Privacy Policy
Last updated: 19 August 2026
This Privacy Policy explains how Atmaway ("Atmaway", "we", "us" or "our") collects, uses, discloses and protects your personal information when you visit www.atmaway.co (the "Site") or purchase one of our personalised numerology reports (the "Services"). We are based in Melbourne, Victoria, Australia.
We are committed to handling your personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other applicable data-protection laws.
1. Who we are and how to contact us
Atmaway is the controller responsible for your personal information. If you have any questions about this policy or wish to exercise your rights, get in touch via our contact form.
2. The information we collect
Information you give us:
- Identity and contact details: your name and email address.
- Your date of birth (and, for relationship readings such as "Know Your Love", a partner's date of birth that you choose to provide). Your date of birth is the core input we use to prepare your report.
- Account information: if you create an account, your login is managed by our authentication provider (Clerk); we store your email and role only, not your password.
- Marketing preferences: whether you have opted in to receive marketing emails.
- Communications: the content of any messages you send us.
Information we collect automatically:
- Usage and device data: basic technical information such as IP address, browser type and pages visited, used to operate and secure the Site.
- Order and sign-in security records: when you place an order, book a consultation or sign in to your account, we record the IP address your request came from, the country associated with that address, and a description of your browser or device. We use these records to detect and prevent fraudulent payments and misuse of the Site, and we may refuse orders from addresses or accounts connected to previous fraudulent activity.
- Email and report engagement: when your report link is opened, we record that it was opened and when, so we can confirm successful delivery.
- Cookies: see "Cookies and tracking" below.
Information from third parties:
- Payment confirmation from our payment processor (Stripe). We do not receive or store your full card number.
- Authentication data from Clerk and, if you choose social sign-in, from Google.
3. A note about your date of birth
Your date of birth is personal information, but it is not "special category" or "sensitive information" under the GDPR or the Australian Privacy Act. We use it solely to calculate and prepare your numerology report. We encrypt dates of birth (and partner dates of birth and names) at rest using AES-256-GCM encryption, and we decrypt them only when needed to prepare your report or when you or our staff access your order.
4. How and why we use your information
| Purpose | Legal basis (GDPR) |
|---|---|
| To prepare and deliver your numerology report and provide the Services | Performance of our contract with you |
| To process payments | Performance of our contract; legal obligation |
| To create and manage your account and authenticate you | Performance of our contract; legitimate interests |
| To provide customer support and respond to enquiries | Legitimate interests; performance of our contract |
| To send marketing emails about our reports and offers | Your consent (which you may withdraw at any time) |
| To keep the Site and your data secure and prevent fraud, including recording the IP address, country and device details of orders, bookings and sign-ins, and refusing orders connected to previous fraudulent payments | Legitimate interests; legal obligation |
| To keep financial and tax records | Legal obligation |
| To improve our Services | Legitimate interests |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can object to this processing (see "Your privacy rights" below).
5. Cookies and tracking
We use a small number of cookies and similar technologies:
- Strictly necessary cookies: set by our authentication provider (Clerk) to keep you signed in and the Site secure. The Site does not work properly without these.
- Report open tracking: we record when your report link is first opened so we can confirm successful delivery.
We do not use cookies to build advertising profiles or to sell your data. You can control cookies through your browser settings; blocking strictly necessary cookies may prevent you from signing in or accessing your report.
6. Who we share your information with
We never sell your personal information, and we do not "share" it for cross-context behavioural advertising. We disclose your information only to the trusted service providers who help us run our business, each bound by contractual data-protection obligations:
- Stripe: payment processing.
- Twilio SendGrid: sending transactional and marketing email.
- Clerk: user authentication and account management.
- Cloudflare: file storage (R2) and content delivery/security.
- Our hosting and infrastructure providers, and professional advisers (e.g. accountants, lawyers) where necessary.
We may also disclose information where required by law, to enforce our terms, or to protect our rights, our users or the public, and in connection with a business sale or restructure (subject to this policy).
7. International data transfers
Some of our service providers are located outside Australia (including in the United States and the European Union). Where we transfer personal information overseas, we take reasonable steps to ensure it is protected to a standard consistent with applicable law, for example by relying on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, and data-processing agreements with each provider.
8. How long we keep your information
- Account and report data: for as long as your account is active, or until you ask us to delete it.
- Order and financial records: for at least 7 years, to meet Australian tax and record-keeping obligations.
- Marketing data: until you unsubscribe or withdraw consent.
- Security records: the IP address, country and device details recorded with an order or booking are kept as part of that transaction record. The IP address and country from your most recent sign-in are deleted after 12 months without any sign-in activity.
When we no longer need your information we securely delete or de-identify it. Residual copies may remain in backups for a limited period before being overwritten.
9. How we keep your information secure
We use appropriate technical and organisational measures to protect your information, including encryption of sensitive fields at rest (AES-256-GCM), encryption in transit (TLS), access controls, and the use of reputable, security-vetted service providers. No method of transmission or storage is completely secure, but we work hard to protect your information and to respond promptly to any incident.
10. Your privacy rights
Depending on where you live, you have some or all of the following rights. We will not discriminate against you for exercising them.
EU, UK and EEA (GDPR / UK GDPR): the right to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority (for example the UK Information Commissioner's Office, or your EU member-state Data Protection Authority).
Australia: the right to access and correct your personal information under the Australian Privacy Principles, and to complain to us and then to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
California (CCPA/CPRA): the right to know, access, delete and correct your personal information, and to opt out of the "sale" or "sharing" of personal information. Note that we do not sell or share your personal information.
To exercise any right, reach us via our contact form. We may need to verify your identity, and we will respond within the timeframes required by law.
11. Children
Our Services are intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version here and change the "Last updated" date above. If the changes are significant, we will take reasonable steps to notify you.
13. Contact us
Questions or concerns about your privacy? Reach us via our contact form. If you are not satisfied with our response, you may contact the relevant supervisory authority listed above.