Privacy Policy
Last updated: August 31, 2026
1. Who We Are
PMC Baltic FZ-LLC (Legal entity code: 104086952900001) ("we", "us", "our") is the data controller responsible for the processing of your personal data in connection with Nocturnum.
- Address: Compass Building, SFFO0507, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, 10055, UAE
- Email: hello@nocturnum.app
This Privacy Policy applies to Nocturnum’s Witch Power Readings and Past Life Reading experiences, including their quizzes, personalized content, and associated account and subscription features.
2. Data We Collect
We collect and process the personal data described in the Data Inventory table below.
This includes information you provide directly to us, such as your email address and Nocturnum quiz answers; information generated through your use of Nocturnum, such as recommendation segments, funnel events, and content progress; and information associated with purchases, such as payment identifiers and order history.
| Category | Fields | Purpose | Legal Basis | Retention |
|---|---|---|---|---|
| Email address | Deliver personalized quiz results, create and maintain an account, and send transactional communications | Contract performance, Art. 6(1)(b); consent where required for marketing, Art. 6(1)(a) | Active accounts: duration of account; abandoned sessions: 90 days | |
| Nocturnum quiz answers | quiz_answers, JSONB | Generate personalized Nocturnum insights, readings, interpretations, and recommendations | Consent, Art. 6(1)(a) | Active accounts: duration of account; abandoned sessions: 90 days |
| Recommendation or behavioral segment | result_segment | Tailor readings, insights, content, and product recommendations to quiz results | Legitimate interest, Art. 6(1)(f), or consent where required | Active accounts: duration of account; abandoned sessions: 90 days |
| Payment identifiers | stripe_customer_id, default_payment_method, stripe_payment_intent_id | Process payments, support eligible one-click purchases or upsells, and handle refunds or payment issues | Contract performance, Art. 6(1)(b) | 7 years, where required for tax/accounting obligations |
| Order history | amount_cents, currency, status, product_name | Fulfill purchases, provide receipts, manage subscriptions, and handle disputes | Contract performance, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) | 7 years, where required for tax/accounting obligations |
| Content progress | day_number, completion_status, language | Track progress through purchased content, maintain access, and allow users to resume their experience | Contract performance, Art. 6(1)(b) | Duration of account |
| OTP login attempts | email, ip_address, success, attempted_at | Security monitoring, authentication, and brute-force protection | Legitimate interest, Art. 6(1)(f) | 30 days |
| Funnel behavior events | event_type, step_number, metadata | Analytics, conversion optimization, performance measurement, and drop-off detection | Consent, Art. 6(1)(a), where required | Non-purchased sessions: 90 days; purchased sessions: 2 years |
| Entitlements | product_slug, access_level, granted_at, expires_at | Grant and verify access to purchased digital products and subscription features | Contract performance, Art. 6(1)(b) | Duration of account |
3. Purpose of Processing
We process your personal data for the following purposes:
- Quiz personalization: to generate personalized Nocturnum readings, insights, interpretations, and recommendations based on the information you provide.
- Account management: to create and maintain your account, authenticate access, and track your product entitlements.
- Payment processing: to process purchases, manage subscriptions, process applicable refunds, and resolve payment disputes.
- Service delivery: to provide access to purchased Nocturnum content, readings, reports, digital tools, and other available features.
- Content progress: to remember your progress and allow you to continue using purchased content.
- Analytics and optimization: to understand how users interact with Nocturnum, identify technical or funnel issues, measure performance, and improve the Service, where permitted and, where required, with your consent.
- Retargeting and advertising: to measure advertising performance and show relevant advertising where you have provided the required consent.
- Communications: to send transactional, account-related, service-related, and, where you have consented, promotional communications.
- Security: to detect and prevent fraudulent activity, unauthorized access, abuse, and suspicious login attempts.
4. Legal Basis for Processing
We rely on the following legal bases under GDPR Article 6(1), where applicable:
- Consent — Art. 6(1)(a): for certain quiz personalization activities, non-essential analytics, advertising technologies, marketing communications, and funnel behavior tracking where consent is legally required.
You may withdraw your consent at any time.
- Contract Performance — Art. 6(1)(b): for account creation and management, payment processing, order fulfillment, subscription administration, entitlement delivery, content access, and progress tracking.
- Legal Obligation — Art. 6(1)(c): where we are required to retain transaction, accounting, tax, fraud-prevention, or other records under applicable law.
