Privacy Policy — Solaya Live

Last updated: 2 September 2026

1. General provisions

This Privacy Policy describes the rules for processing personal data of users of the Solaya Live mobile application available on iOS and Android devices.

The Solaya Live application is a platform that enables individual 1-on-1 decision sessions conducted live by specialists, in particular via text chat and the exchange of attachments. Each session is carried out personally by a live specialist and is individual in nature.

The application is offered to users in selected countries of the European Union, in particular Poland, Italy, Hungary, the Czech Republic and France.

The Administrator processes personal data in accordance with UK GDPR and — to the extent applicable to persons in the European Economic Area — in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR"), as well as with the relevant national provisions implementing the GDPR, in particular:

- in Poland — the Act of 10 May 2018 on the protection of personal data,
- in Italy — Decreto Legislativo 30 giugno 2003, n. 196 (Codice in materia di protezione dei dati personali), as amended,
- in Hungary — Act CXII of 2011 on the right to informational self-determination and freedom of information (Infotv.),
- in the Czech Republic — Act No. 110/2019 Sb. on the processing of personal data,
- in France — Act No. 78-17 of 6 January 1978 (Loi Informatique et Libertés), as amended.

2. Data Administrator

The Administrator of your personal data is:

Solaya LLP
United Kingdom
Office 1.01, 411 Oxford Street, London, Greater London W1C 2PE
email: kontakt@solaya.live
website: https://solaya.live

For matters concerning the processing of personal data, you may contact the Administrator at: kontakt@solaya.live.

3. Administrator's representative in the EEA

In connection with offering services to persons in the European Economic Area, in accordance with Article 27 of the GDPR, the Administrator has appointed a representative in the EEA:

Nykolaichuk Mykola
02-454, Szczęsna 5B, Warsaw, Poland
email: kontakt@solaya.live

For matters related to the processing of personal data, you may also contact us via the EEA representative.

4. Scope of data we process

Depending on how you use the application, we may process the following personal data:

registration and identification data, such as: email address, name, password (in the form of an encrypted hash);

authentication data from external sign-in services, such as Google or Apple identifier;

profile data, such as avatar, if added by the user;

technical and application data, such as device locale, push notification token, information needed to maintain the session and login security;

data on the use of the services, such as the history of conversations with specialists, message content, photos and other files sent within sessions;

transactional data, such as amount, currency, purchase date, type of session ordered and payment status;

data concerning the country or language version, determined automatically based on device or interface settings;

data related to contact with customer support, complaints and reports;

data provided in the analysis order form, such as name, date and place of birth, and the content of the question;

data concerning marketing consents, such as the content of the declaration in the wording displayed to the user, the date and place where it was given, and information about the withdrawal of consent;

data on interaction with email messages, such as information about the opening of a message and about clicks on the links contained in it.

We do not store user passwords in plain text. Passwords are protected using the bcrypt mechanism.

Some of the data provided in the analysis order form concerns a third party. For couple analyses we ask for the partner's date of birth and, in some cases, also their place of birth and name. That person does not provide this data to us themselves and is usually unaware that we hold it.

The legal basis for processing this data is Article 6(1)(f) of the GDPR — our legitimate interest in performing the analysis ordered by the customer; without the partner's birth data the ordered product cannot be created at all. The scope of this data is minimal (date of birth and, in some cases, place of birth and name), it does not belong to the special categories of data within the meaning of Article 9 of the GDPR, and we use it solely to prepare the ordered analysis — we do not contact the person concerned on the basis of this data and we do not build a profile of that person.

We store the partner's data solely together with the order to which it relates and for the same period as the other data of that order — under the rules described in section 11 of this Policy; we do not keep it as a separate data set and we do not keep it for longer than the order itself.

We do not inform such a person individually, because we do not hold any contact details that would make this possible — we have neither their address, nor their email address, nor any other identifier — and therefore there is no channel through which we could provide them with the information. In this respect we rely on the exemption provided for in Article 14(5)(b) of the GDPR (impossibility or disproportionate effort), and we make the required information publicly available in this Policy — as that provision envisages.

