Privacy Policy
Last Updated: September 7, 2026
1. Data Controller Identity
The data controller responsible for your personal data is:
As a data controller under GDPR, we determine the purposes and means of processing your personal data and are responsible for compliance with data protection laws.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address - Used for account recovery and important service notifications
- Username - Your chosen display name
- Password - Stored securely using one-way cryptographic hashing (we cannot see your password)
- Account tier - Subscription level for access control
- API keys (AI Agent) - If you generate API keys for AI Agent access, we store a SHA-256 hash of each key (the original key cannot be recovered from the hash)
2.2 Usage Data
We automatically collect:
- Custom databases - Words and phrases you add to your personal databases
- Session data - Login sessions and authentication state
2.3 IP Address Collection
GDPR Notice: IP addresses are considered Personal Data under GDPR Article 4(1).
We collect IP addresses for the following legitimate interests (GDPR Article 6(1)(f)):
- Rate limiting - Prevent abuse and denial-of-service attacks
- Security monitoring - Detect brute-force login attempts and suspicious activity
- Session management - Validate login sessions from consistent locations
- Fraud prevention - Identify and block malicious actors
Retention period:
- Rate limiting data: Expires after the rate limit window (typically 1 minute), entries become inactive
- Security logs: Retained for 90 days for incident investigation
- Server access logs: Retained for 30 days (standard practice)
IP address processing:
- IP addresses are NOT stored with your account or user data
- IP addresses are NOT used for tracking, profiling, or marketing
- IP addresses are NOT shared with third parties
- IP-based rate limiting is anonymous (no link to user accounts)
Legal basis: Legitimate interest in protecting our service and users from security threats (GDPR Article 6(1)(f)).
2.4 What We DON'T Collect
We do NOT use:
- ❌ Google Analytics or tracking cookies
- ❌ Advertising or marketing cookies
- ❌ Social media tracking pixels
- ❌ Third-party data brokers
- ❌ Behavioral tracking or profiling
3. Legal Basis for Processing (GDPR)
We process your personal data under the following legal bases:
| Data Type | Legal Basis | GDPR Article |
|---|---|---|
| Account data (email, username, password) | Performance of contract | Article 6(1)(b) |
| Custom databases | Performance of contract | Article 6(1)(b) |
| IP addresses (rate limiting, security) | Legitimate interest | Article 6(1)(f) |
| Session cookies | Strictly necessary | ePrivacy Directive |
| Payment data (transaction IDs, amounts, supporter email for BMC) | Performance of contract | Article 6(1)(b) |
| OAuth login data (email, provider ID from Google/GitHub/Twitter/Patreon) | Performance of contract (with your consent to connect the provider) | Article 6(1)(a), 6(1)(b) |
| AI Agent (MCP) requests & responses | Performance of contract, initiated by your explicit action to connect an AI assistant | Article 6(1)(a), 6(1)(b) |
Legitimate Interest Assessment (IP Addresses):
- Purpose: Prevent denial-of-service attacks, brute-force attempts, and abuse
- Necessity: Essential for service availability and security
- Balancing test: Protection of all users outweighs minimal privacy impact of temporary IP storage
- Mitigation: IP addresses are not linked to user accounts, used only for rate limiting
4. How We Use Your Information
We use your data only to:
- Provide the service - Process gematria analysis, store custom databases, authenticate AI Agent API requests
- Maintain your account - Authentication, session management, tier-based features, API key management
- Ensure security - Rate limiting, abuse prevention, account protection
- Communicate with you - Transactional emails only: welcome message on registration, subscription reminders, calendar event reminders, and periodic activity updates. You can disable email notifications at any time from your My Account page
- Improve the platform - Aggregate usage statistics (no individual tracking)
5. Cookies & Tracking
5.1 Essential Cookies Only
We use only strictly necessary cookies for the website to function:
| Cookie Name | Purpose | Duration |
|---|---|---|
gemcodes_session |
Authentication, session management, and anonymous user rate limiting | Session (deleted when browser closes) |
5.2 Anonymous User Tracking
For users who are not logged in, we use session cookies to:
- Rate limiting: Limit free analyses to 3 per day (IP-based)
- Feature access control: Track Quick Insights feature usage (2 free views, then upgrade prompt)
Privacy note:
- ✓ No personal data is collected from anonymous users
- ✓ Session counter resets when you clear cookies or use a new browser
- ✓ Counter is stored client-side only (signed cookie)
- ✓ We cannot identify you across sessions
No consent required: These cookies are exempt from GDPR consent requirements as they are strictly necessary for the service to function.
