Privacy Policy

This Privacy Policy explains how Xivena collects, uses, discloses, and safeguards your personal information when you use our website at xivena.com and our mobile applications (together, the “Service”). The Service offers AI-assisted astrology and self-reflection features, including horoscopes, tarot, live transits, palm reading, a dream journal, compatibility reports, zodiac insights, and conversations with AI experts.

Please read this policy alongside our Terms of Use. By using the Service, you confirm you have read and understood this policy.

Xivena is operated by Babakulov Shakhzodbek, an individual sole trader (“Xivena,” “we,” “us,” or “our”). For the purposes of UK and EU data protection law, we are the data controller responsible for your personal data.

If you have any questions about this policy or how we handle your data, you can reach us at babakulov@xivena.com.

We only collect data we need to run the Service and give you personalised readings. Under the UK GDPR and EU GDPR (Article 6), our legal basis for each use is one of: performance of a contract with you, your consent, our legitimate interests in operating and improving the Service, or compliance with a legal obligation.

2.1 Identity & account

Your name, email address, and avatar (a photo URL or chosen emoji). Collected to create and secure your account. If you upload a profile photo, it is stored at a long-lived, unguessable link so the app can display it; anyone who has that exact link could view the photo, and the link changes when you upload a new one. Palm photographs are never stored this way. Legal basis: contract.

2.2 Birth data

Your date of birth and, optionally, your time and place of birth (including the latitude, longitude, and timezone derived from the place you enter). We use this to calculate your natal chart, current transits, and personalised readings. Legal basis: contract and, where you provide optional details, consent.

2.3 Derived astrological signs

Your sun, moon, and rising signs, calculated from your birth data and stored to personalise the Service. Legal basis: contract.

2.4 Data about other people (partner / compatibility)

If you use compatibility or relationship features, you may enter another person’s name, birth date, birth time, location, and gender, and describe how you relate to them. Only enter another person’s details if you have their permission to do so. You are responsible for ensuring you have the right to share this information with us. The details you enter are shared with our AI providers as relationship context when generating readings and conversations for you. Legal basis: consent and legitimate interest.

2.5 Palm photographs (sensitive data)

If you use palm reading, the photograph you take is stored in Firebase Cloud Storage so we can generate your reading and so you can revisit it later. We treat palm photographs as sensitive personal data. They may be considered biometric in some jurisdictions. We use them only to generate your palm reading — never to identify you, and never for any other purpose. Legal basis: explicit consent.

2.6 Content you create

Your reading history, dream journal entries, and compatibility reports, stored so you can return to them. Legal basis: contract.

2.7 Voice audio

When you use Expert Voice, your speech streams directly to our voice provider (ElevenLabs) and is transcribed in real time so the AI can respond. Xivena does not store your voice audio on its own servers. ElevenLabs retains session audio recordings and transcripts under its own retention policy, and may use them to train and improve its AI models. Deleting your Xivena account deletes your data from our systems, and withdrawing consent stops any further voice processing. Legal basis: explicit consent.

2.8 Video sessions

When you use Expert Video, the Expert’s spoken replies are rendered as an animated avatar by our video provider — the reply audio is streamed to LiveAvatar (HeyGen) over LiveKit’s real-time infrastructure so the avatar can speak it to you. HeyGen may use this submitted content — the Expert’s spoken replies, which can reflect your personal context — to train and improve its models. Your camera is never accessed and no video of you is captured. Your side of the conversation is voice audio, handled as described in section 2.7. Legal basis: consent.

2.9 Payment data

Your subscription tier and purchase history. Your card details are handled entirely by our payment providers (Paddle on the web, Apple on iOS, Google Play on Android) and are never seen or stored by Xivena. Legal basis: contract and legal obligation.

2.10 Usage & game data

Feature-usage counters and scores from in-app games, used to operate features, enforce fair-use limits, and improve the Service. Legal basis: legitimate interest.

2.11 Technical & security data

Your IP address, request logs, error logs, and rate-limit counters, used to keep the Service secure, reliable, and free from abuse. Legal basis: legitimate interest and legal obligation.

2.12 Psychological self-assessment results

Your answers to the in-app self-assessments and the results calculated from them — numeric scores for personality traits (the Big Five, including neuroticism), attachment style, chronotype, values, and strengths. We store them to build your personal portrait, and the scores are included in the prompts we send to our AI providers so your readings and conversations reflect who you are. These are self-reflection tools, not clinical assessments. Legal basis: explicit consent.

2.13 Companion memory

To make conversations feel continuous, the Service keeps three things derived from your content: short notes the AI writes about you, which you can see and edit in the app; a rolling summary of your recent readings and conversations; and numerical representations (“embeddings”) of your entries that let the AI find related moments later. All three are produced by our AI providers from your content and shared back to them as context for future conversations. Legal basis: consent.

