only section. We do not ask for gender.
Please do not send free-text health, sexual, financial, government-ID, employment, or other sensitive information.
Your email address and birth date are required to request a preview or place an order. Without them, we cannot provide the requested service or check eligibility. Your name or alias is optional. A paid order also requires payment information provided directly to Stripe. You do not have to provide these details merely to browse the website.
4. Why and on what basis we process it
Rows describing features not currently offered apply only if those features are introduced. We will update this Policy and provide any required notice or choice before introducing them.
| Purpose | Information | Legal basis under GDPR |
|---|---|---|
| Create and show a free preview you request | preview data | contract (providing the free service you request under our Terms) |
| Take payment, create and deliver a buyer’s self-report, provide support and remedies | contact/order, buyer birth date and name, generated report, payment status | contract; legal obligation for tax/consumer records |
| Create a private report requested about another adult | minimal subject data and generated report | our and the buyer’s legitimate interests in providing a lawful personal reflection service, subject to a documented necessity and balancing assessment; we do not rely on this basis where the subject’s interests or rights override those interests |
| Maintain quality, fix errors, and improve the service, including restricted review of a limited sample of generated content and use of de-identified or aggregated data | generated data, technical data | legitimate interests in a reliable, safe, and improving service |
| Prevent misuse, fraud, link abuse and security incidents | order, technical, security and limited report metadata | legitimate interests; legal obligations where applicable |
| Check that the service is available where you are, and keep evidence of the buyer’s country for tax | IP address and the approximate location derived from it | legal obligation (tax evidence); legitimate interests in offering the service only where we have decided to |
| Display the payment form, including fonts loaded from Google Fonts | IP address and technical request data | legitimate interests in presenting a legible, consistent payment step |
| Send service emails (delivery, receipts, support) | email, order data | contract; legitimate interests |
| Send occasional news and offers about The Tell | consent where the law requires it; otherwise legitimate interests. Every marketing email has an unsubscribe link | |
| Keep tax, accounting, consent and dispute evidence | transaction and evidence records | legal obligation; legitimate interests in legal claims |
| Optional self-report content that could reveal sex-life information | only where offered to the person who is the report subject | explicit consent; consent can be withheld or withdrawn without affecting the base report |
| Non-essential analytics or advertising | cookie/device and interaction data | consent where required; otherwise only a documented lawful basis and applicable opt-out rights |
We do not use a report to make decisions producing legal or similarly significant effects about anyone. We do not sell personal information or use report information for targeted advertising, and we never build advertising audiences from birth dates or report content.
5. Automated generation and AI
The Tell calculates interpretive inputs from the submitted birth date and uses automated tools, including artificial intelligence, to draft and format the report. Reports are not individually reviewed by a person before delivery. The output is intended for personal reflection and entertainment. It is not a statement of fact, a scientific or clinically validated assessment, a diagnosis, a prediction, or professional advice.
We send our AI text-generation provider the birth date, optional name or alias, derived interpretive inputs, and report drafts needed to generate and refine the report. We do not include your email address or payment details in these generation requests. The provider processes this content to provide its service to us. Our requests ask it not to store the responses as application state; it may still keep request data for a limited period for security and abuse prevention under its own terms. Provider retention is separate from our own retention periods in Section 9.
6. Reports about another adult
If another person requested a report about you, we received your birth date and optional name or alias from that buyer and generated an interpretive report. We do not collect your email address solely to create that report. The buyer is instructed to keep the report private, not treat it as factual proof, and not use it to make significant decisions about or harm you.
You may object, request access or deletion, or ask us to restrict further processing at care@thetell.life. We will stop processing based on legitimate interests unless we demonstrate compelling overriding grounds or need limited data for legal claims.
7. Recipients
We disclose personal information to the following categories of recipients for the purposes described in this Policy, limited to what is necessary for each purpose:
- payment: Stripe, our payment provider;
- AI technology providers: to generate report text, as described in Section 5 (processing may take place in the United States);
- hosting and storage providers: for the application, database, and report files;
- email delivery providers: for delivery links, receipts, and service messages;
- font delivery: the payment form loads fonts from Google Fonts, so your browser sends Google your IP address and technical request information to retrieve them (see Google’s Privacy Policy);
- support, security, and logging tools: under restricted access;
- professional advisers, authorities, or counterparties where legally necessary, including to establish or defend legal claims; and
- a successor or acquirer if the business is reorganized, merged, or sold, subject to this Policy.
