Privacy Policy

Last updated: March 1, 2026

Karma Speaks, operated by Meganathan Gnanamani (“we,” “us,” “our”), is committed to protecting your personal data. This policy explains what we collect, why we collect it, and your rights over it. It applies to all visitors and clients of karmaspeaks.com.

For clients in the European Economic Area (EEA) and UK, this policy is designed to comply with the General Data Protection Regulation (GDPR). For clients in India, this policy aligns with the Digital Personal Data Protection Act, 2023 (DPDPA).

1. Information We Collect

Birth & Personal Details

• Full name, email address, and phone number (provided during booking)
• Date of birth, time of birth (optional), and place of birth — required for astrological analysis
• Consultation preferences and notes you share with us
• Geographic coordinates of birth place (derived from place name via OpenStreetMap Nominatim)

Payment Information

• We do not store card numbers, UPI IDs, or bank details. All payment data is handled directly by Razorpay or PayPal under their respective privacy policies.
• We retain payment confirmation records including transaction IDs, amounts, and gateway references for accounting and dispute resolution.

Usage Data

• IP address, browser type, and device information
• Pages visited, time on site, and referral source (via Google Analytics 4)
• Currency preference cookie (INR or USD, set for 1 year based on your location)

2. How We Use Your Information

• Delivering consultations: Your birth data is used solely to prepare and conduct your astrological consultation.
• Booking management: Name, email, and booking reference are used to schedule your session and send confirmation and reminder emails.
• Communication: We send transactional emails (booking confirmation, session links, report delivery) via Resend from mail.karmaspeaks.com.
• Payment processing: Order amounts and booking details are shared with your chosen payment gateway to process your transaction.
• Analytics: Aggregated, anonymised usage data helps us improve our website and services.
• Legal compliance: We retain records as required by Indian accounting and tax laws.

3. Legal Basis for Processing (GDPR)

For clients in the EEA and UK, our legal bases for processing are:

• Contract performance: Processing necessary to deliver your booked consultation.
• Legitimate interests: Website analytics, fraud prevention, and service improvement.
• Legal obligation: Retention of financial records for statutory periods.
• Consent: Non-essential cookies (analytics, preference) are set only with your consent, which you may withdraw at any time.

4. Sharing Your Data

We do not sell your personal data. We share it only with:

• Razorpay: For Indian payment processing. Razorpay Privacy Policy.
• PayPal: For international payment processing. PayPal Privacy Policy.
• Resend: Email delivery infrastructure. Data processed under their DPA.
• Google Analytics: Anonymised usage data only, with IP anonymisation enabled.
• Legal authorities: Where required by law or to protect our legal rights.

5. Data Retention

• Consultation records (birth data, session notes, reports): Retained for 7 years to support follow-up consultations and statutory compliance.
• Payment records: Retained for 7 years per Indian accounting requirements.
• Marketing preferences: Until you unsubscribe or withdraw consent.
• Analytics data: Retained for 26 months per Google Analytics default, then automatically deleted.

You may request earlier deletion of your personal data. See “Your Rights” below.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data (“right to be forgotten”), subject to legal retention obligations.
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request that we limit how we process your data while a dispute is pending.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent for cookie-based tracking at any time.

To exercise any right, email our Data Protection Officer at dpo@karmaspeaks.com. We will respond within 30 days. EEA/UK clients may also lodge a complaint with their local supervisory authority.

7. Cookies

We use essential, functional, and analytics cookies. Analytics cookies are not set until you provide consent via our cookie banner. Full details are in our Cookie Policy.

8. Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encrypted data transmission (HTTPS/TLS) across all pages
• Database access restricted by Row-Level Security policies (Supabase)
• Payment data never stored on our servers — tokenised and handled by PCI-DSS compliant processors
• Access to production data limited to authorised personnel only

No method of transmission or storage is 100% secure. In the event of a data breach affecting your rights, we will notify you within 72 hours as required by GDPR.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor's data has been submitted, contact us immediately at support@karmaspeaks.com for prompt deletion.

10. International Transfers

Our primary infrastructure is hosted in the United States (Supabase, Vercel). By using our services, you consent to the transfer of your data to these regions. We rely on Standard Contractual Clauses (SCCs) where required for GDPR compliance.

11. Contact & Data Protection Officer

For general privacy enquiries: support@karmaspeaks.com

For data subject rights requests: dpo@karmaspeaks.com

Karma Speaks — operated by Meganathan Gnanamani, Bangalore, Karnataka, India.