Privacy & GDPR

Article 1 – Purpose and data controller

This privacy policy explains how Féedima processes the personal data of people using the Féedima® website and platform (the “Platform”), in accordance with Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act.

The data controller is FEEDIMA SAS, a simplified joint-stock company (SAS) with share capital of 10 000 €, whose registered office is at 18 rue Masséna, 06000 Nice, France, registered with the Nice Trade and Companies Register under number 108 045 683. Contact: privacy@feedima.com

Article 2 – Categories of data processed

• Identification and account data: name or pseudonym, email address, login credentials, age or declaration of adulthood, preferences, settings and account history.
• Usage data: logins, technical logs, IP address, session identifiers, device, browser, security events, journeys and interactions with features.
• Purchase data: orders, subscriptions, credits acquired and consumed, amounts, invoices, transaction identifiers and payment information limited to what the payment provider sends. Féedima does not intend to store full card numbers.
• Conversation data: messages, questions, generated replies, information freely shared with the digital experts, results of astrological calculations or card draws, consultation metadata.
• Voice data: audio recordings or streams and transcriptions, when the user activates the voice features.
• Data relating to requests and complaints: correspondence with support, GDPR requests, reports and strictly necessary supporting documents.
• Security data: automated alerts, incident categories, moderation decisions and items reviewed by authorised persons.

Article 3 – The opening waitlist

Before the site opens, you can leave your email address to be notified of the launch. We record that address, the language of the page, the date and the version of the text you accepted. Legal basis: your consent. Sole purpose: to announce the opening of Féedima to you. The address is hosted by our provider Supabase, in the European Union; it is neither sold nor transferred, and it is kept for three years at most. You can withdraw your consent and ask for your address to be erased at any time by writing to us.

Article 4 – Signing in with Google, Apple or Facebook

When this sign-in option is offered, you can create your account or sign in with your Google, Apple or Facebook account. The service you choose then sends us your name, your email address, a technical identifier for your account with that service and, depending on the service, the address of your profile picture. With Apple, you can hide your address: we then receive a relay address that forwards our emails to you. We receive neither your password nor your contacts, and nothing is posted on your behalf. Legal basis: performance of the contract (creating your account and giving you access to it). This data is kept like the rest of your account data. What Google, Apple or Meta do on their side with this sign-in is governed by their own privacy policies.

Article 5 – Birth data, Shop orders and audience measurement

Article drafted in-house, pending validation by our legal advisers.

Birth data (date, time and place): optional, it is only requested for consultations that need it (astrology, numerology). It is sensitive data, collected with your explicit consent. It is never used for advertising, does not appear in our technical logs and is not sent as such to an artificial intelligence model: only the information derived from it (sign, life path…) feeds the conversation.

Shop orders: delivery address, phone number, printed first name and gift message, for as long as it takes to make and deliver the item.

Audience measurement: if you accept it in the cookie banner, a random identifier drawn by your browser lets us count visits and understand journeys; it is described in the article “Audience measurement and digital wallets”.

Article 6 – Sensitive data and information about third parties

Consultations may lead users to share, spontaneously, personal and sometimes intimate information, in particular about their health, their love life, their beliefs or their family situation. Féedima invites users to share only the information that is useful to their request, to avoid needlessly sensitive information and not to share data about third parties without a legitimate reason. Some information may fall within the special categories of data referred to in Article 9 GDPR. Such information may only be processed where a condition of lawfulness under Article 6 and an exception under Article 9(2) GDPR are both met. Where processing relies on explicit consent, that consent will be collected by means of a specific request. Users may withdraw this consent at any time by writing to privacy@feedima.com.

Article 7 – Your explicit consent to sensitive data

Article drafted in-house, pending validation by our legal advisers.

Before your first consultation, Féedima asks you, through a separate box that is never ticked in advance, for your explicit consent to the processing of the sensitive information you choose to share (health, love or sex life, beliefs…) in order to answer you, to keep conversations safe and, where it is offered, for your expert's memory. As this information is read in order to answer you, the consultation does not start without this consent.

Féedima keeps proof of this consent (version of the text displayed and date), without its content. You can withdraw it at any time from your profile: your experts' memory is then erased and stops being fed, and your consent is asked for again before your next consultation. Withdrawal does not affect processing already carried out.

Article 8 – Purposes and legal bases

• Creating, authenticating and managing accounts, providing consultations, managing history and personalisation strictly necessary to the service subscribed: performance of the contract (Article 6(1)(b) GDPR).
• Managing purchases, subscriptions, credits, payments, invoicing and contractual support: performance of the contract; compliance with legal obligations, in particular accounting and tax obligations.
• Personalisation and continuity of consultations: Féedima may use account information, preferences and the context of the exchanges to ensure the continuity of consultations and to adapt replies to the user's request, to the extent necessary to provide the service. Where optional memory or personalisation features are offered, how to activate them, deactivate them and erase the related information is indicated in the interface or provided on request at privacy@feedima.com.

• Marketing and commercial prospecting: prior consent where the regulations require it, in particular for electronic communications and advertising trackers; legitimate interest in the cases permitted by law, with a right to object.
• Audience measurement and traffic analysis: legitimate interest for strictly necessary measurement or trackers meeting the exemption conditions; prior consent for other trackers and operations subject to it.
• Use of conversations for training: Féedima does not use users' conversations to train its own artificial intelligence models. The information needed to generate replies may be sent to the technical providers listed in the article “Recipients and processors”, under the terms applicable to their services.

• Automated analysis of conversations for security, moderation and abuse detection: Féedima's legitimate interest, subject to a documented balancing test, data minimisation and appropriate safeguards; legal obligation where applicable.
• Other analyses and developments: processing separate from the provision of the service, in particular for optional personalisation, commercial recommendations or improving features, is only carried out once an appropriate legal basis has been identified and the safeguards and information required by the regulations are in place.

• Securing the Platform, preventing fraud, managing incidents and defending Féedima's rights: legitimate interest, subject to balancing the users' interests and rights; legal obligation where it applies.
• Handling requests, complaints and the exercise of rights: performance of the contract, legal obligation or legitimate interest depending on the subject of the request.
• Data falling under Article 9 GDPR: spontaneously sharing a piece of sensitive information does not, on its own, amount to explicit consent to its processing. Where Féedima bases the processing of such information on explicit consent, the user will be informed and will be able to give that consent separately before the processing.

Article 9 – How the digital experts and the AI work

Féedima® offers interactions with digital experts, virtual characters using artificial intelligence systems. The digital experts use the Claude models provided by Anthropic. Féedima's internal engine performs certain astrological calculations and card draws; the AI models may then formulate and present the results. OpenAI may be involved in transcribing voice messages where this is not done directly by the browser.

To generate a reply, the messages and the context useful to the consultation may be sent to Anthropic. If the user uses an external voice transcription feature, the necessary audio may be sent to the relevant provider, in particular OpenAI. The exchanges take place with AI systems and not with human professionals. Users are invited to limit the information they enter to what is necessary for their consultation.

Article 10 – Your expert's memory

Article drafted in-house, pending validation by our legal advisers.

At the end of a consultation, the expert keeps what will let it pick up the thread with you: the people you mentioned and the first name you gave them, your situation and the events you described, your astrological sign (never your date of birth), and a summary of each consultation — the method used, the cards drawn, what came out of it and the advice given. Never your name, a place, a full date or a number; nothing about a medical diagnosis or treatment, religion or politics, and no precise sum of money; and your intimate life only as the state of the relationship, in general terms, never a detail.

These items are extracted by our artificial intelligence provider, stored under a key that contains neither your identifier nor the expert's, and serve only that expert — never another expert, and never those of a consultation done for someone else on your account. This memory relies on your explicit consent: you can see and erase it from your profile, it is erased if you withdraw your consent, and it disappears with your account.

Article 11 – Moderation, alerts and human review

Detection and moderation mechanisms may flag certain prohibited behaviour, risk situations or uses incompatible with the Terms of Use. Depending on the circumstances, a reply may be limited, a consultation interrupted, an account temporarily suspended or an alert sent to specially authorised persons.

Where justified, a human review may cover the items strictly necessary to assess the alert and decide on the appropriate action. These mechanisms are neither general monitoring of users nor an emergency assistance service. Any disclosure to the authorities is based on a legal obligation or an appropriate legal basis.

Article 12 – What an alert contains

Article drafted in-house, pending validation by our legal advisers.

Each message is analysed automatically, by our provider Anthropic whichever expert is consulted, to spot certain sensitive subjects (distress, requests outside the scope of the service) and, where appropriate, display a prevention or guidance message.

Repeated insults towards a digital expert despite a warning, or a serious request (threat towards others, manifestly unlawful or dangerous request, sexual content involving a minor, misuse of the service), close the consultation and file an internal alert, reviewed by an authorised member of the team. It contains an excerpt of the message (600 characters at most) and the latest exchanges around it, is kept for one year and then erased, and is included in the export and erasure of your data. No decision is taken automatically against your account following an alert.

