Layla is an astrology reading service available at hilayla.co, as an installable web application, and through related pages, notifications, emails and social-media accounts (together, the Service). In this policy, Layla, we, us and our refer to the operator of the Service, and you refers to any person who visits, uses, or provides information to the Service.
This Privacy Policy explains what information we collect, why we collect it, how we use it, when we share it, how long we keep it, how we protect it, and the choices and rights you have. It applies to every part of the Service, whether you arrive as an invited guest with a password, as a free visitor using the sun-sign reveal, as a signed-in account holder, or as a paying member of Layla’s Circle.
This policy forms part of, and should be read together with, our Terms of Service. Capitalised terms that are not defined here have the meaning given to them in the Terms. By using the Service, ticking the consent box at the door, creating an account, or continuing to use the Service after being shown this policy, you acknowledge that you have read and understood it and you agree to the collection, use, disclosure and other processing of your information as described here. If you do not agree, please do not use the Service.
Every reading is built from computations and from text written by machine-learning models on the basis of your Birth Data and Life Data. This Derived Data is stored so that you do not have to wait for the same reading twice, so that we can review quality, and for the purposes described in sections 4 and 5. Derived Data can reveal a great deal about a person; we treat it with the same care as the information it was derived from while it remains linked to you.
We receive limited information from the services we rely on: sign-in providers (Google, our authentication provider) confirm your email and give us an account identifier; our payment processor tells us about the state of your subscription and purchases; our hosting provider gives us approximate location and device signals; our email provider tells us whether a message was delivered. We may also receive public information from social platforms when you interact with our accounts there.
Layla does not ask for, and asks you not to provide, government identification numbers, financial account numbers (other than through Stripe), precise health records or biometric data. Because Layla is an astrology service, your use of it, and the things you tell it, may reveal or allow inferences about your beliefs, relationships, sexual orientation, health, or other matters that some laws treat as sensitive. By ticking the consent box and using the Service you give your explicit consent to our processing of that information as described in this policy. You may withdraw that consent at any time as described in section 16, though the Service cannot function without Birth Data.
We use the information we collect for the following purposes, which apply to Personal Information; section 5 explains what we do once information has been de-identified or aggregated.
This section matters, so please read it carefully.
5.1 What we do. We may create De-identified Data and Aggregated Data from any information we hold, including Birth Data, Life Data, Derived Data, Usage Data and correspondence. To do so we remove or replace direct identifiers (such as names, email addresses, phone numbers, account identifiers, payment identifiers and full network addresses), we may generalise or perturb values that could single someone out (for example rounding a birth place to a region, or shifting dates), we separate the result from any key that would allow it to be re-linked to you, and we apply technical and organisational safeguards against re-identification.
5.2 How we use it. Once information has been de-identified or aggregated it is no longer Personal Information, and we may use, analyse, copy, store, combine, publish, license, sell, share and otherwise exploit it, for any lawful purpose whatsoever, without further notice to you and without compensation, in perpetuity. Those purposes include, without limitation:
5.3 Our commitments. We commit that we will (a) maintain and use De-identified Data only in de-identified form, (b) not attempt to re-identify it, except to the extent necessary to test whether our de-identification is effective, (c) contractually require anyone we share it with to honour the same commitments, and (d) publicly commit to these obligations, which we do here. Where a law defines de-identified data or requires particular measures, we intend this section to satisfy that definition and those measures.
5.4 Research and development on identifiable data. Much research and development work is more valuable before records are de-identified, for example checking that a reading matched the life events a reader confirmed, measuring how timing predictions performed against real lives, studying which questions people ask and how readings land, or training and evaluating models on complete records. You agree that we, our affiliates, our contractors, and research and development partners working under written confidentiality and data-protection obligations may use your identifiable Birth Data, Life Data, Derived Data and Usage Data for all of the purposes in section 4 and this section, under access controls. We do not sell identifiable Personal Information, and anything we publish, license or sell is first de-identified or aggregated.
5.5 Your acknowledgment. By using the Service you acknowledge that you have read this section and that you agree that we may use your information for research and development as described in sections 4 and 5, and may create and use De-identified Data and Aggregated Data without restriction. These rights are perpetual and survive the closure of your account. Deleting your account or Personal Information does not require us to delete De-identified Data or Aggregated Data, because it is no longer linked to you, nor to retrain or unwind models, rules or products already built with your data, because your data is no longer separable from them.
