PRIVACY POLICY

Last Updated: 2026-09-22

Astriva, operated by White City Technology Limited ("Company," "we," "our," or "us"), respects your privacy and is committed to protecting your information. White City Technology Limited is the controller of your personal information for the Service, including where the App Store listing displays an affiliated developer name (such as Spiritrue Ltd.). This Privacy Policy explains how we collect, use, disclose, store, and otherwise process information when you access or use the Astriva mobile application, website, and related services (collectively, the "Service").

This Privacy Policy is written to reflect the current core Service experience, which centers on one-on-one advisor consultations, clearly labeled AI chat experiences ("AI Seers"), account access, payments, promotional programs, and customer support. Our website may also serve as a static informational website describing the Service, supported platforms, product features, and promotional offerings.

1. SCOPE OF THIS POLICY

This Privacy Policy applies to personal information we collect when you:

(a) create or use an Astriva account;

(b) sign in through Apple Sign-In or another supported login method;

(c) browse advisor profiles or use consultation features;

(d) chat with AI Seer personas or purchase AI Seer chat sessions;

(e) add funds to a balance, recharge a balance, or complete payments through Apple IAP or another supported payment method (such as card or Apple Pay);

(f) participate in first-order offers, promotional credit flows, coupons, or other campaigns;

(g) contact customer support;

(h) browse our website or interact with website analytics, cookies, or similar technologies; or

(i) otherwise interact with the Service.

This Privacy Policy does not apply to third-party services that may be linked to, integrated with, or made available through the Service, including app stores, payment processors, social login providers, or other third-party websites and services, which are governed by their own privacy policies.

2. INFORMATION WE COLLECT

We collect the following categories of information, depending on how you use the Service.

2.1 Account and Profile Information

This may include:

• user ID and account identifiers;
• display name, nickname, or profile information you choose to provide;
• login method and authentication-related information;
• email address, if provided directly by you or through a sign-in provider;
• account status, registration date, and basic account settings.

If you use the App without creating an account (guest mode), we associate the information described in this Privacy Policy with device-level identifiers. If you later create an account, that information may be linked to your account.

2.2 Sign in with Apple and Other Login Information

If you sign in using Apple Sign-In, we may receive information such as your unique Apple-linked identifier, the name associated with the sign-in flow, and an Apple private relay email address if you choose to hide your email. We use this information to create, authenticate, and maintain your account.

2.3 Advisor Consultation Data

To provide consultation features with human advisors, we may collect and store:

• the advisors you view, select, follow, or contact;
• consultation order records;
• chat messages, images or other attachments you choose to send, and related timestamps;
• session duration and service consumption data;
• ratings, feedback, reports, or complaints you submit regarding an advisor or consultation.

Where reasonably necessary, we may review consultation-related records for customer support, trust and safety enforcement, fraud prevention, service improvement, and legal compliance.

2.4 AI Seer Interaction Data

When you use AI Seer features, we may collect and store:

• the messages and other content you submit in AI Seer chats;
• the AI-generated responses delivered to you;
• session records and metadata, such as the AI Seer persona you selected, the type of chat session purchased, session start and end times, and message timestamps;
• reports or feedback you submit about AI-generated content.

Where reasonably necessary, we may review AI Seer chat records for customer support, trust and safety enforcement, abuse prevention, service quality, and legal compliance. Section 4 explains how AI Seer chat content is processed, including by third-party AI service providers acting on our behalf.

2.5 Wallet, Promotional Balance, and Transaction Information

When you use paid features or promotional flows, we may collect and store:

• wallet or balance records, including separate balances maintained for different service categories (such as a consultation balance and a Seer Balance);
• gifted balance, promotional credits, coupons, discount records, and redemption history;
• recharge amounts, purchase history, consumption history, and order identifiers;
• chat-session purchase and usage records;
• eligibility and anti-abuse signals related to promotions and payment activity.

2.6 Payment Information

Payments may be processed through Apple's in-app purchase system and/or through our third-party payment processor (using payment methods such as card or Apple Pay), depending on the purchase and the flow shown in the Service. The Terms of Use describe which purchases use which payment channels.

We generally do not receive or store your full payment card number. However, we may receive limited payment-related metadata such as:

• transaction identifiers;
• payment channel;
• payment status;
• country or region associated with the transaction;
• limited fraud-prevention or verification information;
• refund or dispute status.