Article 13 – Recipients and processors

Within the limits of their tasks and authorisations, data may be accessible to Féedima's authorised teams and to the providers involved in hosting, databases, authentication, payment, artificial intelligence, maintenance, support and security. The technical providers identified at this stage include Vercel, Supabase, Anthropic, OpenAI and Stripe.

Data is not sold to third parties. Providers must only receive the data needed for their services, according to their respective roles and the applicable contractual commitments.

Article 14 – The list of our providers

Article drafted in-house, pending validation by our legal advisers.

Each provider is bound by a data processing agreement and limited to what Féedima asks of it:

• Vercel (United States) — hosting of the website and the pages you view.
• Supabase (company established in Singapore, data hosted in the European Union) — database and authentication of your account.
• Stripe (Ireland, United States) — payment processing. Your card data never passes through our servers.
• Anthropic (European Union, United States) — generation of the digital expert's replies by the Claude models, for every expert: Féedima on Anthropic, Orion on Anthropic. The text of your messages and the recent history of the conversation are sent to it so that the reply can be produced.
• OpenAI (United States) — transcription of voice messages, when you dictate one. The recording is converted into text and then destroyed: no audio file is kept on our servers or written to our logs.
• Brevo (European Union) — sending of service emails (confirmations, password resets, confirmation and invoice for a Shop order — and, if you give a digital lucky card, the single sending of that card to the address you provide).
• Google LLC (United States) — hosting of your lucky card, only if you add it to Google Wallet.
• Print workshop and carrier — making and delivering the items of the Féedima Shop.

Article 15 – Transfers outside the European Economic Area

Some of Féedima's providers, or their own sub-processors, are established outside the European Economic Area, in particular in the United States or in Singapore, or may access certain data from those territories. Choosing a European hosting region for the database does not, on its own, guarantee that no transfer outside the EEA takes place.

International transfers of personal data must be governed in accordance with Chapter V GDPR, in particular, as the case may be, by an applicable adequacy decision or by the European Commission's standard contractual clauses together with, where necessary, supplementary safeguards. Data subjects may obtain information about the mechanisms applied by contacting privacy@feedima.com.

Article 16 – Retention periods

Féedima keeps users' personal data for no longer than is necessary for the purposes for which it was collected, in accordance with the storage limitation principle in Article 5(1)(e) GDPR.

Retention periods vary according to the nature of the data and the purposes of the processing.

16.1 – User account data

Users' identification data, contact details, preferences and settings are kept for as long as their account is active.

When the account is deleted, this data is deleted or anonymised, subject to the information that must be kept to meet Féedima's legal obligations or to establish, exercise or defend legal claims.

Accounts that have been inactive for three years may be deleted after the user has been informed beforehand.

16.2 – Conversations with the digital experts

Messages exchanged with the digital experts, the replies generated by artificial intelligence and any voice transcriptions are kept for as long as the account is active, so that users can access their consultation history.

This data is deleted when the account is deleted, except where limited retention is necessary to handle an incident, manage a dispute or comply with a legal obligation.

16.3 – Voice recordings

When the user uses the voice features, audio recordings are kept only for as long as necessary to transcribe them and handle the request.

They are then deleted, unless a specific feature for keeping voice messages is offered to the user and expressly brought to their attention.

16.4 – Purchase and payment data

Data relating to orders, subscriptions, credit purchases and invoicing is kept for as long as necessary to perform the services and comply with Féedima's accounting and tax obligations.

Invoices and accounting documents are kept for ten years, in accordance with Article L. 123-22 of the French Commercial Code.

The banking data needed to process payments is mainly processed by the payment provider Stripe, in accordance with its own retention and security obligations.

16.5 – Security and moderation data

Technical logs and data needed for the security of the platform are kept for a maximum of twelve months, unless a particular need justifies longer retention.

Data relating to security alerts, reports and moderation operations is kept for a period proportionate to the nature of the incident and the action taken on it.

Where an incident leads to a dispute or proceedings, the strictly necessary data may be kept until the applicable limitation periods expire or the proceedings are finally concluded.

16.6 – Requests and complaints

Data relating to requests sent to customer service is kept for as long as necessary to handle them and then, where justified, for a maximum of three years from their closure.

Information relating to the exercise of data protection rights is kept for as long as necessary to handle the requests and to demonstrate compliance with Féedima's legal obligations.

16.7 – Deletion and archiving

When the applicable retention periods expire, the data is irreversibly deleted or anonymised.