- Legitimate Interest — Art. 6(1)(f): for fraud prevention, security monitoring, OTP attempt logging, service protection, certain analytics activities, and recommendation or behavioral segmentation where consent is not legally required.
Where we rely on legitimate interest, we consider whether our interests are proportionate and whether your rights and interests override those interests.
5. Data Recipients and Third-Party Processors
We share certain personal data with third-party service providers that help us operate, deliver, secure, analyze, market, and maintain Nocturnum.
Where applicable, these providers act as data processors under contractual arrangements, including Data Processing Agreements, and process personal data according to our instructions. Certain providers may act as independent or joint controllers for specific processing activities where required by their services or applicable law.
We do not sell your personal data to third parties.
| Service | Role | Data Shared | Location | Transfer Mechanism |
|---|---|---|---|---|
| PostHog | Analytics processor | Session ID, email when identified, event names, page URLs | EU infrastructure | EU data residency |
| Google Tag Manager / Google Ads | Processor / Controller, depending on processing | Hashed email, session identifiers, event names, and event metadata | USA / international | EU-US Data Privacy Framework and/or SCCs, where applicable |
| Stripe | Payment service provider | Email, tokenized payment information, amounts, customer identifiers, transaction metadata | USA / international | EU-US Data Privacy Framework and/or SCCs, where applicable |
| Vercel Analytics | Processor | Page URLs, Web Vitals, referrer information, user agent | USA / international | EU-US Data Privacy Framework and/or SCCs, where applicable |
| Vercel Speed Insights | Processor | Page-load and performance information, connection information | USA / international | EU-US Data Privacy Framework and/or SCCs, where applicable |
| Supabase | Processor | Account information, authentication data, orders, events, content progress, and other database information | Project region | Depends on configured project region and applicable safeguards |
| Meta Pixel | Processor / Controller, depending on processing | Hashed identifiers, page views, advertising events, and purchase events | USA / international | EU-US Data Privacy Framework and/or SCCs, where applicable |
| ActiveCampaign | Processor | Email address, lead metadata, tags, subscription or quiz status | USA | Standard Contractual Clauses and other applicable safeguards |
6. International Data Transfers
Some of our service providers may process personal data outside the European Economic Area, including in the United States.
Where required by applicable data-protection law, we use recognized mechanisms designed to protect personal data transferred internationally.
These may include:
- EU-US Data Privacy Framework: where a recipient participates in and is covered by the applicable framework.
- Standard Contractual Clauses (SCCs): contractual safeguards approved by the European Commission for certain international transfers.
- EU Data Residency: certain analytics data processed through PostHog may be processed through EU-based infrastructure.
- Supabase: the applicable processing location and transfer safeguards depend on the configured project region.
You may contact us at hello@nocturnum.app if you would like more information about international transfers applicable to your personal data.
7. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to fulfill contractual obligations and comply with legal, tax, accounting, security, and dispute-resolution requirements.
Specific retention periods are shown in the Data Inventory above.
In summary:
- Abandoned quiz sessions without a purchase: up to 90 days.
- Purchased sessions and account data: for the duration of the account relationship, subject to applicable legal requirements.
- Orders and payment records: up to 7 years where required for tax, accounting, or legal obligations.
- Funnel behavior events for non-purchased sessions: up to 90 days.
- Funnel behavior events associated with purchased sessions: up to 2 years.
- OTP login attempts: up to 30 days.
- Product entitlements: for the duration of the account relationship.
8. Your Rights Under GDPR
Where the GDPR applies to you, you may have the following rights regarding your personal data:
- Right of access — Art. 15: request information about the personal data we process and obtain a copy of that data.
- Right to rectification — Art. 16: request correction of inaccurate or incomplete personal data.
- Right to erasure — Art. 17: request deletion of your personal data in circumstances provided by applicable law.
- Right to restriction — Art. 18: request restriction of processing in certain circumstances.
- Right to data portability — Art. 20: receive certain personal data in a structured, commonly used, machine-readable format and, where applicable, transmit it to another controller.
- Right to object — Art. 21: object to certain processing based on legitimate interests and to processing for direct-marketing purposes.
- Right to withdraw consent — Art. 7(3): withdraw consent at any time where processing is based on consent.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
- Right to lodge a complaint — Art. 77: lodge a complaint with a competent data-protection supervisory authority.
