Birth information
We collect birth date, time, and place to generate readings. You may request deletion when you delete your account.
PRIVACY
Privacy Policy
Oracely operates the oracely.com website and api.oracely.com API to provide fate and astrology readings. This policy explains how we collect, use, retain, delete, and transfer your personal information.
Effective date: August 30, 2026Last updated: August 30, 2026
Privacy at a glance
AI processing
Our deterministic engine calculates chart data first. AI explains pre-computed results in natural language—it does not generate the underlying fate calculations.
We do not sell data
We do not sell your personal information. We use processors and integrations only as needed to operate the service.
Deletion & rights
You may access, correct, delete, or restrict processing where applicable. See Account Deletion or email info@univting.cc.
1. Data controller
Controller: Univting (trade name Oracely)
Representative: Seong Junhyeog (성준혁)
Business registration no.: 190-49-00637
Address: Unit 801-a-29, 8th Floor, 135 Wirye-dong-ro, Sujeong-gu, Seongnam-si, Gyeonggi-do, Republic of Korea (Changgok-dong, Sinsung W Castle Tower)
Service URLs: https://oracely.com (web), https://api.oracely.com (API)
Privacy inquiries: info@univting.cc
2. Information we collect
We collect only what is necessary to provide the service. Categories, purposes, whether required, and retention are summarized below.
Collection summary
| Category | Items | Purpose | Required? | Retention |
|---|---|---|---|---|
| Account | Email, name (optional), locale, social login identifiers (Google/Apple/Kakao) | Identification, authentication, account management, support | Email/auth identifier required for sign-up | Until account deletion (legal exceptions apply) |
| Birth profile | Birth date, birth time (optional), time accuracy, gender (optional), timezone, place name, latitude/longitude (optional) | Traditional chart calculation, readings, timezone correction | Birth date, timezone, place required for relevant traditions | Until profile/account deletion |
| Saved counterpart profile | Nickname, optional relationship hint, counterpart birth date/time (optional), place, timezone | Romantic/compatibility analysis (Person B), reuse for later analyses | Optional when using match features (counterpart need not be an ORACELY member) | Deleted when you remove the saved profile or delete your account |
| Readings | Calculation JSON, AI interpretation text, reading ID, language | Deliver and cache results per locale | Generated when you use the service | Until reading/account deletion |
| Payments (if purchased) | Order ID, product type, amount, currency, payment status, processor transaction ID | Paid features, refunds, disputes, fraud prevention | Required for paid checkout | As required by e-commerce law (see §4) |
| Support | Contact email, message content | Respond to inquiries, handle disputes | Required when you contact us | Up to 3 years after resolution (consumer dispute records) |
| Automatic collection | Browser/device info (User-Agent, etc.), language, anonymous session ID, 2-letter country code (CDN header) | Stability, usage statistics, market/pricing display, error analysis | Automatic when using the service | See §4 and §11 |
We block birth date/time/place, email, raw IP, and tokens from first-party Analytics event metadata on the server.
3. Purposes of processing
- Registration, login, and identity verification
- Calculating traditional charts and delivering readings from birth information
- Generating natural-language AI interpretations of pre-computed chart data
- Processing payments and entitlements (when paid features are used)
- Improving the service, monitoring errors, and usage statistics (minimized, non-identifying where possible)
- Legal compliance, dispute handling, and abuse prevention
4. Retention periods
We delete personal information without undue delay after the purpose is fulfilled, unless law requires otherwise.
① Account, birth profiles, readings: until you delete your account (typically processed within 30 days—see Account Deletion).
② Under the Korean Act on Consumer Protection in Electronic Commerce (when a paid transaction occurs):
- Records on contracts or withdrawal of subscription: 5 years
- Records on payment and supply of goods: 5 years
- Records on consumer complaints or disputes: 3 years
- Records on advertising: 6 months
Operational retention (internal policy)
| Data type | Period | Basis |
|---|---|---|
| First-party Analytics events | As needed for operations (periodic review/deletion) | Service improvement & KPIs |
| Server/application logs | Short-term for operations/security | Incident response & security |
| Sentry error events | Per Sentry project settings | Error monitoring |
5. Deletion procedure & method
Grounds: end of retention, purpose achieved, or your deletion request.
Procedure: select data → privacy officer approval → secure deletion → internal record.
Method: electronic files are permanently deleted or rendered unrecoverable; paper records are shredded or incinerated.
Account deletion requests are accepted via the Account Deletion page or info@univting.cc.
6. AI processing
Oracely computes core chart values (Mayan, Saju, Western, etc.) with our own deterministic engine first.
When configured, OpenAI API—or built-in templates—generates natural-language interpretations from the pre-computed chart JSON and language code. AI does not calculate birth charts, planetary positions, or calendar conversions, and does not alter computed results.
Data sent to OpenAI is structured calculation JSON and language. Email, account identifiers, and raw birth-date strings are not included in the request body. Western chart JSON may include the timezone and coordinates used in calculation; Four Pillars JSON may include timezone at birth.
Under OpenAI’s published API data-usage policy, inputs and outputs submitted via the API are not used to train OpenAI models by default. Live organization data-sharing settings still need an operational check.
If no OpenAI API key is configured, template-based interpretations may be used instead.
