This Privacy Policy explains how LineSpotting AB (“we,” “us,” or “our”) collects, uses, stores, and shares information when you use the Mutual Ascension Human Design application and website at mutualascension.org (the “Service”). It should be read together with our Terms of Service and Data Retention Policy.
LineSpotting AB is the data controller for personal data processed through the Service.
The Service is offered worldwide except in France. We do not knowingly offer or market the Service to users located in France. If you access the Service from France, you do so on your own initiative and at your own risk.
This policy applies to the web app, native iOS and Android apps, our APIs (including chart calculation at api.mutualascension.org), and related support channels.
To generate Human Design charts, you may provide:
Birth data can reveal information about you or third parties whose charts you store. Please only add data you are entitled to use.
If you create an account, we process:
You can sign in with an email magic link and/or with email + password. Password registration and login are available in the native apps; magic links remain available for passwordless access and account recovery. We do not store plaintext passwords.
Your chart library is stored locally on your device using IndexedDB (via Dexie). This local library can include birth data, chart results, notes, and backups you create. Data in IndexedDB remains on your device unless you sync to the cloud, export it, or clear app/browser storage.
We do not access your local IndexedDB remotely. Clearing site data or uninstalling the app may permanently delete local copies.
When you are signed in, we may store copies of your charts, notes, folders, preferences, and related content on our servers (Cloudflare D1 and related infrastructure) so you can access them across devices and restore after reinstall. See our Data Retention Policy for how long we keep server data.
We automatically collect limited technical information, such as:
If you use optional AI features (for example chart Q&A or group narration), we process the question or prompt you submit and chart-derived context needed to answer (such as type, profile, centers, channels, gates, and related calculated fields). That content is transmitted to our AI processor (xAI) solely to generate the response.
We use personal data to:
We do not sell your personal data.
Where the GDPR or UK GDPR applies, we rely on:
| Purpose | Legal basis |
|---|---|
| Providing the Service you request (charts, library, sync) | Performance of a contract |
| Subscriptions & billing | Performance of a contract; legal obligation (tax/accounting) |
| Security, abuse prevention, service logs | Legitimate interests |
| Marketing emails (if any, opt-in) | Consent |
| Retention beyond deletion where law requires | Legal obligation / legitimate interests |
We share data only with service providers that help us run the Service, under contracts that require appropriate safeguards:
We may also disclose information if required by law, to protect rights and safety, or in connection with a merger or asset sale, subject to this policy.
We and our processors may process data in the European Union, United States, and other countries. Where required, we use appropriate safeguards such as the EU Standard Contractual Clauses or equivalent mechanisms for transfers outside your country.
Server-held account and chart data is retained while your account is active unless you request deletion. Detailed schedules—including logs, backups, and payment records—are in our Data Retention Policy.
Local IndexedDB data is controlled by you on your device and is not deleted when you request server deletion unless you also clear local storage.
Depending on where you live, you may have the right to:
To exercise these rights, email [email protected] from your registered account email. We may need to verify your identity. We respond within the timeframes required by applicable law (generally within 30 days under GDPR).
You may request deletion of server-held personal data by:
We acknowledge verified requests within 14 business days and complete deletion within 120 calendar days, as described in our Data Retention Policy and Delete Account page. Deletion is irreversible.
Some data may be retained where required by law, for fraud prevention, or in encrypted backups for a limited period as disclosed in the Data Retention Policy.
The Service is not directed to children under 16 years of age (or the minimum age required in your country). We do not knowingly collect personal data from children without appropriate parental authority.
If you believe a child has provided us personal data without consent, contact [email protected] and we will take appropriate steps to delete it.
We use technical and organizational measures appropriate to the sensitivity of birth and account data, including encryption in transit (HTTPS/TLS), access controls, and infrastructure monitoring. No method of transmission or storage is 100% secure; you use the Service at your own risk.
California residents may request access to, correction of, or deletion of personal information, and may opt out of “sale” or “sharing” as defined by California law. We do not sell personal information. Submit requests to [email protected]. We will not discriminate against you for exercising privacy rights.
We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date. Continued use after changes take effect constitutes acceptance where permitted by law.
Questions about this policy: