PRIVACY POLICY

Pythia Pili — pythiapili.eu

This Privacy Policy describes how the sole proprietorship Chrysoula Kefala — VITA FORCE (hereinafter “we”, “us”, “the Business”) collects, uses, and protects your personal data when you visit or use the Pythia Pili platform (pythiapili.com and pythiapili.eu, hereinafter “the Platform”).

This Policy complies with the EU General Data Protection Regulation (EU 2016/679 — GDPR) and Greek law 4624/2019.

1. Data Controller

Business name: Chrysoula Kefala — VITA FORCE
Activity: Educational and Consulting Services
Registered address: 2 Konstantinou Karamanli St., Melissia 15127, Attica, Greece
Tax ID (AFM): 045128746 — Tax Office: KEFODE Attica
Contact email: pythiapili@gmail.com

2. What data we collect

2.1 Data you provide directly

• Email address — when you register as a “Friend” or purchase a subscription
• Age — confirmation that you are 18+ and personalization of prophecies
• Billing information — name, address, VAT number (only for users requesting an invoice)
• Oracle questions and follow-ups — transmitted to the AI system for processing
• Figure and zodiac selection — as declared in the prophecy form
• Newsletter email — if you provide explicit consent via a separate checkbox

2.2 Data collected automatically

• IP address — stored encrypted (SHA-256 hash) for abuse prevention
• Browsing cookie (pythia_anon) — random identifier for tracking free uses
• Login cookie (pythia_friend) — only for logged-in users, signed with HMAC
• Browser fingerprint (user-agent hash) — for account security
• Google Analytics 4 data — only if you provide consent via the cookie banner

2.3 Payment data

We never store credit card details. All payments are processed through Stripe (PCI-DSS Level 1 certified). From Stripe we receive only: transaction ID, amount, country, status. See the Stripe Privacy Policy.

3. Purpose of processing

Data	Purpose	Legal basis
Email	Login via magic link	Contract
Age, zodiac, question	Provision of prophecy	Contract + Consent
IP hash, cookie	Abuse prevention	Legitimate interest
Billing details	Issuance of invoices	Legal obligation
Transaction data	Subscription management	Contract
Newsletter email	Sending newsletters	Consent
Google Analytics	Usage statistics	Consent

4. Whom we share your data with

We never sell your data. We share it exclusively with the following data processors:

• Anthropic PBC (USA) — processing of oracle questions through the Claude AI. Your question is transmitted instantaneously and is not stored on our servers. Privacy Policy. Transfer outside the EU is covered by Standard Contractual Clauses (SCCs).
• Stripe Payments Europe Ltd (Ireland) — payment processing
• Elorus (Theofilopoulou 13, Athens 11743, Greece — VAT 800585687) — issuance and delivery of electronic invoices
• Elorus Fuse → Greek Tax Authority (myDATA) — transmission of tax information (legal obligation)
• SiteGround (6 Olimpiyska St, Sofia 1166, Bulgaria/EU) — Platform hosting
• Google Ireland Ltd (Ireland) — Google Analytics 4, only after consent
• Google Workspace (SMTP) — sending confirmation emails and receipts

Data may be disclosed to public authorities only if required by law (e.g. tax audit, court order).

5. How long we keep the data

• Friend account / Subscription: for the duration of the relationship + 5 years after the last activity
• Oracle questions: not stored in our database after the prophecy is delivered — only transmitted instantaneously to Anthropic
• Tax invoices: 10 years (legal obligation)
• IP hashes: 90 days
• Cookies: up to 1 year (pythia_anon), 30 days (pythia_friend)
• Newsletter email: until consent is withdrawn

6. Your rights (GDPR)

You have the following rights. Exercise them by emailing pythiapili@gmail.com:

• Right to information — through this Policy
• Right of access — to know what data we hold about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure (“right to be forgotten”) — to request deletion of your account, subject to tax obligations
• Right to restriction — to request temporary suspension of processing
• Right to data portability — to receive your data in a readable format
• Right to object — to object to processing based on legitimate interest
• Right to withdraw consent — where processing is based on consent (newsletter, analytics cookies)

We respond to requests within 30 days. If you are not satisfied, you may file a complaint with the Hellenic Data Protection Authority (HDPA) — 1-3 Kifissias Ave., 11523 Athens, or with the data protection authority of your country of residence.

7. Security

We implement technical and organizational measures to protect your data:

• All communication is via HTTPS (TLS 1.3)
• No passwords are stored — we use passwordless magic link authentication
• Cookies are signed with HMAC and are httpOnly
• IP addresses are stored only as encrypted hashes
• Database backups are encrypted, daily frequency
• Data access is restricted to authorized personnel only

8. Cookies

We use two categories of cookies:

Strictly necessary cookies (no consent required):

• pythia_anon — for tracking free uses (duration: 1 year)
• pythia_friend — for maintaining login session (duration: 30 days)
• pythia_age_asked — stored locally (localStorage) so the age is not requested again
• pp_lang — language preference

Analytics cookies (require explicit consent via cookie banner):

• Google Analytics 4 (_ga, _ga_*) — anonymized usage statistics. Not used for advertising. You may withdraw consent at any time by clearing browser cookies.

We do not use advertising cookies or third-party tracking beyond Google Analytics.

9. Newsletter

If you provide explicit consent via a separate (non pre-ticked) checkbox during registration, you will receive newsletter communications about the Platform. You may unsubscribe at any time via the “unsubscribe” link in every email or by emailing pythiapili@gmail.com.

10. Children and minors

The Platform is intended exclusively for adults (18 years and over). We do not knowingly collect data from minors. If a minor is found to have created an account, it will be deleted immediately.

11. Changes to this Policy

We may update this Policy. Significant changes will be announced via email to registered users at least 30 days before they take effect.

12. Contact

For any question regarding this Privacy Policy or data protection:

📧 pythiapili@gmail.com