Xivena uses AI to generate horoscopes, tarot, dream interpretations, palm analysis, psyche insights, and expert conversations. We send the relevant inputs to our AI providers to produce your reading — depending on the feature, this can include: your name; your birth date, time, and place; your derived signs; your messages and Expert conversations; your dream journal entries; your psychological assessment scores (section 2.12); your companion memory — the AI’s notes, rolling summary, and embeddings (section 2.13); details of the people you add (section 2.4); your past readings; and, for palm reading, the palm photograph you take. Palm photographs are analysed by Google Gemini; if Gemini is unavailable, the photograph may be analysed by Anthropic Claude as a fallback. To personalise future readings, the text of your readings and conversations is also processed by the same AI providers into a private memory summary for your account.

Before any of your personal data is shared with an AI provider, we ask for your explicit consent inside the app — the AI features of the Service only begin once you have agreed, and this is enforced by our servers: AI features do not run for an account with no recorded consent. You can withdraw that consent at any time in the app at Settings → Privacy → “Withdraw AI consent”; the AI features stop working until you agree again, and your account and everything you have saved stay exactly as they are. You can also withdraw by emailing us (see section 7).

We do not use AI to make automated decisions that produce legal or similarly significant effects about you. No profiling under Article 22 of the GDPR takes place.

We share personal data only with the service providers (sub-processors) that help us operate the Service. Each processes data on our behalf under contractual safeguards:

What our AI providers commit to

From their published terms and policies:

• Google (Gemini) — we use the paid tier of the Gemini API; under its terms, Google does not use your prompts (including images such as your palm photograph) or the generated responses to improve its products.
• Anthropic (Claude) — its commercial terms state it may not train models on API customer content, and API inputs and outputs are deleted from its systems within 30 days under its standard retention policy.
• ElevenLabs — certified under the EU-US Data Privacy Framework and provides a data-processing agreement; it retains session recordings and transcripts under its own retention policy and may use them to train and improve its AI models, as described in section 2.7.
• HeyGen (LiveAvatar) — SOC 2 Type II audited; it may use content submitted to it (the Expert’s spoken replies, as described in section 2.8) to train and improve its models, and its agreements with its own AI vendors do not allow those vendors to train on customer data. Only the Expert’s synthesized replies reach HeyGen — never your voice and never your camera.
• LiveKit — does not use customer content, prompts, transcripts, or audio to train models, and operates zero retention for AI inference; media is encrypted in transit.

These commitments are not identical. Google, Anthropic and LiveKit commit not to train on your content; ElevenLabs and HeyGen may. We do not present those two as equivalent to the others. Instead we disclose it where it can affect your decision: the in-app consent screen states it before you agree, and no session runs until you do. Both providers are involved only in live voice and video sessions — if you do not use Expert Voice or Expert Video, neither receives anything about you.

We do not sell your personal data. We do not share it with third parties for their own marketing. We may disclose data if required to do so by law, by a court order, or to protect the rights, safety, and security of our users or the Service.

Most of our infrastructure and several of our providers are based in the United States, so your data may be transferred to and processed outside the United Kingdom and the European Economic Area. Where we make such transfers, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, and the EU-US Data Privacy Framework where applicable. By using the Service from outside these regions, you consent to your data being processed in the countries described above.

We keep your personal data only as long as we need it:

• Account & profile data — kept while your account is active; deleted immediately when you delete your account in the app, and in any event permanently deleted within 30 days.
• Palm photographs — kept while the reading and your account exist, so you can revisit them; deleted when you delete the reading or your account.
• Payment records — kept for at least 7 years, as required by UK tax and accounting law.
• Administrative action records — an append-only log of account-level administrative actions (for example refunds), kept after account deletion for accountability and fraud prevention. It references your account ID only and contains none of your content.
• Voice session audio & transcripts — not stored on Xivena’s servers; our voice provider retains them under its own retention policy (section 2.7).
• Technical & security logs — kept for up to 90 days.
• Support emails — kept for up to 24 months.

Depending on where you live, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected (rectification)
• Have your data deleted (erasure, or the “right to be forgotten”)
• Restrict how we process your data
• Receive your data in a portable format
• Object to processing based on our legitimate interests
• Withdraw consent at any time, where processing is based on consent — in the app at Settings → Privacy → “Withdraw AI consent”, without deleting your account
• Complain to a supervisory authority (in the UK, the Information Commissioner’s Office)

To exercise any of these rights, email us at babakulov@xivena.com from the address linked to your account. We will respond within 30 days. You can also delete your account at any time from within the app.

The Service is intended for adults. You must be at least 18 years old to use Xivena. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will promptly delete it.

We protect your data using industry-standard measures: encryption in transit (TLS), encryption at rest, Firebase security rules, and access controls that limit who can reach your data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a data breach occurs that affects your rights, we will notify you and the relevant authorities as required by law.

We keep our use of cookies and local storage to a minimum:

• Firebase Authentication uses essential cookies required for you to sign in and stay signed in.
• Paddle.js is used during checkout to process payments securely.
• Vercel Analytics measures page views and performance (Web Vitals) without using cookies or tracking you across other sites.
• Local storage on your device holds your session and interface preferences.

In our mobile apps we use Google Analytics for Firebase to understand which screens are viewed, time spent per screen, and which features are used, so we can improve the app. This data is not used to track you across other apps and does not power App Tracking Transparency requests.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. If the changes are significant, we will take reasonable steps to let you know. Continued use of the Service after changes take effect means you accept the revised policy.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: