Privacy Policy
How Cassandria handles personal data across the Oracle, Business services and Research Lab. Last updated: 5 September 2026.
1. Data controller (identity)
The data controller is Hendeka Orchestra, S.L., NIF B93853315, Calle Domingo J. Navarro 1, 2º, 35002 Las Palmas de Gran Canaria, Spain, operating cassandria.ai. Contact: info@cassandria.ai.
2. What we collect and why (legal basis)
- Account (email, Google sign-in identifier, name) — to provide the service and your consultation history. Basis: performance of a contract.
- Billing (donation or invoice status, where applicable) — when payments or donations are active, they are processed by Stripe acting as a processor; card data is handled by Stripe, not stored by us. Basis: contract and legal (tax/accounting) obligations.
- Business intake (dossier/pilot/quote requests and the details you provide) — to respond to and deliver the service you ask for. Basis: pre-contract steps and contract.
- Customer questions (the questions you ask the Oracle) — to produce a reading and, in aggregate and de-identified, to improve quality. Basis: contract and legitimate interest.
- Research consent — a question enters the PYTHIA research registry only with your explicit opt-in; consent defaults to off and can be withdrawn. Basis: consent.
3. Retention
- Account and consultation history: kept while your account is active; deleted on request or after prolonged inactivity.
- Billing and invoices: kept for the period required by applicable tax and accounting law.
- Business intake and customer questions: kept for the duration of the engagement and a reasonable follow-up period, then deleted or de-identified.
- Research submissions: retained as sealed records for the trial; the link to your identity is removed on de-identification.
4. Sharing and international transfers
We share personal data only with processors needed to run the service, under written data-processing terms: Stripe (payments), Google LLC (sign-in as independent controller; GA4 and Ads measurement only with your consent), and our hosting and email providers. Transfers outside the EU/EEA use safeguards required by applicable law, including Standard Contractual Clauses where applicable.
5. Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing; and withdraw consent at any time. Email info@cassandria.ai. You may also complain to the Spanish supervisory authority (AEPD).
6. Contact
info@cassandria.ai — privacy requests and questions.