5. Sources of data

We receive personal data:

directly from you during registration, login, account creation, the use of sessions, payments or contact with us;

from external sign-in providers, if you choose to log in via Google or Apple — in accordance with their privacy policies (Google Privacy Policy: https://policies.google.com/privacy; Apple Privacy Policy: https://www.apple.com/legal/privacy/);

automatically from your device and the application, to the extent necessary for service operation, security and matching the language, country and currency.

6. Purposes and legal bases of processing

We process your personal data for the following purposes:

a) creating and maintaining a user account
including registration, login, session maintenance, password reset and user authentication
legal basis: Article 6(1)(b) of the GDPR — performance of a contract or steps taken prior to entering into a contract;

b) providing the session services available in the application
including enabling individual conversations with specialists, sending messages and attachments and the provision of paid 1-on-1 decision sessions
legal basis: Article 6(1)(b) of the GDPR — performance of a contract;

c) handling payments and settlements
including the recording of purchases, transaction confirmations, handling complaints and refunds
legal basis: Article 6(1)(b) of the GDPR and Article 6(1)(c) of the GDPR — performance of a contract and compliance with legal obligations;

d) sending technical and organisational messages
including emails related to the account, welcome messages, security messages and codes or links for password reset
legal basis: Article 6(1)(b) of the GDPR, and to the extent justified, also Article 6(1)(f) of the GDPR — our legitimate interest in ensuring security and efficient user service;

e) sending push notifications related to session activity
including notifications about new messages from a specialist;
legal basis: Article 6(1)(b) of the GDPR — performance of a contract, and Article 6(1)(f) of the GDPR — our legitimate interest in ensuring smooth communication;

f) sending push notifications of a reminder and engagement nature
including reminders about ongoing sessions or encouragement to contact a specialist;
legal basis: Article 6(1)(f) of the GDPR — our legitimate interest in maintaining the relationship with the user;
the user may at any time disable push notifications in the system settings of their device;

g) ensuring the security of the service, preventing abuse and enforcing the rules of use of the application
including detecting spam, offensive content, threats, abuse and protection against unauthorised access
legal basis: Article 6(1)(f) of the GDPR — our legitimate interest;

h) analytics, statistics and measurement of the effectiveness of sales processes and the operation of the application
to the extent limited to business and technical needs, including the use of conversion analytics tools
legal basis: Article 6(1)(f) of the GDPR — our legitimate interest in developing, analysing and optimising the service;

i) establishing, asserting or defending against claims
legal basis: Article 6(1)(f) of the GDPR — our legitimate interest;

j) sending marketing messages by email
including commercial information about our services, new analyses, promotions and discounts, sent to the email address provided; the selection of content may take into account the country, language version, products ordered and payment status, and we measure the effectiveness of the mailing by recording the opening of a message and clicks on the links contained in it
legal basis: Article 6(1)(a) of the GDPR — consent given by ticking a separate box, not ticked by default, when placing an order; messages are sent solely on the basis of prior consent, in accordance with the provisions on electronic communications in force in the user's country; giving consent is voluntary and is not a condition of placing an order or of the scope of the service provided, and consent may be withdrawn at any time — by clicking the unsubscribe link included in the message or by writing to us at: kontakt@solaya.live; withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal.

We record the fact that marketing consent has been given, together with the date, the content of the declaration in the wording displayed to the user and the place where it was given — so that we are able to demonstrate that consent has been given or withdrawn, and so that we do not send further messages after its withdrawal; the legal basis for this record is Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR — the obligation to demonstrate consent. If we process personal data in the future for other marketing purposes that require consent, we will inform users accordingly and request a separate consent.

7. Profiling

As part of providing the service, we may use limited forms of profiling within the meaning of Article 4(4) of the GDPR, consisting of automatic analysis of selected data on user activity in order to adjust service handling, prioritise communication and — if the user has given marketing consent — select the content of the marketing messages sent to them.

In particular, we may analyse the user's country and language version, the history of their orders together with the payment status, and the way in which the emails we send are used (opens, clicks) — in order to categorise customer activity for the purposes of internal service handling and, if the user has given marketing consent, also in order to select the content of the marketing messages sent to them. This profiling does not lead to decisions producing legal effects on the user or similarly significantly affecting them. It is not used to differentiate prices or the terms on which the service is provided between individual users; prices depend solely on the country and currency in which the service is offered.

