Privacy and data protection
The short version: a birth chart needs your birth, so Sorsye keeps what you give it and nothing more. It runs on our own server, uses no advertising trackers, sells nothing, and you can see, download or delete everything about you from Settings at any time.
1. Who is responsible
The data controller is Astorva Holdings Ltd, an International Business Company incorporated in the Republic of Seychelles, company number 252040, registered office c/o AAA International Services Limited, House of Francis, Room 303, Ile du Port, Mahé, Seychelles. For anything about your personal data, write to support@sorsye.com.
2. What we keep, and why
If you only visit
Nothing that names you. The doors you open, the screens you see and how long you stay are counted against a random device id that your browser creates and keeps; on our server we store only a hashed form of it, so it cannot be turned back into your device. We do not store your IP address; it is used in memory only to stop abuse, and to note the country the connection came from, and then forgotten. The birth details you type to draw a chart are used to draw it and are not saved on the server unless you make a place. On your own device, your browser may keep your chart, your partner and your journal so you find them again; Settings lets you forget them.
If you make a place
Your email address, a hash of your passphrase (never the passphrase itself), your name if you give one, your birth details (date, time and place), the birth details of a partner if you add one, your chart preferences, your journal, and the readings you have unlocked. We also note when you confirmed your email address, because a place opens only once its address is confirmed. These are kept so that your place follows you and so that what you have paid for stays yours. The lawful basis is the agreement between us when you make the place, and your consent when you add a partner's details, which you may only do with their permission.
If you ask the machine
When you ask a question about your chart or ask for a whole dream to be read, the text of your question and the reading it is grounded in are sent to our language model provider, MiniMax (api.minimax.io), to compose the answer. We send the minimum needed and no name or email. The question, the number of words used and the cost are kept in our own ledger for review and to keep the service affordable; you may ask us to delete your questions, and we can switch the keeping of question texts off entirely.
If you buy
PayPal processes the payment, and holds your card, account and billing details under its own privacy statement. We never see your card. We keep the PayPal order number and capture number, what was bought, the amount, the currency and the time, linked to your place, so we can open what you paid for, send your receipt and keep the accounts the law requires.
The letters we send
We write to you only because of something done in your place: the letter to confirm your email, a passphrase reset, a receipt, a note that your passphrase was changed, a note when the house opens something for you, an invitation if we invite you to try Sorsye, and a last letter when a place is deleted. We keep the address, the kind of letter and the date, so we can tell whether a letter went out. There is no marketing and nothing to unsubscribe from.
To keep the house running
Errors, slow answers and faults are logged so we can fix them. Sign-in attempts are counted to stop guessing. These records are about the service, not about you, and are cleared on a schedule.
If you use the two extra birth-profile slots included with an annual Everything pass, we also keep those names and birth details under your account. They do not create accounts for other people or give anyone else access to your journal. Add someone only with their permission, or as their parent or guardian. These profiles are included in your export and are deleted when you remove them or delete your place.
3. Cookies and storage
Sorsye sets one cookie, and only when you sign in: a session cookie so the server knows it is you, marked httpOnly and secure. There are no advertising or tracking cookies, and no third-party analytics. If we ever add a third-party measurement tool, this page will say so first and you will be asked. Your browser's local storage keeps your device id, your theme, the gate word if you ask it to, and a copy of your journal for offline use. When you choose to pay, PayPal's own window loads PayPal's scripts and cookies, under PayPal's privacy statement.
4. Where the data lives, and who else sees it
Our server is rented from Contabo GmbH, a German company, and stands in Europe; it is administered only by Astorva Holdings Ltd. Personal data leaves that server in these cases only:
- a letter to you goes out through our email provider, Hostinger, from support@sorsye.com;
- the text of a question goes to MiniMax to be answered;
- a payment goes to PayPal to be processed;
- a Telegram message about the house's own health goes to the company (counts and faults only, never a name, an email or a reading), and when you write to the house through "Tell us what you think", your words go to the company the same way, without your name or email;
- an encrypted copy of the whole database is kept for three days on a second server rented from Hostinger and on the company's own computer, readable only with a key held by the company.
Transfers outside Seychelles are made only to providers bound by their own data protection terms, as the Act requires.
5. How long
| What | Kept for |
|---|---|
| Your place and everything in it | Until you delete it (we do not remove places for inactivity; if that changes, you will be told by email first) |
| A place that never confirmed its email | Until it is confirmed or deleted; you may ask us to remove it at any time |
| Payment records (PayPal order and capture numbers, what was bought, amount, date) | Seven years, as accounting law requires |
| The letters we sent you (address, kind and date) | 400 days; a copy of a letter that could not be sent, 30 days |
| Questions to the machine | Up to four hundred days while the review setting is on; at once when it is switched off, when you delete your place, or when you ask |
| Visit statistics (hashed device id) | Four hundred days |
| Error and fault logs | Ninety days |
| Backups | Three days, encrypted, then deleted |
6. Your rights
Under the Data Protection Act, 2023 you may ask to see the personal data we hold about you, to correct it, to erase it, to restrict or object to its processing, and to receive it in a portable form. Most of this you can do yourself in Settings: "show everything Sorsye holds about me" gives you the whole record, "edit my details" corrects it, and "delete my place and everything in it" erases it at once (the payment records the accounts require are kept, but no longer linked to you: the order number, what was bought, the amount and the date). For anything else write to support@sorsye.com from the email of your place and we will answer within thirty days. You may also complain to the Information Commission of Seychelles, the authority under the Act.
7. Children
Sorsye is for people of eighteen and over. We do not knowingly keep a place for a child; if you believe one exists, tell us and it will be removed. A parent may save a child's birth details as a family profile in their own place; those details belong to the parent's place and are removed with it.
8. Security
Everything travels over HTTPS. Passphrases are hashed with argon2id and are never stored or seen in the clear. Readings and the books stay on the server and are never sent to the browser as a whole. Access to the server is by key only, and the back room that shows statistics is open only to the company's administrators. If a breach ever touched your personal data, we would tell the Information Commission and you promptly, as the Act requires, and say what happened and what to do.
9. Changes
When this page changes, the date at the top changes with it. If a change is important, we tell you inside Sorsye or by email.