Privacy Policy

Nataly Popovych | natalypopovych.com · Last updated: November 9, 2026

Your privacy matters to me. This Privacy Policy explains what personal information I collect through natalypopovych.com, why I use it, who may process it on my behalf, how long I keep it, and how you can exercise your rights.

1. Who is responsible for your data

The data controller is Nataliia Popovych, an individual entrepreneur (sole proprietor, FOP) registered in Ukraine under the name ФОП Попович Наталя Анатоліївна (FOP Popovych Nataliia Anatoliivna), operating the Nataly Popovych website.

For any privacy request, contact [email protected].

2. Information I collect and why

A. Free Human Design chart

When you request a free chart, you enter your date, time and place of birth. I use these details to calculate your Human Design chart and display its results. Your name and email address are not required for this step.

Purpose: provide the chart you request.
Legal basis (where the GDPR applies): Article 6(1)(b), taking steps to provide the service at your request.

The server may keep a chart calculation associated with your birth details, without your name or email address, to avoid recalculating the same chart. Charts not linked to a requested PDF are scheduled to be deleted after 30 days. Birth details and calculated charts may still be personal data, even without your name.

B. Free PDF reading

If you ask for a PDF reading by email, I process your email address, your first name if you choose to provide it, your chart and the information needed to create and deliver your reading.

Purpose: prepare and email the requested PDF reading.
Legal basis: Article 6(1)(b), providing the requested service. Where a separate consent is requested, I also record that consent and use it for the specific purpose stated beside the checkbox.

Your PDF request is not an automatic subscription to marketing emails.

C. Tali waitlist and optional updates

If you join the Tali waitlist, I use your email address to notify you about Tali's availability. If you separately choose to receive other updates, I may also send news about Tali and new readings.

Purpose: send the notifications you requested.
Legal basis: Article 6(1)(a), your consent. You can withdraw it at any time by replying unsubscribe to an email or contacting [email protected].

D. Questions, bookings and personal services

If you contact me by email or through a linked messaging or booking service, I may receive your name or account name, contact details, messages, requested service, booking information, and any birth information or other details you choose to share for a personal reading, couple or family reading, or mentoring.

Purpose: respond to your inquiry, arrange and provide the service, and manage necessary service records.
Legal basis: Article 6(1)(b), steps requested before a contract or performance of a contract. Where recordkeeping is legally required, Article 6(1)(c) may apply.

Please do not send medical records or other highly sensitive information through the website's general contact channels. If sensitive information is necessary for a service, I will explain why it is needed and obtain any additional consent required by law before processing it. Human Design services are not medical or psychological treatment.

If a booking or payment service is introduced or changed, this Policy will be updated to identify the relevant provider and data processing before it is used.

E. Consent records and security

When you check a consent box, I may retain a record of the consent text and version, timestamp, and information needed to link the consent to your request, so I can demonstrate and manage your preferences.

Purpose and legal basis: compliance with applicable data protection obligations, Article 6(1)(c), and, where relevant, my legitimate interest in demonstrating responsible handling of requests, Article 6(1)(f).

To protect the site against misuse, the server may temporarily process your IP address to limit repeated requests. Under the current configuration, this rate-limiting record is held in server memory for up to one hour and is not saved in the application database. Hosting and infrastructure providers may maintain technical logs under their own retention settings.

Purpose and legal basis: keeping the service available and secure, Article 6(1)(f), legitimate interests.

3. Cookies, analytics and browser storage

At the date of this Policy, the website does not intentionally use advertising or analytics trackers. It uses session storage in your browser to display your chart on the results page. This browser storage is generally cleared when the browser session ends.

Infrastructure and embedded third-party services may use technologies necessary for their own operation. If I add nonessential cookies, analytics, advertising pixels or new embedded tracking services, I will update this notice and implement any consent controls required by applicable law before activating them.

4. Service providers

I use technical providers to operate the website and deliver requested features. Depending on which feature you use, these may include:

  • Cloudflare: website and domain infrastructure, and email forwarding.
  • Render: hosting of the application server and database; the database is configured in Frankfurt, Germany.
  • Total Human Design: calculation of Human Design charts using birth details.
  • Photon by komoot: suggestions for city names entered in the place-of-birth field. The search request contains the text typed in that field.
  • Resend: delivery of PDF emails and other requested messages.
  • LiqPay (JSC CB PrivatBank, Ukraine): processing of payments for paid readings. Card details are entered on the LiqPay page and are not received or stored by me. I receive the payment status, amount and order details.