2.7 Customer Support and Communications

If you contact us, we may collect:

• your email address or contact details;
• the contents of your support messages;
• attachments, screenshots, or documents you choose to send;
• records of our communications with you.

2.8 Device, Technical, and Usage Information

We may automatically collect certain technical and usage information, including:

• IP address;
• approximate location inferred from IP address;
• device identifiers;
• operating system and app version;
• browser type and language settings;
• crash logs and diagnostics information;
• timestamps, session activity, and interaction events;
• referral information and general performance analytics.

2.9 Website Cookies and Similar Technologies

When you visit our website, we and our service providers may use cookies, pixels, local storage, SDK-like technologies, server logs, and similar technologies for site functionality, security, analytics, and performance monitoring.

Our website is primarily a static informational site. It does not currently use analytics or advertising cookies; we use only technologies that are strictly necessary for the site to function. If this changes, we will update this Privacy Policy and, where required by law, seek your consent before placing non-essential cookies or similar technologies on your device.

3. SENSITIVE AND HIGH-RISK INFORMATION

Because the Service involves spirituality, astrology, tarot, and personal reflection, users may choose to submit information that is personal, emotional, or sensitive in nature.

Please do not submit sensitive personal information that is not necessary for your use of the Service — in advisor chats or in AI Seer chats — especially information relating to:

• health conditions or diagnoses;
• mental health crises;
• legal matters;
• detailed financial account information;
• government identification numbers; or
• other highly sensitive topics.

The App clearly indicates when you are chatting with an AI Seer rather than a human advisor. Content you submit in AI Seer chats is processed by automated AI systems, including third-party AI service providers acting on our behalf, in order to generate responses (see Section 4).

The Service is not intended for emergency, medical, legal, or financial use. AI Seer conversations include an automated mechanism designed to detect certain expressions of suicidal ideation or self-harm and, when detected, to display referral information for crisis service providers; this mechanism is automated and is not real-time human monitoring. Details of our crisis-response protocol are published on our website at https://astriva.co/safety. If you are experiencing a crisis, contact your local emergency services or a local crisis service provider immediately.

If you choose to submit personal reflections, questions, or other content, we may process that content to provide the Service, maintain safety, prevent abuse, provide support, investigate complaints, and improve quality and reliability.

4. AI FEATURES AND YOUR INFORMATION

This Section summarizes how personal information is handled in connection with AI features. It supplements the other sections of this Privacy Policy.

4.1 What Is AI on Astriva

AI Seers are clearly labeled AI chat personas. Responses from AI Seers are generated by artificial intelligence technology, including large language models. Human advisor consultations are conducted by human beings and are not generated by AI.

4.2 How Your AI Chat Content Is Processed

When you send a message to an AI Seer, the content of your message and relevant conversation context are processed by automated systems in order to generate a response. This processing may be performed by third-party AI model and infrastructure providers acting on our behalf. These providers are engaged as our processors or service providers: they are contractually permitted to process your content solely to provide the service to us, and are contractually prohibited from using it for their own purposes. These providers may retain processed content for a limited period for abuse monitoring and service integrity, subject to contractual limits, after which it is deleted.

We currently use two AI service providers to generate AI Seer responses: Google (Google LLC and its affiliates) and OpenAI (OpenAI, L.L.C. and its affiliates). A given conversation may be processed by either provider, depending on the AI Seer you select and on service availability. Before your AI Seer messages are first sent to these providers, the App identifies them and asks for your permission. You can use human Advisor consultations without granting this permission. If we add or replace an AI service provider, we will update this Privacy Policy and, where required, ask for your permission again.

In-app statements about an AI Seer's "memory" (such as "This thread only") describe the conversation context the AI uses to generate responses; they are not statements about data storage or retention, which are described in Section 9.

4.3 No Training on Your Conversations

We do not use the content of your AI Seer conversations to train AI models, and we contractually require the AI service providers that process this content on our behalf not to use it to train their models. If we ever intend to change this practice, we will update this Privacy Policy in advance, provide prominent notice, offer any legally required choices, and will not apply the change retroactively to conversations that occurred before the change.

4.4 Human Review

AI Seer responses are generated automatically and are not individually reviewed by a human before delivery. Our personnel may review specific AI Seer chat records where reasonably necessary for customer support, safety, abuse prevention, complaint investigation, or legal compliance.