The user has the right to object to profiling under the rules set out in Article 21 of the GDPR. To the extent that profiling serves to select marketing content, the user may withdraw marketing consent at any time (Article 7(3) of the GDPR) — this results in that profiling being discontinued.

8. Whether providing data is mandatory

Providing personal data is generally voluntary, however, some data is necessary to conclude and perform the contract for the provision of services by electronic means within the Solaya Live application.

In particular:

providing an email address, name and login data is necessary to create and operate a user account;

providing data necessary for authorisation by Google or Apple is necessary if the user chooses this method of login;

providing data necessary to process payments and settle the purchase is necessary to acquire paid sessions;

providing data related to the content of the conversation and attachments is necessary to the extent that the user wishes to use sessions and communication with a specialist;

providing a push notification token, adding an avatar or sending photos is voluntary, but failure to provide them may make it impossible to use certain application features;

giving consent to receive marketing messages is entirely voluntary — its absence or withdrawal means only that we will not send such messages, and affects neither the possibility of placing an order nor the scope and quality of the service provided.

Failure to provide the data required for registration, login, purchase or service performance results in the inability to enter into a contract or to provide the service in full.

9. Recipients of the data

Your data may be made available to the following categories of recipients:

the chosen specialist with whom you have a session — to the extent including the content of the conversation, attachments and data necessary to perform the session;

cloud infrastructure, hosting and data storage providers;

payment system providers;

email and notification service providers;

providers of the services used to prepare and deliver the ordered analysis, including astrological calculations, determination of the coordinates of the place of birth and generation of the PDF file;

providers of artificial intelligence tools used to prepare the content of the ordered analysis and to automatically screen chat messages for crisis situations;

analytics service providers;

providers of advertising services and of advertising effectiveness measurement;

providers of messaging applications that we use for internal operational notifications addressed to our team;

external sign-in service providers, if you choose Google Sign-In or Apple Sign-In;

entities providing technical, legal, accounting or organisational support;

public authorities, where the obligation to provide data follows from provisions of law.

We currently use, in particular, the following providers:

Stripe — payment handling for selected countries, in particular Italy, Hungary, the Czech Republic and France;

PayU — payment handling for Poland;

Google Cloud Platform — hosting, data processing and file storage;

MongoDB Atlas (MongoDB, Inc.) — database;

Brevo (Sendinblue SAS) — management of the contact database, including the data provided in the order form, and the sending of emails: reminders related to the use of the service, marketing messages sent with the user's consent and — as a backup provider — transactional emails when the primary provider is unavailable;

Postmark (AC PM, LLC) — sending transactional emails, including login codes, order confirmations and messages containing the ordered analysis;

Expo (650 Industries, Inc.) — technical handling of push notifications;

Strimix — conversion analytics;

Meta Platforms Ireland Ltd. — measurement of advertising effectiveness: the Meta pixel running in your browser and the Conversions API running on our server side; we pass on the email address solely in the form of a SHA-256 hash, whereas the IP address and browser information (user agent) — in their original form, without conversion into a hash, together with ad click identifiers, the order value and the address of the page visited;

TikTok — measurement of advertising effectiveness (Events API, on our server side), solely in relation to persons who came to us from TikTok; the scope of data is the same: the email address in the form of a SHA-256 hash, and the IP address and user agent in their original form, without conversion into a hash;

Google Ireland Limited — Google Analytics 4, loaded via Google Tag Manager on payment pages; we pass on a SHA-256 hash of the email address, used as a persistent identifier of the person, as well as session identifiers and transaction data;

OpenAI — preparation of the content of the ordered analysis; we pass on the date of birth and, in the case of couple analyses, also the partner's date of birth, the place of birth, the names indicated in the order (in the case of French orders for a couple analysis) and the calculated planetary chart;

PDF.co — conversion of the prepared content into a PDF file; the provider receives the finished document, and therefore the names, the birth data and the entire content of the analysis prepared for you, and stores this file in its own infrastructure;

AstrologyAPI (json.astrologyapi.com) — calculation of the planetary chart on the basis of the birth data provided;

Google Maps Platform (Google Ireland Limited) — determination of the geographic coordinates of the place of birth indicated in the order;

