Privacy Policy

The details you enter

We collect your email address, your name at birth including any middle names, your date of birth and your place of birth. We also store your answers to the ten assessment questions and the readings generated from them.

If you sign in with Google we receive your email address and basic profile information from Google. We do not receive your Google password.

We do not ask for and do not want information about your health, your beliefs, your ethnicity, your sexual life or any other special category of personal data. Please do not enter it.

Purpose and legal basis

Your birth details and answers exist for one reason: to generate and display your readings. We rely on the performance of our contract with you as the legal basis, because without this information there is no service to provide.

We use your email address to run your account, to verify it and to send messages necessary to the service. We do not sell your data, and we do not share it with advertisers.

Generating a reading involves automated processing of the details you provide. It has no legal effect on you and produces no decision about you: it produces text for you to read.

Storage and access

Data is stored in the European Economic Area with our infrastructure provider. Access is restricted at the database level so that your records can only be read by your own account.

We use processors to host the site, run the database, send email and generate readings. They act on our instructions and are bound to protect your data.

Retention

We keep your account data for as long as your account exists. When you close your account we delete your profile, answers and readings. Backups are overwritten on a rolling basis and are fully cleared within 90 days.

What you can ask for

Under UK data protection law you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our use of it, and ask for it in a portable format. You can exercise most of these directly in your account, and you can ask us for the rest.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

What we set, and why there is no banner

We set only the cookies needed to keep you signed in and to keep the service secure. We do not use advertising cookies, we do not run analytics, and we do not track you across other websites.

Under the Privacy and Electronic Communications Regulations, consent is not required for cookies that are strictly necessary to deliver a service you have asked for. Ours are, which is why you are not asked to click through a banner. If we ever add anything beyond that, we will ask first.

Signing you in sets a session cookie and a refresh token so you are not asked for your password on every page. Clearing them signs you out. Nothing else is stored on your device.

Getting in touch

For any question about your data, or to make a request under the rights above, contact us at hello@inloraapp.com.

How your records are protected

Access is enforced inside the database itself rather than only in application code, so a record can only be read by the account it belongs to. Passwords are stored as salted hashes and are never visible to us. Traffic is encrypted in transit.

No system is perfect. If a breach ever affects your data and presents a risk to you, we will tell you and the Information Commissioner's Office within the timescales the law requires.

Where data may travel

Your records are held in the European Economic Area. Some processors we rely on may handle data outside the UK and the EEA. Where that happens we rely on the safeguards UK data protection law provides for international transfers, including approved contractual clauses.

Age

Inlora is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child has created an account, write to us and we will delete it.

Updates to this policy

We may update this policy. The date at the top shows when it last changed, and where a change is significant we will tell you before it takes effect.

What we hold, and where it came from

Identifiers: your email address and the name you were given at birth. Birth details: your date of birth, your place of birth and, if you choose to give it, your time of birth.

Your responses: the ten answers you select. Generated content: the readings written for you and the shorter readings for the year, month and week. Technical records: sign in times and security logs.

All of it comes from you, apart from the email address and basic profile we receive from Google if you choose to sign in that way, and the technical records the service creates as you use it.

Readings are generated, not decided

Your readings are produced automatically from the details you enter, by a fixed set of rules running on our own servers. Nobody reads your answers and writes a reading by hand, and no artificial intelligence service is involved.

This processing produces text for you to read. It does not produce a decision about you, it has no legal effect, and it is not used to grant or refuse you anything. If you want a human to look at how a reading was produced, write to us and we will.

Processors

We use a small number of companies to run the service: a hosting provider for the website, a database and authentication provider for your account, and an email provider for verification and account messages.

Your readings are produced on our own servers. Your details are not sent to any artificial intelligence service, and no third party sees them in order to write your reading.

Our processors act only on our instructions and cannot use your data for their own purposes. We do not sell your data, we do not share it with advertisers, and we do not use it to train models.

Transfers of the service

If the service is ever transferred to another operator, your data may transfer with it. If that happens we will tell you first, and the new operator will be bound by protections at least as strong as these.

What we will and will not send

We send messages needed to run your account: verification, password resets, security notices and important changes to these policies. You cannot opt out of those while you have an account, because without them the account cannot be operated safely.

We will not send marketing email unless you ask for it, and if you do, every message will carry a way to stop it.