4.5 Automated Safety Measures

AI Seer conversations are subject to automated content safeguards, including the crisis-referral mechanism described in Section 3. These mechanisms process message content in order to operate. The App informs you of these automated safeguards at the start of AI Seer conversations.

4.6 Entertainment Positioning

AI features are provided for entertainment and personal insight purposes. They are not used to make decisions that produce legal or similarly significant effects concerning you.

5. HOW WE USE INFORMATION

We may use the information we collect for the following purposes:

(a) to create, authenticate, manage, and secure user accounts;

(b) to provide consultations, messaging, wallet functions, purchase flows, and other Service features;

(c) to generate automated AI responses when you use AI Seer features, including through third-party AI service providers acting on our behalf;

(d) to process payments, redemptions, refunds, and transaction records;

(e) to operate, administer, maintain, troubleshoot, and improve the Service;

(f) to administer promotions, first-order offers, coupons, gifted balance, and anti-abuse controls;

(g) to respond to inquiries, provide support, and resolve disputes or complaints;

(h) to detect, investigate, and prevent fraud, abuse, policy violations, unauthorized activity, and security incidents;

(i) to moderate content and maintain trust and safety, including operating automated safety measures in AI features;

(j) to conduct analytics, diagnostics, quality assurance, and internal reporting;

(k) to communicate with you regarding service-related notices, policy updates, account issues, or support matters; and

(l) to comply with legal obligations and protect the rights, safety, and interests of users, advisors, the Company, and third parties.

As described in Section 4.3, we do not use the content of your AI Seer conversations to train AI models.

We send marketing or promotional communications relating to the Service only where permitted by applicable law — including only with your consent where consent is required (for example, in the EEA, the UK, and Canada). You can opt out of marketing communications at any time using the unsubscribe mechanism provided or by contacting us; we may still send you non-promotional, service-related messages.

6. LEGAL BASES FOR PROCESSING (EEA/UK)

If you are located in the EEA or the UK, we rely on one or more of the following legal bases to process your personal information, as applicable:

(a) performance of a contract, including providing the Service you request — for example, processing your AI Seer messages in order to generate the responses you have asked for;

(b) compliance with legal obligations;

(c) our legitimate interests, such as maintaining the Service, securing the platform, preventing fraud and abuse (including reviewing AI Seer chat records for safety and abuse prevention), improving performance, and communicating with users; and

(d) your consent, where required by law; and

(e) your explicit consent, where content you choose to submit contains special categories of personal data (such as information revealing health, beliefs, or similar matters). We ask you not to submit such information unless it is necessary for your use of the Service, and we process it only in the ways described in this Privacy Policy.

Where we rely on consent, you may withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

7. HOW WE SHARE INFORMATION

We may disclose personal information to:

(a) affiliates and corporate group entities;

(b) hosting, cloud, infrastructure, and technical service providers;

(c) artificial intelligence model and infrastructure providers — currently Google and OpenAI — that process AI Seer chat content solely on our behalf in order to generate responses, and that are contractually prohibited from using it for their own purposes, including training their models;

(d) payment processors, billing providers, and app stores;

(e) analytics, attribution, diagnostics, fraud prevention, and security providers;

(f) customer support, communications, and operations vendors;

(g) the human advisor you choose to consult, who receives your display name and the messages you send in that consultation in order to provide it — advisors are independent service providers, not our employees, and may be located outside your country (please do not share payment-card numbers, government identification numbers, or other highly sensitive information in chat);

(h) professional advisers such as lawyers, auditors, insurers, and consultants;

(i) transaction counterparties in connection with a merger, acquisition, financing, restructuring, or sale of all or part of our business; and

(j) courts, regulators, law enforcement, or other third parties where required by law or reasonably necessary to protect rights, safety, security, or legal compliance.

We do not sell personal information for money.

Analytics and diagnostics providers — such as Mixpanel (product analytics) and Google Firebase (analytics and crash reporting) — process personal information on our behalf as service providers, under contracts that limit their use of it to providing services to us.

Advertising attribution and measurement partners — currently Adjust (attribution) and Meta (advertising measurement) — may receive device identifiers and app-activity information to measure advertising performance. Meta may process such data for its own purposes as an independent controller under its own terms. Where applicable U.S. state law treats these disclosures as "sharing" for cross-context behavioral advertising, you have the right to opt out at any time: (i) decline or revoke the tracking permission on iOS (Settings → Privacy & Security → Tracking); (ii) use the "Do Not Sell or Share My Personal Information" option where made available in the App or on our website; or (iii) contact us at product@astriva.co. When you opt out, we stop sending identifiers and event data used for cross-context advertising measurement; the Service itself remains available. On our website, we honor Global Privacy Control signals where required by law.