Google Sheets (Google Workspace, Google Ireland Limited) — order register: the email address, country and order details are entered into the spreadsheet;

Anthropic — automatic screening of messages sent in the chat for crisis situations; the provider receives the content of the message;

Telegram Messenger — operational notifications addressed to our team's internal channel; these notifications may quote excerpts of a user's messages, including messages flagged by the crisis detection mechanism;

Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) — delivery of push notifications to the user's device; we use them via Expo;

ipify — determination of the IP address from which the order is placed; the payment operator rejects an order without this information, so by design this service learns your IP address;

Google Ireland Limited — Google Fonts and the image server used on some of our pages; both of these learn the visitor's IP address by the very fact of delivering a file to their browser.

Entities processing personal data on our behalf act on the basis of appropriate data processing agreements (Article 28 of the GDPR) and only in accordance with our instructions, unless they act as separate or joint data administrators — as is the case in the area of payment services performed independently, and also in the area of advertising and advertising effectiveness measurement services (Meta, Google, TikTok), where these providers also process data for their own purposes and do not act solely in accordance with our instructions.

We do not sell your personal data to third parties.

10. Payments

The application is free to download. 1-on-1 decision sessions with specialists are paid services.

Payments for individual 1-on-1 decision sessions are processed via external payment providers, in particular Stripe or PayU. Payment card data or other detailed payment data is processed by the relevant payment provider in accordance with their own privacy policy and terms.

The Administrator stores information about the purchase, such as date, amount, currency, type of session ordered and transaction status.

Refunds are considered individually within 14 days of the date of purchase, if the service has not been performed.

11. Data retention period

We store personal data for no longer than is necessary to achieve the purposes for which it was collected, and then for the period required by law or necessary for protection against claims.

In particular:

we store user account data for the duration of the account, and after its deletion — for up to 30 days for the purposes of completing the deletion process;

we store data of conversations with specialists and attachments for 3 years from the date of the user's last activity, unless a shorter or longer period results from the needs of providing the service, handling complaints or defending against claims;

we store transactional and settlement data for 5 years from the end of the tax year in which the transaction took place, or longer if required by tax, accounting or claims-related provisions of the law in the relevant country;

we store security and audit logs for 90 days;

we store session logs for 12 months;

we store notification logs for 90 days;

we store push notification tokens until they are deactivated, the user revokes the permission, the user logs out or they become invalid;

we store marketing consent declarations and records of their withdrawal for the period during which marketing messages are sent, and then for the period of limitation of claims connected with that mailing, but no longer than 3 years from the withdrawal of consent; the email address of a person who has withdrawn consent or raised an objection remains on our internal exclusion list indefinitely and we retain it also after the deletion of the user's remaining data — this is the only way for the withdrawal of consent to remain effective (Article 17(3)(b) of the GDPR).

After the relevant period, the data is deleted or anonymised.

12. Place of data processing and transfers outside the EEA

In principle, users' personal data is stored and processed in infrastructure located within the European Economic Area, in particular in the europe-west1 region (Belgium), used by our backend, database and file storage services.

Since the Administrator is established in the United Kingdom, data may also be made available or accessible in the United Kingdom to the extent necessary for managing the service, handling users, security and fulfilling the Administrator's obligations. Transfer of data to the United Kingdom is based on the Implementing Decision of the European Commission of 28 June 2021 finding an adequate level of protection of personal data in the United Kingdom (C(2021) 4800).

In connection with the use of selected technology providers (including MongoDB Atlas, Expo, Postmark, OpenAI, PDF.co, Anthropic, ipify and Telegram Messenger, as well as Meta, Google and TikTok in the area of advertising and advertising effectiveness measurement services), data may also be transferred to the United States or other third countries outside the EEA. This also applies to AstrologyAPI, whose service is operated from India — a country in respect of which the European Commission has not issued an adequacy decision. In such cases, the transfer is carried out solely in accordance with applicable law, in particular:

on the basis of an adequacy decision (including the EU-US Data Privacy Framework), or

with appropriate safeguards, in particular standard contractual clauses approved by the European Commission (Implementing Decision 2021/914).