I share with each provider only the information reasonably necessary for the relevant function. These providers may use their own subprocessors and infrastructure, subject to their applicable terms and data protection arrangements.

If you use an external YouTube, WhatsApp, Telegram or other linked service, the provider of that service may also process your data under its own privacy policy. Simply following an external link takes you to a separate service.

5. International data transfers

I am registered as a sole proprietor in Ukraine, while parts of the website infrastructure operate in the European Economic Area (EEA). Some service providers or their subprocessors may process personal data outside the EEA, including in the United States. Access to data from Ukraine may also involve international processing or transfer considerations.

Where the GDPR applies and a transfer of personal data from the EEA to a country without an EU adequacy decision occurs, I must use an applicable legal transfer mechanism and safeguards, such as the European Commission's Standard Contractual Clauses where appropriate, or another valid mechanism. The EU-U.S. Data Privacy Framework applies only to U.S. recipients with an active, relevant certification; it must not be assumed to cover every provider.

You may contact [email protected] to request further information about the safeguards applicable to your data.

6. How long I keep personal data

  • Chart calculations without a PDF request: up to 30 days.
  • PDF request, emailed reading, and its associated chart: until you request deletion, or up to 24 months after your last relevant contact, whichever occurs first, unless a longer period is legally required.
  • Tali waitlist and optional news subscriptions: until you unsubscribe or the list is discontinued, subject to any limited records needed to honor your preference.
  • Consent and opt-out records: for as long as reasonably necessary to demonstrate the consent or comply with an applicable legal obligation.
  • Booking inquiries, communications and service records: only as long as necessary for the service, follow-up, dispute handling and applicable recordkeeping requirements.
  • Temporary application rate-limit records: up to one hour in memory, without excluding infrastructure logs held separately by the relevant hosting provider.

When information is no longer required, I delete it or take reasonable steps to de-identify it. Copies in backups may remain temporarily under applicable backup cycles.

7. Your rights

Depending on the law that applies to you, you may have the right to:

  • request access to your personal data;
  • correct inaccurate information;
  • request deletion of information;
  • restrict or object to certain processing;
  • receive personal data in a portable format where applicable;
  • withdraw consent at any time, without affecting processing already carried out lawfully; and
  • lodge a complaint with a relevant data protection supervisory authority.

To exercise a right, email [email protected]. I may need reasonable information to verify your identity before sharing or deleting data. Where the GDPR applies, I normally respond within one month, subject to lawful extensions.

If you are in Sweden, you can contact the Swedish Authority for Privacy Protection (IMY) at imy.se. You may also contact the competent authority in your own country.

8. Children and family readings

This website is intended for people aged 16 or older. It is not intended for children under 16 to independently create accounts, submit personal details or request services.

An adult parent or legal guardian may request a reading concerning their child, but must have the legal authority to provide the child's information. I process a child's birth details only for the specific reading requested by the responsible adult and do not use them for marketing to children.

If you believe a child has submitted personal data without appropriate authorization, please contact [email protected] so I can review and, where required, delete it.

9. Automated chart calculation

The chart generator automatically produces Human Design information from birth details. This is a self-exploration feature, not a medical diagnosis, psychological assessment, credit decision, employment decision, or other decision intended to have legal or similarly significant effects on you.

The generated descriptions are informational and reflective. You decide whether they are useful to you. Human Design is not a scientifically validated method for diagnosing health conditions or determining a person's abilities or future.

10. Data security

I take reasonable technical and organizational measures to protect personal data, including using access controls and selecting providers for the relevant services. However, no online service can guarantee complete security.

11. Changes to this Policy

I may update this Policy when the website, its providers, or legal requirements change. The updated version and its effective date will appear on this page. Where required, I will provide additional notice or request renewed consent.

12. Contact

Nataliia Popovych
Sole proprietor registered in Ukraine: ФОП Попович Наталя Анатоліївна
Website: https://natalypopovych.com
Email: [email protected]