7. Processors (entrusted processing)
We may entrust processing to the parties below. Contracts require appropriate safeguards under applicable privacy law.
Processors
| Processor | Entrusted tasks | Retention |
|---|---|---|
| Vercel Inc. | Web frontend hosting (oracely.com), CDN, edge requests | Until contract ends |
| NAVER Cloud Platform (NCP) | API server, PostgreSQL, Redis, api.oracely.com infrastructure | Until contract ends |
| OpenAI, L.L.C. | AI interpretation via API (when OPENAI_API_KEY is set) | Per OpenAI policy after request |
| Google LLC | Google Sign-In (OAuth), Google Analytics 4 (production web, when measurement ID is set) | Per Google policies |
| Apple Inc. | Sign in with Apple (OAuth), server notifications (e.g. consent revoked) | Per Apple policies |
| Kakao Corp. | Kakao Login (OAuth) | Per Kakao policies |
| Functional Software, Inc. (Sentry) | Web/API error & performance monitoring (when SENTRY_DSN and SENTRY_ENABLED are set) | Per Sentry project retention |
| Toss Payments Corp. | KR market payment processing (when you complete a paid checkout) | Per payment and e-commerce laws |
Paddle and Stripe integrations exist in code but are not active processors until production API keys are enabled. We will update this policy when global payments go live.
8. Third-party provision
We do not sell personal information or provide it to third parties for their own marketing purposes.
When you choose social login (Google, Apple, Kakao), necessary identifiers are exchanged with that provider for authentication—you initiate this flow.
For paid checkout in Korea, payment data is sent to Toss Payments. Card numbers are not stored on Oracely servers; the processor handles payment data.
We may disclose information when required by law (e.g. valid government request) within legal limits.
9. International transfers
Primary data storage is in the Republic of Korea (NCP). The services below may involve cross-border transfers.
We comply with applicable transfer requirements (consent, standard contractual clauses, adequacy, etc.).
Cross-border transfers
| Recipient | Country | Items transferred | Purpose | Timing & method | Retention |
|---|---|---|---|---|---|
| Vercel Inc. | USA, etc. | Access logs, cookies, request metadata, errors | Web hosting & CDN | On use, network transmission | Per Vercel policies |
| OpenAI, L.L.C. | USA | Structured chart JSON, language code | AI interpretation | On interpretation API call (HTTPS) | Per OpenAI API policy |
| Google LLC | USA, etc. | OAuth identifiers, GA4 client/event data (production) | Login, web analytics | On auth/page load | Per Google policies |
| Apple Inc. | USA, etc. | Apple user ID, email (if provided/hidden email relay) | Apple Sign-In | On authentication | Apple policies |
| Functional Software, Inc. (Sentry) | USA, etc. | Error stacks, request path, masked context | Error monitoring | On error | Per Sentry retention settings |
Kakao Login is processed in Korea. Toss Payments data is processed domestically.
10. Cookies & automatic collection
We use cookies and similar technologies (including localStorage). See our Cookie Policy for details.
Key cookies & storage
| Name / type | Purpose | Duration |
|---|---|---|
| oracely_locale | Stores your chosen display language | ~1 year |
| Auth token cookie | Maintains login session (when set) | Per session/settings |
| Google Analytics (_ga, etc.) | Web usage statistics when GA4 is enabled on production | Google policy |
| localStorage: analyticsSessionId | Anonymous first-party analytics session | ~30 days |
| localStorage: auth/profile keys | Login state, last profile ID | Until logout/clear |
11. Analytics
First-party Analytics: the web client sends event names, anonymous sessionId, and non-identifying metadata to api.oracely.com. The server stores a 2-letter countryCode only when CDN/edge headers (e.g. x-vercel-ip-country) are present—it does not store raw IP addresses in the Analytics database.
Server-side filters block email, birth date/time/place, coordinates, tokens, and similar fields from event metadata.
Google Analytics 4: enabled only on Vercel production deployments when a measurement ID is configured. Preview and local builds do not load GA4.
Payment market hints use request country headers separately; raw IP is not stored in our database for Analytics.
12. Your rights
Contact info@univting.cc or use the Account Deletion page. We respond without undue delay as required by law.
You may contact the Korean Personal Information Protection Commission or other competent authority for guidance or dispute resolution.
- Access your personal information
- Request correction of inaccurate data
- Request deletion (see Account Deletion)
- Request restriction of processing where applicable
- Data portability where applicable law allows
13. Children’s privacy
Oracely is not directed to children under 14. We do not knowingly collect personal information from children under 14 and will delete it if we become aware.
Users aged 14–17 may require guardian consent where required by law.
14. Security
No method of transmission or storage is 100% secure.
- TLS (HTTPS) encryption in transit
- Access controls for tokens and password hashes
- Firewall and least-privilege on servers and databases
- Sensitive data masking in logs and Sentry (log-masker)
- Backups and operational monitoring on NCP infrastructure
15. Privacy officer
Privacy officer: Seong Junhyeog (성준혁)
Title: Representative
Contact: info@univting.cc
Privacy contact team: Oracely Operations (Univting)
16. Policy changes
We may update this policy. Material changes will be posted on this page with an updated effective/last-updated date and, where appropriate, additional notice.
The updated policy takes effect when published unless stated otherwise.