Layla’s calculations are deterministic and run on our own servers. The written readings, letters, portraits, answers and translations are produced by large language models operated by third-party providers (at the time of writing, Google’s Gemini models). To produce them we send the provider a description of your chart, computed timings, your confirmed and unconfirmed life events, your relationship status, your questions and, for Loved Ones, the other person’s chart and relationship to you. We do not send the provider your name, email address or payment details as part of a reading request. Providers process this information under their own terms and privacy commitments for API customers, which at the time of writing state that data submitted through their paid API is not used to train their general models; we choose providers on that basis. Model output is stored by us as Derived Data.
Machine-generated text can be wrong, incomplete or inappropriate. Readings are for reflection and entertainment and are not professional advice of any kind; see the Terms of Service. Decisions about you are not made solely by automated means in a way that produces legal or similarly significant effects on you.
Where the law of your country requires us to have a legal basis for processing Personal Information (for example in the European Economic Area, the United Kingdom, Switzerland, Brazil and some other places), we rely on the following:
We do not sell Personal Information, and we do not share it with third parties for their own marketing. We share Personal Information in the following circumstances:
Content you choose to share (for example the share cards) becomes visible to whoever you share it with and to any platform you post it on, under that platform’s terms.
Loved Ones and some questions let you enter Birth Data and other details about people other than yourself, such as a partner, parent, child, friend or colleague. When you do this you are responsible for it. You confirm that you have the right to give us that information, that where the law requires it you have told the person and obtained their permission, and that you will not enter information about someone who has asked you not to. We process information about other people only to produce the readings you request and for the purposes in sections 4 and 5, and we treat it under this policy. If you believe someone has entered information about you into Layla without a proper basis, contact us and we will help.
Layla uses your browser’s local storage, session storage and, where you install the app, a service-worker cache, rather than traditional tracking cookies. These hold: your sign-in token; your profile and Birth Data so you do not have to type them again; recent readings so they load instantly; your Loved Ones list; your language, display, notification and consent preferences; your random client and session identifiers; the tag in the link you arrived by; and cached application files. This storage lives only in your browser. You can clear it at any time from your browser settings or by using Sign out, which removes the sign-in token and profile; doing so means you will need to enter your details again. Our service providers may set strictly necessary cookies for security and load balancing. We do not use advertising cookies or third-party analytics trackers on the Service. Because we do not currently use cross-site tracking, the Service does not respond differently to “Do Not Track” signals; see section 17 for opt-out-preference signals.
If you turn on the morning bell, your browser gives us a push subscription which we store together with your Birth Data and time-zone so that we can send you one line each morning. You can turn notifications off at any time in your browser or device settings, and we will delete the subscription when it stops working. If you give us an email address we may send you service messages that are necessary to run the Service; you cannot opt out of those while you have an account. Where we send marketing or news by email, every message will contain a way to unsubscribe. We may contact you at a phone number you save only for the purpose you saved it for, and will ask for your agreement before using it for anything else.
Payments are processed by Stripe, Inc. and its affiliates under Stripe’s own privacy policy. When you start a checkout we pass Stripe a random reference for your account so that the purchase can be tied back to you, and Stripe returns the outcome to us through signed webhooks. We keep the transaction and subscription records described in section 3.1 for as long as tax and accounting rules require. You can manage or cancel a subscription from your profile, which opens Stripe’s billing portal.
We keep Personal Information for as long as needed for the purposes described in this policy, and then delete or de-identify it. In general:
Backups may hold copies for a limited period after deletion. De-identified Data and Aggregated Data may be kept indefinitely.
We use administrative, technical and physical safeguards designed to protect information against loss, misuse, unauthorised access, disclosure, alteration and destruction. These include encryption of data in transit (TLS), encryption at rest by our hosting and database providers, signed and time-limited session tokens, hashed passwords and invitation codes, server-side verification of memberships and purchases, request rate-limiting, strict browser security headers, least-privilege access to production systems, and separation of development and production data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password, invitation codes and devices secure. If you believe your access to Layla has been compromised, contact us at once.
Layla is operated from the United States, and our service providers run infrastructure in the United States and in other countries. If you use the Service from elsewhere, your information will be transferred to, stored and processed in the United States and those other countries, whose privacy laws may differ from those of your country. Where required, we rely on recognised transfer mechanisms such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, or your explicit consent. You can ask us for more information about the mechanism that applies to you.
Depending on where you live, you may have some or all of the following rights in relation to your Personal Information. We extend the substance of these rights to everyone who uses Layla, wherever they live, as a matter of practice.