For users in the EEA and the UK, advertising-measurement data is sent to attribution partners only with your consent (for example, through the iOS tracking permission), where such consent is required. On iOS, tracking as defined by Apple occurs only with the permission requested through Apple's App Tracking Transparency framework.

8. INTERNATIONAL DATA TRANSFERS

We may process and store personal information in countries other than your country of residence, including through cloud and AI service providers located in the United States. Those countries may have data protection laws that differ from the laws in your jurisdiction.

Where required by law, we implement appropriate safeguards for international data transfers. For transfers of personal information from the EEA or the UK, these safeguards may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, reliance on an adequacy decision, or transfers to recipients certified under an applicable data transfer framework.

9. DATA RETENTION

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain accounts, complete transactions, comply with legal obligations, resolve disputes, enforce agreements, and detect and prevent fraud and abuse.

Retention periods vary depending on the type of information. As general guidelines:

• account and profile information is retained while your account remains active, and is deleted or de-identified within 90 days after your account is deleted, except as described below;
• chat records with human Advisors and with AI Seers are retained while your account remains active and are deleted or de-identified with your account; records connected to an open dispute, investigation, or safety matter may be kept until that matter is resolved;
• our AI service providers may retain processed content for a short period for abuse monitoring and service integrity — typically no more than 30 days — subject to the contractual limits described in Section 4;
• transaction, recharge, refund, dispute, and accounting records are retained for up to 7 years, as required for tax, audit, financial reporting, chargeback handling, and compliance purposes;
• support, complaint, and moderation records are retained for up to 2 years after the matter is closed, or longer where needed to enforce our policies or to establish or defend legal claims;
• technical logs and diagnostics information are typically retained for 90 days to 12 months; aggregated or de-identified analytics data may be retained longer.

Where different periods could apply to the same record, the longest applicable period controls. Residual copies may remain in routine backups for a short period before being overwritten in the ordinary course of our backup cycle.

10. COOKIES AND YOUR CHOICES

You can usually control cookies through your browser settings, including by blocking or deleting cookies. Blocking some cookies may affect website functionality.

Where required by law, we will seek consent before placing non-essential cookies or similar technologies on your device.

11. SECURITY

We use reasonable technical, administrative, and organizational safeguards designed to protect personal information. However, no method of transmission, storage, or security control is completely secure, and we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your credentials and for using the Service in a secure manner.

12. CHILDREN'S PRIVACY

The Service, including all AI Seer features, is not directed to children, and we do not knowingly collect personal information from individuals under 18. If we learn that we have collected personal information from a child in violation of applicable law, we will take reasonable steps to delete it.

If you believe a child has provided personal information to us, please contact us using the contact details below.

13. YOUR PRIVACY RIGHTS

Depending on where you live, you may have certain privacy rights, subject to legal limitations and verification requirements. These may include the right to:

(a) know whether we process your personal information;

(b) request access to personal information;

(c) request correction of inaccurate information;

(d) request deletion of personal information;

(e) object to or restrict certain processing;

(f) withdraw consent where processing is based on consent;

(g) request data portability; and

(h) lodge a complaint with an applicable supervisory authority.

These rights apply equally to personal information contained in your AI Seer chat records. We engage processors, including AI service providers, under contracts that require them to assist us in giving effect to verified deletion and other rights requests.

To exercise rights, please contact us at product@astriva.co. We may need to verify your identity before processing your request.

You can delete your account at any time through the account settings in the App, or by contacting us at product@astriva.co. When your account is deleted, we delete or de-identify the personal information associated with it, except where we are required or permitted to retain certain records (such as transaction, tax, fraud-prevention, and dispute records) as described in Section 9. Deleting your account does not by itself entitle you to a refund of unused balances, except where applicable law provides otherwise — please review any remaining balances before deleting your account.

14. ADDITIONAL U.S. STATE PRIVACY DISCLOSURES

If you are a resident of a U.S. state with an applicable privacy law, you may have rights to access, correct, delete, or obtain a copy of certain personal information, as well as rights to opt out of certain processing activities where required by law.

