Privacy Policy
This policy explains what data the Arcanum.Life bot collects, why, who it is shared with, how long it is kept and what rights you have. It has been prepared in accordance with the EU General Data Protection Regulation (GDPR / DSGVO).
1. Who is responsible for your data
Controller responsible for data processing (Art. 4(7) GDPR):
Kostyantyn Rokash
Krampestraße 2, 45139 Essen, Germany
E-mail: support@arcanum.life
Telegram support: @Azrael_Costa
For any questions about your data, write to this address or contact support. We reply within 30 days.
2. What data we process
The bot collects only what it needs to work, and mostly only what you provide yourself.
| Category | What exactly | Source |
|---|---|---|
| Telegram account data | Telegram ID, username (@username), first and last name from your profile, language of your Telegram app | Telegram transmits them automatically when you write to the bot |
| Birth data | Date, time and city of birth; coordinates and time zone of the city; zodiac sign, Moon, Ascendant, life path number | You provide them yourself; derived values are calculated |
| Data of other people | Partner’s date, time and city of birth (for compatibility); company name and founding date, entrepreneur’s date of birth (for business numerology) | You provide them yourself |
| Questions and results | Your questions, spreads, horoscopes, interpretations and history of results | You and the bot |
| Access and payment | Remaining free attempts and requests, subscription period, plan, amount, currency, payment method and status, payment identifier | The bot and payment services |
| Consent and settings | Date and version of acceptance of the terms, selected language, notification setting | You |
| Confirmations at checkout | Which consents you ticked before payment (terms, disclaimer, 18+, waiver of the right of withdrawal), when you ticked them and the version of the terms | You, on the checkout screen |
| Trial attempt counter | SHA-256 hash of your Telegram ID with a secret salt and the number of remaining free attempts. The ID cannot be derived from the hash | The bot |
| Technical data | Time and duration of message processing, calls to external services, error codes, AI resource usage. The server log records your Telegram ID but not the text of your messages | The bot |
We do not receive or store bank card numbers or crypto wallet data: payments are processed by Telegram and the payment services, and we only receive a confirmation.
If you enter another person’s data, for example a partner’s, make sure you are entitled to share it. Provide only what is needed for the calculation.
3. Purposes and legal bases
- Operating the bot and providing the service: calculations, interpretations, history, profile, balance. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) under the Terms of Use.
- Accepting and recording payments: legal basis — performance of a contract and legal obligations under tax and commercial record-keeping law (Art. 6(1)(b) and (c) GDPR). The confirmations ticked before payment are stored together with the payment record as evidence in case of payment disputes (Art. 6(1)(f) GDPR).
- Protection against abuse: a pseudonymous counter of free attempts (so that deleting a profile does not grant new free attempts), request rate limiting, blocking of violators. Legal basis: our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).
- Stability and security: technical logs, troubleshooting, cost tracking. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Notifications: the daily card of the day or horoscope is sent only if you have switched it on yourself in the settings. Legal basis: your consent (Art. 6(1)(a) GDPR); you can switch it off at any time.
There is no advertising in the bot. We do not sell data, do not build advertising profiles and do not use your data to train AI models.
If you yourself mention health or other special categories of data (Art. 9 GDPR) in a question, they are processed only to answer that question. Please do not share such information unless necessary.
4. Who receives the data
Telegram
You communicate with the bot via Telegram, so Telegram processes your messages as an independent controller under its own policy: telegram.org/privacy. Payments in Telegram Stars also go through Telegram.
RoxyAPI — astrological and numerological calculations
Operator: Roxy Labs, New Delhi, India. The servers are located in Nuremberg (Germany). RoxyAPI processes data on our behalf (processor, Art. 28 GDPR) on the basis of its data processing agreement (DPA).
- What is transmitted: date, time and coordinates of the place of birth, time zone, the question for a Tarot spread, the name or company name for numerology. Your Telegram ID and contact details are not transmitted.
- How it is stored: according to RoxyAPI, the content of requests is processed only in memory and is not written to databases, logs or files. Service metadata is retained: time, request address, response code and our server’s IP address, for up to 120 days.
- RoxyAPI policy: roxyapi.com/policy/privacy
Anthropic — AI-assisted interpretations (Claude model)
Operator: Anthropic Ireland, Limited (Dublin, Ireland) and Anthropic PBC (San Francisco, USA). Anthropic processes data on our behalf as a processor under its commercial terms and data processing agreement (DPA).
- What is transmitted: calculation results (planetary positions, cards, numbers), a description of the birth data, your name from Telegram, your question, a short summary of the latest result and the last few messages of the “Ask the Astrologer” dialogue. Telegram ID, username and payment data are not transmitted.