How to exercise these rights. Email us at the address in section 22 from the email address linked to your account, or, if you use Layla without an email, tell us the birth date, time and place you entered and roughly when you used the Service, so that we can locate your records. We may ask for additional information to verify that you are the person the records belong to, or an authorised agent acting for them; we will use that information only for verification. We will respond within the time the law requires, normally within thirty days, and will tell you if we need longer. Requests are free, unless they are manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or decline. You may also clear the information stored in your browser at any time as described in section 10, turn off notifications in your device settings, and manage your subscription from your profile.
This section supplements the rest of the policy for residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and any other state with a comprehensive privacy law, to the extent those laws apply to us.
Categories of Personal Information collected and disclosed. In the preceding twelve months we have collected the following categories, from the sources and for the purposes described in sections 3 and 4, and disclosed them to the categories of service providers described in section 8 for business purposes: identifiers (email, account identifiers, client and session identifiers, IP address); personal records (name or label, phone number, payment information held by Stripe); characteristics of protected classifications that may be inferred from Birth Data and Life Data (such as age, and possibly religion, sexual orientation or family status where you tell us about them); commercial information (purchases and subscriptions); internet and network activity (Usage Data); geolocation (approximate, from IP; and birth place); inferences (Derived Data); and sensitive personal information as described in section 3.5. We do not collect biometric, genetic, or precise real-time geolocation data, or the contents of your private communications other than your messages to us and to Layla.
Sale and sharing. We do not sell Personal Information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding twelve months. We have no actual knowledge that we sell or share the Personal Information of anyone under sixteen. Because we do not sell or share, there is no “Do Not Sell or Share” choice to make; if that changes we will update this policy and honour opt-out-preference signals such as Global Privacy Control.
Sensitive personal information. We use sensitive personal information only to provide the Service you ask for, to secure it, to perform the research described in section 5 in de-identified form, and as otherwise permitted by law; we do not use it to infer characteristics for advertising. Where a state gives you the right to limit our use of sensitive information beyond those purposes, you may exercise it by contacting us.
Your rights. You have the rights described in section 16, including the right to know, access, correct, delete, and obtain a portable copy, and the right to appeal a decision we make on a request by replying to our response; if we deny your appeal, you may contact your state attorney general. An authorised agent may make a request on your behalf if they give us written permission from you and we can verify your identity.
Financial incentives. Free readings and trial access are offered to everyone on the same basis and are not a financial incentive in exchange for Personal Information.
Nevada. We do not sell covered information as defined by Nevada law.
For readers in the European Economic Area, the United Kingdom and Switzerland, Layla is the controller of your Personal Data. The legal bases are described in section 7. Special-category data (which may include beliefs, health, sex life or sexual orientation, where you reveal them or they can be inferred) is processed on the basis of your explicit consent given at the door and, in de-identified form, for scientific, statistical and research purposes with appropriate safeguards. You have the rights in section 16 under the GDPR and the UK GDPR, and you may complain to your local data-protection authority; a list of EEA authorities is at edpb.europa.eu, the UK authority is the Information Commissioner’s Office at ico.org.uk, and the Swiss authority is the FDPIC at edoeb.admin.ch. Providing Birth Data is a requirement of the contract because the Service cannot work without it; all other information is optional. Transfers outside the EEA, UK and Switzerland are described in section 15. We have not appointed a representative in the EEA or UK; requests can be sent to the contact in section 22.
The Service is for adults. You must be at least eighteen years old, or the age of majority where you live if that is higher, to use Layla. We do not knowingly collect Personal Information from anyone under eighteen. Birth Data entered about a Loved One who is a child is entered by the adult who is responsible for that person and is processed only to produce the reading that adult requests. If you believe a person under eighteen has used the Service or that we hold their information, contact us and we will delete it promptly.
The Service may link to, or let you share with, websites, apps and platforms we do not control, such as Instagram, Google, Apple, and Stripe’s checkout pages. This policy does not apply to them. Their collection and use of your information is governed by their own policies, which we encourage you to read.
We may change this policy from time to time. When we make a change we will update the effective date and version at the top of the page. If a change materially reduces your rights or materially expands how we use Personal Information already collected, we will give you notice in the Service, by email where we have one, or by another reasonable means, before the change takes effect, and where the law requires it we will ask for your consent again. Your continued use of the Service after a change takes effect means you accept the updated policy. Previous versions are available on request.
Questions, requests and complaints about privacy can be sent to hilayla.app@gmail.com with the word “Privacy” in the subject line. Please include enough detail for us to understand and act on your request. We aim to reply to every message within a few business days.