As described in Section 7, we disclose AI Seer chat content to AI service providers solely so that they can generate responses on our behalf, under contracts that prohibit them from using it for their own purposes, including training their models.

Astriva does not:

• sell personal information for monetary consideration; or
• process personal information for profiling in furtherance of decisions that produce legal or similarly significant effects about individuals. Our AI features are provided for entertainment and personal insight purposes and are not used to make such decisions.

As described in Section 7, we may share device identifiers and app-activity information with advertising and attribution partners for advertising measurement; where applicable law treats this as "sharing," you may opt out as described in Section 7.

If applicable law grants you the right to appeal a privacy rights decision, you may do so by replying to our response or contacting us again at product@astriva.co with the word "Appeal" in the subject line.

15. EEA AND UK RIGHTS

If you are in the EEA or the UK, you may also have the right to:

• object to processing based on legitimate interests;
• request restriction of processing;
• withdraw consent at any time where consent is the legal basis; and
• file a complaint with your local data protection authority.

16. CALIFORNIA NOTICE

This Section provides additional disclosures under the California Consumer Privacy Act ("CCPA") and applies if California law applies to you. It supplements Sections 2 (what we collect), 5 (purposes), 7 (recipients), 9 (retention), and 13–14 (your rights and how to exercise them).

In the preceding 12 months, we have collected the following categories of personal information, as those categories are described in the CCPA:

• Identifiers — account and user IDs, display name or nickname, email address, Apple sign-in identifiers, device identifiers, and IP address (Sections 2.1, 2.2, 2.8).
• Customer records — contact details and limited payment-related metadata, such as transaction identifiers and payment status; we do not store full payment card numbers (Sections 2.6, 2.7).
• Commercial information — purchase and recharge history, order records, Balance and Seer Balance records, Chat Session purchase and usage records, and Coupon and promotion records (Sections 2.3, 2.5).
• Internet or other electronic network activity information — app usage and interaction events, session activity, crash logs and diagnostics, and website log information (Sections 2.8, 2.9).
• Audio, electronic, visual, or similar information — chat messages with human Advisors and AI Seers, and images or attachments you choose to send (Sections 2.3, 2.4, 2.7).
• Geolocation data — approximate location inferred from IP address; we do not collect precise geolocation (Section 2.8).
• Inferences — limited signals we derive for promotion eligibility, fraud prevention, and service quality (Sections 2.3, 2.5).
• Sensitive personal information — the contents of your messages, and information you choose to share in them that may reveal religious or philosophical beliefs or other personal matters (Sections 2.3, 2.4, 3).

We do not collect biometric information or professional, employment, or education information.

The sources of this information are you, your device, and our payment and sign-in partners, as described in Section 2. We use it for the business purposes described in Section 5, and disclose it for business purposes to the recipients described in Section 7 — service providers (including AI model and infrastructure providers such as Google and OpenAI, analytics providers, and cloud hosting), payment partners, the human Advisor you contact (for consultation content), and advertising and attribution partners.

We do not sell personal information for monetary consideration. Our use of advertising and attribution partners, as described in Section 7, may constitute "sharing" for cross-context behavioral advertising under the CCPA; the categories involved are identifiers and internet activity information, and you may opt out at any time as described in Section 7. We have no actual knowledge that we sell or share the personal information of consumers under 16.

We use and disclose sensitive personal information only to provide the Service and for other purposes permitted by the CCPA, and we do not use it to infer characteristics about you; accordingly, we do not offer a separate "Limit the Use of My Sensitive Personal Information" option.

We retain each category of personal information as described in Section 9. You may exercise your CCPA rights (to know/access, correct, delete, obtain a copy, and opt out of sharing) as described in Sections 13 and 14, including through an authorized agent. We will verify your request, we will not discriminate against you for exercising your rights, and you may appeal a decision as described in Section 14.

17. DO NOT TRACK

Some browsers offer a "Do Not Track" setting. Because there is no universally accepted standard for responding to Do Not Track signals, the Service does not currently respond to them unless required by applicable law.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The updated version will be posted with a revised "Last Updated" date. If we make material changes — such as changes to how AI features process your information — we will provide prominent notice in the App before the changes take effect.

19. CONTACT US

If you have questions, concerns, or requests relating to this Privacy Policy, please contact us at:

White City Technology Limited

Email: product@astriva.co