Privacy Policy
Effective date:
Who we are
Path of the Nine is operated by Foundry Vale Ltd, a company registered in England and Wales under company number 17465033. Our registered office is 23 Berrow Park Road, Plymouth, Devon, England, PL3 5PZ.
Foundry Vale Ltd is the controller of personal data described in this policy. Questions or requests about your personal data can be sent to privacy@pathofthenine.com. General support questions can be sent to support@pathofthenine.com.
Path of the Nine is a general-audience service available internationally. It is not specifically directed at children under 13.
The information we process
Depending on how you use the service, we may process:
- your email address, account identifiers, sign-in records and account preferences;
- questions you choose to submit, generated readings, saved readings and Daily Card history;
- subscription status, product entitlement, transaction references, invoice and refund information supplied by our payment provider; we do not receive or store your full card number;
- support messages, complaints and related correspondence;
- consent records, including your acceptance of immediate digital-content delivery and cookie choices;
- technical and security information such as IP address, device and browser details, timestamps, request identifiers, authentication events and error information; and
- limited audit records needed to document account deletion, payments, refunds, security actions or compliance with law.
If you use the Daily Card without an account, some information may remain only on your device in browser storage until you clear it or it is replaced.
Please do not put another person’s confidential information or sensitive personal data into a question. If you choose to include sensitive information about yourself, you do so voluntarily and should include only what is necessary.
Why we use information and our lawful bases
We use personal data:
- to create and operate your account, deliver readings, save your chosen content and provide paid features, because this is necessary to perform our contract with you;
- to process purchases, subscriptions, cancellations and refunds, because this is necessary to perform our contract and meet legal obligations;
- to secure, troubleshoot and improve the reliability of the service, prevent fraud and abuse, and keep proportionate operational records, based on our legitimate interests in running a safe and dependable service;
- to keep tax, accounting, consumer-rights and compliance records, because the law requires it;
- to respond to support requests, complaints and legal claims, to perform our contract, comply with law and pursue our legitimate interests; and
- to use optional analytics only where you have separately consented, so we can understand visits, site performance and product use; and
- to send marketing only where you have separately consented. We do not use advertising cookies or cross-site behavioural advertising.
Where we rely on legitimate interests, we consider the impact on you and use only information reasonably necessary for the stated purpose. You may object in the circumstances explained below.
How AI is used
Path of the Nine combines our authored card meanings and product rules with an external artificial-intelligence service to compose personalised reading text. A submitted question, relevant card information and limited instructions may be sent to that provider so the reading can be generated.
Foundry Vale Ltd does not use your questions or generated readings to train its own AI model. We use an external AI provider under applicable service arrangements. Personalised readings currently use OpenAI. We do not promise zero retention by that provider. See the Terms of Use for more detail about how AI is used.
Readings are automated, may be incomplete or mistaken, and are offered for reflective entertainment and personal exploration. They are not professional advice and do not guarantee or predict events.
Who receives information
We use service providers to operate the product, including providers for hosting and deployment, database and authentication, payment processing, AI generation, bot and abuse protection, and support email. The application uses Vercel for hosting and, where you consent, privacy-conscious web/performance analytics; Supabase for database and authentication; Stripe for payments; OpenAI for AI generation; Cloudflare Turnstile for bot and abuse protection; and Google Tag Manager to manage measurement tags. Google Tag Manager loads with analytics and advertising consent denied by default. Google Analytics may process optional analytics only after you choose to allow analytics.
These providers process information only for the relevant service and under their own applicable terms and our contractual arrangements. We may also disclose information to professional advisers, regulators, courts, law-enforcement bodies or another organisation involved in a corporate transaction where the law permits or requires it.
We do not sell your personal data.
International transfers
Some providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, we will use an approved mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any necessary risk assessment. Details of the safeguards relevant to your information are available from privacy@pathofthenine.com.
How long we keep information
We apply the following target retention periods unless a longer period is required for an active dispute, legal claim, fraud investigation or legal obligation:
| Information | Normal retention |
|---|---|
| Account, email, saved readings and Daily Card history | While the account remains open; deleted or anonymised when the account is deleted |
| Anonymous Daily Card browser data | On your device until cleared or replaced |
| Unfinished drafts | 30 days |
| One-time sign-in or authentication tokens | Until expiry |
| Authentication and security events | 90 days |
| Operational logs | 30 days |
| AI failure diagnostics | 30 days; questions and generated text should not be included in these logs |
| Minimal account-deletion audit | 6 years |
| Immediate digital-delivery consent records | 6 years |
| Payment, invoice, refund and accounting records | 6 years from the end of the relevant financial year, or longer if law requires |
| Minimal webhook audit needed for financial or legal records | 6 years; raw webhook payloads are not retained for this purpose |
| Abandoned checkout information | 30 days after it can no longer reasonably be reconciled |
| Ordinary support correspondence | 2 years after the matter closes |
| Complaint or legal-dispute records | 6 years after closure, or until an active claim ends |
| Analytics consent choice | Stored on your device until you change it or clear browser storage; we do not send the choice itself to analytics |
| Optional analytics, where enabled with consent | Analytics reporting data is configured for no more than 14 months where the provider offers that control |
| Backups | Removed from normal use immediately and overwritten on a target cycle of no more than 35 days |
Deletion from live systems does not always remove information instantly from encrypted backups. Backup copies remain protected, are not restored for ordinary use, and age out on the stated cycle.
Account deletion
You can request account deletion through Account deletion or by emailing support@pathofthenine.com from the address connected to the account. We may need to verify your identity.
Deleting your account immediately cancels any active Path of the Nine subscription and ends access to subscription features. It deletes your account, saved readings, submitted questions, generated interpretations and Daily Card history from live product systems, subject to the limited records we must retain for accounting, fraud prevention, legal claims or compliance.
Deletion does not itself create an automatic refund. Your statutory rights and any right to a refund for a duplicate charge, billing error or service failure are not affected. See the Refund and Cancellation Policy.
Your rights
UK data-protection law may give you rights to:
- obtain a copy of your personal data and information about its use;
- correct inaccurate or incomplete information;
- request deletion;
- restrict or object to processing;
- receive certain information in a portable format;
- withdraw consent at any time, without affecting earlier lawful processing; and
- complain to the Information Commissioner’s Office.
These rights are not absolute. We may retain or continue processing limited information where the law permits or requires it. If you are outside the United Kingdom, local law may give you additional or different privacy rights, and we will honour mandatory rights that apply to our processing. To exercise a right, email privacy@pathofthenine.com. We normally respond within one month and may ask for information needed to verify your identity.
You can contact the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. We would appreciate the opportunity to address your concern first.
Security
We use proportionate technical and organisational measures designed to protect personal data, including access controls, encrypted connections, restricted operational logging and separation of production responsibilities. No internet service can promise absolute security. Please protect access to your email account and contact us promptly if you believe your Path of the Nine account has been misused.
Children
Path of the Nine is a general-audience service and is not specifically directed at children under 13. If you believe a child under 13 has provided personal information to us, contact privacy@pathofthenine.com.
Changes to this policy
We may update this policy as the service or law changes. We will post the revised version with a new effective date and give reasonable advance notice where a change materially affects your rights or how we use personal data.