5.3 Local Storage
The free Gematria Calculator (non-authenticated tool) uses browser local storage to save:
- Cipher preferences - Which ciphers you've selected for calculations
- Calculation history - Words and results you've calculated in the browser
Privacy note:
- ✓ This data remains on your device only and is never transmitted to our servers
- ✓ No personal information is stored in local storage
- ✓ You can clear this data anytime through your browser settings or the calculator's "Clear History" button
- ✓ Local storage persists until manually cleared (unlike session cookies)
6. Data Storage & Security
- Encryption: All connections use industry-standard HTTPS/TLS encryption
- Passwords: Stored using secure one-way cryptographic hashing (passwords cannot be recovered)
- API keys: Stored as SHA-256 hashes only — original keys are shown once at creation and cannot be retrieved
- Database security: Secured with access controls and encryption at rest
- Rate limiting: Protection against brute-force attacks and abuse
- Regular updates: Security patches applied promptly
- Access controls: Strict authentication and authorization measures
7. Data Retention
- Account data: Retained until you delete your account
- Custom databases: Retained until you delete them or your account
- Rate limiting data: Expires after rate limit window (typically 1 minute)
- Security logs: Retained for 90 days for incident investigation
- Payment records: Transaction IDs, amounts, and payment status retained for accounting and dispute resolution purposes
- API keys: Key hashes retained until you revoke and delete them; audit logs of key actions retained for 90 days
8. Data Sharing & Third Parties
We do NOT sell, rent, or trade your personal data to third parties for commercial or advertising purposes. We do share limited data with the service providers below, and with AI providers you personally choose to connect via the AI Agent (see 8.3) — these are necessary to operate the features you use, not commercial data sales.
8.1 Payment Processors
When you make payments for premium subscriptions, add funds to your Account Balance, or make donations, we use the following third-party processors:
NOWPayments (Cryptocurrency payments for subscriptions and Account Balance top-ups)
- Purpose: Process cryptocurrency payments for premium subscriptions and Account Balance funding (300+ cryptocurrencies including Bitcoin, Ethereum, XRP, USDT, and more)
- Data shared: Payment amount, invoice details, transaction details, webhook notifications
- Data stored by us: Invoice ID, Order ID, payment amount, payment status, cryptocurrency type, transaction timestamps
- Privacy policy: https://nowpayments.io/privacy-policy
Buy Me a Coffee (Credit/debit card payments for Account Balance, donations, and recurring memberships)
- Purpose: Process credit/debit card payments for Account Balance funding, voluntary donations, and auto-recurring premium membership subscriptions. Card payments are handled by Stripe through BuyMeACoffee
- Data shared: Payment amount, supporter email (used to match your GematriaLens account), supporter name (optional), membership status and billing period (for recurring subscriptions)
- Data stored by us: Transaction ID, payment amount, supporter email, supporter name, payment status, support note (if provided), membership ID, membership status, and current period dates (for recurring subscriptions)
- Email matching: Your email address entered at BuyMeACoffee checkout is used to match the payment to your GematriaLens account. We store this email in our payment records for transaction auditing
- Privacy policy: https://www.buymeacoffee.com/privacy-policy
Important: We do NOT store your payment card details or cryptocurrency wallet addresses. All payment processing occurs directly with these third-party processors.
