# PRIVACY POLICY & COOKIE NOTICE
Last Updated: November 1, 2026
This Privacy Notice for **DestinoMatriz** ("**we**," "**us**," or "**our**"), operating **https://destinomatriz.com**, describes how and why we process information when you use our Services, in compliance with global privacy regulations including the **Brazil General Data Protection Law (LGPD)**, the **EU/UK General Data Protection Regulation (GDPR)**, and the **California Consumer Privacy Act (CCPA)**.
If you have any questions or wish to exercise your privacy rights, please contact us at **legal@destinomatriz.com**.
## SUMMARY OF KEY POINTS
- **Zero Mandatory Account Registration:** You do not need to create an account or sign in with Google/Facebook to calculate your Destiny Matrix or purchase a report.
- **Minimal Ephemeral Data Processing:** Birth dates, optional birth times, and first names/aliases entered into our calculators are processed deterministically in memory to generate your reading and PDF booklet. We do not sell your personal data to third parties.
- **Secure Third-Party Checkout (Lemon Squeezy & PayPal):** Payment details (credit cards, Apple Pay, Google Pay, PayPal) are processed directly by **Lemon Squeezy** (Merchant of Record) and **PayPal**. We never touch or store your payment card numbers.
- **Essential Local Storage & Cookies Only:** We use essential browser storage (`localStorage` and `sessionStorage`) to keep your paid reading unlocked (`unlock_token`) and remember your language/cookie banner preference.
## 1. WHAT INFORMATION DO WE PROCESS?
### A. Information You Voluntarily Provide for Calculation
When you use our calculators (Personal Matrix, 1:1 Compatibility, or 3-Way Relationship Profiler), you input:
- **Date of Birth** (required for 22 Arcana and K-Saju calendar math)
- **Time of Birth or Habit Clues** (optional, used to estimate the K-Saju Hour Pillar)
- **Name or Alias** (optional, used for numerology and personalizing your PDF booklet cover)
**Important Privacy Safeguard:** Shared Story Cards and public share links (`/r/{share_id}`) only contain the public summary snapshot and never expose third-party names or paid sections. Ephemeral server share caches expire automatically (TTL 2 hours).
### B. Payment & Order Verification Data
When you purchase a full reading ($2.99 USD or $4.99 USD), your transaction is processed by:
- **Lemon Squeezy, LLC** (Privacy Policy: https://www.lemonsqueezy.com/privacy)
- **PayPal, Inc.** (Privacy Policy: https://www.paypal.com/webapps/mpp/ua/privacy-full)
We receive only the transaction status, Order ID, product identifier, and cryptographic input digest required to issue your encrypted `unlock_token`.
### C. Automatically Collected Technical Data
When you visit **destinomatriz.com**, our web server automatically processes standard HTTP request metadata (IP address for rate-limiting and DDoS/abuse protection, browser locale, and request timestamps). Rate-limit counters are held in memory only and automatically pruned.
## 2. HOW DO WE USE COOKIES & LOCAL STORAGE?
We do **not** use invasive cross-site spyware cookies. We use strictly necessary browser storage (`localStorage` and `sessionStorage`) on your device for three essential functions:
1. **Paid Reading Entitlement (`md_entitlement_*`):** Stores your AES-256-GCM encrypted, HMAC-signed `unlock_token` (valid for 30 days) so your unlocked report and PDF download remain accessible without forcing you to create an account.
2. **Checkout Continuation (`md_pending_order_*`):** Temporarily holds your session state while you approve a payment on Lemon Squeezy or PayPal so your reading opens immediately upon redirect back to **destinomatriz.com**.
3. **Consent Preference (`md_cookie_consent_v1`):** Remembers that you dismissed the privacy/cookie notice banner.
You can clear your browser storage at any time in your browser settings.
## 3. LEGAL BASES FOR PROCESSING (GDPR / LGPD)
- **Performance of a Contract:** Processing your birth date input to calculate and deliver the free or paid digital reading and PDF booklet you requested.
- **Legitimate Interests & Security:** Rate-limiting abusive automated traffic and verifying cryptographic payment signatures to prevent fraud.
- **Consent:** Storing optional preferences where applicable.
## 4. INTERNATIONAL DATA TRANSFERS & RETENTION
Our application servers are hosted on secure cloud infrastructure in the **United States / South Korea**. Because our calculation engine is stateless and ephemeral:
- In-memory share snapshots and pending order caches automatically expire within **2 hours**.
- Encrypted client entitlement tokens expire after **30 days**.
## 5. CHILDREN'S PRIVACY
Our Services are intended for users aged **18 and older**. We do not knowingly collect personal information from minors under 18.
## 6. YOUR PRIVACY RIGHTS (LGPD, GDPR, CCPA)
Depending on your jurisdiction, you have the right to request access to, correction of, or deletion of any personal information associated with an order or support inquiry. To exercise your rights, email **legal@destinomatriz.com**.
## 7. CONTACT INFORMATION
**DestinoMatriz**
Email: **legal@destinomatriz.com**
Seoul, South Korea (Nowon-ro 331, 302-1402, 01786)
Website: **https://destinomatriz.com**