- Model training: under its commercial terms, Anthropic does not train models on data submitted via the API.
- Storage: Anthropic automatically deletes inputs and outputs within 30 days. The exception is requests reviewed for violations of the usage policy: these may be retained for up to 2 years, and safety classification scores for up to 7 years.
- Terms: anthropic.com/legal/commercial-terms, privacy policy: anthropic.com/legal/privacy
Payment services
- Telegram Stars: payment within Telegram.
We receive from them only the payment status, amount and identifier.
Hosting
The bot and the database run on a server of the hosting provider netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany) in a data centre within the EU. A data processing agreement pursuant to Art. 28 GDPR is in place with netcup.
Apart from the cases listed, data is disclosed to third parties only where required by law.
5. Transfers outside the EU
Some recipients are located outside the European Economic Area or have access to the data from there:
- Anthropic: processing in the USA.
- RoxyAPI: servers in Germany, administration from India.
- Telegram: in accordance with its own policy.
Transfers are made on the basis of the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which Anthropic and RoxyAPI apply. A copy of the safeguards can be requested at the address in section 1.
6. How artificial intelligence is used
The calculations (planetary positions, drawn cards, numbers) are performed by RoxyAPI. The Claude model only turns this data into readable text in your language and does not “calculate” anything itself.
The answers are symbolic and for entertainment. They do not constitute medical, legal or financial advice and may contain inaccuracies. The bot does not make automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR).
7. Retention periods
- Profile, birth data, history and questions are kept while you use the bot and are deleted immediately after the delete command (section 8). If the account is inactive for more than 24 months, we delete it.
- Payment records are kept for the periods required by German tax and commercial law (§ 147 AO, § 257 HGB, up to 10 years). After the account is deleted, they are kept in anonymised form, without any link to the profile.
- The pseudonymous trial attempt counter (ID hash and number of attempts) is kept for 24 months from last use. It is retained after the account is deleted so that free attempts cannot be obtained again.
- Technical logs and events are kept for up to 90 days.
- The intermediate calculation cache is kept for up to 30 days. Calculation results are stored by a hash of the input data, without being linked to your profile.
- Retention periods at RoxyAPI and Anthropic are described in section 4.
8. Your rights
Under the GDPR you have the right to:
- obtain information about your data and a copy of it Art. 15;
- have inaccurate data corrected Art. 16;
- have your data deleted Art. 17;
- restrict processing Art. 18;
- receive your data in a machine-readable format Art. 20;
- object to processing based on legitimate interest Art. 21;
- withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal Art. 7(3).
Most of these rights can be exercised directly in the bot:
- /settings → “Privacy” → “Export my data”: a JSON file with all your data;
- /settings → “Privacy” → “Delete my data”: immediate deletion of your profile, birth data and history;
- /profile: change your birth data.
Purchased requests and subscriptions are cancelled upon deletion. For all other matters, write to the address in section 1.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the place where you live or where we are established: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
9. Age restriction
The bot is intended for persons aged 18 and over. We do not knowingly process data of minors. If you become aware that a minor is using the bot, let us know and we will delete their data.
10. Security
We protect data with technical and organisational measures:
- data is transmitted to RoxyAPI, Anthropic and payment services only over an encrypted connection (TLS);
- only administrators have access to the server and the database;
- secret keys are stored outside the program code;
- the signature of every payment notification is verified;
- trial attempts are recorded only in pseudonymous form.
11. The arcanum.life website
The website only provides information about the bot and links to Telegram. It has no registration, forms, cookies, analytics, advertising pixels or external fonts or scripts: everything is loaded from our own server.
- Server logs. When you open a page, the server receives your IP address, the date and time, the page address, the referring page and browser data. We use them only for the secure operation of the website and protection against attacks, and delete them after 7 days. Legal basis: our legitimate interest in the security of the website (Art. 6(1)(f) GDPR). Hosting: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany; a data processing agreement pursuant to Art. 28 GDPR is in place.
- Language selection. If you switch the language, your choice is stored only in your browser (localStorage), so that the same version opens on your next visit. It is not sent to the server. Legal basis: § 25 (2) no. 2 TDDDG (necessary for a function you requested).
- Bot referral tag. The website buttons open the bot via a link with a tag, for example
web-en-heroor an advertising campaign tag. The tag contains no personal data. When you start the bot, it is stored in your profile so that we can see how many users came from the website and from which advertisement. Legal basis: our legitimate interest in evaluating advertising (Art. 6(1)(f) GDPR); the tag is deleted together with the profile.
12. Changes to this policy
If we change this policy, a notice will appear in the bot. In the case of material changes, the bot will ask you to confirm your consent again. The current version is always available via the /terms command and at this link.