Information on the safeguards applied to transfers outside the EEA, as well as information on how to obtain a copy of these safeguards, can be obtained by contacting us at: kontakt@solaya.live.

13. User rights

In accordance with the GDPR, you have the right to:

a) access your data (Article 15 of the GDPR);

b) rectify the data (Article 16 of the GDPR);

c) erasure of the data (Article 17 of the GDPR);

d) restriction of processing (Article 18 of the GDPR);

e) data portability in a commonly used machine-readable format (Article 20 of the GDPR);

f) object to processing based on our legitimate interest, including profiling (Article 21 of the GDPR);

g) withdraw consent — if processing is based on consent; withdrawal of consent does not affect the lawfulness of prior processing;

h) lodge a complaint with the competent supervisory authority.

To exercise your rights, you may contact us at: kontakt@solaya.live. We respond to requests without undue delay, generally within 1 month of receipt, subject to the cases provided by law.

If you believe that the processing of your data violates the law, you have the right to lodge a complaint with the competent supervisory authority, in particular:

in Poland — to the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl;

in Italy — to Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, https://www.garanteprivacy.it;

in Hungary — to Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Falk Miksa utca 9-11, 1055 Budapest, https://www.naih.hu;

in the Czech Republic — to Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, https://www.uoou.cz;

in France — to Commission nationale de l'informatique et des libertés (CNIL), 3 Place de Fontenoy, 75007 Paris, https://www.cnil.fr;

in the United Kingdom — to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, https://ico.org.uk.

14. Automated decision-making

We do not make decisions concerning users that produce legal effects or similarly significantly affect them, made solely on an automated basis within the meaning of Article 22(1) of the GDPR.

Information regarding the profiling we use has been described in section 7 of this Policy.

We may use limited technical mechanisms related to security, matching the language version, currency or operation of the application, but they do not lead to decisions concerning the user that have legal or similarly significant effects.

15. Children's data and age limit

The Solaya Live application is intended exclusively for persons over 18 years of age.

We do not direct our services to children and do not knowingly collect personal data of persons under 18 years of age. If we learn that an account has been created by a person under 18 years of age, we may block the account and delete the data in accordance with applicable law.

16. Rules for using sessions and privacy

The user is responsible for the content sent within sessions, including messages and photos.

When using sessions, it is prohibited to send unlawful, offensive content, content containing threats, spam, indecent content or content that infringes the rights of other persons. In the event of a breach of the rules, we may take action provided for in the terms and conditions, including restricting access to the service or blocking the account.

The service is informational and entertainment in nature. It does not constitute medical, legal or financial advice.

Due to the nature of the service, please do not share, in the course of sessions, excessive data or special category data within the meaning of Article 9 of the GDPR (such as data concerning health, religious beliefs, sexual orientation or ethnic origin), unless this is necessary for the session to take place. If such data is voluntarily shared, the basis for its processing is Article 9(2)(e) of the GDPR — data manifestly made public by the data subject.

17. Data security

We apply appropriate technical and organisational measures to protect personal data, including in particular:

encryption of data transmission (TLS);

secure password storage (bcrypt);

authentication and access control mechanisms (JWT, roles, session restrictions);

protection against brute-force attacks (login attempt limits, account blocking);

restriction of access to data in accordance with the principle of least privilege;

solutions to protect against loss, misuse and unauthorised access.

Despite applying appropriate safeguards, no method of data transmission over the Internet or method of electronic storage guarantees complete security.

18. Data protection breaches

In the event of a personal data breach that may pose a high risk to the rights or freedoms of users, we will inform users without undue delay, in accordance with Article 34 of the GDPR, indicating the nature of the breach, its possible consequences and the measures taken to address the breach.

19. Changes to the Privacy Policy

We may update this Privacy Policy from time to time, in particular in the event of legal, technological or organisational changes.

The new version of the Privacy Policy will be published in the application and on the Administrator's website. In case of material changes, we will provide users with additional information via an in-app notification or email.

20. Contact

For matters concerning privacy, personal data or the exercise of user rights, please contact us:

Solaya LLP
email: kontakt@solaya.live
website: https://solaya.live

Representative in the EEA:
Nykolaichuk Mykola
02-454, Szczęsna 5B, Warsaw, Poland
email: kontakt@solaya.live