Privacy Policy
Last updated: September 2026 · v1.0
This policy explains how Shay Barokas, a registered dealer (Osek Murshe) No. 318509106 ("Operator", "we"), collects, uses, shares, and protects your personal information when you use the Zohar service at zohar-mystic.com ("Service"). We operate in accordance with the Israeli Protection of Privacy Law, 5741-1981 (including Amendment 13), and, where applicable, the EU General Data Protection Regulation (GDPR) and California privacy laws (CCPA/CPRA).
In case of any conflict between the Hebrew and English versions, the Hebrew version prevails.
1. Data Controller
Shay Barokas · Osek Murshe 318509106
Address: David Sakharov 5, Rishon LeZion, Israel
Privacy contact email: zoharmistic@gmail.com
Privacy contact person: Shay Barokas (no dedicated DPO appointed; requests handled by the Operator).
2. Information We Collect
| Field | Purpose | Classification |
|---|---|---|
| Email address | Authentication (magic link) and mailing | Identifier |
| Full name / display name | Personal address + numerology | Identifier |
| Date of birth | Sign, birth chart, numerology | Potentially sensitive |
| Time and place of birth | Precise birth chart | Potentially sensitive |
| Latitude/longitude (geocode from birthplace) | Chart accuracy | Location |
| Gender | Correct grammatical address | Sensitive (GDPR) |
| Relationship status | Content tailoring | Sensitive |
| Focus area (love/career/money/family/self) | Content tailoring | Preference |
| "Current challenge" (free text) | Reading tailoring | May contain sensitive info |
| Communication style | Response tone | Preference |
| Chat content and messages | Chat management and memory | May contain sensitive info |
| "Memories" (extracted facts) | Continuity across sessions | Derived |
| Customer/subscriber billing IDs | Link to payment provider | Billing |
| Marketing consent + timestamps | Consent proof (§30A) | Compliance |
| Usage data, logs, IP address | Security and operations (at providers) | Technical |
Credit card details are not collected or stored by us — they are handled entirely by the payment provider Gumroad (Section 6).
2.1 Sensitive Information / Special Categories
Some fields (date/time of birth, gender, relationship status) and free text ("current challenge", chat content) may contain sensitive information — e.g., about health, relationships, or beliefs. We ask you not to enter sensitive information in free-text fields and chat, and display a dedicated warning.
If you provide sensitive information voluntarily, you thereby give explicit consent to its processing solely for providing the Service. Gender is collected only for correct grammatical address.
3. Purposes and Legal Basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service and generating readings | Contract performance (Art. 6(1)(b)) |
| Processing sensitive info provided in chat | Explicit consent (Art. 9(2)(a)) |
| Authentication and account security | Contract / legitimate interest |
| Marketing communications | Consent (§30A / opt-in) |
| Service improvement and fraud prevention | Legitimate interest |
| Legal compliance (tax, authority requests) | Legal obligation |
4. AI Processing and Automated Decision-Making
- Readings and chat are generated using an Anthropic (Claude) language model. Mystical data is computed in code; the model phrases it.
- For live chat, your message content is sent to the model (operating in the US). See Section 6 and the AI Processing Addendum.
- Profiling: We create an interpretive "profile" to tailor Content. This is not automated decision-making with legal or similarly significant effects — the Content is for entertainment only. Under GDPR you have the right to obtain an explanation, express your view, and request human intervention regarding automated processing.
5. Third-Party Providers (Sub-processors)
We do not sell your information. We use third-party providers to operate the Service:
| Provider | Role | Data transferred | Location |
|---|---|---|---|
| Supabase | Database, auth, storage | All user data and Content | Europe |
| Anthropic (Claude) | Language model | Derived data, name, gender, chat content | US |
| Gumroad | Payment processing (MoR) | Email and payment details (directly from you) | US |
| Resend | Transactional email | Email and message content | Abroad |
| Vercel | Site hosting and server logs | Request data, IP | Abroad |
| Open-Meteo | Birthplace-to-coordinates | Birthplace name only | Abroad |
| Google (Analytics) | Usage and traffic analytics | Usage IDs, truncated IP, device data | US |
| Meta (Pixel) | Conversion measurement and marketing | Usage events, marketing IDs | US |
| ElevenLabs / HeyGen | Voice and video avatar (planned) | Reading text (future) | US |
Advertising transparency: We use Google Analytics and Meta Pixel for measurement and marketing. You can object/manage this via our cookie settings and consent mechanisms — see the Cookie Policy. We may also disclose information if required by law, court order, or to protect our rights.
6. International Data Transfers
Our primary database (Supabase) is located in Europe. However, some providers (Anthropic, Gumroad, Vercel, Google, Meta, and others) are in the US or elsewhere. By using the Service and providing information, you consent to the transfer of your data to these providers for the purpose of providing the Service.
For EU users: transfers to providers outside the EEA rely on an appropriate legal mechanism, including EU Standard Contractual Clauses (SCC) and/or adequacy decisions, where available with the relevant provider.
7. Data Retention
We retain data only as long as necessary for the purposes collected, or as required by law:
| Data type | Retention |
|---|---|
| Account and birth data | While account active + 24 months after closure |
| Chat content and "memories" | While active; deletable on request anytime; auto-deleted after 12 months of inactivity |
| Billing records and invoices | 7 years (tax obligation) |
| Marketing consent/unsubscribe proof | As long as needed for compliance + limitation period |
| Security / IP logs | 90 days |
After the period ends, data is deleted or anonymized.
8. Your Rights
Subject to applicable law, you have the rights to: access, rectification, erasure ("right to be forgotten"), restriction and objection to processing, data portability (GDPR), withdraw consent at any time (without affecting prior lawful processing), and object to marketing (unsubscribe in any message or by contacting us). California residents (CCPA/CPRA): the rights to know, delete, correct, and limit use of sensitive info; we do not sell information.
To exercise a right — contact zoharmistic@gmail.com. We will respond within the legally required timeframes (generally up to 30 days). We may verify your identity first. Right to complain: You may contact the Israeli Privacy Protection Authority, or the relevant EU supervisory authority.
9. Data Security
- Passwordless authentication (magic link / OTP), with passkey infrastructure;
- Row-Level Security (RLS) — each user accesses only their own data; admin operations isolated to the server side;
- No storage of payment details by us — handled by the MoR provider;
- Encrypted transport (HTTPS) and storage with reputable infrastructure providers.
No system is completely immune. In the event of a reportable security incident, we will act in accordance with legal obligations (Amendment 13 and GDPR).
10. Cookies
We use local storage and essential cookies for functionality and preferences, and measurement/marketing tools (Google, Meta). Details and consent mechanism — see the Cookie Policy.
11. Minors
The Service is for those aged 18 and over only. We do not knowingly collect information from minors. If we learn of such information, we will delete it.
12. Changes
We may update this policy from time to time. Material changes will be posted and, where possible, notified by email.
13. Contact
Shay Barokas · Osek Murshe 318509106
Email: zoharmistic@gmail.com
Address: David Sakharov 5, Rishon LeZion, Israel