Privacy Policy

Data Controller

Ifá Wisdom is responsible for processing the personal data collected through this platform. For privacy-related questions, you can reach out through the Contact page.

Data We Collect

We collect only the minimum necessary for the platform to operate: (1) Email for authentication and important communications; (2) Username for personalizing the experience; (3) Study reading history for your personal Diary; (4) Learning progress and gamification (XP, Ase, level); (5) Payment data securely processed by Stripe (on the site) or by Apple and Google (in the apps; see below). We do not ask for sensitive data (detailed religious beliefs, political affiliation, health). The free text you write in a consultation is yours: please do not include sensitive data in it; it is sent to the AI model only after your consent.

How We Use the Data

Your data is used exclusively for: secure authentication on the platform; maintaining your Diary of spiritual consultations; tracking progress in the learning modules; processing payments for Premium plans and one-off consultations; communications about your account, security, or important updates; and aggregated anonymous analysis to improve the platform. We never sell your data to third parties nor use it for behavioral advertising.

Storage and Security

Data is stored on Supabase, a secure platform with SOC 2 Type 2 certifications. We implement Row Level Security (RLS) policies that ensure only you can access your consultations and personal data. All communications are encrypted via HTTPS/TLS. Backups are performed regularly and kept in secure locations.

Sharing with Third Parties

We share only the data that is necessary with the processors below, which handle data on our behalf and under contract (LGPD Art. 5, VII; GDPR Art. 28; Swiss FADP art. 9):

Supabase Inc. (USA) — database, authentication and Row Level Security. Data: email, profile, consultations, comments, progress, consents. Purpose: running your account. Legal basis: performance of contract.

Vercel Inc. (USA) — website hosting, access logs and performance metrics (Vercel Analytics and Speed Insights, aggregated and cookieless). Data: IP address and technical browser data. Legal basis: legitimate interest (security and performance).

OpenRouter, Inc. (USA) — intermediary that receives the text of the AI consultation and forwards it to Anthropic's model. Data: your question, the Odu that was cast and, in contextual consultations, the opening lines of your last three answers; no name, email or account identifier. Legal basis: performance of contract, with your consent before the first submission.

Anthropic PBC (USA) — provider of the AI models used in consultations (Claude, from the Sonnet and Haiku families), through OpenRouter and, as a fallback, directly. It receives the same data described above. Under Anthropic's commercial terms, data sent through the API is not used to train its models.

Stripe, Inc. / Stripe Payments Europe Ltd. (USA / Ireland) — payments, subscriptions and invoices. Data: email, account identifier and payment data (the card is stored only by Stripe, PCI-DSS Level 1 certified). Legal basis: performance of contract and legal obligation (tax).

Resend, Inc. (USA) — email delivery: sign-up confirmation, account notices, newsletter (opt-in only) and the internal notice when an AI answer is reported. Data: email and message content. Legal basis: performance of contract; consent for the newsletter.

Cloudflare, Inc. (USA) — Turnstile, bot protection on login and sign-up. Data: IP address and technical browser signals. Legal basis: legitimate interest (security).

Functional Software, Inc. (Sentry) (USA) — technical error logging, configured not to collect cookies, headers, request bodies or the text of consultations. Legal basis: legitimate interest (service stability).

Google LLC / Google Ireland Ltd. (USA / Ireland) — (1) Google Analytics 4, only with your consent in the cookie notice; (2) "Continue with Google", if you choose that login (name, email and Google identifier); (3) Gemini, used only to generate article cover images, with no user data at all. Legal basis: consent (1 and 2); not applicable (3).

Browser notification services (Google, Mozilla, Apple, depending on your browser) — if you turn on notifications, your browser's push service delivers the message. Data: the technical subscription address and the notification content. Legal basis: consent.

RevenueCat, Inc. (USA) — in the iOS and Android apps, manages subscriptions bought on the App Store and Google Play and tells Ifá Wisdom whether Premium is active. Data: account identifier, an anonymous app identifier, purchase receipts and history (product, dates, country, price); no card data. Purpose: unlock and restore Premium in the app and on the site. Legal basis: performance of contract. Policy: https://www.revenuecat.com/privacy

Apple Inc. / Apple Distribution International Ltd. (USA / Ireland) — In-App Purchase on iPhone and iPad: Apple charges, issues the receipt and handles renewals and refunds; we never receive card data. Data we receive: the purchase receipt (via RevenueCat). Purpose: payment of subscriptions on iOS. Legal basis: performance of contract and legal obligation (tax). Policy: https://www.apple.com/legal/privacy/

Google LLC / Google Ireland Ltd. — Google Play Billing (USA / Ireland) — in-app purchase on Android: Google charges, issues the receipt and handles renewals and refunds; we never receive card data. Data we receive: the purchase token and status (via RevenueCat). Purpose: payment of subscriptions on Android. Legal basis: performance of contract and legal obligation (tax). Policy: https://policies.google.com/privacy

Google LLC — Firebase Cloud Messaging (USA) — delivers the apps' push notifications (on iPhone, through the Apple Push Notification service), only if you allow notifications on your device. Data: the device push token, the language and the notification content. Purpose: the push notifications you turn on in the apps (for example, new Studies). The daily Odu of the Day reminder is a local notification created on the device itself and does not go through Firebase. Legal basis: consent. Policy: https://firebase.google.com/support/privacy

International transfers to the USA and other countries without an adequacy decision rely on the European Commission's Standard Contractual Clauses (with the Swiss addendum, for the FADP) or on the EU-US / Swiss-US Data Privacy Framework when the processor is certified. For Brazil, they follow LGPD Art. 33. We do not sell data and do not use it for advertising.

Your Rights

Data Protection Officer (DPO)

In compliance with LGPD Art. 41 and GDPR Art. 37, the Ifá Wisdom Data Protection Officer can be contacted at:

Email: contact@ifa-wisdom.com Contact page: available at /contact

The DPO handles rights requests (access, rectification, erasure, portability, objection), complaints, and questions about personal data processing. Response time is up to 15 calendar days. Account deletion and data export can be triggered directly at /profile without contacting the DPO.

You also have the right to lodge a complaint with the Brazilian Data Protection Authority (ANPD — gov.br/anpd) or the competent data protection authority in your country.

Retention Period

We retain your data only for as long as necessary: account data while you keep an active registration (deleted within 30 days after a cancellation request); consultation history according to your preference (you can archive or delete entries individually); payment data for the legally required period (7 years for tax obligations); and security logs for up to 90 days.

Changes to This Policy

This policy may be updated to reflect changes in legislation, in our practices, or in the platform's functionality. We will notify significant changes via email or notice on the platform. The date of the last update is shown at the bottom of this page.