This Privacy Policy explains what personal data Alpha & Omega Sacred Frequencies collects, why we collect it, how we protect it, and how you can exercise your privacy rights under Brazil’s LGPD, the European Union/UK GDPR, and California’s CCPA/CPRA. We collect only what the site needs to serve you.
1. Who we are
Alpha & Omega Sacred Frequencies (“Alpha & Omega”, “we”, “us”) is based in Feira de Santana, State of Bahia, Brazil. We are the data controller responsible for the personal data described in this policy.
Privacy & Data Protection Contact (Encarregado / DPO): Data Protection Officer (Encarregado LGPD / GDPR Privacy Contact) — [email protected].
2. The data we collect
When you create or sign in to an account
- Email & Password Accounts: your name, email address, email confirmation status, and a one-way cryptographic hash of your password (
scryptwith a unique per-user random salt). We never store plaintext passwords. - Sign in with Google or Apple (OAuth 2.0 / OpenID Connect): if you choose “Continue with Google” or “Continue with Apple”, we receive your verified email address, display name, unique provider identifier, and optional profile avatar URL from Google or Apple to create or sign in to your account without requiring a separate password.
When you calculate your birth chart & numerology
- Birth details: the name (used for Pythagorean numerology), birth date, optional birth time, birth city/coordinates, and preferred language.
- We store your birth input in your account (
last_chartandsaved_charts) so you can reopen your chart anytime across devices. When you delete your account, all saved chart records are permanently deleted. - If you request your full report by email, we use your email address solely to deliver the PDF report.
Newsletter & community testimonials
- Newsletter: if you subscribe to our newsletter (on the Home page, Journal, or Birth Chart), we store your email address, language preference, and signup source in our database and synchronize it with our email delivery partner Brevo. Every newsletter includes a one-click unsubscribe link.
- Testimonials (“Share your words”): if you submit a testimonial, we collect the display name you choose, your city/country, your message, and your email address (which is never published). Testimonials are reviewed before publication and published only with your explicit consent.
Automatically, when you browse the site
- Security & technical logs: IP address, browser headers, and request timestamps used strictly to deliver pages, enforce rate limits against automated password-guessing or abuse, and keep the server secure.
- Essential cookies & local preferences: an
HttpOnlysession cookie (ao_sess), a temporary OAuth state cookie (ao_oauth_state) during social sign-in, and your language preference (ao-lang/ao_lang) in browser storage. See our Cookie Policy.
What we never collect: credit card or bank numbers (all purchases happen on official partner checkouts, Payhip, or Printful), precise GPS tracking, or behavioral advertising profiles. We use no third-party advertising trackers.
3. Why we use your data & legal bases
| Purpose | Data | Legal basis (LGPD · GDPR) |
|---|---|---|
| Create and authenticate your account (email/password, Google, or Apple); verify your email; calculate and save your birth chart & numerology; send your PDF report or password-reset links | Account profile, OAuth identifier, birth data, email | Performance of a contract / service requested by you (LGPD art. 7, V · GDPR art. 6(1)(b)) |
| Server security, rate limiting, and fraud/abuse prevention | IP address, technical logs, session cookies | Legitimate interest (LGPD art. 7, IX · GDPR art. 6(1)(f)) |
| Monthly/weekly sky newsletter; publishing your submitted testimonial | Email & language; testimonial submission | Your explicit consent, which you may withdraw anytime (LGPD art. 7, I · GDPR art. 6(1)(a)) |
| Compliance with legal obligations | As required by law | Legal obligation (LGPD art. 7, II · GDPR art. 6(1)(c)) |
4. Who receives your data
We never sell or rent your personal data. We share data only with essential infrastructure providers acting under strict data-processing terms:
- Cloudflare — HTTPS encryption, DNS, and edge protection.
- Google (Gmail SMTP & Google Identity Services) — transactional email delivery (chart PDFs, email confirmation, password resets) and optional “Continue with Google” sign-in.
- Apple Inc. — optional “Continue with Apple” authentication.
- Brevo — managing and delivering opt-in newsletter emails.
- Google Fonts, Fontshare, cdnjs, unpkg, and jsDelivr — delivering typography and open-source front-end scripts.
When you click to purchase a product from a partner brand store, Payhip (for digital guides and frequency packs), or Printful, or when you visit our channels on YouTube (@alpha.omega.s.f), Instagram, Facebook, TikTok, or X, that platform’s own privacy policy governs your interaction there.
5. International data transfers
Because our community is global, infrastructure providers may process data in the United States, the European Union, or Brazil under standard contractual clauses and equivalent legal safeguards (LGPD art. 33 · GDPR art. 46).
6. Retention periods
- Account & saved birth charts: kept while your account remains active. Deleted immediately when you delete your account.
- Sign-in sessions: up to 60 days, or until you sign out.
- Email confirmation links: valid for 24 hours, single use.
- Password-reset links: valid for 1 hour, single use.
- Encrypted server backups: rolling daily backups retained for up to 30 days for disaster recovery, then automatically overwritten.
- Newsletter subscriptions: until you click “Unsubscribe” or ask us to remove your address.
7. How we protect your data
We use scrypt password hashing with per-user salts, HttpOnly and SameSite=Lax session cookies, strict Content-Security-Policy (CSP) headers, TLS/HTTPS encryption, SQLite WAL concurrency protection, automated firewall/Fail2Ban protection, and daily integrity-checked backups.
8. Your privacy rights (LGPD, GDPR & CCPA/CPRA)
Regardless of where you live, you have the right to:
- Access & Portability: request a copy of the personal data associated with your account.
- Correction: update your name, email, or birth chart details.
- Deletion (Right to be Forgotten): delete your account and all saved birth charts directly or by emailing us.
- Withdraw Consent: unsubscribe from the newsletter or ask us to remove a published testimonial at any time.
- Non-Sale Guarantee (CCPA/CPRA): we do not sell or share your personal information for cross-context behavioral advertising.
To exercise any right, email us at [email protected] from the address linked to your account. We respond promptly and always within 15 days.
9. Children’s privacy
Our site and accounts are intended for individuals aged 18 and older. If you believe a minor has provided personal data to us, please contact [email protected] and we will delete it immediately.
10. Changes to this policy
When we update this Privacy Policy, we revise the “Last updated” date at the top of this page and notify members of any material changes.