9. How to Exercise Your Rights
To exercise any of the rights described above, please contact us at:
hello@nocturnum.app
You may also contact us by post at:
PMC Baltic FZ-LLC Compass Building, SFFO0507, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, 10055, UAE
We will respond to valid requests within the period required by applicable law.
Under the GDPR, this is generally within one month after receiving the request. Where permitted by law, the response period may be extended by up to an additional two months where necessary due to the complexity or number of requests. If an extension applies, we will inform you.
We may request information reasonably necessary to verify your identity before completing a request.
Exercising your privacy rights is generally free of charge. However, where permitted by law, we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.
10. Supervisory Authority
If you believe that our processing of your personal data violates applicable data-protection law, you may have the right to lodge a complaint with a competent supervisory authority.
If the GDPR applies to you, you may generally submit a complaint to the data-protection authority responsible for:
- Your country of residence;
- Your place of work; or
- The place where the alleged infringement occurred.
Company name: PMC Baltic FZ-LLC Legal entity code: 104086952900001 VAT: 104086952900003 Address: Compass Building, SFFO0507, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, 10055, UAE
Nothing in this Privacy Policy limits your right to contact any competent data-protection or regulatory authority with jurisdiction over the processing of your personal data.
11. Data Provision Requirements
Providing certain personal data is necessary for us to provide specific Nocturnum features, while other information is optional.
- Email address: required where necessary to deliver your personalized results, create or access your account, communicate important service information, or provide purchased content.
Without a valid email address, certain Nocturnum functionality may not be available.
- Nocturnum quiz answers: required to generate personalized Nocturnum readings, interpretations, insights, or recommendations that depend on those answers.
Without the necessary answers, the personalized service may not function as intended.
- Payment data: required when purchasing a product or subscription.
Payment information is processed through our payment provider. We do not store your complete payment-card details.
- Analytics data: voluntary where consent is legally required.
You may decline non-essential analytics or advertising cookies without losing access to the core functionality of the Service.
- Marketing consent: voluntary.
You may use the Service without agreeing to receive optional promotional communications.
12. Automated Decision-Making and Profiling
Nocturnum may use automated processing to generate personalized readings, recommendations, insights, or content based on the answers you provide through a quiz or similar experience.
This processing may constitute profiling within the meaning of GDPR Article 4(4).
How It Works
Your answers may be analyzed to determine a personalized reading, archetype, recommendation, or content segment.
Depending on whether you use the Witch Power Readings or Past Life Reading experience, this may relate to themes such as:
- Astrology and personality patterns;
- Relationships and compatibility;
- Personal tendencies or emotional patterns;
- Life themes or symbolic archetypes;
- Past-life or spiritual interpretations;
- Personal guidance and recommended content.
The resulting profile or segment may be used to:
- Generate personalized readings and interpretations;
- Recommend relevant Nocturnum content, reports, or digital products;
- Customize the results you see;
- Tailor content displayed on offer or recommendation pages.
This automated processing is not intended to produce legal effects concerning you or otherwise similarly significantly affect your legal rights.
Where applicable under data-protection law, you may contact us to ask questions about this processing or request appropriate human review.
Email: hello@nocturnum.app
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- Changes to Nocturnum or its features;
- Changes to the personal data we process;
- Changes to service providers or technology;
- Changes to applicable laws or regulatory requirements; or
- Other operational, security, or compliance developments.
When we make changes, we may update the "Last updated" date at the top of this Privacy Policy.
Where required by applicable law, we will provide additional notice of material changes.
Contact
Nocturnum is operated by PMC Baltic FZ-LLC.
Email: hello@nocturnum.app
© 2021–2026 Nocturnum. All rights reserved.
Related Policies
- Cookie Policy — Details about cookies, local storage, analytics, advertising, and similar technologies used by Nocturnum.
- Subscription Terms — Witch Power Readings — Subscription pricing, recurring billing, renewal, and cancellation terms for the Witch Power Readings experience.
- Subscription Terms — Past Life Reading — Subscription pricing, recurring billing, renewal, and cancellation terms for the Past Life Reading experience.
- Money-Back Policy — Witch Power Readings — Refund eligibility and refund-request requirements for the Witch Power Readings experience.
- Money-Back Policy — Past Life Reading — Refund eligibility and refund-request requirements for the Past Life Reading experience.
- Terms of Service — General terms governing your use of Nocturnum.
- Contact Us — How to reach us regarding privacy or other service-related questions.