Where its retention remains necessary to meet a legal obligation or defend Féedima's legitimate interests, it may be placed in intermediate archiving, with access restricted to authorised persons only.

Article 17 – Our retention periods, processing by processing

Article drafted in-house, pending validation by our legal advisers.

• Consultations after the account is deleted: the text of the conversations is erased; Féedima keeps, under an identifier that no longer names you, what proves the service provided (dates, expert, method used, cards drawn, number of messages, credits debited, reason for ending) for five years, in order to respond to a payment dispute.
• Moderation alerts: one year, then erased; deleted with your account.
• Spending alerts (threshold reached, amount, dates of display and sending, without any text): three years; kept under an identifier that no longer names you after the account is deleted, as proof that you were warned.
• Consultation allowances and the 24h Unlimited Pass (number of messages counted, end of the Pass, without any text): the retention period of the consultation they describe.
• Proof of your consents (version of the text accepted and date, for a purchase, a waiver of the right of withdrawal or your consent to sensitive data): ten years, without content or identity.
• Refund of credits when the account is closed: the amount and the orders concerned are kept for ten years with the accounting documents, without any other data.
• Shop: the delivery address, phone number, the email of a purchase without an account and that of the person to whom you give a card are erased 90 days after delivery (a digital card is delivered on payment); the printed first name and the message of a card stay attached to the card for as long as it can be viewed, and are erased with your account; the order itself (amounts, statuses, card number) is kept for ten years with the invoice, without identity. Our payment provider keeps the order details with the payment, for its own retention periods. The person to whom you give a card receives only one email.
• Expert's memory: for as long as your account is open and your consent given; erased at your request, when you withdraw your consent or with your account.

Article 18 – Security and confidentiality

Féedima implements technical and organisational measures appropriate to the risks, in particular for access control, confidentiality of conversations, account security, management of authorisations, backups and incident management. No measure guarantees absolute security; Féedima adapts its measures to the risks identified and to changes in its processing.

Article 19 – Cookies and other trackers

Trackers strictly necessary for the Platform to work may be used within the limits set by the regulations. Other trackers, in particular advertising or audience measurement trackers that do not qualify for an exemption, are only placed or read after valid consent has been obtained. Details are on the Cookies page.

Article 20 – Audience measurement and digital wallets

Article drafted in-house, pending validation by our legal advisers.

Audience measurement: if you accept it in the cookie banner, a random identifier generated by your browser lets us count visits and understand how the site is used. It contains no identity, is shared with no one and does not follow you on any other site. If you later create an account, these measurements are attached to it — and are therefore erased with it.

With an account: your cookie banner choice also applies once you are signed in. Without your consent, nothing is measured. The only things still recorded are those needed for your safety (a referral or a report during a session), as proof of a payment, a refund or a consent, and to keep the service working. Your purchases, invoices and messages to support are kept to provide the service and handle a complaint, whatever your choice.

The audience measurement identifier and the events it carries are kept for 13 months. Withdrawing your consent from the Cookies page immediately erases it from your device.

Digital wallets: if you add your digital lucky card to Google Wallet, your printed first name, the theme, the card number and the share link are sent to Google LLC (United States), which hosts the card in your wallet; we request its deactivation when your account is erased. Apple Wallet receives nothing: the card is signed by our servers and exists only on your device.

Article 21 – Rights of data subjects

Under the conditions and limits set by the regulations, everyone has the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw consent at any time where processing is based on it, without affecting the lawfulness of prior processing. They may also set instructions concerning what happens to their data after their death, under the conditions of French law.

Requests may be sent to privacy@feedima.com or by post to Féedima's registered office. Féedima may ask for proof of identity in case of reasonable doubt and replies within the time limits set by the GDPR, in principle one month, subject to the extensions permitted by law. You can also export and erase your data directly from your profile.

Everyone may lodge a complaint with the French data protection authority (CNIL).

Article 22 – Minors

The Platform is reserved for people aged at least 18. Féedima does not knowingly seek to collect data about minors in connection with a user account. If an account opened by a minor is reported, Féedima takes the appropriate measures under the regulations and the Terms of Use.

Article 23 – Changes to the policy

Féedima may update this privacy policy to reflect changes in processing, providers or regulations. The current version is made available on the Platform. Where the law requires it, specific information will be given or new consent obtained before the processing concerned is carried out.

Article 24 – Contact

For any question about the protection of personal data: privacy@feedima.com. Postal address: FEEDIMA SAS, 18 rue Masséna, 06000 Nice, France.