Providers acting as our processors process personal information on our instructions under applicable data-processing agreements. Some recipients, including Stripe for certain payment, fraud-prevention, and legal-compliance activities, act as independent controllers under their own privacy notices. You may request information about the actual recipients of your personal data at care@thetell.life. We provide their identities where required by applicable law.
8. International transfers
We are established in the European Economic Area. Some providers, including AI technology providers, process information in the United States or other countries outside the EEA/UK. Where required, we use an adequacy decision, the EU-US Data Privacy Framework for an eligible recipient and its UK extension, approved contractual clauses, or another lawful safeguard, plus supplementary measures where appropriate. Contact care@thetell.life to learn which transfer mechanism applies to your personal data and to obtain a copy of the relevant safeguards, subject to necessary redactions.
9. Retention
- previews and unfinished, unpaid orders: kept only as long as needed to let you continue to a paid order, answer questions about it, and prevent abuse, and then deleted; if you complete an order, the paid-order periods below apply;
- delivered reports, including the birth date and name printed in them, and records needed to provide access: up to 24 months after delivery, then deleted or irreversibly anonymized;
- additional working copies of generation inputs, temporary files, and failure records: deleted once they are no longer needed to deliver the report or to correct an error; AI provider security logs follow Section 5;
- download-link token: a short validity window; secure session up to 30 days;
- security and access logs: kept for the period needed to detect and investigate misuse, troubleshoot access problems, and handle security incidents, taking account of the age of the event and any unresolved investigation or legal requirement;
- support records: kept for the period needed to resolve your request and handle related complaints or legal claims, taking account of applicable limitation periods;
- marketing preferences: until you unsubscribe, plus a suppression record so we do not contact you again;
- consent, Terms-version, complaint, refund, and dispute evidence: kept for the period needed to demonstrate compliance and establish, exercise, or defend legal claims, taking account of applicable limitation periods and any unresolved proceedings;
- accounting, invoice, tax, and payment records: up to 10 years or the period required by applicable law;
- backups: kept for disaster recovery and replaced according to the backup rotation in use; copies of deleted data may remain until the relevant backup is replaced or expires.
Statutory transaction records do not need report content, and we do not keep report content longer because of them. Legal holds override deletion only for the necessary records and period. De-identified or aggregated information that can no longer identify anyone may be kept longer.
10. Security
We use technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or disclosure. No online service is perfectly secure. If you believe a report or link was exposed, contact care@thetell.life immediately.
11. Your rights
The GDPR applies to our processing described in this Policy regardless of where you live. Subject to its conditions and exceptions, you may request access, correction, erasure, restriction, or portability, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. Additional rights, such as appealing a refusal, may apply under your local law. You will not be discriminated against for exercising a privacy right. You can object to marketing at any time.
Submit a request by email to care@thetell.life. Give an order reference or other limited information sufficient to locate the record; do not email a full birth date or report. We may request proportionate verification. If we cannot identify a record from the information you provide, we may ask for additional information but will not collect identity data only to retain it.
If you are acting for another person, we may require proof of authority. We will respond within the legally required period and explain any extension or refusal and appeal route.
You may complain to the Bulgarian Commission for Personal Data Protection; EEA residents may also complain to their local supervisory authority. UK residents may complain to the ICO. US residents may contact their state attorney general where applicable.
12. Children
The Tell is for adults only. We do not knowingly process a preview or report for anyone under 18. If submitted information shows that a buyer or subject is under 18, we reject the request and delete the product data, retaining only what is necessary to document a refund or prevent abuse.
13. Cookies and tracking
We use strictly necessary technologies only:
- a sign-in cookie,
thetell_session, that keeps you signed in to My portraits for up to 30 days or until you sign out; - browser session storage that keeps an order or preview in progress on your device and is cleared when you close the tab; and
- the technologies Stripe uses on the payment step to process your payment and prevent fraud, described in Stripe’s own notices.
We do not use analytics or advertising cookies. We will not activate non-essential technologies where consent is required before obtaining that consent. We do not track your browsing activity across third-party websites for advertising, and our own collection practices do not change in response to a browser’s Do Not Track signal. Stripe may collect information about your activity over time and across websites using its services, including for fraud prevention, as described in its Privacy Policy.
14. Changes
We will post a new version and effective date when this Policy changes. Material changes to report processing will be highlighted before they take effect and, where required, we will seek a new choice.