8.2 Email Service Provider
Resend (Transactional email delivery)
- Purpose: Deliver transactional emails including welcome messages, subscription reminders, calendar event reminders, and activity updates
- Data shared: Your email address and username (for personalization)
- Data stored by us: Email send status, timestamp, and message ID in our email log for deduplication
- Opt-out: You can disable all email notifications at any time from your My Account page
- Privacy policy: https://resend.com/legal/privacy-policy
8.3 AI Agent / MCP Connectors
If you connect a third-party AI assistant (such as Claude, ChatGPT, GitHub Copilot, or Cursor) to your account via our AI Agent (MCP), that assistant sends requests to our API and receives back the data needed to answer you — for example, gematria values, your custom database contents, saved events, or report results. This means:
- The AI provider you choose to connect (e.g. Anthropic, OpenAI, GitHub, or the maker of your MCP client) receives and processes the content of your requests and our responses as part of that conversation
- This processing is governed by that AI provider's own privacy policy and terms, not ours — we do not control how they store, log, or use that data
- We only send data you have explicitly requested via a tool call (e.g. your own saved databases or events); we do not push data to AI providers outside of a request you initiate
- You can stop this sharing at any time by disconnecting the connector or revoking the API key from your My AI Agent page
8.4 Other Limited Sharing
- Legal requirements: If required by law or to protect our rights
- Service providers: Hosting infrastructure (data processors bound by contract)
We do NOT share data with:
- ❌ Advertisers or marketing companies
- ❌ Data brokers or analytics services
- ❌ Social media platforms
- ❌ Any third party for commercial purposes
9. Subprocessors & Service Providers
We use the following subprocessors to provide our service. These entities process data on our behalf under strict contractual obligations:
- Cloud Hosting Provider: Application and database hosting within EU/EEA
- NOWPayments: Cryptocurrency payment processing for subscriptions - see their Privacy Policy
- Buy Me a Coffee: Credit/debit card payment processing for Account Balance and donations - see their Privacy Policy
- Resend: Transactional email delivery (welcome emails, subscription reminders, calendar reminders, activity updates). Data shared: email address and username. See their Privacy Policy
- OAuth Login Providers (Google, GitHub, Twitter/X, Patreon): If you choose to sign in or link your account using one of these providers, we receive your email address, a provider account identifier, and (where applicable) your display name from that provider to create or match your account. See their respective privacy policies: Google, GitHub, Twitter/X, Patreon
- AI Agent Connectors (user-initiated): If you connect a third-party AI assistant to your account via MCP, that assistant's provider (e.g. Anthropic, OpenAI, GitHub) processes the requests and responses exchanged during your session. See section 8.3 above for details.
Data Transfer Safeguards: For processors located outside the EU/EEA, we ensure adequate safeguards through Standard Contractual Clauses (SCCs) or equivalent mechanisms as required by GDPR Article 46. Please refer to each processor's privacy policy for their current jurisdiction and data handling practices.
10. Your Rights (GDPR)
Under GDPR, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate data
- Erasure: Request deletion of your account and data
- Portability: Export your custom databases
- Restriction: Limit how we process your data
- Objection: Object to data processing (where applicable)
- Withdraw Consent: Where processing is based on consent
- Lodge a Complaint: File a complaint with your national data protection authority
10.1 Account Deletion Process
To permanently delete your account and all associated data:
Email support@gematrialens.com with your deletion request.
What gets deleted:
- ✓ Account credentials (email, username, password hash)
- ✓ Custom databases and all stored phrases
- ✓ Saved reports and analysis history
- ✓ Session data and authentication tokens
Retention for legal purposes: Some data may be retained in backup systems for up to 90 days for security incident investigation, as permitted under GDPR Article 17(3)(e). After this period, all data is permanently deleted.
Response time: We will respond to rights requests within 30 days as required by GDPR Article 12(3).
To exercise these rights, contact us at: support@gematrialens.com
11. Age Requirement
You must be at least 18 years of age to use this service.
We do not knowingly collect personal information from individuals under 18 years of age. If you are under 18, you may not create an account or use our services. If we become aware that a user is under 18, we will promptly delete their account and associated data.
This age requirement is necessary for:
- Legal capacity to enter into binding contracts (Terms of Service)
- Payment processing for premium subscriptions (requires contractual capacity)
- Compliance with payment processor requirements
12. International Data Transfers
Your data may be transferred to and stored on servers outside your country. We ensure appropriate safeguards are in place to protect your data according to GDPR standards.
13. Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Continued use of the service after changes constitutes acceptance of the new policy.
14. Contact Us
Questions about this privacy policy or your data?
- General inquiries/Data protection matters: support@gematrialens.com
🛡️ Our Commitment
Your privacy matters. We built this platform for truth seekers, not advertisers. We collect only what's necessary, protect it rigorously, and will never sell your data.